MCP 2026-07-28 Spec: Protocol Shifts to Stateless Core

Introduction

The Agentic AI Foundation, which maintains the Model Context Protocol (MCP) under the Linux Foundation, published a new specification dated July 28, 2026. The official release notes describe it as the largest revision of the protocol's architecture since MCP's launch. The update changes the transport layer, the authorization model, and the extension system that governs how MCP servers and clients exchange capabilities.

MCP defines how AI agents and applications connect to external tools, data sources, and services through a standardized interface. Because the protocol underpins production integrations across multiple SDKs and vendors, changes to its core request model affect anyone who builds or operates an MCP server or client. This review examines what changed in the 2026-07-28 specification, what it means for developers maintaining existing implementations, and how the update is likely to affect deployment patterns going forward.

Feature Overview

From Stateful Sessions to a Stateless Core

The most consequential change is architectural. Previous MCP versions operated on a bidirectional, stateful connection model. Clients and servers performed an initialize/initialized handshake at the start of a session, and the server tracked that session using an Mcp-Session-Id header for the life of the connection.

The 2026-07-28 specification removes that handshake entirely. Every request is now self-contained: it independently carries its own protocol version, client identity, and capability declarations. Neither side needs to retain state about the other between calls. The practical effect, according to the release notes, is that MCP servers no longer require session affinity and can be deployed behind plain round-robin load balancers without shared session storage, an improvement for production deployment and scaling.

Multi Round-Trip Requests (MRTR)

The old protocol supported server-initiated requests, which required a client to keep a stream open so the server could ask follow-up questions mid-task. The 2026-07-28 spec replaces this with Multi Round-Trip Requests (MRTR). Instead of holding a connection open, a server can respond to a request with a resultType of "input_required," describing what additional information it needs. The client then issues a new request containing an inputResponses field with the requested answers. This turns a previously stream-dependent interaction into a sequence of independent request/response exchanges, consistent with the new stateless core.

Header-Based Routing

HTTP requests must now include Mcp-Method and Mcp-Name headers. This lets API gateways, proxies, and firewalls route and meter MCP traffic by inspecting headers rather than parsing the JSON body of every request, a change relevant to anyone operating MCP traffic at scale behind standard web infrastructure.

Cacheable List and Read Results

tools/list, prompts/list, resources/list, and resources/read responses now accept ttlMs and cacheScope parameters, giving servers a standard way to signal how long a client or intermediary may cache a given result, instead of leaving caching behavior undefined.

Authorization Hardening

The specification tightens the authorization model in three ways: it adopts RFC 9207 OAuth issuer validation, replaces Dynamic Client Registration with Client ID Metadata Documents, and moves to issuer-bound credentials.

Tasks Extension and a Formal Extensions Framework

The previously experimental Tasks extension is now a formal part of the spec, with a poll-based tasks/get method and a new tasks/update method for asynchronous work. This sits inside a newly formalized Extensions Framework, which also structures MCP Apps and Enterprise Managed Authorization as extensions rather than ad hoc additions.

SDK Support and Deprecation Timeline

Usability Analysis

For teams maintaining MCP servers or clients, the practical work centers on migration rather than new feature adoption. Removing the initialize/initialized handshake and the Mcp-Session-Id header means any implementation that assumed a persistent session, whether for authentication context, in-memory state, or connection-scoped caching, needs to be reworked to treat each request independently. Teams running MCP servers behind sticky-session load balancing gain the option to simplify to round-robin routing, but only after their session-dependent logic is removed.

Adopting MRTR requires replacing server-initiated request handling with the input_required / inputResponses pattern, which changes how multi-step tool interactions, such as confirmations or clarifying questions, are implemented on both sides of a connection.

Header-based routing (Mcp-Method, Mcp-Name) is a lower-effort change for most implementers, since it is additive to the HTTP request rather than a replacement for existing JSON fields. The authorization changes are more involved for anyone relying on Dynamic Client Registration, since Client ID Metadata Documents represent a different registration flow that needs new server-side and client-side handling.

