Issues

• The 2026-07-28 TypeScript quickstart builds a server that 2026-07-28 clients cannot connect to

  modelcontextprotocol/modelcontextprotocol#3422 · Filter by author ANcpLua opened on Oct 8, 2026 · Updated on Oct 9, 2026

• Origin validation rejects browser-based MCP clients on authenticated remote servers

  bug
  modelcontextprotocol/modelcontextprotocol#3370 · Filter by author daoluc opened on Sep 18, 2026 · Updated on Oct 8, 2026
  7

• Lost-response retry on a mutating tools/call re-executes external effects — reproduction evidence and a spec-clarification question

  modelcontextprotocol/modelcontextprotocol#3394 · Filter by author arjun2075 opened on Sep 27, 2026 · Updated on Oct 8, 2026
  12

• Access Token Privilege Restriction: does "MUST NOT pass through" cover an API of the same authorization server/project (Supabase Edge MCP pattern)?

  modelcontextprotocol/modelcontextprotocol#3413 · Filter by author jryski opened on Oct 4, 2026 · Updated on Oct 8, 2026
  5

• Unspecified error handling for tool calls with output schema

  enhancement
  modelcontextprotocol/modelcontextprotocol#569 · Filter by author TomCN0803 opened on May 23, 2025 · Updated on Oct 7, 2026
  3

• Discussion: Should an MCP Server Expose Its Resource List Before Authentication?

  authsecurity
  modelcontextprotocol/modelcontextprotocol#540 · Filter by author kakao-gt-park opened on May 16, 2025 · Updated on Oct 7, 2026
  15

  

• Client-credentials examples should require issuer binding

  modelcontextprotocol/modelcontextprotocol#3419 · Filter by author LHMisme420 opened on Oct 6, 2026 · Updated on Oct 7, 2026
  1

• SEP-1488: securitySchemes in Tool Metadata for Mixed-Auth Servers

  authdraftsecuritySEP
  modelcontextprotocol/modelcontextprotocol#1488 · Filter by author thiago-openai opened on Sep 18, 2025 · Updated on Oct 7, 2026
  43

  

• (implementation): SEP-2133 - Extensions framework for MCP

  implementation-neededtracking
  modelcontextprotocol/modelcontextprotocol#2872 · by Filter by author localden was closed on Aug 23, 2026 · Updated on Oct 6, 2026
  1

  

• Docs: clarify where an MCP server should integrate in an existing application architecture

  modelcontextprotocol/modelcontextprotocol#3417 · Filter by author peter-iglaev opened on Oct 6, 2026 · Updated on Oct 6, 2026

• MCP-2026-015: server/discover instructions field enables prompt injection (amplified by cacheScope:public)

  modelcontextprotocol/modelcontextprotocol#3213 · Filter by author shunfeng8421 opened on Aug 7, 2026 · Updated on Oct 6, 2026
  12

• MRTR url-mode: standardize the "still waiting" response (state-only InputRequiredResult) + retry/cancel guidance

  modelcontextprotocol/modelcontextprotocol#2920 · Filter by author ferentinai opened on Jun 15, 2026 · Updated on Oct 3, 2026
  1

• cancellation.mdx and subscriptions.mdx disagree on how a server ends a subscriptions/listen stream

  modelcontextprotocol/modelcontextprotocol#3348 · Filter by author AmirK-S opened on Sep 6, 2026 · Updated on Oct 3, 2026
  1

• MRTR: inputRequests is a closed enum of three methods — add an extensible / reverse-DNS-namespaced member type

  modelcontextprotocol/modelcontextprotocol#2919 · Filter by author ferentinai opened on Jun 15, 2026 · Updated on Oct 3, 2026
  3