I track where the API economy is moving by reading what the providers themselves publish, and every month I pull the Model Context Protocol thread out of that firehose. Over the last 30 days — June 22 to July 22, 2026 — the providers in the API Evangelist network published 776 posts that touched MCP. That number lies. Strip the cross-repo duplication — AWS alone republishes a single announcement across seven amazon-* brands, and integration mills like Merge shipped 24 near-identical “How to connect X MCP in 4 steps” pieces — and you land on roughly 260 distinct, MCP-focused stories from 142 providers. That is the real signal, and its shape matters more than its size.
A year ago MCP was an emerging idea. This month it is a surface with a spec deadline, a security reckoning, a gateway war, and a growing chorus of skeptics — all at once. This roundup organizes the month into the five themes that actually moved.
If you want the durable, deduplicated version of this — every official provider MCP server, cross-linked to its provider profile and Agent Skills — skip the monthly snapshot and browse the directory at apis.io/mcp/, where 238 servers are indexed and kept current. Everything below is the month’s motion on top of that standing map.
1. The Spec Is About to Move
The single most time-sensitive story: a new MCP spec release candidate lands July 28. This is not a rumor — the protocol team published Beta SDKs for the 2026-07-28 MCP Spec Release Candidate, and the ecosystem is already bracing.
- Arcade — The 2026 MCP Release Will Break Things — Join Our Webinar. When a tooling vendor leads with “will break things,” take the maintenance window seriously.
- Barndoor — MCP Spec Changes July 2026: What’s Changing and What It Means for You. The migration breakdown for teams who shipped a server this spring and now have homework.
If you shipped an MCP server in the first half of the year, the last week of July is a re-test-everything moment.
2. Security and Authorization Became the Whole Conversation
This was the loudest theme by a wide margin, and it marks a phase change: the Q1 gold rush is meeting its Q3 security reckoning. The month’s posts read like an incident retrospective for an entire protocol.
- TechRepublic and Waxell both amplified Microsoft’s warning that poisoned tool descriptions are a hidden agent attack path — the tool manifest itself is now an injection vector.
- Wiz launched Wiz MCP the same month it documented an MCP auto-execution flaw walking from git clone to cloud compromise in Amazon Q’s VS Code extension.
- Microsoft / Azure shipped enterprise authorization for Entra and App Service — and separately measured that only 8.5% of MCP servers use OAuth. That statistic is the whole problem in one number.
- Permit.io made the case for runtime authorization in agentic ERP workflows, and filed a CVE for database MCP servers that fail open instead of closed.
- WorkOS introduced MCP interceptors: the primitive that decides what an agent is allowed to do — per-tool scopes and consent as a first-class layer.
- Okta and Descope both pushed Cross-App Access and tunneled auth — identity vendors treating MCP as a first-class client type.
- Fastly and n8n rounded out the edge-and-workflow security guidance.
The takeaway: MCP’s authorization story is being written in public, in real time, and mostly by the identity and security vendors rather than the protocol itself.
3. The Gateway Layer Is Claiming MCP
The API management incumbents have decided MCP is theirs. The framing quote of the month goes to Tyk:
- Tyk — The MCP Gateway Is Just the API Gateway Growing a New Limb. The clearest articulation this month that MCP is a managed surface, not a greenfield category.
- Kong — Enterprise-Grade MCP Access Control Is Here. Your Gateway Makes It Real.
- Gravitee — First-Class Agent Identities + Self-Service Onboarding for the MCP Era.
- Solo.io — warm scale-to-zero MCP servers, and a virtual-MCP pattern for managing LLM cost.
- Zuplo — per-role tool catalogs, and, notably, charging agents per tool call. Metered MCP has arrived.
- Speakeasy — MCP tunnels: govern private servers without exposing them.
- Requesty published a full MCP gateway comparison, and Gleap covered MCPJungle for managing a team’s servers in one place.
When comparison posts and “pick a gateway” content appear, the category has matured past experimentation into procurement.
4. Everyone Shipped a Server
The long tail is where the ubiquity shows. The read-mostly SaaS surfaces are lining up first, exactly as you’d predict — and the roster this month is remarkable for who’s on it:
- Meta — Meta’s ads MCP server for developers.
- Apple / WebKit — a Safari MCP server for web developers. Apple shipping an MCP server is its own headline.
- Shopify — already deprecating its first Storefront MCP cart tools in favor of UCP Cart MCP. The churn cycle has begun.
- Vercel, Cloudflare (agents responding to elicitation requests), Datadog (agentic Cloud SIEM), ClickHouse, Runpod, Vonage, Alchemy (every blockchain API in your assistant), Hedera, and Felt (a full GIS for every agent).
- Strapi — its MCP server reached GA. The move from preview to GA is the real maturity marker in this list.
- Substack even folded MCP into a general product-update post — the surest sign a capability has gone from differentiator to table stakes.
And at the enterprise end, MuleSoft wired MCP servers into its API Catalog, while Atlassian shared what 5M+ daily MCP tool calls taught them about agents at work — a rare real-usage datapoint at scale.
5. The Pushback Started
The most interesting theme, because it’s new: the reflexive “ship an MCP server” phase is giving way to “should this even be MCP?”
- Dremio — Why AI Agents Need a CLI, Not Just an MCP Server.
- Soda — CLI, API, or MCP? Pick the right way to use Soda for the job.
- Nango — MCP vs. tool calls for agent integrations.
- CircleCI — ACP vs MCP: What’s the Difference for Agentic Coding? A new protocol acronym enters the ring.
- apilayer — MCP vs. SDK vs. REST, three ways to expose the same data.
This is healthy. When the market starts asking whether a given surface should be a CLI, a plain API, or an MCP server — rather than assuming MCP by default — the protocol has matured from novelty into one option among several. The teams reaching for MCP thoughtfully will build better agent surfaces than the teams reaching for it reflexively.
What the Month Adds Up To
Five simultaneous motions: a spec deadline forcing maintenance, a security reckoning being written by identity vendors, the API gateways absorbing MCP into managed infrastructure, ubiquity reaching Apple and Meta, and a skeptic’s counter-current asking whether MCP is always the right shape. That is what a technology looks like in the year it stops being new.
The noise — the seven-way AWS reposts, the 24 Merge how-to clones, the “Best MCP Servers in 2026” listicles — is itself a signal: the SEO gold rush has arrived, which only happens once a category is worth ranking for. The antidote to that noise is a maintained, deduplicated map. That’s what we keep at apis.io/mcp/ — 238 real provider MCP servers, each tied back to its provider profile, capabilities, and Agent Skills. Bookmark it, and I’ll be back next month with the motion on top.