On December 9, 2025, Anthropic announced it was donating the Model Context Protocol to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation. Co-founders Anthropic, Block, and OpenAI contributed MCP, goose, and AGENTS.md respectively. Google, Microsoft, AWS, Cloudflare, and Bloomberg joined as platinum supporters.
The announcement was significant, but the practical impact on server authors was deferred. Nine months later, the foundation published its first major membership update: 97 new organizations joined in a single cohort, bringing the total to 146 members. The governing board, chaired by David Nalley (AWS Director of Developer Experience), is now seated. Eight platinum sponsors — AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, OpenAI — fund the operations.
For developers building on MCP, the question is not whether the protocol changes — it does not. The question is what the new governance structure unlocks and what constraints it introduces.
The spec is frozen at the donation boundary
The MCP specification itself did not change when the donation closed. The 2026-07-28 revision — which made MCP stateless at the protocol layer, removing the initialize/initialized handshake and Mcp-Session-Id sessions — was finalized before the foundation took stewardship. That spec is now the baseline.
Future revisions will follow the Linux Foundation's standard process: RFCs, working group review, and maintainer merges. The governing board approves budgets and project scope; it does not approve or reject individual specification merges. This is the standard split for a directed fund. A platinum membership buys a seat at the budget table, not a veto on the protocol.
What the foundation actually governs
The AAIF governs three things that directly affect server authors:
- The MCP Registry. The discoverability layer — server cards, publisher verification, and the
registry.modelcontextprotocol.ioendpoint — is now foundation infrastructure. Enterprise controls (group policy, MDM support, pre-approved deployments, publisher blocklists, private extension directories) are being built into the registry, not the protocol. - Conformance testing. The SEP-2640 scenarios merged September 11, 2026 define five test scenarios for skill discovery. The foundation funds the test harness and CI infrastructure. A server that passes conformance gets a registry badge. This is optional but increasingly expected by enterprise buyers.
- SDK maintenance. The TypeScript, Python, and Go SDKs (97M monthly downloads combined per the foundation's September metrics) are now foundation projects. Bug fixes and spec-aligning updates are funded. Breaking changes still require the RFC process.
What the foundation does not govern: your server code, your transport choice, your authentication scheme, or your deployment model. Those remain implementation decisions.
Why the stateless spec matters more than the governance announcement
The July 2026 spec revision is the practical milestone for server authors. By removing sessions from the protocol layer, every call now carries its own metadata. This enables horizontal HTTP scaling — a single server can now sit behind a load balancer without sticky sessions. It also simplifies gateway implementations: an MCP gateway no longer needs to track session state across upstream servers.
If you are shipping a production MCP server today, the stateless transport is the feature to adopt. The foundation's conformance suite will validate it. The registry will surface it. The governance structure ensures the spec won't be unilaterally rewritten by a single vendor.
What changes for enterprise adopters
Before the donation, an enterprise evaluating MCP had to accept vendor risk: Anthropic could pivot, deprecate, or relicense. That risk is now structurally reduced. The protocol lives in a Linux Foundation LLC series. The trademark is held by the foundation. The specification evolution follows an open RFC process with multiple corporate stakeholders.
For regulated industries (finance, healthcare, defense), this is the difference between "we can pilot this" and "we can standardize on this." Bloomberg's public statement on the AAIF launch cited exactly this: MCP as critical infrastructure that now has the governance durability to meet compliance requirements.
What server authors should do this quarter
- Migrate to the stateless transport. Drop
initialize/initializedandMcp-Session-Id. Send metadata per request. Test against the SEP-2640 conformance harness. - Publish a Server Card. The registry now expects a
server.jsonmanifest with name, version, capabilities, transport, and authentication metadata. This is what the registry UI surfaces and what enterprise policy engines consume. - Run the conformance suite. It is open source. Passing it gets you the "Conformant" badge on the registry. No one is mandating it yet, but the procurement checklists are being written.
- Watch the A2A working group. The AAIF is also incubating the Agent-to-Agent (A2A) protocol in parallel. MCP and A2A solve adjacent problems (tool calling vs. agent coordination). Interop patterns will emerge from the working groups.
The bottom line
MCP is now neutral infrastructure in the same sense as Kubernetes or Node.js. The protocol spec is stable. The registry, conformance, and SDKs are funded. The governing board manages budgets, not merges. For server authors, the work is the same: build useful servers, adopt the stateless transport, publish Server Cards. The difference is that the rails you are building on now have institutional durability.
If this was useful, you can support my open-source work on Ko-fi or check out my services.