Runlayer ships MCP Explained, an interactive protocol guide. Runlayer's free interactive guide, MCP Explained, walks through every JSON-RPC message in the Model Context Protocol, including the 2026-07-28 spec. Runlayer, a company that sells AI governance and MCP gateway tools to enterprises, released MCP Explained on 5 November 2026, a free interactive guide to the Model Context Protocol (MCP). The site animates the JSON-RPC messages a host, model and MCP server exchange, lesson by lesson, and a "spec time machine" replays each flow across five protocol versions. The Show HN post reached 270 points and 117 comments on Hacker News. MCP Explained is a free interactive guide to the Model Context Protocol, built by Runlayer. It animates each JSON-RPC message a host, model and server exchange, step by step, across lifecycle, tools, resources and auth, and includes a spec time machine that replays every flow from the 2024-11-05 release through the current 2026-07-28 spec. What changed. * The site teaches MCP as a sequence of lessons: JSON-RPC, lifecycle, transports, authorization, tools, resources, prompts, sampling, elicitation, roots, progress and tasks, each linked to the official spec. * A "spec time machine" shows how the same flow worked under five spec versions: 2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25 and 2026-07-28. * A "harness techniques" section covers tool search, finding the right tool among thousands, and codemode, writing a program instead of making many separate tool calls. * A "break it" section walks through five attacks on MCP: tool poisoning, tool shadowing, token passthrough, prompt injection and elicitation phishing. * A "coming to MCP" section covers three extensions not yet in the core spec: Skills over MCP, MCP Apps and Server Cards. * The official MCP extensions overview at modelcontextprotocol.io lists MCP Apps as Stable, letting servers show interactive UI such as charts and forms inside a conversation. Skills over MCP and Server Cards are both Beta, with no destination (Stable or promotion to Core) yet stated. MCP Tasks is Beta with a stated destination of Core. * The current spec, dated 2026-07-28, made several breaking changes from the prior 2025-11-25 version: it removed the initialize and notifications/initialized handshake and protocol-level sessions, added a server/discover RPC for version and capability negotiation, replaced the old resource-subscription mechanism with a single subscriptions/listen stream, and introduced a Multi Round-Trip Requests pattern that replaces server-initiated requests like sampling and elicitation. The same spec deprecated the Roots, Sampling and Logging features and the HTTP+SSE transport. * MCP Explained's source is published on GitHub as a single, dependency-free HTML file served from a Cloudflare Worker. Why it matters for agent builders. Anyone building or debugging an MCP server now has one page that shows the literal bytes on the wire for every feature, instead of piecing it together from the spec's prose. The protocol has changed shape five times since November 2024, most recently by removing the session handshake entirely and deprecating three client features, Roots, Sampling and Logging, that many existing servers still rely on. A server built against the 2025-11-25 spec is not automatically compatible with a host that only speaks 2026-07-28, and the site's version-by-version comparison shows exactly what to change. The extension list is also a planning signal. Skills over MCP, which lets a server expose Agent Skills as discoverable resources, and Server Cards, which lets a client read a server's metadata before connecting, are both still Beta with no committed destination. Builders who adopt them now should expect the interface to move before either extension stabilizes. What to watch. MCP Explained's own roadmap link points to modelcontextprotocol.io's published schedule, which lists the next spec release for March 2027. Whether Skills over MCP and Server Cards stabilize or get folded into the core protocol before then, and whether Runlayer keeps the guide updated as the spec keeps moving, are the two open questions this launch leaves for anyone relying on it as a reference. Key takeaways. * Runlayer released MCP Explained on 5 November 2026, a free interactive, lesson-based guide to the Model Context Protocol; it reached 270 points and 117 comments on Hacker News. * The guide's "spec time machine" compares the same MCP flow across five protocol versions, from 2024-11-05 to the current 2026-07-28 release. * The 2026-07-28 MCP spec removed the initialize handshake and protocol-level sessions, added a server/discover RPC, and deprecated the Roots, Sampling and Logging features. * Three MCP extensions not yet in the core spec, Skills over MCP, MCP Apps and Server Cards, are covered in the guide; MCP Apps is Stable, the other two are Beta with no destination yet decided. * The next MCP spec release is scheduled for March 2027, per modelcontextprotocol.io's roadmap. Faq. What is MCP Explained? MCP Explained is a free, interactive explainer at mcp-explained.com, built by Runlayer, that animates every JSON-RPC message exchanged between an AI host, a model and an MCP server, lesson by lesson, with a version comparison across five MCP spec releases. What is the Model Context Protocol (MCP)? MCP is an open standard for connecting AI applications to the tools and data they use. A server describes what it can do, the AI app shows that to the model, and when the model wants to use something, the app calls the server and passes the result back, so any compliant app can work with any compliant server. What changed in the MCP 2026-07-28 spec? The 2026-07-28 spec removed the initialize and notifications/initialized handshake and protocol-level sessions, added a server/discover RPC, replaced resource subscriptions with a single subscriptions/listen stream, introduced the Multi Round-Trip Requests pattern, and deprecated the Roots, Sampling and Logging features along with the HTTP+SSE transport. Anyone building or browsing MCP servers can compare implementations on AI Agents Listing's MCP server directory. One email a week. New agents, MCP servers and skills, and what is actually getting traction. More news.

