MCP 2026-07-28 spec removes sessions, adds OAuth hardening; ships July 28 with breaking changes
The Model Context Protocol's largest revision since launch drops as final specification on July 28, 2026. MCP 2026-07-28 removes the session model that powered the 2025-11-25 spec: no more Mcp-Session-Id headers, no initialize/initialized handshake, no sticky-session load-balancer routing. Protocol version, client capabilities, and metadata now travel in a _meta field on every request, making every request self-contained. A remote MCP server can now run behind a plain round-robin load balancer instead of requiring sticky sessions and shared session stores.
Six Specification Enhancement Proposals (SEPs) work together to deliver a stateless core, an Extensions framework (MCP Apps for server-rendered UIs, Tasks extension for long-running work), hardened OAuth 2.0/OIDC-aligned authorization, and a formal deprecation policy. Three features are deprecated, not removed: Roots, Sampling, and Logging have a minimum 12-month grace period before removal. The 10-week validation window between release candidate (locked May 21) and final spec (July 28) is for SDK maintainers and production servers to test against real workloads.
Architects running remote MCP servers need to migrate off session affinity before July 28. The stateless model is a major operability win — no more Redis session stores, no more layer-7 packet inspection. However, the breaking changes are real: servers using Sampling (allowing tool calls to request LLM inference directly) must plan migration paths, and Roots-based file system declarations are being phased out. The spec now covers 10,000+ public servers and 97 million monthly SDK downloads. OpenAI, Google, Microsoft, and AWS have all integrated MCP into their agent stacks.