MCP’s enterprise gate is auth, not the protocol

You can tell a protocol is becoming real infrastructure not by its feature count but by where it blocks enterprises. In 2026, MCP is blocked at the authorization layer and the reliability layer, not the protocol itself. The Enterprise-Managed Authorisation extension went stable in July and moved “who can connect” into the identity provider — but “what an agent may do once connected” is still every organization’s own problem. And a 100-server production test put the ecosystem’s quality on the table: median pass rate 71%, worst category 47%. Being able to connect is not the same as being able to do the job.

What changed: EMA goes stable, connection auth moves into the IdP

On July 6, 2026, InfoQ reported that the MCP team promoted the Enterprise-Managed Authorisation extension to stable status: organizations control access to MCP servers centrally through their identity provider, and users sign in once to reach organization-approved servers — replacing per-server consent prompts. The flow uses the Identity Assertion JWT Authorisation Grant (ID-JAG), exchanged for an access token by the server’s authorization server. The launch announcement says Anthropic, Microsoft and Okta have adopted it; Claude/Claude Code/Cowork and VS Code support it on the client side, with Asana, Atlassian, Canva, Figma, Linear and Supabase listed among supporting servers (vendor and official statements; sources at the end).

The backdrop is that adoption has crossed the early phase: Anthropic donated MCP to the Linux Foundation’s Agentic AI Foundation in December 2025, citing 10K+ active public servers and 97M+ monthly SDK downloads; Stacklok’s 2026 software report puts 41% of surveyed software organizations in limited or broad production. One cautionary note: the widely circulated “78% enterprise production adoption” figure could not be traced to a source and was removed by Digital Applied’s verification. In ecosystem scale, trust only the numbers you can trace.

The 100-server test: the ecosystem is bimodal

Scale is one thing; quality is another. Between February and April 2026, Digital Applied ran the first ecosystem-level reliability study of MCP: 100 production servers, 12 task families, roughly 12,000 trials. Median pass rate 71%; top decile 95% or better; bottom decile just 38%. Servers do not cluster “mostly fine” — they split into a works group and a does-not-work group. The largest single failure class (38%) was schema mismatch — request/response failing validation against the server’s declared schema, the most preventable kind. Latency tails diverge just as sharply: P50 320ms, P95 1,840ms, P99 6,200ms. By category, file-system tools lead at 89% median; browser-automation tools are worst at 47%.

For agent systems this is a multiplication problem: five tools at 71% pass each succeed end-to-end only ~18% of the time. The weakest server in the chain sets the water level for the whole chain. And popularity does not proxy reliability — the most-starred server in the sample ranked 41st by pass rate. Select on pass rate and tail latency, not stars.

Our judgment: two control planes, two gates

“Who can connect” is an identity problem, and EMA putting it in the IdP is the right move: one sign-in, organization-level approval, zero-touch — it frees security teams from per-server consent prompts. But the official announcement draws the boundary clearly: EMA does not provide runtime authorization for individual actions; it does not inspect traffic after the token is issued. Connection-level authorization decides who may connect which client to which server; action-level authorization decides whether a specific action an agent takes after connecting is permitted. The former is the protocol’s job. The latter is always the organization’s job.

This separation is the default design in our own architecture: tool onboarding (skill registration, red-card review of third-party skills) and action execution (an action queue as the cross-unit bus, decision logs, unit-level authorization) are two independent control planes. A connection approval never substitutes for an action gate — a tool being approved for integration does not mean an agent may call it without limits. Enterprises adopting MCP should build gates the same way, instead of waiting for “the protocol to mature.”

One counter-intuitive point worth flagging: the more successful MCP standardization becomes, the more important server admission becomes. Lower integration cost means low-quality servers can slip into production more easily. The four reliability gates — typed schema, idempotency, explicit cancellation, quotas — are what every top-decile server in the test shared and what bottom-decile servers almost never had. That is the shortest evidence-backed checklist the ecosystem has produced so far.

Playbook: four moves for enterprises adopting MCP

Act: answer one architecture question first

Decision question for digital transformation leads: if “who can connect” goes to the IdP and “what an agent may do” stays with you — where is your action-level gate today? Teams without an answer should keep MCP pilots limited to read/write-separated, reversible tools while building action-level audit, then scale. The day the protocol stops being the bottleneck is the day these two gates decide how far you get.

References: InfoQ “AI Model Context Protocol Adds Centralised Auth for Enterprise” (Jul 6, 2026) https://www.infoq.com/news/2026/07/mcp-ema-enterprise-auth/ · MCP Blog “Enterprise-Managed Authorisation” (official announcement) https://blog.modelcontextprotocol.io/posts/enterprise-managed-auth/ · Digital Applied “100 MCP Servers Stress-Tested: Reliability Findings” (Apr 26, 2026, independent measurement) https://www.digitalapplied.com/blog/mcp-server-reliability-100-server-stress-test-study · Digital Applied “MCP Adoption Statistics 2026” (verified May 24, 2026) https://www.digitalapplied.com/blog/mcp-adoption-statistics-2026-model-context-protocol · Stacklok “State of MCP in Software 2026” (survey) https://stacklok.com/wp-content/uploads/2026/01/State-of-MCP-in-Software-2026_FINAL.pdf · Anthropic “Donating MCP to the Agentic AI Foundation” (Dec 2025, vendor-reported) https://www.anthropic.com/news/donating-the-model-context-protocol-and-establishing-of-the-agentic-ai-foundation