This AI agents 2026 research report probes the Model Context Protocol negotiation layer: 27 public, hosted MCP endpoints tested against four real protocol eras and two fictional ones.
MCP security in 2026 is the problem that the protocol negotiation layer between AI agents and tool servers is largely unobservable. Our probes found roughly 74 percent (20 of 27) of endpoints hide behind an OAuth wall, and 2 of the 7 observable ones silently downgraded the newest protocol era without declaring it — meaning AI agents in 2026 often cannot verify what version they actually get.
We ran protocol-handshake probes against 27 public, hosted MCP endpoints — Microsoft, AWS, GitHub, Stripe, Figma, Cloudflare, Linear, Notion, Slack and more — asking each one to negotiate four real protocol eras and two fictional ones. The results say less about any single vendor and more about the ecosystem: the negotiation layer is unobservable for most servers, and the ones we could see downgrade you quietly.
We asked for the newest protocol era, 2026-07-28. The server answered with 2025-06-18 — an older era — without declaring the downgrade. Your client thinks it's speaking the newest protocol; it isn't. A silent downgrade may be a compatibility choice, but it is one you should see, not discover in production when a new-era feature silently doesn't work.
Both downgrading endpoints (Microsoft Learn, AWS) also answered fictional eras (1999-01-01, 2037-12-31) with their default version instead of rejecting them — the version field is not validated.
Twenty endpoints — GitHub, Stripe, Figma, Linear, Slack, Notion, Cloudflare, HubSpot, Atlassian, Supabase, Sentry, Neon, Vercel, Monday.com, Ahrefs, Perplexity, Semrush, Exa, X API, X Docs' authenticated paths — require OAuth before answering any handshake. That's reasonable access control, but it has a side effect the ecosystem hasn't reckoned with: independent researchers cannot verify negotiation behavior at all. The October 2026 public probe of 78 endpoints (85% silent downgrades) was retracted partly because the stateless 2026-07-28 spec removed the handshake — the instrument gap is real, and OAuth walls make it wider.
| Endpoint | Answered eras | Worst verdict |
|---|---|---|
| Microsoft Learn | 3/6 honest, downgraded 2026-07-28 | SILENT-DOWNGRADE |
| AWS | 2/6 honest, downgraded 2026-07-28 | SILENT-DOWNGRADE |
| Context7 | 3/6 honest | UNKNOWN |
| X Docs | 3/6 honest | UNKNOWN |
| PMWallets (public) | 3/6 honest | UNKNOWN |
| LPSignal (public) | 3/6 honest | UNKNOWN |
| OutcomeTick (public) | 2/6 honest | UNKNOWN |
| GitHub, Stripe, Figma, Linear, Slack, Notion, Cloudflare, HubSpot, Atlassian (v1+v2), Supabase, Sentry, Neon, Vercel, Monday.com, Ahrefs, Perplexity, Semrush, Exa, X API — all 6 probes returned 401: UNKNOWN (OAuth-walled) | ||
Run date: 2026-10-17. Tool: mcp-negotiation-prober (open source, MIT) — sends an MCP initialize handshake with protocolVersion set to each of 6 eras (2024-11-05, 2025-03-26, 2025-06-18, 2026-07-28, plus fictional 1999-01-01 and 2037-12-31) and classifies the echoed version. No credentials were used and none were needed: every probe was an unauthenticated handshake. Endpoints were taken from vendors' own published docs (Microsoft Learn, Linear, Stripe, Figma docs; the Skyvia Oct 2026 roundup; vendor changelogs). An endpoint was included only if it responded to probes at all (HTTP response, including 401). Verdicts describe negotiation behavior only — a silent downgrade is not a vulnerability, and UNKNOWN is not a finding of wrongdoing. Results are reproducible: same tool + same endpoints = same verdicts.
If you run agents against hosted MCP servers: pin and log the negotiated protocol version per session, not the requested one; treat OAuth-walled servers as unobservable and demand version-transparency from vendors; re-run negotiation checks after vendor updates — the downgrade you don't see is the behavior change you can't explain.
An MCP server can expose powerful tools — file access, code execution, credentials, network calls — to any AI agent connected to it. Key risks include over-permissioned tools, prompt injection through tool descriptions, silent protocol downgrades, and negotiation behavior hidden behind OAuth walls, as our 2026-10-17 probe documented.
Probe its negotiation behavior to check for silent protocol downgrades, review every tool’s permissions and descriptions for injected instructions, verify authentication and scope design, and re-verify after vendor updates. Our open-source mcp-negotiation-prober on GitHub automates the handshake part of that audit.
A minimum checklist: verify the negotiated protocol version per session — not just the requested one — review tool permissions and descriptions, demand version transparency from vendors, pin and log what each tool can touch, and re-run checks after every vendor update. The directory above grades 27 public servers on the first item.