The MCP specification dated July 28, 2026 retires protocol-level initialization and session identifiers, making requests self-describing and removing the protocol’s requirement for session affinity. It also adds explicit HTTP routing headers, a retry-based way to request missing input or confirmation, cache metadata, and authorization changes. For production teams, the main work is to remove handshake and sticky-session assumptions, preserve the new headers through gateways, and make application state and authorization boundaries explicit.
What changed in the 2026-07-28 MCP specification?
The MCP maintainers’ July 28, 2026 announcement describes a change to the protocol lifecycle, not a guarantee that every application built on MCP is stateless. Each request now carries its protocol version, client identity, and capabilities in _meta; the initialize/initialized exchange and Mcp-Session-Id are retired. Clients may use server/discover to learn server capabilities before making calls, but discovery is optional.
| Area | Change in the July 28 revision | Production implication |
|---|---|---|
| Protocol lifecycle | Requests carry protocol context in _meta; initialization and protocol session identifiers are retired. Optional server/discover can expose capabilities. |
Requests no longer need to return to a server instance holding protocol-session state. Application workflow state still needs an explicit design. |
| Streamable HTTP | Mcp-Method and Mcp-Name are required routing headers. |
Gateways can route and apply policy using headers, provided they preserve and validate them against the request body. |
| Interactive calls | Multi Round-Trip Requests (MRTR) allow a response to request input, followed by a retry containing inputResponses. |
Confirmation and missing-input flows can work without relying on a held-open bidirectional stream. |
| Cache metadata | Responses for selected list/read methods include ttlMs and cacheScope; list ordering is deterministic. |
Clients and servers need an intentional freshness and sharing policy rather than assuming that results are safely cacheable. |
| Authorization and extensions | OAuth issuer validation, issuer-bound credentials, and a move from DCR toward CIMD are specified; Tasks move to an extension. | Review identity boundaries and extension use alongside the wire-protocol migration. |
The release announcement identifies David Soria Parra and Den Delimarsky as lead maintainers. It says the Tier 1 TypeScript, Python, Go, and C# SDKs speak this revision, while Rust support is in beta. That is release-level availability information, not a guarantee that a particular version of every SDK or downstream client already supports every feature.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do I migrate an MCP server to the new stateless protocol?
Start by finding protocol-session assumptions, then separate them from application state. The July revision removes protocol-level initialization and identifiers; it does not remove the need to preserve a long-running job, conversation, or other workflow across calls.
- Inventory lifecycle dependencies. Search server, client, and deployment configuration for handshake sequencing,
Mcp-Session-Id, session stores, reconnect logic, and sticky routing. Identify which dependencies implement MCP protocol behavior and which hold application data. - Update the request path for the target SDK revision. Remove retired initialization/session handling and ensure requests carry their protocol version, client identity, and capabilities in
_meta. Check the chosen language SDK’s migration guidance and wire codec for the exact revision rather than assuming compatibility from a package name or another SDK’s behavior. - Make durable application state explicit. For work that spans calls, create an application-level handle, persist the associated state in an appropriate store, and pass the handle in subsequent tool arguments. Do not treat the absence of MCP session IDs as proof that workflow state can be discarded.
- Exercise requests across instances. Send successive calls for the same workflow to different server instances. Verify that each instance can interpret the request and that required application state can be recovered through the explicit handle. This tests the new routing model without assuming protocol-session affinity.
- Test interrupted and retried operations. Check reconnects, client retries, and any call that may pause for user input. Verify that a retry neither loses its correlation to the original operation nor repeats a side effect prematurely.
The maintainers say requests can reach any instance behind a plain round-robin load balancer without shared protocol-session storage. That removes a protocol-level affinity requirement; it does not establish that a particular service, database, or workflow is safe to distribute without its own state and failure-handling design.
Does MCP still use sessions?
Not as protocol sessions in the July 28, 2026 revision: the initialization exchange and Mcp-Session-Id are retired. An application can still maintain state between calls, but should represent that state explicitly—for example, with a durable workflow handle passed as a tool argument—rather than relying on an implicit protocol session or a particular server process.
Optional server/discover is a way to obtain capabilities; it is not a replacement handshake that recreates session affinity. Likewise, an application’s own handle and persistence rules are application design choices, not session features supplied by MCP.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How should I route MCP requests through an API gateway?
Use the Streamable HTTP routing headers required by the revision, and treat consistency between headers and the JSON-RPC request body as part of request validation. The TypeScript SDK support guide says its modern path checks standard headers including MCP-Protocol-Version, Mcp-Method, and applicable Mcp-Name values against the body; missing or inconsistent values can be rejected. This is TypeScript SDK behavior and should not be assumed to describe every language implementation.
- Preserve the headers. Configure proxies, ingress controllers, and gateways not to strip, rename, or normalize the routing headers in a way that changes their values.
- Route on validated values. The headers enable routing, rate limiting, and authorization without first parsing a JSON body, but validate them against that body before trusting them as the request’s meaning.
- Keep custom clients aligned. Construct
Mcp-Methodand applicableMcp-Namevalues consistently with the JSON-RPC envelope. Exercise missing, malformed, and mismatched-header cases; rejection behavior can otherwise appear as an unexplained gateway or client failure. - Remove protocol-session affinity only after migration. The new protocol no longer requires sticky routing for its own session state. Do not remove affinity that an application independently needs until its application-state design has been checked.
