Daily signal: MCP fixes its release calendar and extension stages while the patch path for stable extensions stays undefined, and Claude Code drops the telemetry event we called a detection feed
MCP maintainers merged SEP-3398 (two releases a year, rotating release managers) and finalised SEP-3392 (Experimental, Beta, Stable, Core stages for extensions) on 27 Oct, and the pull-request text I could read does not say how a security fix reaches a Stable extension. Claude Code 2.1.312 stopped sending the safety_event telemetry that a 25 Oct signal recommended for detection.
Covers Tue 27 Oct 08:00 CET to Wed 28 Oct 08:00 CET
Short, deliberately. No new MCP specification revision, no A2A release (the A2A repository's only recent commits are an antitrust policy and a Technical Steering Committee member), no TypeScript or Python SDK release in the window, and I verified no new frontier or open-weight model release: search results for 27 and 28 Oct returned only older launches (a Claude Haiku 5.5 on 7 Oct per an aggregator, and OpenAI's GPT-6 Astra on 3 Sep, which OpenAI reportedly rated Critical for cyber capability). Both are outside the window and I do not cover them. Only GitHub pages were reachable as primary sources; modelcontextprotocol.io and vendor sites did not resolve. For SEP-3392 and SEP-3398 I read the pull-request pages, not the full SEP text, so what the SEPs say about security review and emergency fixes may be in a part I did not see. Vulnerabilities from the SDKs are in the [security brief](/reports/2026-10-28-security-brief/).
In brief
- SEP-3398 (merged 27 Oct, 7 of 7 core-maintainer votes): MCP releases move to March and September on overlapping eight-month cycles, with rotating release managers, a shared SEP review queue and 'emergency approvals'. The page I read gives no freeze dates and says nothing on how security patches are handled.
- SEP-3392 (Final, 27 Oct): extension stages Experimental, Beta, Stable and Core. A Stable extension changes only with a new core protocol revision; proposed Stable at transition are ext-apps and ext-auth, Beta are ext-skills, ext-tasks and ext-server-card. The discussion I read has no security-review gate for graduation.
- Pull request 3364 (open) documents that most SDKs negotiate extensions through initialize on the 2025-11-25 version: 9 of 10 official SDKs preserve capabilities.extensions, Python's server side is fixed on main but unreleased, Swift has none. It advises falling back gracefully when the field is missing, which does not address a peer stripping the field to force a downgrade.
- SEP-3149 (CIMD must declare token endpoint auth methods): still open; its September questions about treating an omitted method as 'none' and binding the method to refresh are unanswered, and on 25 Oct reviewers pointed to the IETF client-ID-metadata draft as the place this is being settled.
- Claude Code 2.1.312 (27 Oct) removes the claude_code.safety_event OpenTelemetry event added in 2.1.307; Codex 0.165.0 (27 Oct) closes a marketplace URL validation gap that could let Git connect to a host other than the one checked against allow patterns.
Executive summary
The level stays elevated, carried by the security brief rather than by anything here. The ecosystem story is process, not protocol: the MCP project merged a release calendar (SEP-3398) and finalised an extension lifecycle (SEP-3392), and neither text I could read says how a security fix reaches a Stable extension between releases. In the agent clients, Claude Code removed the telemetry event the 25 Oct signal recommended for detection, so any alert built on it has gone silent. No new specification, A2A release or confirmed model launch fell in the window.
MCP governance: a calendar and a lifecycle, and a missing patch path
What happened. Two process proposals landed in the modelcontextprotocol repository. SEP-3398 (Release Cycle Updates) was accepted by the core maintainers 7 to 0 and merged on 27 Oct: releases in March and September on overlapping eight-month cycles, with a proposed transition to March 2027, rotating release managers, a shared review queue with sponsorship and voting, freeze and SDK milestones, and ‘emergency approvals’. SEP-3392 (Extension Lifecycle) went to Final the same day. It replaces the earlier rule that every breaking change needs a new extension identifier with four stages: Experimental (any change without notice), Beta (changes approved by the extension maintainer, breaking changes expected to be rare), Stable (changes only with a new core protocol revision) and Core. The stage is the directory an extension lives in, and moving between stages is a directory move approved by a core maintainer. The proposed first classification puts ext-apps and ext-auth at Stable and ext-skills, ext-tasks and ext-server-card at Beta.
Analysis. Read for security, the questions are who can change what and how fast a fix can ship. Predictable release dates help implementers plan upgrades and give researchers a known window for disclosure. The lifecycle makes the status of an extension explicit, which clients can use to decide what to enable by default (the ext-skills and ext-tasks extensions are both on the Beta list while SDKs already ship them, as the TypeScript 2.4.0 Skills support shows). The gap I could not close: a Stable extension ‘changes only with a new core protocol revision’, and core revisions are now twice a year. ext-auth is in the proposed Stable set. If a flaw is found in an authorization extension, the rule as I read it either blocks a spec-level fix for months or depends on the unexplained ‘emergency approvals’. The SEP-3398 page I read does not describe security patches or hotfixes, and the SEP-3392 page I read has no security-review requirement for promotion; both may be in the full text. This is the same question the MCP community has to answer for SDKs: this week’s SDK advisories show that the fixes that matter ship as SDK releases and defaults, not as spec revisions.
