One read of Model Context Protocolmcp-20261111T020708Z
9 pages moved out of 359 read.
Pages moved
9
significant first
Pages read
359
in this capture
Captured
02:07 UTC
Corpus hash
f37190ead811
corpus-hash
What this read moved
1-9 of 9community/contributor-ladder Changed · +3 / -3 lines
from line 8
88
99| Role | What it is | Access granted | Minimum time |
1010| - | - | - | - |
11| [Contributor](#contributor) | Anyone who has contributed to MCP in any form | None; issues, pull requests and discussions are open to all | None |
11| [Contributor](#contributor) | Anyone who has contributed to MCP in any form | None. Issues and group meetings are open to all. [Pull requests](https://modelcontextprotocol.io/community/contributing.md#change-the-specification-or-docs) vary by repository | None |
1212| [Member](#member) | Established, active contributor | GitHub organization membership, triage rights | 2-3 months of active participation |
1313| [Maintainer](#maintainer) | Steward of a named area (an SDK, a tool, a docs area, a group) | Merge rights in the area, listed in [`MAINTAINERS.md`](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/MAINTAINERS.md) | 6 months as Member |
1414| [Core Maintainer](#core-maintainer) | Project-wide technical leadership; authority in [Governance](https://modelcontextprotocol.io/community/governance.md#roles) | Administrative rights on all repositories | By invitation after sustained Maintainer contribution |
from line 19
1919
2020## Contributor
2121
22A Contributor is anyone who has contributed to MCP in any form: issues, pull requests, group discussion, documentation, or help to others. There are no formal requirements. Start at [Contributing](https://modelcontextprotocol.io/community/contributing.md#where-to-start) and join the channels listed in [Communication](https://modelcontextprotocol.io/community/communication.md).
22A Contributor is anyone who has contributed to MCP in any form: issues, pull requests, group discussion, documentation, or help to others. There are no formal requirements. Start at [Contributing](https://modelcontextprotocol.io/community/contributing.md#where-to-start) and join the channels listed in [Communication](https://modelcontextprotocol.io/community/communication.md). Pull requests on the specification repository are opened by [Members](#member). Other repositories set their own rules in their contributing guides.
2323
2424## Member
2525
from line 29
2929
3030**Duties.** Respond to issues and pull requests assigned to you. Help onboard new contributors when you can. Follow the [Code of Conduct](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/CODE_OF_CONDUCT.md).
3131
32**Privileges.** GitHub organization membership with triage rights. Can be assigned issues and pull requests and use review commands such as `/lgtm`. Pull request creation on the specification repository follows [Contributing](https://modelcontextprotocol.io/community/contributing.md#change-the-specification-or-docs). Eligible to serve as WG Lead or IG Facilitator. The member lists in the [access repository](https://github.com/modelcontextprotocol/access) are the roster. No separate list is published.
32**Privileges.** GitHub organization membership with triage rights. Can be assigned issues and pull requests and use review commands such as `/lgtm`. Can open pull requests on the specification repository, as set out in [Contributing](https://modelcontextprotocol.io/community/contributing.md#change-the-specification-or-docs). Eligible to serve as WG Lead or IG Facilitator. The member lists in the [access repository](https://github.com/modelcontextprotocol/access) are the roster. No separate list is published.
3333
3434**Minimum time.** 2-3 months of active participation.
3535
community/interest-groups/enterprise Changed · +6 / -6 lines
from line 17
1717### In Scope
1818
1919* **Enterprise Requirements Gaps (overarching focus)**: The group’s primary mandate is identifying enterprise deployment requirements that are not addressed at the MCP protocol level today and turning them into problem statements and recommendations for the relevant Working Groups. Each requirement is captured with the enterprise opportunity it represents, not only the pain point, since closing these gaps is what unlocks broader enterprise adoption and value. The specific domains below are explored through that lens; governance and best-practice patterns are documented only where they surface a protocol-level gap:
20* **Enterprise Authentication and Identity**: Discussion of enterprise-managed auth patterns including IdP integration (SSO, SAML, OIDC), token lifecycle management, On-Behalf-Of (OBO) token exchange flows, and fine-grained authorization (Rich Authorization Requests). Gathering requirements to inform the Auth WG and related SEPs.
20* **Enterprise Authentication and Identity**: Discussion of enterprise-managed auth patterns including IdP integration (SSO, SAML, OIDC), token lifecycle management, On-Behalf-Of (OBO) token exchange flows, and fine-grained authorization (Rich Authorization Requests). Gathering requirements to inform the Authorization IG and related SEPs.
2121* **Identity Propagation and Session Context**: Defines how verified identity is surfaced and conveyed across MCP clients, servers, and downstream services for policy enforcement and audit. This includes spawned-agent and delegated-agent use cases: identity lineage, least-privilege for child agents, descendant revocation, and auditability across multi-agent chains, which is adjacent to authentication but distinct in focus.
