The Bill Came Due Early
Executive Summary
In January I published The MCP Governance Problem Nobody’s Talking About. The thesis: MCP tooling had outpaced MCP governance by approximately eighteen months, and the bill would come due eventually.
Today, July 28, 2026, the new MCP specification ships. The press coverage calls it “enterprise-ready.” The changelog tells a more interesting story: the core got smaller, the enterprise features got pushed into optional extensions — some still officially experimental — and the whole thing is a formal, protocol-level statement that security is now the platform operator’s problem. More on that later.
First, the accounting. Six months is enough time to score predictions honestly, and honest scoring means admitting where I was wrong. I was wrong in both directions:
- Too pessimistic on attention. The title died within ninety days. Everybody’s talking about it now.
- Too optimistic on timing. Eighteen months of runway? The first fully-realized version of my “nightmare scenario” was documented in February. The structural RCE landed in April. The bill came due in one quarter, and interest had already been accruing.
This post addresses:
- The Scorecard: What I predicted vs. what actually happened.
- The Incidents: The nightmare scenario, now with dates and CVE numbers.
- What I Got Wrong: A public correction, because that’s the deal.
- The New Spec: What 2026-07-28 changes — and what it deliberately refuses to change.
- The Point, Revisited: Governance didn’t get solved. It got productized. These are not the same thing.
1. The Scorecard
Six claims from January, graded without mercy:
| January claim | July reality | Grade |
|---|---|---|
| “Enterprises are one intern’s debugging server away from an unforensicable breach” | SmartLoader ran a three-month social-engineering campaign to plant a trojanized MCP server in a legitimate registry. Payload: full credential exfiltration. | ✅ Understated |
| “No audit trail exists; the answer to every forensic question is ‘we don’t know’” | GitGuardian found 24,008 secrets sitting in MCP config files on public GitHub — over 2,000 still valid. A 2026 survey: under a quarter of orgs have full visibility into agent-to-agent communication. | ✅ Confirmed |
| “Allowlisting, audit logging, RBAC, lifecycle, isolation — none of this exists” | It now exists as an entire vendor category. The list from Section 4 of the January post is, almost verbatim, the 2026 enterprise convergence playbook: enforced allowlists per agent, OAuth 2.1 identity binding, centralized inventory, human-in-the-loop for destructive actions. | ✅ / ⚠️ See §3 |
| “Someone will build the governance layer — might be a well-funded startup” | Plural. It’s a gold rush. Gartner expects three-quarters of API gateway vendors to ship MCP-native features by end of year. | ✅ Underestimated |
| “Nobody’s talking about this” | CIS published an MCP Companion Guide in April. OWASP’s MCP Top 10 hit beta. Gartner analysts now cite MCP by name in breach forecasts. | ❌ Dead in 90 days |
| “Eighteen months of governance debt” | The debt was called in Q1–Q2. | ❌ Too generous |
Four out of six. I’ve seen worse quarterly forecasts get people promoted.
2. The Incidents
In January, the enterprise nightmare scenario was a thought experiment: an unvetted server, quietly installed, exfiltrating data nobody knew it could touch, discovered only after the damage. Here’s the non-fiction edition.
2.1 The Patient One (February)
An established malware operation — SmartLoader, not some kid with a fork button — spent three months building a fake developer ecosystem. Five GitHub accounts with AI-generated personas, cross-forked to simulate community activity. Then they submitted a trojanized Oura Ring MCP server to a legitimate registry. Functionally identical to the real thing. The payload, a StealC infostealer, silently harvested browser passwords, cloud session tokens, SSH keys, and crypto wallets, with persistence disguised as a Windows audio process.
Read that adoption flow against the one I described in January: engineer finds server, skims README, installs, done. The attackers read the same flow. They just read it as a funnel.
My January version had a well-meaning intern with a debugging endpoint. Reality shipped a professional criminal operation with a content calendar. I apologize to interns everywhere.
2.2 The Structural One (April)
OX Security disclosed remote code execution across six live production platforms — with an estimated 200,000 vulnerable instances downstream of a supply chain measured in the nine figures of package downloads. The root cause was not a bug. The STDIO transport executes OS commands without sanitization by design, in the official SDKs, propagated into every project that trusted the reference implementation.
Anthropic confirmed the behavior is intentional and declined to fix it at the protocol level. Remediation is on you, downstream developer. Keep that sentence in mind for Section 4 — it’s the whole spec strategy in miniature.
2.3 The Boring Ones (Continuously)
- Trend Micro found 492 MCP servers exposed to the public internet with zero authentication. Not misconfigured auth. No auth.
- The GitHub MCP incident: one over-privileged PAT wired into a server let a prompt-injected agent exfiltrate private repository contents into a public pull request. RBAC for MCP capabilities, the thing that “should be obvious,” remains apparently not obvious.
- OAuth implementations keep failing in ways the web solved fifteen years ago — authorization codes unbound to sessions, redirect_uri restrictions applied only to newly-registered clients (FastMCP, CVE-2026-27124, and friends).
None of these are exotic. That’s the indictment. The 2005-PHP-application energy I described in January wasn’t hyperbole; it was a changelog preview.
