Introduction
Since its launch, the Model Context Protocol has carried a well-known structural liability for any team that tried to run it at scale: its stateful architecture required maintaining persistent sessions between client and server. Round-robin load balancing was out. Serverless was out. Edge deployments were out. Every connection had to stay pinned to the same instance. Horizontal scaling — trivial for any REST API — became a full-blown architectural problem.
The specification published on July 28, 2026 closes that chapter for good. This is the fifth revision of the protocol, and by far the most consequential since its initial release.
A Truly Stateless Protocol
The core change is architectural. MCP drops its bidirectional, session-based model in favor of a stateless request/response approach. Each request is now self-describing — it carries the protocol version and client capabilities directly in its metadata. The Mcp-Session-Id header is gone. The initialize/initialized handshake has been removed from the specification entirely.
For DevOps teams, the implications are immediate: an MCP server can now run behind any standard HTTP infrastructure — round-robin load balancers, serverless functions, edge nodes. No more sticky sessions. No more shared state across instances. Scaling out becomes as straightforward as it is for any ordinary stateless microservice.
For interactions that still require multiple back-and-forths — progressive validation, additional input collection — the spec introduces Multi Round-Trip Requests: the server signals that a response is incomplete without holding an open persistent connection, preserving full compatibility with stateless infrastructure.
An Official Extension Framework
Beyond the network architecture changes, the 2026-07-28 spec establishes an official framework for extending the protocol without modifying its core. Two extensions launch the framework. Tasks — management of long-running asynchronous workloads — graduates from experimental status to become the io.modelcontextprotocol/tasks extension, complete with polling (tasks/get) and update (tasks/update) mechanisms. MCP Apps enables user interfaces to be embedded directly within MCP workflows. A third extension, Enterprise Managed Authorization, targets deployments operating under strict identity and access requirements.
Stronger OAuth 2.0 and OIDC Alignment
On the authentication front, the spec doubles down on OAuth 2.0 and OpenID Connect. Issuer validation per RFC 9207 is now mandatory. Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents — an approach better suited to enterprise deployments integrated with identity providers such as Microsoft Entra or Okta.
All Four Tier 1 SDKs Ship Together
The TypeScript, Python, Go, and C# SDKs ship simultaneously with full support for the 2026-07-28 specification. A fifth SDK, in Rust, is available in beta. On the deprecation side, the Roots, Sampling, and Logging capabilities each receive a transition window of at least twelve months. The legacy HTTP+SSE transport also has twelve months before the new architecture fully takes over.
What to Prioritize Now
For teams running MCP servers in production, this release is a welcome breaking change — but it demands a proper audit. The session handshake is gone, SSE transport is deprecated, and several core capabilities are changing status. The twelve-month window is generous, but the time to take inventory is now, before your dependencies calcify around behaviors that are scheduled for removal.