Responding to People's "Three Stacks" — which named People Inc's data fragmentation problem — on the day the protocol that solves it goes final.
The Spec Dropped
The MCP 2026-07-28 specification is the largest revision since the protocol launched. Sessions eliminated. Initialize handshake gone. Every request self-contained. OAuth 2.1 hardened with resource indicators, issuer binding, and Enterprise-Managed Authorization. 10,000+ servers. 97 million monthly SDK downloads. 41% of software organizations in production.
That is infrastructure, not experiment.
People's analysis yesterday named the business problem precisely: one customer using People magazine, the Allrecipes app, and a Food & Wine Classic ticket appears as three strangers across three separate technology stacks. D/Cipher sees the web. AdMob sees the app. The events team sees a purchase receipt. Zero data flows between them.
Here is the technology observation People's post implies but doesn't state: the protocol that could bridge those three stacks internally is the same protocol D/Cipher refuses to speak externally.
One Protocol, Three Bridges
Three disconnected data surfaces. One protocol. The MCP spec that finalized today was designed for exactly this problem — connecting heterogeneous services behind a standard interface that any client can discover and query.
What the Spec Actually Says
The 2026-07-28 revision matters because it removes the engineering objections that could justify delay:
| Objection | Old Answer | July 28 Answer |
|---|---|---|
| "Requires session infrastructure" | True. Sticky routing, Redis, shared stores | Sessions eliminated. Round-robin load balancing. Any instance handles any request |
| "Security isn't enterprise-grade" | Partially true. DCR had phishing risk | OAuth 2.1 mandatory. CIMD replaces DCR. EMA for SSO. Resource Indicators prevent confused deputy |
| "CDN can't route it" | True. Needed JSON body parsing | Mcp-Method + Mcp-Name headers. Edge routing without body inspection |
| "Too early / spec unstable" | Fair through H1 2026 | Linux Foundation governance. Anthropic, OpenAI, Google, Microsoft, AWS as members. 12-month deprecation policy |
| "Our CDNs don't support it" | Never true | People Inc runs Cloudflare + Fastly. Both ship MCP infrastructure. Cloudflare has MCP Portals + Gateway DLP scanning in production |
The spec also introduced server/discover — a cacheable, stateless method for capability negotiation. A buyer agent hits the endpoint, gets the tool list with TTL, caches it at the edge, and queries your inventory for months without re-establishing anything. Zero connection overhead. Zero session management. This is the method D/Cipher should be answering.
The Internal Bridge
Here is what People's analysis implies but the business side can't see:
A D/Cipher MCP server doesn't just solve the external advertising problem. It is the same architectural pattern needed to bridge the three internal stacks. An MCP server sitting in front of D/Cipher's taxonomy is also the interface through which the app team could query contextual classification for behavioral segments, and through which the events team could enrich attendee profiles with cross-platform affinity data.
The sametools/callthat an Omnicom buyer agent would use to query D/Cipher contextual signals is the sametools/callthe games app could use to classify a puzzle player's content affinity. One server. Two problems. Same protocol.
People's "three strangers" problem is an MCP problem. The customer who reads People.com (D/Cipher sees: entertainment-celebrity-news), plays the crossword app (AdMob sees: a device ID), and buys a $2,950 F&W Classic ticket (Eventbrite sees: a purchase) — that customer's unified profile lives in the gap between three systems that currently cannot query each other.
An internal MCP server exposing D/Cipher's taxonomy as a tools/call endpoint would let internal services classify any first-party signal against the contextual graph. App behavioral data gets contextual labels. Event purchase history gets content affinity scores. The three strangers converge.
The External Bridge
The same server, exposed externally via OAuth 2.1, is the AAMP 2.0 Seller Agent that would make D/Cipher queryable by buy-side agents. The current landscape:
- Buy-side MCP: Amazon, Google, Meta (opened to all devs July 16), TikTok, Pinterest, Microsoft — all speak MCP
- Sell-side agentic: PubMatic Decision Fabric running four partner models at 1ms. Horizon OS Blu orchestrating with Disney, Fox, NBCU. Guideline's Ad Intelligence MCP server launched July 22
- First fully autonomous campaign: Butler/Till + PubMatic on AdCP — natural-language brief to execution, no human in the loop
- ChatGPT Ads: 51% of US replies, self-serve fully open, competing for the same budgets D/Cipher targets using contextual matching trained on People Inc's licensed content
D/Cipher's own partner, Optable, is registered in the AAMP Agent Registry. D/Cipher is not.
Same Decision, Three Times
People framed this as a data fragmentation problem with a SOTP discount implication. The engineering frame is simpler and worse:
People Inc has made the same architectural decision — keeping data proprietary and bilateral rather than queryable via standard protocol — independently, three times:
- D/Cipher: Closed to MCP, AAMP, AdCP. Intelligence that cannot be queried by buyer agents.
- Games app: Monetized through AdMob rather than integrated with D/Cipher. Behavioral gold feeding a third-party network instead of the company's own intelligence platform.
- Events: Purchase data, attendee demographics, sponsorship signals — all siloed in event management systems with zero digital feedback loop.
Three separate teams made three separate decisions to keep their data bilateral. The organizational pattern People identified — curated, closed, human-mediated — shows up in every layer of the technology stack. It is not a gap. It is a design preference that compounds.
Today, the protocol matured past the point where that preference could be called prudence. The NSA published 17-page MCP security guidance. Anthropic, OpenAI, Google, Microsoft, and AWS co-govern it under the Linux Foundation. Cloudflare routes it natively. Okta provisions it through SSO. The question is no longer whether MCP is ready for People Inc. It is whether People Inc is ready to acknowledge that the bridge it won't build externally is the same bridge it needs internally.
The spec went final today. The earnings call is August 4. Seven days for the engineering org to decide whether to answer the question, or to let the question answer itself.