2222* **Audit, Observability, and Compliance**: Exploration of standardized audit trail formats for MCP tool invocations, integration with enterprise SIEM and observability platforms, and evidence generation for compliance frameworks (SOC 2, HIPAA, GDPR, EU AI Act). Includes sector-specific compliance patterns such as PHI handling and BAA-scoped data flows in healthcare environments.
2323* **Gateway and Proxy Behavior**: Documentation of enterprise deployment patterns where MCP traffic routes through API gateways, load balancers, reverse proxies, and security proxies. With the move to a stateless protocol core in the 2026-07-28 release, the focus shifts from session affinity to gaps that persist in a stateless model: header and context propagation, authorization handoff across proxies, and policy enforcement at the gateway.
from line 26
2626* **Configuration Portability and Deployment**: Discussion of challenges in deploying MCP servers across heterogeneous client environments, multi-tenant configuration patterns, and enterprise-scale rollout practices.
2727* **Interceptors and Middleware**: Exploration of use cases for request/response interception in MCP pipelines, including PII redaction, compliance validation, content filtering, and hallucination detection. Gathering requirements that may inform future specification work on middleware patterns.
2828* **Problem Statements and Use Cases**: Documentation of enterprise pain points and production failure scenarios (anonymized) to build an evidence base for prioritizing specification work.
29* **Recommendations to Working Groups**: Providing structured input from enterprise practitioners to the Auth WG, Security IG, Gateways IG, and other groups on enterprise-specific requirements.
29* **Recommendations to Working Groups**: Providing structured input from enterprise practitioners to the Authorization IG, Security IG, Gateways IG, and other groups on enterprise-specific requirements.
3030
3131### Out of Scope
3232
from line 33
3333* Writing or owning SEPs. The Enterprise IG produces problem statements, use cases, and recommendations. Concrete specification changes are driven through the appropriate Working Groups.
3434* Discussion of product-specific or vendor-specific solutions. Discussions must remain vendor-neutral and focused on protocol-level patterns.
3535* General MCP support or onboarding. The group focuses on enterprise deployment challenges, not introductory MCP topics.
36* Overlapping directly with the Auth WG's specification work. The Enterprise IG gathers enterprise auth requirements and feeds them to the Auth WG rather than proposing auth protocol changes.
36* Overlapping directly with the Authorization IG's specification work. The Enterprise IG gathers enterprise auth requirements and feeds them to the Authorization IG rather than proposing auth protocol changes.
3737
3838### Related Groups
3939
4040#### Working Groups
4141
42* **Auth WG** — Enterprise auth requirements (IdP integration, OBO flows, RAR) are gathered and provided as input to the Auth WG's specification work.
43* **Transport WG** — Transport-level needs for enterprise support (non-functional requirements such as latency and horizontal scaling) are bundled and provided as input to the Transport WG.
42* **[Transports WG](https://modelcontextprotocol.io/community/working-groups/transports.md)** — Transport-level needs for enterprise support (non-functional requirements such as latency and horizontal scaling) are bundled and provided as input to the Transports WG.
4443* **Extensions WG** — Requirements for extensions other than authorization are bundled and provided as input to the Extensions WG.
4544
4645#### Interest Groups
4746
47* **[Authorization IG](https://modelcontextprotocol.io/community/interest-groups/auth.md)** — Enterprise auth requirements (IdP integration, OBO flows, RAR) are gathered and provided as input to the Authorization IG's specification work.
4848* **Security IG** — Overlapping interest in runtime security, tool poisoning, and credential management. The Enterprise IG focuses on the organizational and governance dimensions; the Security IG focuses on threat models and protocol-level mitigations.
4949* **Gateways IG** — Direct overlap on gateway/proxy behavior patterns. The Enterprise IG provides enterprise deployment context; the Gateways IG focuses on technical gateway specifications.
5050* **Financial Services IG** — Several enterprise concerns (compliance, audit, regulated environments) overlap with the FS-IG. Cross-posting and joint sessions will be coordinated where appropriate.
from line 98
9898| - | - | - | - |
9999| Enterprise Pain Points Catalog | Planned | Q2 2026 | Raghu Chandra |
100100| Healthcare & Compliance Use Cases (PHI, BAA) | Planned | Q3 2026 | Aman s |
101| Enterprise Auth Requirements (input to Auth WG) | Planned | Q3 2026 | TBD |
101| Enterprise Auth Requirements (input to Authorization IG) | Planned | Q3 2026 | TBD |
102102| Gateway Deployment Patterns Document | Planned | Q3 2026 | TBD |
103103
104104## Changelog
community/interest-groups/enterprise-managed-authorization Page removed · 74 lines, page removed
# Enterprise-Managed Authorization Charter ## Group Type ## Mission Statement ## Scope ### In Scope ### Out of Scope ### Related Groups ## Leadership ## Membership ## Operations ## Changelog
The page is gone upstream. What it last said is kept here.
