MCP servers, SDKs, registries, app stores, auth patterns, security tools, and launches worth knowing.
The 2026-07-28 specification removed sessions and the handshake, and more than half of Hugging Face's MCP tool calls already use it. Issue #006 covers the keynotes, David Soria Parra's roadmap, Sam Morrow on the context-window debate, and a year of real MCP attacks.
Read the MCP Con recap →
With MCP Events, your server lists the events it supports, ChatGPT subscribes with a callback URL and a signing secret, and your server sends matching events as webhooks. Requires the 2026-07-28 protocol version.
Read OpenAI's guide →
The TypeScript and Python SDKs patched OAuth credential redirection, cross-origin header leaks and missing token audience checks. Upgrade to TypeScript 2.3.x or Python 2.3.0, then set expectedResource or validate_token_resource. Upgrading alone does not turn it on.
MCPnewsletter
One short email from the r/MCPservers team. Free.
01MCPservers Reddit
02MCP Directory
03MCP Hackathon
04MCPnewsletter