Model Context Protocol

Everything Fervor AI has published that touches Model Context Protocol — 12 pieces, newest first.

• Briefing · September 7, 2026 · afternoon

  What an agent loads has become the thing worth managing, and the week's launches are almost all knobs on that inventory rather than new capability.

• Claude Code 2.1.259 Changed What Your MCP Allowlist Covers, and the Docs Still Say Otherwise

  Claude Code 2.1.259 narrowed allowedMcpServers to servers users add, so a managed-mcp.json server your allowlist used to filter out now loads on upgrade, while the…

• codex-with-chatgpt Says Your Repository Is Never Uploaded. Read That Sentence Again.

  Codex-with-chatgpt's read-only MCP bridge is unusually careful security engineering, and its own reassuring line about never uploading your repository is true only about…

• Codex Deprecated Its MCP Server, Not MCP. The Direction of That Cut Is the Story

  Codex stopped serving MCP while expanding its MCP client support in the same release, and that one-directional cut marks the real boundary of the protocol: MCP is for…

• chrome-devtools-mcp Shipped a CLI and a Skill. That Moved the Approval Gate.

  Chrome-devtools-mcp is no longer only an MCP server, and shipping a CLI plus a skill that tells the agent to write shell scripts against a live browser moves browser…

• MCP Server Security: 12,520 Exposed Servers and What the Scans Actually Found

  MCP's exposure problem is a deployment-default problem rather than a spec problem, because the protocol never required authentication and internet scan data shows a…

• Corsair Makes the Approval Gate a Database Row Your Agent Cannot Reach

  Corsair's load-bearing move is putting both the credentials and the pending approval into your database instead of the model's context, which turns permission from a…

• The Azure DevOps MCP Server Ships a Prompt-Injection Guardrail. One Tool Doesn't Use It.

  Microsoft built the prompt-injection defense for its Azure DevOps MCP server and applied it to wiki and build-log tools but not to the one returning pull request…

• OpenConnector Hands Your Agent 8,310 SaaS Actions. Credential Encryption Is Off by Default.

  OpenConnector's value is the credential boundary rather than the provider count, and that boundary ships unlocked because encryption, the admin token, and the action…

• MCP 2026-07-28 Goes Stateless: The Session Didn't Disappear, It Moved Into Your Model's Context

  MCP's stateless rework deletes the session from the transport and rebuilds it as an explicit handle the model threads through tool arguments, which is a real…

• MCP Apps Let a Tool Server Draw the Interface You Click

  MCP Apps makes the server asking for permission the same party that renders the interface you grant it in, and half the safeguards in its security model are phrased as…

• Briefing · July 25, 2026 · afternoon

  The agent harness is separating from the model vendor, with OpenWorker, the stateless MCP specification, and OpenAI's own Codex plugin for Claude Code all landing in the…