Pull request 3364 adds a related detail. Extensions became official in the 2026-07-28 revision, but many SDKs, clients and servers already negotiate them through initialize on the 2025-11-25 version. The author’s audit of ten official SDKs found nine preserve capabilities.extensions through the older handshake, Python’s server-side gap is fixed on main and unreleased, and Swift has no support (its fixes are open). The text tells implementations to fall back gracefully when the field is missing. It does not analyse downgrade: a peer or an intermediary that strips extensions from an initialize message gets the client to proceed as if a protection (for example an auth extension) were not negotiated. I have not tested a client for this; it is a question to put to your SDK vendor, and an argument for clients to treat ‘extension required but not confirmed’ as a hard failure.
Authorization hygiene is moving on a separate track. SEP-3149 (client ID metadata documents must declare token_endpoint_auth_methods_supported) is still open. In September a reviewer asked whether treating an omitted method as none is safe (RFC 7591 defaults to client_secret_basic), and whether the chosen method should be bound to the authorization-code and refresh grants so a client cannot later drop to a weaker one. I see no author reply. On 25 Oct two reviewers noted the same field is being added to the IETF client-ID-metadata draft, so this SEP may shrink or disappear.
Why it matters. The protocol’s rule-making is maturing at the same time as the most security-relevant behaviour (audience checks, redirect handling, size limits) is being set by SDK defaults. For a team that depends on MCP, the dates give a planning rhythm, but the security-relevant surface for the next six months is the SDK changelog, not the spec calendar.
Mitigation and detection. Pin extensions by name and version, not by stage; ask your SDK vendor how a missing extensions field is handled; track the full text of SEP-3392 and SEP-3398 for the patch and hotfix path before you build on a Stable extension.
Recommendation (opinion): raise it in the working group. Ask the maintainers to state in SEP-3392 how a security fix reaches a Stable extension between core revisions, and to add a security-review step to Beta-to-Stable promotion.
Sources: SEP-3398 pull request · SEP-3392 pull request · Pull request 3364 · SEP-3149 pull request
Agent clients: a telemetry event removed, a marketplace check tightened
What happened. Claude Code 2.1.312 (27 Oct) removed the claude_code.safety_event OpenTelemetry event. The 25 Oct signal described that event, added in 2.1.307, as a usable detection feed: one record for every tool call stopped, prompted or sent back by a permission rule, auto mode, hook or sandbox. The 2.1.312 notes say teams that alert on it will stop receiving it. The same release adds an automatic model switch after a flagged message that now also covers unrecognised model names such as custom deployment names (set CLAUDE_CODE_DISABLE_REFUSAL_FALLBACK=1 to turn it off) and fixes managed-settings fetching after sign-in from the VS Code extension. Release 2.1.311 (26 Oct) escapes control and Unicode format characters in JSON output as \uXXXX, fixes /mcp showing ‘authenticated’ for a remote server that gets no credentials, and fixes a Linux sandbox failure with blockReadsOutsideWorkingDirectories. Codex 0.165.0 (27 Oct) closes a marketplace URL validation gap that could let Git connect to a host other than the one checked against allow patterns, rejects backslashes in marketplace URL userinfo, and cancels remote MCP tool requests whose response futures are dropped.
Analysis. The telemetry removal matters more than its size. A detection control that a vendor can drop in a point release is a dependency, and any alert built on safety_event is now silent without an error. The 2.1.311 changes are small hardening: the JSON escaping closes a channel where a tool result or file name carrying terminal control sequences reaches a downstream log viewer unchanged, and the /mcp fix removes a false assurance that a server was authenticated. The Codex fix is a host-confusion bug: the string checked against the allow list is not the host Git connects to, a classic parser-differential error, here in the path by which an agent gets plugins.
Mitigation and detection. If you alert on claude_code.safety_event, check for silence today and move the rule to the permission-decision data you still have (hook output, sandbox logs and the proxy in front of the model gateway). Pin Claude Code and Codex versions in managed images and read release notes as security input. For marketplaces, restrict allow lists to exact hosts and test URLs containing userinfo and backslashes.
Recommendation (opinion): fix the alert. Treat vendor telemetry that you rely on for detection as a contract: ask for it to be documented and versioned, and keep an independent record (egress proxy logs) of the agent’s tool and network activity.
Sources: Claude Code releases · Codex releases · PADAWAN 25 Oct signal
SDK and protocol state
The MCP specification is unchanged at 2026-07-28 and the latest SDKs are Python 2.3.0 (2 Oct) and TypeScript 2.4.0 (23 Oct, with 1.32.2 on the 1.x line); nothing newer. One read-across from the Python releases worth knowing, because it shows where SDK defaults stand: 2.2.0 (7 Sep) restricted client redirects to the same origin, checked the authorization-server issuer on the legacy path, expired idle Streamable HTTP sessions after 30 minutes by default and capped servers at 10,000 concurrent sessions, while 2.3.0 added a 1 MiB default per SSE event and stopped counting the request timeout during an interactive OAuth login (add your own limit in callback_handler if a stuck login worries you). The Python release notes list DPoP (SEP-1932), the jwt-bearer grant and the tasks extension as not implemented. The A2A repository has only a Linux Foundation antitrust policy (27 Oct) and a Technical Steering Committee addition (20 Oct); the specification stays at 1.0.1. Sources: Python SDK releases · TypeScript SDK releases · A2A commits