The Model Context Protocol published its 2026-07-28 specification on July 28, locking in a release candidate that had been open for comment since May 21. It's the most significant revision to the agent-tooling standard since MCP launched, replacing the protocol's original stateful handshake with a stateless request/response core built for production-scale deployment.

From sticky sessions to stateless requests

Previous MCP versions required an initialize/initialized handshake and a persistent Mcp-Session-Id, meaning a client's requests had to keep landing on the same server instance. The new core drops both: any MCP request can now land on any server instance behind a standard load balancer, with no shared session store to maintain. In place of server-initiated requests over an open stream, the spec introduces Multi Round-Trip Requests, letting a server ask a client for missing input or confirmation mid-call without holding a connection open. Method and tool names also move into HTTP headers, so gateways can route and authorize calls without parsing request bodies, and list responses now carry ttlMs and cache-scope hints to cut redundant catalog re-fetching.

Tasks and MCP Apps become formal extensions

Two capabilities that shipped experimentally in the prior 2025-11-25 spec now graduate into independently versioned extensions with reverse-DNS identifiers. Tasks moves into io.modelcontextprotocol/tasks, replacing its old experimental lifecycle with a poll-based model built around tasks/get, tasks/update and tasks/cancel — the MCP team has flagged that anyone who built against the 2025-11-25 experimental Tasks API will need to migrate. MCP Apps lets servers ship server-rendered interactive interfaces — charts, forms, and similar widgets — that hosts render inside sandboxed iframes while keeping a JSON-RPC audit trail. On the authorization side, six proposals tighten alignment with OAuth 2.0 and OpenID Connect, including RFC 9207 issuer validation, and formally deprecate Dynamic Client Registration in favor of Client ID Metadata Documents.

Why it matters for agent builders

MCP has become a default way for AI agents to call external tools and data sources, so a spec change of this size ripples through every framework and hosted agent platform built on it. The stateless core is squarely aimed at teams running MCP servers in production, where session affinity and connection limits have been operational pain points; the new deprecation policy, which guarantees at least 12 months between marking a feature deprecated and removing it, is meant to make future migrations less disruptive than this one. TypeScript, Python, Go and C# SDKs already support the new spec, with a Rust SDK in beta.