Quirin Schlegel

Loading

Guidance, not a fence - MCP deprecates Roots and the agent's scope becomes a tool argument

The Model Context Protocol deprecated Roots in revision 2026-07-28 under SEP-2577, alongside Sampling and Logging, with a twelve-month lifecycle floor putting the earliest removal at the first revision released on or after 28 July 2027 - four months before the AI Act's Annex III high-risk obligations start to apply on 2 December 2027 under Regulation (EU) 2026/1744. The obvious reading, that a security control has been withdrawn, is wrong on the specification's own terms: roots are "informational guidance rather than an access-control mechanism" and "the protocol does not enforce that servers stay within roots", and SEP-2577's stated rationale is low adoption relative to implementation complexity, not security. What is withdrawn is the declaration - the one machine-readable place where a client stated the intended scope of an agent's filesystem access. The registry's migration path is to pass directories or files via tool parameters, resource URIs, or server configuration, and tool parameters are composed at runtime by the model. GDPR Article 25(2) requires that by default only personal data necessary for each specific purpose is processed and names accessibility explicitly; a path the model writes is an outcome, not a default. The roadmap published 22 August 2026 names five priority areas and none restores a client-declared resource scope: agent identity, its closest relative, is scoped to DPoP, Workload Identity Federation, ID-JAG and RFC 8693 token exchange, and answers who is calling rather than what may be reached. The practitioner move is to enforce below the protocol - a filesystem the server cannot leave - and to record the scope in server configuration a DPIA can cite.

26 August 202611 verified claims7 sources

The new MCP roadmap landed on 22 August. Most of the reading went straight to agent identity. The part worth your attention is what is not in it.

In the 2026-07-28 specification, Roots was deprecated — how an MCP client tells a server which directories and files it may work with. Sampling and Logging went with it, under SEP-2577, merged in May. Under the new twelve-month lifecycle policy, the earliest a revision may drop them is 28 July 2027. That is four months before Annex III high-risk obligations start applying on 2 December 2027.

Three things before you call this a security regression.

1. It was never a security control. The specification says so itself: roots are "informational guidance rather than an access-control mechanism", and "the protocol does not enforce that servers stay within roots". Servers SHOULD respect the boundary. SHOULD.

2. It was not deprecated for security reasons either. The stated rationale is low adoption relative to implementation complexity — for Roots, vague semantics overlapping tool parameters and server configuration. A maintenance decision, and a defensible one.

3. The migration path is the line to read twice. Pass directories or files via tool parameters, resource URIs, or server configuration.

Tool parameters are written by the model.

So you lose nothing that was enforcing anything — except the declaration. The one machine-readable place where a client stated the intended scope of an agent's filesystem access becomes an argument composed at runtime by the thing you are trying to bound.

GDPR Article 25(2) requires that by default, only personal data necessary for each specific purpose is processed, and it names accessibility explicitly. A path the model writes is not a default. It is an outcome.

What I would do Monday:

1. Do not migrate scope into tool parameters. Migrate it into server configuration. 2. Enforce below the protocol. Give the server a filesystem it cannot leave — a container mount, a user namespace. That is a default. 3. Keep emitting roots for now, but file it as documentation, not defence. 4. Write the scope where your DPIA can cite it. A chat transcript is not a record.

The roadmap names five priority areas. Agent identity is one of them. But identity answers who is calling — not what it may reach.

Which of your agents has a boundary that survives the model changing its mind?

