Monday

The Model Context Protocol spec goes final on Monday. Not a release candidate. Not a draft. The largest revision since the protocol launched — stateless core, OAuth 2.1, load-balancer-native routing, a formal deprecation policy — becomes the thing enterprise procurement teams point at when they say yes.

For People Inc engineering, this changes the question. Before Monday, not having an MCP server was the default. After Monday, it's a decision.

What Ships

Three changes matter for a publisher with 40+ brands running on Fastly and Cloudflare.

The Header Problem

The detail that should keep a People Inc architect up at night is the new per-request headers. MCP-Method and MCP-Name are designed so load balancers and middleware can route requests without parsing the JSON body. This is a CDN feature, not a protocol feature.

Cloudflare and Fastly — both People Inc CDN providers — already operate at this layer. Cloudflare's Workers can inspect custom headers and route at the edge with zero origin round-trips. Fastly's VCL does the same. After Monday, the question isn't whether your CDN can route MCP. It's whether you've given it anything to route to.

The cost inversion works like this: CDN-native MCP routing means edge nodes handle MCP discovery and routing at the infrastructure layer. The engineering ticket to enable MCP routing — once the CDN supports it — is trivial. The engineering ticket to ensure you're excluded from default MCP discovery is the one that requires justification.

Cloudflare's Shadow MCP detection rules already exist. They detect unauthorized MCP servers, not authorize new ones. The governance default has flipped: the system assumes participation and flags absence.

What D/Cipher Can't See

D/Cipher reads content. It builds intent signals from what people read on People Inc properties. That model depends on sessions — a user visits, reads, signals intent, and D/Cipher maps that intent to an ad opportunity.

MCP doesn't have sessions. As of Monday, sessions are formally removed from the protocol. An agentic buyer doesn't visit your site, read your content, and signal intent. It sends a request — stateless, authenticated, routed at the edge — asking whether your inventory matches a need. The response travels back the same way. No session. No visit. No signal for D/Cipher to read.

D/Cipher+ expanded the model from content signals to managed service. But managed service is human-mediated. It scales linearly: more clients, more people. The AAMP 3.0 reference implementation scales logarithmically: more agents, same infrastructure. Adform committed to AAMP on July 8. The sell-side ecosystem isn't waiting.

The Engineering Decision

A basic MCP server that exposes People Inc ad inventory to agentic buyers costs $200-400K to build. At a $48.30 deal price, that rounds to zero in the enterprise math. At the current stock price (~$46.75, 96.8% of bid), the market is pricing the deal, not operations. Nobody is evaluating whether People Inc's ad infrastructure will be addressable by the buying systems being built right now.

But deals fall through. And if this one does, the company that emerges needs to compete in an ad market where:

• Every walled garden — Meta, Google, Amazon, TikTok — runs MCP ad servers
• PubMatic's Decision Fabric runs 2.7T bids/day with AI models learning from transactions D/Cipher never sees
• The MCP spec is enterprise-hardened with OAuth 2.1, and your own CDNs route it natively
• AAMP 3.0 has a running reference implementation that any SSP can fork

Monday doesn't create the gap. The gap has been building for months — I've written 54 posts tracking it. What Monday does is remove the last ambient excuse. The spec was in draft. The auth wasn't enterprise-grade. The protocol was session-bound. Those were real technical objections. After Monday, they're gone.

The question for People Inc engineering on Tuesday morning: what's the objection now?