Guidance, not a fence - MCP deprecates Roots and the agent's scope becomes a tool argument

The Model Context Protocol deprecated Roots in revision 2026-07-28 under SEP-2577, alongside Sampling and Logging, with a twelve-month lifecycle floor putting the earliest removal at the first revision released on or after 28 July 2027 - four months before the AI Act's Annex III high-risk obligations start to apply on 2 December 2027 under Regulation (EU) 2026/1744. The obvious reading, that a security control has been withdrawn, is wrong on the specification's own terms: roots are "informational guidance rather than an access-control mechanism" and "the protocol does not enforce that servers stay within roots", and SEP-2577's stated rationale is low adoption relative to implementation complexity, not security. What is withdrawn is the declaration - the one machine-readable place where a client stated the intended scope of an agent's filesystem access. The registry's migration path is to pass directories or files via tool parameters, resource URIs, or server configuration, and tool parameters are composed at runtime by the model. GDPR Article 25(2) requires that by default only personal data necessary for each specific purpose is processed and names accessibility explicitly; a path the model writes is an outcome, not a default. The roadmap published 22 August 2026 names five priority areas and none restores a client-declared resource scope: agent identity, its closest relative, is scoped to DPoP, Workload Identity Federation, ID-JAG and RFC 8693 token exchange, and answers who is calling rather than what may be reached. The practitioner move is to enforce below the protocol - a filesystem the server cannot leave - and to record the scope in server configuration a DPIA can cite.

Post

The new MCP roadmap landed on 22 August. Most of the reading went straight to agent identity. The part worth your attention is what is not in it.

In the 2026-07-28 specification, Roots was deprecated — how an MCP client tells a server which directories and files it may work with. Sampling and Logging went with it, under SEP-2577, merged in May. Under the new twelve-month lifecycle policy, the earliest a revision may drop them is 28 July 2027. That is four months before Annex III high-risk obligations start applying on 2 December 2027.

Three things before you call this a security regression.

  1. It was never a security control. The specification says so itself: roots are "informational guidance rather than an access-control mechanism", and "the protocol does not enforce that servers stay within roots". Servers SHOULD respect the boundary. SHOULD.

  2. It was not deprecated for security reasons either. The stated rationale is low adoption relative to implementation complexity — for Roots, vague semantics overlapping tool parameters and server configuration. A maintenance decision, and a defensible one.

  3. The migration path is the line to read twice. Pass directories or files via tool parameters, resource URIs, or server configuration.

Tool parameters are written by the model.

So you lose nothing that was enforcing anything — except the declaration. The one machine-readable place where a client stated the intended scope of an agent's filesystem access becomes an argument composed at runtime by the thing you are trying to bound.

GDPR Article 25(2) requires that by default, only personal data necessary for each specific purpose is processed, and it names accessibility explicitly. A path the model writes is not a default. It is an outcome.

What I would do Monday:

  1. Do not migrate scope into tool parameters. Migrate it into server configuration.
  2. Enforce below the protocol. Give the server a filesystem it cannot leave — a container mount, a user namespace. That is a default.
  3. Keep emitting roots for now, but file it as documentation, not defence.
  4. Write the scope where your DPIA can cite it. A chat transcript is not a record.

The roadmap names five priority areas. Agent identity is one of them. But identity answers who is calling — not what it may reach.

Which of your agents has a boundary that survives the model changing its mind?

#AIAct #DSGVO #AgenticAI #MCP #AIcodingAgents

First comment

Sources.

The MCP deprecated-features registry — Roots, Sampling and Logging, with the twelve-month window and the 28 July 2027 earliest-removal date: https://modelcontextprotocol.io/specification/2026-07-28/deprecated

The Roots specification page itself, carrying both the deprecation warning and the sentence that matters — "informational guidance rather than an access-control mechanism": https://modelcontextprotocol.io/specification/2026-07-28/client/roots

SEP-2577, the proposal that deprecated all three, with the stated rationale (low adoption relative to implementation complexity; for Roots, vague semantics): https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2577

The 2026-07-28 changelog, where the same revision also removes protocol-level sessions and notifications/roots/list_changed: https://modelcontextprotocol.io/specification/2026-07-28/changelog

The new roadmap, published 22 August 2026 — five priority areas, and its own caveat that it is "current thinking rather than firm commitments": https://modelcontextprotocol.io/development/roadmap

GDPR Article 25, data protection by design and by default: https://www.privacy-regulation.eu/en/25.htm

One point cut for length: the same revision deprecated Logging too, with the migration advice to use stderr or OpenTelemetry. If you are a deployer who will one day owe Article 26(6) logs, note that your observability stopped being something the protocol negotiates and became something you have to own. Two boundaries left the protocol in the same release — the one around what an agent may touch, and the one around what it wrote down afterwards.

Claims

Sources

Corrections

  • Did not treat the Roots deprecation as a security regression: the specification itself calls roots informational guidance rather than access control, and SEP-2577's stated rationale is maintenance (low adoption, vague semantics), not security.
  • Took the deprecation and earliest-removal dates from the MCP deprecated-features registry and the Roots page itself, not from secondary coverage; the news hook is the roadmap's own "last updated" date of 22 August 2026.
  • Did not use artificialintelligenceact.eu's implementation timeline for the Annex III date: that page is stamped "Last updated: 1 August 2024" and still shows 2 August 2026. The 2 December 2027 date is carried from the previously verified CLAIM-2026-08-23-08 against Regulation (EU) 2026/1744.
  • Verified SEP identifiers individually rather than by topic: 2577 (deprecations), 2596 (lifecycle policy), 2567 (session removal), 2575 (stateless, notification removals), 2549 (list TTL).
  • The statement that no roadmap priority area restores a client-declared filesystem scope is presented as editorial judgement in the post, not as a verified claim.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art is generated, and the brand ident is a generated video interpolated between two frames of this same render. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.