MCP just grew up. The skeptic who mocked it now ships it.

Twenty months after Anthropic released the Model Context Protocol, it got the release that makes it boring. That is a compliment. The update, now stewarded by the Agentic AI Foundation under the Linux Foundation, finalizes the move to a fully stateless architecture, hardens authentication against a known class of attacks, sets a formal 12-month deprecation policy, and graduates MCP Apps and MCP Tasks to official extensions. The maintainers are not shy about the ambition. Co-creator David Soria Parra called it, in spirit, a v2. The foundation's Mazin Gilbert called the protocol "enterprise ready, versus an open lab sort of experiment."

The statelessness is the part that matters most for anyone running agents at scale. Under the old design, a client had to hold a persistent session with a specific server instance. In a cloud world of interchangeable nodes behind load balancers, that requirement was, in the maintainers' telling, poison: lose the pod holding the session and the agent's work went with it. The new design lets any client talk to any server behind a load balancer. Gilbert compared it to the architectural decision that made the web possible, which is the kind of claim that usually deserves an eye-roll, except this one is mechanically true. HTTP worked because it was stateless. MCP could not scale until it was.

The price is bigger payloads, because the state now rides the wire instead of living on the server, and the loss of a few rarely used features. Out-of-band server logging is gone. The maintainers checked who used it by scraping all of GitHub. Answer: basically nobody. "I'm sad that things I thought were useful turned out not to be useful," Soria Parra said. "I think one of the bigger trade-offs was more about my ego than any actual limitation of the protocol." That is the most honest sentence in the announcement.

The deprecation policy is the enterprise tell. Twelve months minimum between a formal deprecation and the earliest removal, after consulting Google, Microsoft, and Amazon on what their deployment environments need. Features do not get torn out on a whim, and the ecosystem mostly upgrades within six to eight months anyway, so the window functions as a listening period. A Fortune 500 engineering org can now commit to this specification without fearing silent breakage. That sentence could not have been written about MCP a year ago.

The auth work is preventive, not incident-driven, which is rarer than it should be. Mandatory issuer validation closes OAuth mix-up attacks before anyone exploited them. A new Enterprise Managed Authorization extension, built with Okta, lets companies make their corporate identity provider the gatekeeper for MCP server access. No more personal credentials wandering into production tool servers. The maintainers are explicit that this was not a response to a breach. Delimarsky: "This is not something that is gated in any existing vulnerabilities or active exploitation." Shipping the fix before the incident is the whole game.

Now the second half of the week's story, which is almost more telling. The Pi coding agent hit 1.0 on October 1 with native MCP support. Pi's creator had publicly dismissed MCP for over a year, on the grounds that its tool servers were bloated context hogs. The reversal announcement was titled "You Said No MCP!" and topped Hacker News. Earendil, which acquired Pi in April, says MCP improved enough and integration got easy enough to clear Pi's famously high bar for new complexity.

Skeptics converting is a stronger signal than enthusiasts adopting. Pi's objection was never philosophical. It was that MCP servers were bloated context hogs. The new release's deferred tool loading and the broader ecosystem cleanup address exactly that complaint. When the harshest critic of a protocol ships it, the protocol has probably fixed the thing worth criticizing.

One caveat before anyone declares victory. Ground Truth's read of Pi 1.0 notes it "still has no built-in permission system for access to the host computer." Connecting tools and restricting their authority are different problems, and this release solves the first far more than the second. An MCP server your agent can reach is still a server your agent can reach. The auth hardening governs who gets in. It does not govern what the agent does once inside.

The governance question got its most candid answer in the VentureBeat interviews. Soria Parra, an Anthropic employee and lead maintainer, acknowledged he technically holds veto rights over the protocol, "but we have never actively used it." Anthropic's share of contributions is now below half, per Gilbert. The maintainer group spans Anthropic, Microsoft, OpenAI, Google, and Amazon. The foundation went from 40 members at its December inauguration to 240, adding about one a day, including CERN and Consumer Reports. SDK downloads doubled in six months to roughly 250 million a week. None of this proves neutrality. It does make capture harder than it was.

For builders, the decision this week got simpler. If you held off on MCP because it felt like a lab experiment with breaking changes, the three things Gilbert names, an open standard, stateless scale, neutral governance, are now all in place by his account, and the skeptic-to-adopter arc backs him up. Standardize on it for production integrations, but keep the permission layer on your side. The protocol will carry your tools. It will not restrain your agent. That part is still yours.