MCP's 2026-07-28 Spec Goes Stateless and Drops Sessions

MCP Threw Out Its Own Handshake

The 28 July revision removes the initialize handshake and the session header, deprecates HTTP+SSE and lets any request land on any server instance. It is the largest change since the protocol launched.

The Model Context Protocol shipped revision 2026-07-28 on Tuesday, its fifth and by some distance its most disruptive. The protocol that began as a bidirectional stateful connection is now a stateless request/response core. The initialize/initialized handshake is retired and the Mcp-Session-Id header is gone.

Why remove sessions

Because sessions pinned traffic to a machine. Each request now self-describes its protocol version, client identity and capabilities in _meta, and a new mandatory server/discover call lets clients ask what a server supports up front. The blog's own summary is the clearest statement of intent: "Any request can now land on any server instance behind a plain round-robin load balancer without needing shared storage." Legacy HTTP+SSE transport is deprecated with a twelve-month offramp.

The authorisation changes

Four hardening moves, none of which replace OAuth: RFC 9207 issuer validation before a code is redeemed, an application_type field in dynamic client registration that fixes localhost redirects for desktop and CLI apps, credentials bound to the issuer that minted them, and dynamic client registration itself deprecated in favour of Client ID Metadata Documents.

Extensions grow up

A versioned extensions framework graduated Tasks out of experimental core into io.modelcontextprotocol/tasks, with poll-based durable handles, alongside MCP Apps for inline interactive UI, Skills over MCP and Enterprise-Managed Authorization. Anthropic published a same-day post bringing the revision to Claude — inline app UI, enterprise-managed authentication through Entra and Okta, an observability dashboard for published connectors, and MCP Tunnels as a research preview — citing more than 950 connectors in its directory.

The scale it is designing for

MCP now reports close to half a billion downloads a month across its Tier 1 SDKs, with the TypeScript and Python packages each past a billion cumulative. Hosted at the Linux Foundation's Agentic AI Foundation, it lists contributions from AWS, Anthropic, Cloudflare, Figma, Google Cloud, Microsoft, Netlify, Linear and Sentry.

Why It Matters

A stateful protocol forces every MCP server to be a stateful service — the exact thing serverless and edge platforms are built to avoid. Making requests self-describing is unglamorous plumbing that decides whether agent tooling can run anywhere or only on machines someone keeps warm.