3. What I Got Wrong
A retrospective that only grades its wins is a press release. Three corrections:
“Nobody’s talking about it.” False by April at the latest. CIS applying Controls v8.1 to MCP and formally recognizing it as a distinct security boundary is the standards world’s way of saying “this is now everyone’s problem.” When OWASP maintains a Top 10 for your protocol, the conversation has structurally started. The gap today is not awareness. It’s the distance between awareness and enforcement — which is a worse problem, because now everyone has a slide deck and almost half of organizations still report no governance framework at all. Talking, it turns out, is the cheapest control in the stack.
“None of this exists as a coherent solution.” No longer true, and I should update the January post with a correction note. There is now a crowded field of MCP gateways, proxies, and control planes. Some are good. But see Section 5 before you conclude the problem is therefore solved.
The eighteen months. I modeled governance debt like tech debt: linear accrual, distant maturity. Wrong model. It behaves like credit card debt held by someone who ignores the statements — quiet, compounding, then a collections call. The collections call was February.
4. The New Spec
Today MCP 2026-07-28 goes live as the latest revision, under a foundation with real cross-vendor governance — which is what the Linux Foundation donation in December was actually for. The headlines call it enterprise-ready. Read the changelog instead of the headlines and the shape is different, and frankly more honest:
The core shrank. The protocol went stateless: sessions and the initialize handshake are gone, every request carries its own version and capabilities. SSE stream resumability is removed — a broken response stream now simply loses the in-flight request. Roots, Sampling, and Logging are deprecated under a new feature lifecycle policy with a minimum twelve-month window before removal. Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents. This is a protocol deleting its own accidental complexity, and it’s the right call.
The enterprise features moved out. Asynchronous tasks — the thing every “agents at scale” deck assumes — were ejected from the core into an extension. That extension’s own repository currently describes itself as experimental, not official, and still working toward implementing its own SEP. Interceptors, the other capability enterprises keep asking for, live in an experimental extension repo too. “Enterprise-ready” is, at ship date, a core protocol plus a trail of extension repositories at wildly different maturity levels.
The reference implementation proves the point. The Python SDK went 2.0.0 stable the same day as the spec, implementing the new core — but not the tasks extension, whose implementation PR is still open. Meanwhile the SDK’s type package still carries task types in the previous revision’s wire shape: dead symbols from a design that no longer exists on the wire, shipped in a stable release. If your feature detection is hasattr(sdk, "TypeName"), congratulations, you’ve detected a fossil. Verify the shape against the spec, not the symbol table.
Why does a governance blog care about any of this? Because the operational question just changed. Yesterday your inventory problem was “which MCP servers are running.” Today it’s “which servers, speaking which protocol revision, negotiating which extensions, at which extension maturity” — a compatibility and trust matrix that the protocol, by design, will not manage for you. The new spec explicitly shifts critical security responsibility from the protocol to developers and platform operators. This is the same posture as the April STDIO decision, now generalized. The protocol defines the wire. You define the trust.
I want to be precise about this, because it’s easy to read as an indictment and it isn’t one. It’s the correct call. TCP doesn’t do authorization either. A protocol that tried to embed enterprise policy would ossify into unusable committee-ware within two revisions. But it means the January thesis survives the spec upgrade fully intact: governance was never going to arrive in the protocol. It has to live in a layer you deploy, configure, and audit yourself. The spec now says so in writing.
And the calendar is unkind about it: five days from now, on August 2, the EU AI Act’s high-risk provisions become enforceable — risk management, data governance, logging, human oversight. The Act doesn’t mention MCP. It doesn’t need to. If your agent takes a high-risk action through an MCP server, that action inherits the obligations. “We had no visibility into which servers were running” stops being an embarrassing retro item and starts being a regulatory finding.
5. The Point, Revisited
So the ecosystem noticed, the vendors arrived, the spec matured, the regulators showed up. Problem solved?
No — and the incident list above is the proof, because every one of those incidents happened after the awareness arrived. Here’s the distinction that the gold rush obscures:
A market category is not a control. Buying a gateway gives you a chokepoint. It does not give you a policy, an inventory, an approval workflow, or an answer to “what did this server access on March 14th.” Plenty of 2026 deployments now have an MCP gateway in the diagram and shadow servers running happily around it, because a chokepoint you can route around is a decoration.
Detection is not enforcement. A chunk of the new vendor category is ML-flavored anomaly detection on agent traffic. Anomaly detection on a system with no baseline policy is astrology with dashboards. You cannot detect a deviation from a policy you never wrote. Deterministic, boring, auditable enforcement — allowlist, deny, log — is unglamorous precisely because it works.
Attention is not accountability. The org-chart table from January — developer, EM, security, platform, CISO, all pointing at each other — has not changed. The CISO now knows what MCP is. Congratulations. Somebody still has to own it, and in most orgs, six months later, nobody does.
The January post ended by predicting someone would build the governance layer. Six months on, the honest status is: many someones are building many layers, the protocol has formally confirmed the layer is your problem, the regulators have set a date, and the attackers — who read the same adoption flows we do — are already operating at a professionalism level the defense hasn’t matched.
The bill came due early. The next one is already accruing.
“Governance debt doesn’t accrue like tech debt. It accrues like credit card debt held by someone who ignores the statements — quiet, compounding, then a collections call.”
Disclosure: I’m building MCP Hangar in this space — an MIT-licensed MCP policy enforcement plane, at github.com/mcp-hangar/mcp-hangar. Deterministic enforcement, no ML, no SaaS. Read the above with that bias in mind.