--- type: "article" title: "API Governance needs Memory; Understanding the Impact of the Recent MCP Spec Updates - API Developer Weekly" summary: "API Governance needs Memory; Understanding the Impact of the Recent MCP Spec Updates" newsletter: "API Developer Weekly" newsletter_handle: "api-developer-weekly" newsletter_url: "https://usecommune.com/n/api-developer-weekly" author: "James Higginbotham (@jhigginbotham)" published: "2026-07-23T18:00:00.000Z" canonical_url: "https://usecommune.com/n/api-developer-weekly/a/api-governance-needs-memory-understanding-the-impact-of-the" markdown_url: "https://usecommune.com/n/api-developer-weekly/a/api-governance-needs-memory-understanding-the-impact-of-the.md" chat_url: "https://usecommune.com/n/api-developer-weekly/a/api-governance-needs-memory-understanding-the-impact-of-the/chat" source_url: "https://mailchi.mp/d65abfc1c468/key-takeaways-from-platform-summit-2024-api-developer-weekly-2680163" body_source: "imported" likes: 2 replies: 0 body_words: 831 --- # API Governance needs Memory; Understanding the Impact of the Recent MCP Spec Updates - API Developer Weekly ![](https://mcusercontent.com/5005148108dfbac726f74e31e/images/04b6c7bf-305e-b933-367e-a79a24d334d5.png) ![](https://mcusercontent.com/5005148108dfbac726f74e31e/images/9dff09fa-af28-ed1e-7fa6-a6589b89e5e1.png) # API Developer Weekly # July 23, 2026 - Issue #579 *This week we examine why API governance needs memory rather than decisions that are lost once they are made, MCP spec changes, and Kin Lane takes a look at what API sprawl looks like from the APIs.io index. We also have some API security articles of note, from avoiding bearer tokens being treated like house keys, the recent uptick in malicious authenticated API traffic, and avoiding**privilege drift**. Finally, we look at MCP context problems, MCP observability, and zero standing privilege.* *-- Happy Reading!* # Featured Articles [API Governance needs Memory](https://adorsys.com/en/techradar/api-governance-needs-memory/) API governance fails without memory. Discover how shifting from one-time linting to persistent tracking turns rigid compliance into proactive developer enablement and better API quality. by adorsys \[adorsys.com\] [MCP Spec Change: Understanding Its Impact](https://barndoor.ai/mcp-spec-change-july-2026/) MCP's July 2026 spec drops session IDs and DCR. Here's what's changing, what it signals, and how to get ahead of it before servers migrate. by Neil Mansilla \[barndoor.ai\] [What API Sprawl Looks Like From the Index](https://apis.io/2026/07/14/what-api-sprawl-looks-like-from-the-index/) Search and discover APIs by what you want to accomplish. Find API providers, individual APIs, and schemas across the APIs.io network. \[apis.io\] [Stop Using Bearer Tokens Like House Keys](https://www.innoq.com/en/blog/2026/06/stop-using-bearer-tokens-like-house-keys/) You've built an API. You protected it with OAuth 2.0. You're using JWTs. You feel secure. You're not. \[innoq.com\] [5 Signs That Authenticated API Traffic Is Actually Malicious](https://nordicapis.com/5-signs-that-authenticated-api-traffic-is-actually-malicious/) Learn five signs that authenticated API traffic may be malicious, from unusual access patterns to error rates and bulk actions. by J Simpson \[nordicapis.com\] [How to Improve API Observability for AI Agents](https://nordicapis.com/how-to-improve-api-observability-for-ai-agents/) Learn how API providers can improve observability for AI agent traffic, MCP workflows, tool usage, and risk monitoring. by Kristopher Sandoval \[nordicapis.com\] [The MCP debate has a context problem](https://thenewstack.io/mcp-enterprise-agent-governance/) Skeptics dismiss MCP as too complex, but enterprise AI agents require its structural governance and security controls to scale safely. by Amanda Rueda \[thenewstack.io\] [How to Manage Privilege Drift in Multi-Agent Systems](https://nordicapis.com/how-to-manage-privilege-drift-in-multi-agent-systems/) Learn how privilege drift affects multi-agent systems and how to manage AI agent permissions with least privilege and JIT access. by Janet Wagner \[nordicapis.com\] [6 Tools for MCP Observability](https://nordicapis.com/6-tools-for-mcp-observability/) Explore six MCP observability tools for monitoring AI agents, tool calls, telemetry, and MCP server interactions. by Kristopher Sandoval \[nordicapis.com\] [What Is Zero Standing Privilege?](https://curity.io/blog/what-is-zero-standing-privilege/) Zero standing privilege removes long-lived permissions entirely, granting identities temporary, task-specific access only at the moment of execution. Learn how it works, why it matters for agentic AI, and how it differs from least privilege and JIT access. \[curity.io\] [APIs weren't built for LLMs. MCP is.](https://www.youtube.com/watch?v=I3b69W59pkA&%3Bis=Oce2vUPI9so3G92L) APIs were built for apps. MCP was built for AI agents. Learn how the Model Context Protocol (MCP) helps Agents in Copilot discover tools, connect to external systems, and take action more effectively than traditional APIs. 