MCP Ships the 2026-07-28 Specification: A Stateless Protocol Core With No Session Handshake

The Model Context Protocol released its 2026-07-28 specification on July 28, replacing 2025-11-25. The headline change is a stateless protocol core: the initialize handshake and the Mcp-Session-Id header are gone, servers can no longer initiate requests to clients, and interactive steps move to multi round-trip requests. Remote MCP servers no longer need sticky sessions, but session-dependent implementations have to migrate.

Stateless: Every Request Carries Its Own Identity and Capabilities

The specification was published by lead maintainers David Soria Parra and Den Delimarsky. It was locked as a release candidate on May 21 and validated for ten weeks before being finalized. The core change turns MCP from a stateful bidirectional protocol into a request/response model: the initialize / initialized handshake and the transport-level Mcp-Session-Id header are both removed, and protocol version, client identity and capabilities now travel in _meta on every request. A new server/discover call lets clients check what a server supports up front.

Interaction, Routing and Caching All Work Differently

Server-initiated requests disappear along with the session. Multi round-trip requests (MRTR) take their place: when a call needs confirmation or a missing parameter, the server returns resultType: "input_required" and the client retries with inputResponses. HTTP requests now carry Mcp-Method and Mcp-Name headers, so gateways and rate limiters can route and meter without parsing the JSON body. List results from tools/list, resources/read and similar calls now include ttlMs and cacheScope so clients can cache them. On the authorization side, RFC 9207 issuer validation is required, and Dynamic Client Registration (DCR) is formally deprecated in favor of CIMD.

What It Means for Servers You Run Yourself

For operators the upside is clear: remote MCP servers no longer need sticky sessions or shared session storage, so they can sit behind a plain round-robin load balancer and fit more easily into serverless and edge deployments. The cost is that this release contains breaking changes — anything that relies on session identifiers has to be reworked. Roots, Sampling, Logging and the legacy HTTP+SSE transport enter deprecation, and under the new feature lifecycle policy at least twelve months must pass between deprecation and the earliest possible removal. Tasks and MCP Apps move into a versioned extensions framework. Tier 1 SDKs for TypeScript, Python, Go and C# already support the new version, with the Rust SDK in beta. Anthropic says support will roll out across Claude products, without giving a timeline.

via: Official Model Context Protocol Blog (2026-07-28; verified 2026-07-29)