Why MCP matters for endpoint control
The Model Context Protocol is how most coding and desktop agents connect to tools and data: repositories, ticketing systems, databases, internal APIs. Every MCP server an agent connects to widens what it can do. For a security team, MCP connections are one of the clearest control points: which servers are allowed, who may connect to them, and what each tool call through them may do.
What the roadmap says
The roadmap published on the MCP blog on 22 August 2026 lists five priority areas. One of them is agent identity and enterprise security, based on DPoP and Workload Identity Federation. The post also says the Enterprise-Managed Authorization extension is now stable.
In plain terms, DPoP binds a token to a key held by the client, so a stolen token is harder to replay. Workload Identity Federation lets a workload prove who it is using an identity it already has, instead of a long-lived secret. Enterprise-managed authorization means the organization, not each individual user, decides which MCP servers an agent may use and with what access.
What the July specification changed
The specification dated 2026-07-28 removed the initialize handshake and protocol sessions, making the protocol stateless. It added multi round-trip requests, requires clients to validate the iss parameter per RFC 9207, and deprecated Dynamic Client Registration in favor of Client ID Metadata Documents.
For agent controls, statelessness matters because a product can no longer rely on a protocol session to group related calls; it has to build its own picture of the agent session. Products that already describe session-aware decisions, using identity and prior actions, are in a better position to adapt.
How vendors describe MCP control today
Lasso Security describes an open-source MCP gateway that discovers MCP servers across Claude, Cursor and Windsurf, controls which users and teams can connect to which servers, and can block, alert or sanitize. Harmonic Security describes governing at the MCP layer and at the tool surface, with permissions for which systems agents can read, write to and act on. Noma Security keeps a live registry of allowed agents, MCP servers and skills. Bloom Security describes automatically scaling back overpermissioned MCP servers. Bay describes restricting MCP servers through managed settings for Claude Code, Codex and Claude Desktop.
None of the pages we read on 27 September 2026 describes support for the Enterprise-Managed Authorization extension by name. That is not surprising given the dates, and it is a good question for a vendor evaluation.
What it means for buyers
Three practical points follow.
First, enterprise-managed authorization moves part of the MCP policy into the protocol itself. Agent controls will still matter, because they see what happens on the device and in the tool call, but the approved-server list may start to live in your identity provider as well as in your agent control product. Ask vendors how they will work with it.
Second, agent identity in MCP makes the actor trail easier to build. If each agent presents its own identity to an MCP server, a log can say which agent made a call, not only which user's token it used.
Third, statelessness raises the bar for session context. Ask each vendor how it links the calls in one agent session after the 2026-07-28 change.
Standards are converging on runtime control
The OWASP GenAI Security Project's 2026 Top 10 for LLM Applications ranks Excessive Agency third and says the Agent Control Standard has been donated to the project to extend guidance toward runtime enforcement. Together with the MCP roadmap, the direction is clear: identify each agent, limit what it can reach, and enforce the limits when it acts.