Daily signal: a quiet weekend for MCP and A2A, and what the stand-still itself says about where agent security is being decided
The MCP specification, the TypeScript and Python SDKs and A2A did not release anything new in the window, and I found no confirmed frontier model launch. The useful read is about what is pending: SDK security checks that are still opt-in, and a governance reshuffle that moves two security-relevant work areas.
Covers Fri 23 Oct 08:00 CEST to Mon 26 Oct 08:00 CET
Thin Monday window and a deliberately short report. I checked GitHub release and commit pages for the MCP specification, TypeScript SDK, Python SDK, A2A, Claude Code and Codex, and Anthropic's newsroom; the GitHub API and modelcontextprotocol.io were not reachable from this environment, so I used the github.com pages. Model searches returned only aggregators and forecasts with conflicting dates, so I report no model news rather than guess. Claude Code (latest 2.1.310) and Codex (0.164.0) have no release after the ones covered on [25 Oct](/reports/2026-10-25-daily-signal/). Security events are in the [security brief](/reports/2026-10-26-security-brief/).
In brief
- MCP specification: still 2026-07-28. The newest commit is a 23 Oct maintainer handle change (PR 3451); the last substantive merge is PR 3440 on 20 Oct, which forms a Tasks and Events Working Group and turns the Agents group into an interest group.
- SDKs: TypeScript 2.4.0 (23 Oct, Skills extension, stricter schema URIs) and Python 2.3.0 (2 Oct) are the latest; nothing newer. The audience and redirect checks that Python turned on in 2.2.0 are still opt-in in TypeScript.
- A2A: latest release is still v1.0.1 (28 May 2026). No new specification movement.
- Models: no confirmed frontier release in the window. Anthropic's newsroom has nothing after 22 Oct (Agent Skills donation); aggregator claims about new GPT-6 or Gemini 4 variants have no vendor page I could open.
- Read-across: with the spec frozen, security behaviour is being set by SDK defaults and host products, which is where this week's flaws (Inspector, ADK, vLLM) actually were.
MCP, A2A and the stand-still
What happened. Nothing shipped. The specification repository has two commits in the window dated 23 Oct, both a maintainer’s changed GitHub handle and affiliation. The previous merged pull requests are documentation and dependency bumps, plus PR 3440 (20 Oct) which forms a Tasks and Events Working Group and converts the Agents Working Group into an interest group. The TypeScript SDK’s 2.4.0 and 1.32.2 are dated 23 Oct and were covered on 24 Oct; the Python SDK’s latest is 2.3.0 from 2 Oct, and A2A’s is v1.0.1 from 28 May.
Analysis. A frozen spec means the controls that matter this week are the ones SDKs and hosts choose by default. The Python SDK 2.2.0 (7 Sep) follows redirects only within the same scheme, host and port, validates the authorization server issuer on the legacy discovery path, adds an opt-in token-audience check that will default to on in 3.0, closes idle sessions after 30 minutes and caps servers at 10,000 sessions. The 1.30.0 maintenance line carries the same changes and is described as security fixes only. TypeScript has equivalent opt-in checks (the expectedResource audience check from 2.3.1 is off unless set). I have not seen the TypeScript SDK’s own defaults change since 5 Oct. Mapping: an opt-in token-audience check is the SDK-level answer to confused-deputy token passing (OWASP Agentic ASI03, identity and privilege abuse) and to the ‘tokens issued for other services’ advisory on the TypeScript bearer path (GHSA-rvq5-wwqv-78pq, 20 Oct).
The governance change matters because Tasks (long-running work) and Events (server-initiated delivery) are the two features where an authenticated principal, subscription ownership and SSRF-safe verification have to be decided. Folding them into one group makes it likelier that one security review covers both; turning Agents into an interest group suggests no agent-to-agent proposals are about to reach drafting. That is my reading of an organisational change, not a statement from the maintainers.
Why it matters. If your threat model assumes the protocol will fix a class of problems soon, the calendar says no. SDK upgrade notes and host defaults are where changes will land first.
Mitigation and detection. Pin SDKs to the latest line and read the ‘opt-in’ notes: set the audience and issuer checks in TypeScript explicitly; on Python 1.x set validate_token_resource. Alert on SDK version drift in your MCP servers.
Recommendation (opinion): treat SDK defaults as policy. Add ‘audience check on, redirects same-origin only, session caps set’ to your MCP server baseline now, instead of waiting for 3.0 or a spec revision.
Sources: MCP specification repository, recent merges · MCP TypeScript SDK releases · MCP Python SDK releases · A2A releases
Models and agent platforms
I found no confirmed frontier model release or system card in the window. Anthropic’s newsroom lists nothing after 22 Oct (the Agent Skills donation, covered on 23 Oct). Third-party release logs and prediction-market pages mention October launches with conflicting names and dates; none links to a vendor page, so I did not include them.
On coding agents, the newest Claude Code release is 2.1.310 (23 Oct) and Codex’s is 0.164.0 (23 Oct); both were covered on 25 Oct. One configuration detail from Claude Code 2.1.305 is worth a second look because it changes policy at upgrade: allowedMcpServers stopped filtering managed-mcp.json stdio servers that use ${VAR} only in env, so a server your allowlist excluded now loads, and deniedMcpServers is the way to keep it off. Check managed settings after any Claude Code upgrade.
Sources: Anthropic newsroom · Claude Code releases · Codex releases