MCP roadmap meta-issue (v2 / v3 / v4 tracking)

[RichardHightower]

---

roadmap: mcp-meta
status: shipped (v1) / planned (v2–v4)
source_design: docs/plans/2026-05-28-mcp-uds-transport-design.md

MCP roadmap

Meta-issue body for gh issue create --body-file docs/roadmaps/mcp/README.md (the title is "MCP roadmap meta-issue (v2 / v3 / v4 tracking)").
See plan docs/plans/2026-05-28-mcp-uds-transport-design.md §11 and §15.4.

Source design

docs/plans/2026-05-28-mcp-uds-transport-design.md

v1 (this release — 10.1.0)

Shipped per the plan above. UDS transport + 7-tool / 5-resource / 6-prompt stdio MCP server + CLI HTTP/UDS dual transport.

Roadmap

• MCP v2 — MCP v2: Resource subscriptions + deferred URI schemes + Streamable HTTP + 9 remaining tools #186 — Resource subscriptions + the 2 deferred URI schemes + Streamable HTTP + 9 remaining tools. Body: v2-subscriptions-and-resources.md.
• MCP v3 — MCP v3: CLI speaks MCP + framework integration matrix #187 — CLI-via-MCP + framework integration matrix (OpenAI Agents SDK, LangChain, LlamaIndex, Pydantic AI, Mastra, Vercel AI SDK, Autogen). Body: v3-cli-via-mcp-and-frameworks.md.
• MCP v4 — MCP v4: OAuth 2.1 for remote Agent Brain instances #188 — OAuth 2.1 for remote Agent Brain instances (Protected Resource Metadata, Dynamic Client Registration, Resource Indicators, DPoP optional). Body: v4-oauth-for-remote.md.

Each phase requires its own design doc before implementation lands. Phase order is hard:

• v3 depends on v2's HTTP transport. No McpHttpBackend in v3 without Streamable HTTP in v2.
• v4 depends on v3's McpHttpBackend. OAuth lives on the HTTP transport; stdio is local-trust by definition.

How to file these issues

The three roadmap bodies (v2-*.md, v3-*.md, v4-*.md) and this meta-body are formatted to be passed directly to gh issue create --body-file. Suggested titles + labels are in plan §15.

When filing, link the meta-issue back to the three sub-issues using the issue numbers GitHub assigns (e.g., update the checkbox lines above to - [ ] #123 MCP v2 — …).

[RichardHightower]

v10.2 milestone created and scoped: https://github.com/SpillwaveSolutions/agent-brain/milestone/1

Planning artifacts:

• .planning/ROADMAP.md — 6 phases (50-55)
• .planning/REQUIREMENTS.md — 27 REQs across 5 categories (SUB, URI, HTTP, TOOL, VAL)
• 27/27 requirements mapped, no orphans

Phase order (hard dependencies):

• Phase 50 (server endpoints + v2 design doc) → Phase 51 (URI schemes)
• Phase 51 → Phase 52 (subscriptions need job:// URI addressable)
• Phase 52 → Phase 54 (wait_for_job needs notification infrastructure)
• Phase 53 (Streamable HTTP) independent — parallel with 52
• Phase 55 (QA gate) must be last

Next action: /gsd:plan-phase 50 — decompose Phase 50 into plans.

[RichardHightower]

Status update (2026-06-14): MCP v3 (#187) shipped in v10.3.2 and is now closed. MCP v4 (#188, OAuth 2.1) is the active milestone (v10.4) — its hard dependency (v3's McpHttpBackend over Streamable HTTP) is satisfied.

v10.4 scope (research-grounded, see .planning/REQUIREMENTS.md): full OAuth 2.1 DoD — co-located AS/RS and split AS/RS verified against Keycloak-in-CI — bundled with GraphRAG stability fixes (#178 kuzu SIGSEGV, #184 snapshot scope-gap). DPoP deferred (no production Python lib as of June 2026); audit logging deferred to its own milestone.

Roadmap status:

• MCP v2 — MCP v2: Resource subscriptions + deferred URI schemes + Streamable HTTP + 9 remaining tools #186 (shipped v10.2)
• MCP v3 — MCP v3: CLI speaks MCP + framework integration matrix #187 (shipped v10.3.2)
• MCP v4 — MCP v4: OAuth 2.1 for remote Agent Brain instances #188 (in progress, v10.4)