The MCP spec grows up

The March 2025 MCP update was the release that made enterprise adoption plausible. The protocol changelog lists four major changes: an authorization framework based on OAuth 2.1, a streamable HTTP transport replacing the older HTTP plus server-sent events approach, JSON-RPC batching, and tool annotations that describe tool behavior, such as whether a tool is read-only or destructive.

Authorization was the one I cared about most. Without a standard way to establish who is calling a tool and with what rights, no serious security team would let MCP near production data. Tool annotations matter too, because a policy engine can treat a destructive tool very differently from a read-only one.

The ecosystem moved the same week. The OpenAI Agents SDK added MCP support, and Playwright's MCP server let agents use web pages through accessibility snapshots rather than screenshots, which is faster and far more reliable. When Google signaled support days later, it was clear to me that MCP would become the default way agents connect to tools.

Standards become real when security teams can say yes to them.