MCP goes stateless in two weeks, its biggest break with its own past
No more handshake, no more session header, no more sticky sessions. The protocol that won the agent-tool war is rebuilding itself for load balancers before its rivals finish organizing.
- The final MCP specification version 2026-07-28 ships July 28, the largest revision since the protocol launched, per the official MCP blog.
- Headline change: the protocol goes stateless, eliminating the initialize handshake and session header so remote servers no longer need sticky sessions; new Mcp-Method and Mcp-Name headers let gateways route without deep packet inspection.
- Extensions become first-class with formal governance, six SEPs align authorization with OAuth 2.0 and OpenID Connect, and Roots, Sampling, and Logging are deprecated under a new twelve-month policy.
The protocol that quietly won the agent-tool war is about to rebuild its foundations in public. The final MCP specification version 2026-07-28 lands July 28, and the maintainers describe it as the largest revision since MCP launched, per the release candidate announcement from David Soria Parra and Den Delimarsky. Beta SDKs shipped June 29, giving maintainers a validation runway before the cutover.
What stateless actually buys
The marquee change strips MCP of its session machinery: the initialize handshake and the session ID header are gone, so a remote MCP server no longer needs sticky sessions or a shared session store. As the maintainers put it, a server that previously needed all of that "can now run behind a plain round-robin load balancer." New Mcp-Method and Mcp-Name headers on each request let gateways, load balancers, and rate limiters route on the operation without deep packet inspection, and clients can cache tool lists per server. Extensions become first-class with formal governance, launching with MCP Apps for server-rendered UI and Tasks for long-running operations, while six SEPs align authorization with OAuth 2.0 and OpenID Connect. Three original capabilities, Roots, Sampling, and Logging, are deprecated under a new policy guaranteeing at least twelve months before removal.
Infrastructure moves win standards fights
The redesign reads like a direct answer to how MCP is actually deployed now: behind enterprise gateways, at cloud scale, inside certified catalogs, by more than 10,000 public servers. It also lands two weeks after the enterprise software bloc lined up behind a rival discovery standard. That fight will not be settled by press releases; it gets settled by which protocol is easiest to run behind a load balancer at scale, and MCP just spent its biggest revision on exactly that question. Statelessness is not a feature, it is a campaign move.