#AIAct #DSGVO #AgenticAI #MCP #AIcodingAgents

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

Roots — the Model Context Protocol feature by which a client tells a server which directories and files it considers relevant — was deprecated as of protocol revision 2026-07-28, under SEP-2577.
Why it mattersIt is the only protocol-level place an agent's intended filesystem scope was ever declared, and it is on its way out.
modelcontex2026deprecate · modelcontex2026roots
Sampling and Logging were deprecated in the same revision and under the same proposal, SEP-2577; the suggested migration for Logging is stderr on stdio transports or OpenTelemetry for observability.
Why it mattersThe same release moved both the scope boundary and the observability boundary out of the protocol and on to the implementer.
modelcontex2026deprecate · modelcontex2026key · github2026sep
Under the MCP feature lifecycle and deprecation policy adopted in the same revision (SEP-2596), a deprecated feature remains in the specification for a minimum of twelve months; the earliest removal for Roots, Sampling and Logging is the first revision released on or after 28 July 2027.
Why it mattersIt sets the migration window: about eleven months of grace, ending four months before the AI Act's Annex III high-risk obligations start to apply.
modelcontex2026deprecate · modelcontex2026key
The MCP specification describes roots as "informational guidance rather than an access-control mechanism" and states that "the protocol does not enforce that servers stay within roots"; respecting root boundaries is a SHOULD-level obligation on servers, not a MUST.
Why it mattersIt disposes of the obvious reading. Nothing enforceable is being removed, because nothing enforceable was ever there.
modelcontex2026roots
The stated migration path for Roots is to pass directories or files via tool parameters, resource URIs, or server configuration.
Why it mattersTool parameters are composed at runtime by the model. Two of the three replacements move the scope statement out of client configuration and into model-written text.
modelcontex2026deprecate · modelcontex2026roots
SEP-2577, merged on 15 May 2026, gives the rationale for all three deprecations as low adoption relative to implementation complexity, and for Roots specifically "vague semantics, overlaps with tool parameters and server configuration"; it describes the change as advisory only, with no wire-level protocol modification.
Why it mattersThe deprecation was a maintenance decision, not a security one. Any argument that treats it as a security regression is arguing with a claim nobody made.
github2026sep
The 2026-07-28 revision also removed protocol-level sessions and the Mcp-Session-Id header (SEP-2567) and removed the notifications/roots/list_changed notification (SEP-2575).
Why it mattersThe scope declaration lost not only its future but its change signal: there is no longer a protocol notification telling a server that the client's roots changed.
modelcontex2026key
The Model Context Protocol roadmap, last updated 22 August 2026, names five priority areas: agentic messaging primitives; HTTP-native transport unification and hardening; agent identity and enterprise-ready security; improved primitives; and improved SDK developer experience.
Why it mattersIt is the current statement of what the protocol will and will not work on, and it is what expedites SEP review.
modelcontex2026roadmap
The roadmap's Agent Identity and Enterprise-Ready Security area is scoped to DPoP, agent identity and delegation via Workload Identity Federation (SEP-1933), the Identity Assertion JWT Authorization Grant and RFC 8693 token exchange; the roadmap states that it "reflects current thinking rather than firm commitments".
Why it mattersIdentity work answers who is calling and with what delegated authority. It does not restore a declaration of which files an agent may reach.
modelcontex2026roadmap
GDPR Article 25(2) requires the controller to implement measures ensuring that "by default, only personal data which are necessary for each specific purpose of the processing are processed", and states that the obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.
Why it mattersAccessibility is named in the text. A scope expressed as a runtime argument is an outcome, not a default, and Article 25(2) is a duty about defaults.
privacyregu2016article
Regulation (EU) 2026/1744, in force since 27 July 2026, moved the Annex III high-risk obligations of the AI Act to 2 December 2027.
Why it mattersIt dates the Article 19 and Article 26(6) log duties for Annex III: the runway for deciding which logs are genuinely under your control runs to 2 December 2027.
eurlex2026regulatio

Sources

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

- Did not treat the Roots deprecation as a security regression: the specification itself calls roots informational guidance rather than access control, and SEP-2577's stated rationale is maintenance (low adoption, vague semantics), not security. - Took the deprecation and earliest-removal dates from the MCP deprecated-features registry and the Roots page itself, not from secondary coverage; the news hook is the roadmap's own "last updated" date of 22 August 2026. - Did not use artificialintelligenceact.eu's implementation timeline for the Annex III date: that page is stamped "Last updated: 1 August 2024" and still shows 2 August 2026. The 2 December 2027 date is carried from the previously verified CLAIM-2026-08-23-08 against Regulation (EU) 2026/1744. - Verified SEP identifiers individually rather than by topic: 2577 (deprecations), 2596 (lifecycle policy), 2567 (session removal), 2575 (stateless, notification removals), 2549 (list TTL). - The statement that no roadmap priority area restores a client-declared filesystem scope is presented as editorial judgement in the post, not as a verified claim.