How does the MCP specification affect gateways?

In short: the Model Context Protocol defines how agents call tools, and its authorization rules decide how a gateway should check those calls. These seven explainers cover the 2026-07-28 release, OAuth 2.1, CIMD, Enterprise-Managed Authorization, stateless routing and token passthrough. Each links the pages we read.

• What changed in the MCP 2026-07-28 specification?
• How does MCP authorization work?
• What is Enterprise-Managed Authorization?
• Should MCP clients use CIMD or Dynamic Client Registration?
• What do the stateless core and header routing mean for gateways?
• What parts of OAuth 2.1 does MCP use?
• Why does the MCP spec forbid token passthrough?

By The Datasheet desk · Published and reviewed 2026-11-03