Runlayer named an AI Security Endpoint Leader in Latio's 2026 AI Security Market Report. Runlayer is proud to be recognized as an AI Security Endpoint Leader in Latio's 2026 AI Security Market Report. Runlayer provides in-depth security and control of AI use on the endpoint, delivering the golden path to AI transformation. The AI Security market has exploded over the past year, for good reason. New AI tools and capabilities become available every week, and tend to get in employees' hands faster than Security teams are aware of them. Over the past year, most enterprise Security teams were told to accept whatever risk AI transformation introduced internally, and ensure any mitigating controls didn't stifle innovation. Latio's 2026 AI Security Market Report, published today, shows that this is beginning to change. Compared to the findings from their inaugural report in 2025, demand for AI security tools jumped from 8% to 37%, with 45% of respondents citing endpoint agents like Anthropic's Claude and OpenAI's Codex as their primary AI security concern. Runlayer is proud to be recognized by Latio as an AI Security Endpoint Leader, providing in-depth security and control of AI use on the endpoint. Latio evaluated vendors on their ability to map agent permissions and govern their blast radius, apply deterministic runtime controls to skills and MCPs, and facilitate intent-based runtime security detections. Runlayer's AI control plane delivers all of that and more, providing employees a golden path to accelerate AI adoption with security and control built-in. How Runlayer delivers in-depth AI endpoint security. For enterprise security teams working to strengthen their AI security posture without blocking innovation, Runlayer provides the infrastructure to detect, prevent, and respond to rogue agentic behavior. * Know and control what your agents can actually do. In order to control agent behavior, you must first gain visibility into all agents running across your workforce. Runlayer facilitates deep shadow AI discovery on the endpoint, surfacing every AI client, agent, skill, and MCP currently in use. Layering on Agent IAM and granular deterministic policies, you can apply least privilege access on a per-user and per-agent basis to reduce the potential blast radius. * Govern every MCP and skill. MCP servers and skills have become the new software supply chain, and most enterprises have little to no visibility into what's running, what packages they carry, or what they're authorized to do. Runlayer changes that with an employee-facing catalog of governed MCPs and skills ready to share across the workforce. Employees see a one-stop-shop to accelerate their work. Behind the scenes, Security teams get a powerful set of security scanners to detect and prevent malicious MCP tool calls and skill files, both proactively and at runtime. * Track every session, from intent to action. Agents are becoming more powerful, with the ability to reason through complex problems and complete hours-long sessions. It's critical that Security teams have complete visibility into agent sessions so they can respond quickly when the need arises. Runlayer logs every single action across agent sessions, from user inputs to agent reasoning steps, tool calls, actions, and final outputs. The full audit trail can be used to investigate incidents directly in Runlayer, or easily exported to third-party SIEMs. Make the safe path the golden path. Enterprises shouldn't have to choose between accelerating AI adoption and preventing rogue agent behavior. With Runlayer, they don't. Runlayer delivers the golden path to AI transformation. One where the easy way to use AI is also the secure and governed way. See why leading enterprises like AngelList, Gusto, and PagerDuty trust Runlayer to help them go all in on AI | book a custom demo.