🚀 Want to build your own Microsoft 365 Copilot extensions? by Microsoft 365 Developer \[youtube.com\] [Patch now: WordPress REST API bug allows remote code execution](https://www.csoonline.com/article/4198791/patch-now-wordpress-rest-api-bug-allows-remote-code-execution.html) The flaw affects WordPress Core's REST Batch API, allowing unauthenticated attackers to execute code on vulnerable sites. \[csoonline.com\] [There's now an API for mainlining Trump's Truth Social posts](https://www.engadget.com/2217943/there-s-now-an-api-for-mainlining-trump-s-truth-social-posts/) The API is supposed to deliver posts from 'the highest-ranking Truth Social accounts.' \[engadget.com\] *** # From CRUD to Intent-based APIs [![](https://mcusercontent.com/5005148108dfbac726f74e31e/images/eabc10b3-73f2-8132-5cbb-e49ca4862260.png)](https://launchany.com/integrating-enterprise-systems-with-ai-and-apis-report/)Learn intent-based patterns that let LLMs execute real work using the backend systems and APIs you already have. Explore why your current REST APIs break down when LLMs try to use them — and the specific design shift that fixes it. Finally, learn more about the patterns and practices that will help your team prepare your APIs for real-world AI use. [Learn more and download the full report](https://launchany.com/integrating-enterprise-systems-with-ai-and-apis-report/). *** # Business of APIs [Who Owns the Business Meaning of Your APIs?](https://pronovix.com/articles/who-owns-business-meaning-your-apis) Organizations know what they mean. The difficulty is that they are much better at carrying that meaning internally than publishing it externally. \[pronovix.com\] # (Un)Related [From Agile to Agentic: The Blueprint for an Autonomous SDLC - Cybersecurity Magazine](https://cybersecurity-magazine.com/from-agile-to-agentic-the-blueprint-for-an-autonomous-sdlc/) The world of software development is undergoing its most profound transformation since the Agile Manifesto. For the past decade, we have lived in a human-led, AI-assisted paradigm - developers write code while copilots help accelerate productivity. by Parminder Kocher \[cybersecurity-magazine.com\] [The Errand: What Sending a Kid to the Shop Teaches Us About Agentic Delegation](https://dasith.me/2026/06/10/the-errand-agentic-delegation/) A story about what it really takes to send someone to do a job for you, and why that turns out to be a genuinely hard problem we're now being forced to solve because of AI agents. Prefer to click through it? There's an interactive presentation of this post that walks through the same story slide by slide. by Dasith Wijesiriwardena \[dasith.me\] ### Have something to share? As always, if you want to chat, share a link, or make a suggestion, feel free to drop us a quick note or tagging us on X/Twitter ([@launchany](https://x.com/launchany) and [@caseysoftware](https://x.com/caseysoftware)) or by emailing us at: [james@launchany.com](mailto:james@launchany.com). [![Twitter](https://cdn-images.mailchimp.com/icons/social-block-v2/outline-light-twitter-48.png)](https://www.twitter.com/launchany) [![LinkedInlinkedin.com/in/jameshigginbotham/](https://cdn-images.mailchimp.com/icons/social-block-v2/outline-light-linkedin-48.png)](http://www.linkedin.com) [![Website](https://cdn-images.mailchimp.com/icons/social-block-v2/outline-light-link-48.png)](https://launchany.com) Want to change how you receive these emails? You can [update your preferences](https://launchany.us2.list-manage.com/profile?u=5005148108dfbac726f74e31e&id=239e48d26e&e=[UNIQID]&c=0f09d63ab1) or [unsubscribe from this list](https://launchany.us2.list-manage.com/unsubscribe?u=5005148108dfbac726f74e31e&id=239e48d26e&t=b&e=[UNIQID]&c=0f09d63ab1). *** ## Discussion No replies yet.