MCP 2026-07-28 Spec: Protocol Core Goes Stateless
MCP's 2026-07-28 spec drops sessions for a stateless core, adds MRTR, cacheable list responses, and CIMD-based auth hardening.
The new 2026-07-28 release of the Model Context Protocol shifts the core from a bidirectional, stateful design to a request/response stateless model. The initialize/initialized handshake and the Mcp-Session-Id header are retired; every request now carries its own protocol version and client identity, with an optional server/discover call for clients that want capabilities up front. This lets any request land on any server instance behind a plain round-robin load balancer, with no shared session storage required.
Server-initiated calls like elicitation, sampling, and roots/list move to Multi Round-Trip Requests (MRTR), eliminating the need for held-open bidirectional streams. Requests must now include Mcp-Method and Mcp-Name headers, letting gateways route and authorize without parsing JSON bodies. List responses (tools/list, prompts/list, resources/list, resources/read) gain ttlMs and cacheScope fields for client-side caching.
On the authorization side, RFC 9207 issuer validation becomes mandatory, Dynamic Client Registration is formally deprecated in favor of Client ID Metadata Documents (CIMD), and client credentials are now bound to the issuer that minted them. Tasks moves into a dedicated extension, while Roots, Sampling, Logging, and the legacy HTTP+SSE transport enter a minimum twelve-month deprecation window. TypeScript, Python, Go, and C# SDKs already support the new spec, with Rust in beta. The changes directly address reliability and scalability concerns developers have raised as MCP adoption has scaled into production infrastructure.