This Week in Extensibility: MCP ships its stateless spec with sandboxed app UIs, WebMCP starts tracking cross-engine support, WebExtensions weighs OAuth for MCP servers

Week of July 24–31, 2026: MCP ships its 2026-07-28 specification with a stateless core and first-class extensions for sandboxed app UIs and async tasks, WebMCP stands up a cross-engine implementation tracker, and the WebExtensions group weighs letting extensions authenticate to MCP servers.