Tier-1 SDK support across TypeScript, Python, Go, and C# means most production stacks have an official implementation to build against immediately. Rust is currently beta-only, so Rust-based servers and clients should expect the SDK to still be in flux relative to the other four languages.

Pros and Cons

Pros

• The stateless request model removes the need for session storage, simplifying horizontal scaling behind standard round-robin load balancers.
• Header-based routing lets infrastructure teams meter and route MCP traffic at the gateway layer without parsing JSON bodies.
• Cacheable list/read responses (ttlMs, cacheScope) give servers explicit, standardized control over caching behavior.
• Authorization hardening, including RFC 9207 issuer validation and Client ID Metadata Documents, closes gaps in the prior OAuth flow.
• A defined 12-month deprecation window gives maintainers a planned runway instead of an abrupt cutover.

Cons

• Removing the session handshake and Mcp-Session-Id header is a breaking change for existing stateful implementations; migration is required, not optional, for full compliance.
• Deprecating Roots, Sampling, Logging, and the legacy HTTP+SSE transport creates real migration work for maintainers who built on those features, even with the 12-month window.
• Rust SDK support is beta-only at launch, leaving Rust-based implementations behind the four tier-1 languages.
• Adopting MRTR requires rewriting existing server-initiated request handling around the new input_required / inputResponses pattern rather than a drop-in swap.

Outlook

Because MCP is maintained by the Agentic AI Foundation under the Linux Foundation, the specification itself sets direction, but actual adoption depends on SDK maintainers and vendors implementing it. Tier-1 SDK coverage across TypeScript, Python, Go, and C# suggests the major client and server ecosystems can begin migration work now, with Rust following once its SDK exits beta.

Anthropic has confirmed that Claude is expanding support for this spec version, which is one signal of ecosystem movement toward the new architecture. That single data point does not by itself indicate how quickly the broader MCP server ecosystem, including third-party integrations, will complete migration within the 12-month deprecation window.

The deprecation clock on Roots, Sampling, Logging, and the legacy HTTP+SSE transport will likely be the practical driver of adoption timing. Server and client maintainers who depend on those features will need to plan migration work before the window closes.

Conclusion

The 2026-07-28 MCP specification changes how servers and clients communicate at a structural level: it replaces a stateful session model with stateless request/response exchanges, adds Multi Round-Trip Requests in place of held-open server-initiated streams, and formalizes caching, authorization, and extension mechanisms. For developers and organizations operating MCP servers or clients in production, this release is primarily a migration project. It simplifies scaling and tightens authorization, but it also requires reworking any code built around the old session and streaming assumptions. Given the 12-month deprecation window, teams should treat this as a planned migration rather than an immediate hard cutover, prioritized according to how much of their implementation depends on the deprecated Roots, Sampling, Logging, and HTTP+SSE transport features.

Editor's Verdict

MCP 2026-07-28 Spec: Protocol Shifts to Stateless Core earns a solid recommendation within the open source space.

The strongest case for paying attention is stateless core simplifies horizontal scaling by removing the need for session-affinity load balancing or shared session storage, which raises the bar for what readers should now expect from peers in this space. Reinforcing that, header-based routing (Mcp-Method, Mcp-Name) enables traffic management at the infrastructure layer without JSON parsing adds practical value rather than just headline appeal. The broader signal worth registering is straightforward: the shift to a stateless request/response core removes the initialize/initialized handshake and Mcp-Session-Id header, letting MCP servers scale behind standard round-robin load balancers without shared session storage. On the other side of the ledger, removing the session handshake and Mcp-Session-Id header is a breaking change for existing stateful implementations, requiring migration rather than being optional is a real constraint, not a marketing footnote, and it should factor into any serious decision. Layered on top of that, deprecating Roots, Sampling, Logging, and the legacy HTTP+SSE transport creates real migration work for maintainers who built on those features narrows the set of teams for whom this is an obvious yes.

For developers building locally, infrastructure engineers, and anyone preferring transparent, modifiable software, this is a serious evaluation candidate, not just a curiosity to bookmark. For everyone else, the safer posture is to monitor coverage and revisit once the use cases that matter to your team are demonstrated in the wild.