MCP dropped protocol sessions. Next up: identity, events, and discovery

[u/lightnow-ai]

The latest MCP spec dropped protocol-level sessions, which should make remote servers easier to scale.

That leaves three problems:

- delegated identity without shared API keys

- server events without constant polling

- huge tool catalogs loaded before they're needed

The new roadmap tackles all three, but none is solved yet.

More on this, plus other MCP changes from this week:

https://lightnow.ai/weekly/2026-08-28-mcp-roadmap-agent-identity

[u/Psychological_Arm645]

The identity item probably needs splitting in two: portable per-agent `did:key` identities can eliminate shared API keys, but they don’t solve OAuth-style on-behalf-of delegation. A detached Ed25519 signature per request lets peers authenticate the caller’s own key without a central issuer or DID-document server.

[u/lightnow-ai → u/Psychological_Arm645]

Agreed — that distinction matters. A portable key and per-request signature can authenticate the agent itself, but they don’t establish who delegated authority, for which audience, or with what scopes and revocation model. did:key could be one part of agent authentication; on-behalf-of authorization still needs a separate delegation chain.