How should MRTR handle confirmations and missing input?
MRTR changes an interaction that might previously have depended on a server-initiated request over a held-open bidirectional stream into a request-and-retry flow. A server can return resultType: "input_required" with the requests it needs answered. The client gathers those answers and retries the original call with inputResponses. The release gives confirmation and missing-input interactions as use cases.
- The client makes the original call.
- If the server needs user input, it returns the input-required result and the requests the client must answer.
- The client obtains the answers, including any required user confirmation.
- The client retries the original call with
inputResponses.
Design the operation so it can distinguish the initial request from its answer-bearing retry. As an operational safeguard, defer irreversible side effects until the required input has been received, and make retry handling safe against duplicate execution. Those safeguards are implementation guidance derived from the documented retry flow, not a claim that the protocol itself makes an operation idempotent.
What do the new cache fields mean for clients and servers?
The revision adds ttlMs and cacheScope to responses from tools/list, prompts/list, resources/list, and resources/read. The announcement also says list ordering is deterministic. In the TypeScript SDK’s 2026 support, both cache fields are emitted with defaults of ttlMs: 0 and cacheScope: 'private'. Those defaults are specific to that SDK; they should not be generalized to other implementations.
Recommended Free Tools
- Choose a nonzero lifetime only when the result can safely remain unchanged for that period.
- Choose a sharing scope based on whether the data is appropriate to share across users or contexts; a private scope is the TypeScript SDK’s stated default, not a universal policy.
- Test expiration and invalidation from the client’s perspective, particularly when resource contents, tool availability, or user permissions change.
What should I change in authorization?
The release calls out several authorization requirements and migration directions for remote deployments. These affect how clients establish trust in an authorization server and how credentials are scoped; changing the MCP wire revision alone does not prove that the client, SDK, or authorization server enforces them.
- Validate the issuer. Authorization servers should return the OAuth
issparameter defined by RFC 9207. Clients must validate it before redeeming an authorization code. - Bind credentials to their issuer. Treat client credentials as belonging to the authorization server that issued them; do not reuse them across authorization servers.
- Plan for CIMD, not an immediate DCR removal. The specification formally deprecates Dynamic Client Registration (DCR) in favor of Client ID Metadata Documents (CIMD), while retaining DCR for backward compatibility and stating that it is slated for removal in a future specification version. Confirm actual CIMD support in the authorization server and client stack before relying on it.
- Include
application_typewhere DCR is used. The release calls for this field to avoid desktop and CLI localhost redirect URI handling problems. - Check SDK security defaults. The TypeScript support page says several security controls are SDK-level opt-ins. Review that SDK’s migration guidance and configure required controls deliberately; do not assume that selecting the 2026 wire revision enables them automatically.
What changed for Tasks, notifications, and deprecated features?
Tasks and change notifications
Tasks leave the experimental core and move to the io.modelcontextprotocol/tasks extension. The release describes tasks/get and tasks/update in a poll-based lifecycle. Change notifications move to subscriptions/listen, which clients opt into by notification type. Implementations of the earlier experimental Tasks API should review their lifecycle and notification handling against the extension rather than assuming the experimental interface carries forward unchanged.
Deprecated capabilities and transport
Roots, Sampling, and Logging are marked deprecated; the announcement says they continue to work for at least twelve months and advises new implementations not to adopt them. Legacy HTTP+SSE is also deprecated with a year-long offramp. Deprecation is not immediate removal: check the current specification and release timeline before setting a removal deadline, and avoid building new dependencies on features the release has marked deprecated.
Should we upgrade now or remain temporarily on our current revision?
There is no compatibility matrix or comparative reliability study in the official materials cited here. The choice is a deployment assessment, not a universal recommendation. Remaining on a currently supported revision can provide time to resolve dependencies; moving to 2026-07-28 adopts the new request model and its migration work.
| Decision factor | Remain temporarily on the current supported revision | Migrate to 2026-07-28 |
|---|---|---|
| SDK support | Confirm the existing client and server SDKs still support the revision you run. | Confirm target-revision support in both SDKs; release availability differs by language, and Rust support is described as beta. |
| Infrastructure | Keep existing routing behavior while it is needed by the current protocol. | Remove assumptions tied to protocol session IDs or handshake affinity, while retaining any independently required application-state routing. |
| Gateway | Continue validating the headers and request format required by the revision in use. | Preserve and validate the new routing headers, including consistency with the request body. |
| Authorization | Review existing issuer and credential handling against the current authorization-server behavior. | Verify issuer validation, issuer-bound credentials, DCR requirements where applicable, and real CIMD support. |
| Tasks and deprecated features | Identify any dependence on experimental Tasks or deprecated capabilities before changing versions. | Plan Tasks extension changes and avoid adopting features marked deprecated; schedule removals against the published timeline. |
Use the selected language SDK’s version-specific migration guide and conformance information to resolve implementation details. The TypeScript support guide is useful evidence for TypeScript behavior, not a substitute for the guide for Python, Go, C#, Rust, or a custom implementation.
What is roadmap work rather than part of the July release?
The official roadmap dated August 22, 2026 lists five priorities: agentic messaging primitives; HTTP-native transport unification and hardening; agent identity and enterprise-ready security; improved primitives; and improved SDK developer experience. It discusses server-initiated events, agent identity and delegation, result handling, and progressive discovery as work in progress or future direction. These are roadmap items, not features to attribute to the July 28 specification.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
