Think inside your AI world.

An authorization change, against a login you already built

An authorization change is announced for every server at once, but you only have one auth implementation, and it is the one you already shipped. The question that matters is whether your login still stands under the new shape — and the announcement cannot answer it, because it does not know how you built yours.

Read the MCP 2026-07-28 specification through Unl and its authorization changes arrive measured against the login you already built — so instead of reading the whole auth section against a general worry, you get a verdict on whether your specific implementation still holds under the new shape, and where it does not. The verdict, not the reassurance.

What the MCP 2026-07-28 specification carries

The 2026-07-28 revision moves authorization closer to the standards most deployments already run:

  • Authorization aligned more closely with OAuth and OpenID Connect deployments
  • A cleaner separation between the protocol and the identity layer around it
  • Patterns that assume standard token flows rather than protocol-specific handling
  • No line in the spec that knows which of these your existing login depends on

The line the feed can't hold

Say you already built OAuth against the current MCP auth shape, and you settled a line for what a change to it means to you: tell me only when an auth change touches a flow my login actually depends on — the redirect handling, the token exchange, the client registration I implemented — not every clause in the section. That dependency map is yours; the spec does not hold it.

The reason the line is yours is that only your implementation knows which auth flows it leans on. The revision can align the protocol with OAuth and OpenID Connect in general; it cannot know that your login builds its redirect from a request header, or that a registration default you relied on has moved, or that a clause everyone else must act on is one you already satisfy.

The frame judges the data it is given; it does not verify the source’s accuracy.

The one that crosses

So the measured read crosses where the section-wide notice does not: this authorization change touches a flow your login actually depends on, so it is worth checking against your implementation now; the rest of the section aligns things you already do the standard way and needs nothing from you. Same specification; a verdict against the auth you shipped instead of a worry against everyone’s.

You didn't ask — it was already there

You did not read the whole auth section on alert. The criterion — interrupt me only for an auth change my login depends on — was already settled, so the reading arrives in the window the next time you are in that code: the changes that land on your flows, with the reason each one crosses, and the ones you can pass over because you already do them the standard way. You map your dependency once; the read applies it every revision.

The answer comes back measured against what you already decided, and why.

The lane is live and open to this tool today: one box, paste anything. If it speaks MCP, Unl can reach it. Readings arrive unprompted, the data beside the criterion; Unl is a courier, not a warehouse, and keeps only your keys and the frame.

Questions people ask

Will the 2026-07-28 auth changes break my existing login?

The direction of the change is towards standard OAuth and OpenID Connect, so a login already built the standard way is more likely to be aligned than broken. But ‘more likely’ is a statement about servers in general, and you have a specific one. A measured read is what turns the general direction into a verdict against your implementation: which flows you depend on are affected, and which clauses you already satisfy.

How is this different from an auth migration guide?

A migration guide is written for the average server and lists every step someone might need. The measured read joins the public specification to your criterion — the auth flows your login actually depends on — and returns the changes that cross that line, so you act on the two that touch you rather than reading twenty that do not. The guide is the firehose; the read is the verdict.

Does Unl touch my auth server or my users’ credentials?

No. Unl reads the public specification and returns a verdict measured against your criterion; it never reaches into your auth server, and it holds no credentials of your users. Your dependency criterion lives in Unl, the specification is a public source, and the read joins them and changes neither.

What this is

Think inside your AI world — you stay in command

Unlimitless (Unl to friends) holds what you've settled, reads what your tools are showing, and catches what's changed out in the world — and hands your AI whatever bears on the work, the moment it's needed, without you asking. The right thing, in front of the model, unprompted, with you in command of the call. So you keep moving toward what you set out to build, on top of everything you've already decided.

It plugs into Claude, Claude Code, ChatGPT and Cursor as an MCP connector. Quick to connect, in a couple of steps.

Unlimitless is open now to invited Alpha. Apply for the Beta waitlist to come in ahead of the full launch:

Alpha is invite-only · free at launch.