community/working-groups/server-card Changed · +1 / -9 lines
from line 76
7676
7777| Item | Status | Target Date | Champion |
7878| - | - | - | - |
79| [SEP-2127: MCP Server Card](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127) | Draft | Apr 3, 2026 | [@dsp-ant](https://github.com/dsp-ant) |
80
81### Success Criteria
82
83### Active Work Items
84
85| Item | Status | Target Date | Champion |
86| - | - | - | - |
87| SEP 2127: MCP Server Cards | Draft | End March | @dsp-ant |
79| [SEP-2127: MCP Server Cards](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127) | Draft | End March | @dsp-ant |
8880| Reference implementation in Tier-1 SDKs | — | End April | TBD |
8981
9082### Success Criteria
community/interest-groups/auth Changed · +1 / -1 lines
from line 93
9393
9494### Consolidated channels
9595
96The following Discord channels previously hosted authorization sub-groups. They are archived (read-only) as of this re-charter and their topics continue as `#auth-ig` threads and agenda slots. The [Enterprise-Managed Authorization IG](https://modelcontextprotocol.io/community/interest-groups/enterprise-managed-authorization.md) is folded into this group on the same basis: EMA implementers bring interoperability and deployment progress to the call as presentation slots rather than to a standing separate group.
96The following Discord channels previously hosted authorization sub-groups. They are archived (read-only) as of this re-charter and their topics continue as `#auth-ig` threads and agenda slots. The [Enterprise-Managed Authorization IG](https://modelcontextprotocol.io/community/interest-groups/enterprise-managed-authorization) is folded into this group on the same basis: EMA implementers bring interoperability and deployment progress to the call as presentation slots rather than to a standing separate group.
9797
9898| Former channel | Topic | State at consolidation | Continues as |
9999| - | - | - | - |
community/interest-groups/scientific-computing Changed · +1 / -1 lines
from line 50
5050 implementation path for validating correctness and normalizing units between clients and servers
5151* **[File Uploads WG](https://modelcontextprotocol.io/community/working-groups/file-uploads.md)**: input datasets, mesh and geometry
5252 files, and other large files must be considered
53* **[Primitive Grouping IG](https://modelcontextprotocol.io/community/interest-groups/primitive-grouping.md)**: scientific servers often
53* **[Progressive Disclosure WG](https://modelcontextprotocol.io/community/working-groups/progressive-disclosure.md)**: scientific servers often
5454 expose large, hierarchical tool surfaces that motivate organization beyond flat lists
5555* **[Registry WG](https://modelcontextprotocol.io/community/working-groups/registry.md)**: publishing and discovering servers for shared
5656 scientific software and datasets intersects with registry metadata
community/working-groups/file-uploads Changed · +2 / -2 lines
from line 29
2929* **Reference Implementations**: SDK types and helpers for `FileInputDescriptor`, data URI encoding,
3030 and a sample host flow demonstrating picker invocation and value substitution.
3131* **Cross-Cutting Concerns**: Coordination with the MCP Apps WG where embedded UI surfaces present
32 their own file pickers, and with the Security WG on host-side validation requirements.
32 their own file pickers, and with the Security IG on host-side validation requirements.
3333* **Documentation**: Specification sections covering file input declaration and a migration guide
3434 for servers currently using ad-hoc base64 instructions.
3535
from line 46
4646
4747* **MCP Apps WG** — embedded app UIs may surface their own file pickers; the descriptor format
4848 should be reusable in that context.
49* **Security WG** — host-side validation requirements for user-supplied file content (the SEP
49* **[Security IG](https://modelcontextprotocol.io/community/interest-groups/security.md)** — host-side validation requirements for user-supplied file content (the SEP
5050 references [OWASP ASVS V5](https://owasp.org/projects/asvs)
5151 for general upload hygiene).
5252* **Tool Annotations IG** — file input descriptors are a form of input-parameter metadata and should
community/working-groups/inspector-v2 Changed · +1 / -1 lines
from line 33
3333
3434* **SDK WG** — Inspector Core consumes the TypeScript SDK; coordination required for SDK V2 adoption.
3535* **MCP Apps WG** — shared surface area around client/app ergonomics and inspection workflows.
36* **Auth WG** — authentication flows exercised by Inspector when connecting to protected servers.
36* **[Authorization IG](https://modelcontextprotocol.io/community/interest-groups/auth.md)** — authentication flows exercised by Inspector when connecting to protected servers.
3737* **Registry WG** — discovery and metadata surfaces that Inspector presents to users.
3838
3939## Leadership
community/working-interest-groups Changed · +0 / -1 lines
from line 41
4141* [Agents](https://modelcontextprotocol.io/community/interest-groups/agents.md)
4242* [Authorization](https://modelcontextprotocol.io/community/interest-groups/auth.md)
4343* [Enterprise](https://modelcontextprotocol.io/community/interest-groups/enterprise.md)
44* [Enterprise-Managed Authorization](https://modelcontextprotocol.io/community/interest-groups/enterprise-managed-authorization.md)
4544* [Financial Services](https://modelcontextprotocol.io/community/interest-groups/financial-services.md)
4645* [Scientific Computing](https://modelcontextprotocol.io/community/interest-groups/scientific-computing.md)
4746* [Security](https://modelcontextprotocol.io/community/interest-groups/security.md)