Securing MCP integrations after the 28 July 2026 spec: what you must now prove per tool call

Since the 2026-07-28 MCP specification, session IDs disappear and OAuth is tightened, but the spec does not itself enforce consent, authorisation and tool safety. You must therefore secure MCP integrations yourself with a gateway that intercepts every tool call, policy-as-code, bound agent identities and a traceable, cryptographically signed audit trail.

On 28 July 2026 the Model Context Protocol project published the 2026-07-28 specification, which according to the project documentation is the largest revision since launch. The spec describes explicit principles for user consent, data privacy and tool safety, but states itself that the protocol does not enforce these. For anyone deploying MCP in a high-trust environment, that means: responsibility for security shifts to the hosts, servers and gateways you set up yourself.

What exactly changes because of the MCP specification of 28 July 2026?

The most important changes the specification itself names are:

• a stateless architecture, in which the fixed session gives way to handles;
• the removal of the Mcp-Session-Id header and of dynamic client registration;
• tightened OAuth authorisation, referring to RFC 9207 and Client ID Metadata Documents;
• new MCP-specific HTTP headers and richer MCP Apps;
• a twelve-month deprecation window for older versions.

In our assessment the core of this is that a range of old protocol-level risks is removed — session hijacking and spontaneous server prompts become harder — while at the same time the spec acknowledges that consent, authorisation and data minimisation remain an implementation choice. The protocol provides the building blocks; you fit the locks yourself.

Which new security risks arise at the integration layer?

Independent security analyses place this update in a broader picture. Akamai describes the new spec as an enterprise-focused, stateless architecture that removes old risks, but warns that rich UI apps and asynchronous tasks introduce security boundaries that must be fully designed by developers. SecurityWeek points specifically to the new MCP headers (such as MCP-Method and MCP-Name) and to risks such as protocol confusion and desync attacks, plus data leaks via misconfigured x-mcp headers.

The practical consequence: anyone building MCP into a sensitive workflow cannot make do with looking at the model. The attack surface also lies in the HTTP layer, the endpoint configuration and the gateway in between. That aligns with broader attention to identity and access management for AI agents according to NIST: an agent that calls tools needs its own, bound identity, not a shared key.

How do I set up an MCP security gateway and policy-as-code?

Within its Agent Governance Toolkit, Microsoft published an MCP Security Gateway spec in which all MCP traffic between agents and tool servers runs through a single gateway. According to the specification, that gateway offers among other things:

• interception of tool calls and scanning of responses;
• message signing and session authentication;
• rate limiting and enforcement of authorisation;
• integration of a CVE feed and detection of schema drift;
• audit and metrics of all traffic.

Translate this into concrete design questions for your own architecture:

1. Where in your environment is the "firewall" for MCP traffic, and does all traffic really pass through it?
2. Who manages the policy-as-code that determines per tool call what is permitted, under which identity and delegation?
3. Are calls and responses signed and logged, so that you can reconstruct them later?

This is the same movement we described earlier in AI governance from policy document to runtime enforcement: policy that only works once it is enforced during execution, not merely written on paper. We gather more background in the topic hub on AI security and integration security.

What must I be able to prove per MCP integration for audits and supervision?

That verifiability goes further than a gateway is shown by OPAQUE. According to the announcement via PR Newswire, OPAQUE extends the Agent Governance Toolkit with an Agent Manifest and Confidential MCP: MCP servers that run in a confidential-computing runtime, enforce governance policies in hardware and produce independently verifiable evidence of every tool call and agent action. The message: for high-trust domains it is not enough for a server to be called "secure" — it must provide evidence of its behaviour.

In our assessment you must therefore be able to show the following per MCP integration:

• an inventory of MCP servers, tools and agents per workflow;
• policy-as-code that records which tool calls are permitted, under which identity and delegation;
• a gateway or confidential MCP layer that intercepts, signs, rate-limits and audits all calls;
• a reconstructable timeline: which agent called which tool, with which parameters and which result;
• an explicit link to privacy and compliance tasks, such as data minimisation and logging.

Those last two points touch directly on what you must record contractually; we went into that earlier in audit rights and evidence obligations in AI contracts.

A verification layer such as Vera can help here as a visibility layer: it is not a replacement for MCP security gear and not a language model, but it can make verification steps, corrections and sources visible per workflow for inspection. Vera's Semantic Privacy Shield is designed so that sensitive document values are replaced by synthetic, session-only equivalents on EU infrastructure before AI processing, whereby if a privacy check fails nothing is sent onward. That supports control, but the professional final judgement remains with you.

Sources: The article relies on the official MCP specification 2026-07-28, security analyses by Akamai and SecurityWeek, the MCP Security Gateway spec from Microsoft's Agent Governance Toolkit and OPAQUE's announcement via PR Newswire.

← All articles in this topic ← All articles