An Operable Screen Comes Back Inside the Conversation — Claude Adopts the Final MCP Spec the Same Day, and the Plumbing Behind 400M Monthly Downloads Lands in the Product
The new "2026-07-28" version of the connection standard MCP was finalized on July 28. The same day, Anthropic announced its support, rolling out to Claude products—in stages—MCP Apps, which let tools return an "operable screen" inside the conversation, along with enterprise authentication, observabi
The new "2026-07-28" version of the connection standard Model Context Protocol (MCP) was published as the final release on July 28, 2026. Its contents were locked as a release candidate (RC) in May, and after roughly 10 weeks of validation it became the confirmed "fifth edition." On the same day, Anthropic announced support for this specification on its official blog, revealing that it would roll the changes out across the Claude product line in stages, some of them the same day. We covered the substance of the standard itself in a separate article; this time the story is about how it "lands in the product called Claude." The most striking part is that tools can now return not a text answer but an operable screen.
Tools Return a "Screen," Not an "Answer" — MCP Apps Comes to the Conversation
One of the highlights of the new spec is "MCP Apps." Until now, MCP tools basically returned text or data when called. With MCP Apps, a server can return an interactive HTML screen that renders inside a sandboxed iframe (an isolated frame). In Claude, this screen appears directly within the flow of the conversation. For a booking tool, for example, this opens the door to interactions like "show a calendar of open slots and pick a date and time right there" that can be completed without leaving the chat.
Safety-oriented design is built in as well. Because tools declare the UI templates they use for display in advance, the host can preload, cache, and review the screen before it runs. Button operations and other actions on the screen also travel through the same JSON-RPC path as ordinary tool calls, so they are subject to auditing and consent procedures. The idea is not that the screen "renders on its own and acts on its own," but that it passes through the same checkpoints as a normal tool execution.
Three Enterprise-Facing Pieces Claude Ships at the Same Time
Anthropic's announcement isn't only about MCP Apps. Features aimed at real-world operation and enterprise adoption were unveiled at the same time. Here are the main ones.
| Feature | Details |
|---|---|
| Enterprise-managed authentication | Authorization follows the practical realities of OAuth 2.0 and OIDC, connecting to internal identity providers such as Entra and Okta with no workarounds. Administrators handle the setup, and users can just use it without any hassle. |
| Observability dashboard | Provides a screen for tracking the operational status and performance of published connectors (the systems you connect to). |
| MCP tunnel (research preview) | A mechanism for securely connecting to MCP servers running in private environments such as internal corporate networks. |
As background, monthly SDK downloads of MCP have surpassed 400 million, said to be roughly a fourfold increase over the past year. Claude's connector list now includes more than 950 MCP servers, reportedly used by millions of people every day. In other words, MCP has reached a state where the mechanism Claude brought in has grown into the industry-standard "plumbing," and this release positions that plumbing so enterprises can lay it down as-is.
A "Confirmed" Milestone After 10 Weeks of Validation
The reason this edition matters for real-world work is that it is an official finalization. The RC froze its contents on May 21, and after SDK maintainers and implementers validated it under production-equivalent load for about 10 weeks, it was confirmed on July 28. "Sessions" have been removed from the core to make it stateless, so a request can be processed by whichever server instance receives it. "Tasks," the shared convention for long-running processing, has also been organized as an extension. Because it includes breaking changes, existing setups will require some migration work, but Anthropic says that "existing connections keep working, and updates can be adopted optionally and incrementally." It may not be a flashy new-model announcement, but it is a move that solidifies the foundation for "running agents continuously and safely" — outside of model performance.
The More Convenient the Screen, the More It Warrants Scrutiny
At the same time, the issues lurking behind the convenience are beginning to be pointed out. Experts note that MCP Apps is "a screen the user sees" while, at the same time, its contents and the operations performed on it can flow back into the model's context. Because the screen is in many cases generated from external (untrusted) input, the view is that instructions slipped in there could become an entry point for "indirect prompt injection" that steers the agent. The spec defines "how Apps and Tasks behave" but leaves "who may use them, and up to what limits" to the implementer. Against such concerns, it is argued that operational safeguards are effective: treating rendered content as subject to output guardrail inspection, setting timeouts and token limits on long-running tasks to stop runaway behavior, and tracing the entire process so that no "invisible work" is left behind. The freedom to return a screen and the responsibility to inspect it have effectively been handed to designers as two sides of the same standard.
References: Bringing MCP 2026-07-28 to Claude (Anthropic) / The 2026-07-28 MCP Specification (Model Context Protocol Blog) / MCP Specification 2026-07-28 / Governing MCP Apps and Tasks at the Gateway (TrueFoundry)
