Image: Model Context Protocol / modelcontextprotocol.io MCP Goes Stateless: The 2026-07-28 Spec Ships
The Model Context Protocol's most significant update since its remote launch drops a stateless protocol core, Multi Round-Trip Requests, header-based routing, and a formal extensions framework — with all four Tier 1 SDKs updated on day one.
The Model Context Protocol hit a milestone on July 28: the 2026-07-28 specification is now final, and the team is calling it the most important release since remote MCP launched over a year ago.
The headline change is a stateless protocol core. MCP started as a bidirectional, session-based protocol. The new spec turns it into request/response. Every request is now self-contained, so any request can land on any server instance behind a plain round-robin load balancer — no shared session store, no sticky sessions, no deep-packet inspection at the gateway.
That single change unlocks a lot. MCP servers can now run on serverless and edge infrastructure without the operational complexity that stateful connections demand. David Soria Parra, lead maintainer and co-inventor of MCP, put it plainly in the release post: “The newly added extensions showcase the continuous innovation of the wider open source project. I am excited to see what people will do with the new capabilities of MCP.”
What changed
Stateless core, explicit handles. The initialize/initialized handshake and Mcp-Session-Id header are retired. If a server needs state across calls, the spec now formalizes an explicit-handle pattern: a tool returns an identifier and the model threads it back as an argument on subsequent calls. This makes multi-step reasoning more transparent — the model can see the handle and reason about it.
Multi Round-Trip Requests (MRTR). This replaces the old server-initiated sampling and elicitation flows that required held-open bidirectional streams. When a tool needs something from the user mid-call — a confirmation, a missing parameter — the server returns resultType: "input_required" with the requests it needs answered, and the client retries with the answers attached. It lets stateless servers still prompt users mid-execution.
Header-based routing. Streamable HTTP requests now carry Mcp-Method and Mcp-Name headers, so gateways, rate limiters, and WAFs can route and meter on those headers without parsing JSON bodies.
Cacheable list results. Responses from tools/list, prompts/list, and resources/list now carry ttlMs and cacheScope hints, letting clients cache tool catalogs and keep upstream prompt caches stable across reconnects.
Extensions framework. Tasks, MCP Apps, and Enterprise Managed Authorization (EMA) are now formal extensions rather than experimental additions. The Tasks extension moves to a poll-based tasks/get and a new tasks/update — contributed by AWS.
Authorization hardening. Authorization servers must return the iss parameter per RFC 9207, and clients must validate it before redeeming a code. Dynamic Client Registration (DCR) is now formally deprecated in favor of Client ID Metadata Documents (CIMD), with a twelve-month minimum deprecation window.
Ecosystem support out of the gate
The spec shipped with endorsements from a wide range of infrastructure providers. AWS says AgentCore Gateway supports the spec from day zero. Cloudflare’s Agents SDK lets developers run MCP servers in Workers without managing transport-session overhead. Google Cloud, Microsoft Foundry, Netlify, Figma, Supabase, and Honeycomb all signed on with day-one support.
Honeycomb shared a concrete data point worth noting: nearly 20% of all their monthly interactive queries are now made by agents. That adoption backdrop is why the stateless redesign matters — the tooling is being used in production at scale, and the old session model was friction.
Anthropic noted it will bring the 2026-07-28 spec support to Claude shortly after the release. The MCP blog post has migration notes covering the breaking changes, and all four Tier 1 SDKs (TypeScript, Python, Go, C#) speak the new spec as of today, with a Rust beta available.
What’s deprecated
Three features are now deprecated with a twelve-month offramp: Roots, Sampling, and Logging. The legacy HTTP+SSE transport is also formally deprecated. None of these stop working immediately — the policy guarantees at least twelve months before removal.
The spec’s full changelog and updated documentation are live.