By ByteBot
MCP just killed its session model. The 2026-07-28 specification — the biggest protocol revision since MCP launched in 2024 — removes the stateful handshake, drops session IDs, and makes every request self-contained. If you have an MCP server in production, some of your code will break. Here is exactly what changed, what stops working, and how to migrate.
The Handshake Is Dead
The old model required an initialize/notifications/initialized exchange before any real work could happen. That handshake established a session, and the Mcp-Session-Id header bound all subsequent requests to the same server instance. It was a reasonable design for a protocol still living on localhost. It was a terrible design for anything running at scale.
The official 2026-07-28 changelog removes all of it. Every request now carries protocol version, client info, and capabilities in a _meta field inline. No handshake, no session header, no server instance affinity. There is an optional server/discover call for capability negotiation upfront — but it is optional, not a prerequisite.
Servers that stored cross-call state keyed to a session ID need to rethink their approach. The new spec (SEP-2567) is explicit: servers mint opaque handles and pass them as ordinary tool arguments. State becomes opt-in and visible, not implicit and hidden in a session layer.
Server-to-Client Requests, Redesigned
Sampling, elicitation, and roots discovery used to require an open bidirectional stream — the main reason MCP servers had to maintain persistent connections. The 2026-07-28 spec replaces this with Multi Round-Trip Requests (MRTR).
When a tool call needs something from the client mid-execution — an LLM completion, user input, a roots list — the server returns an InputRequiredResult instead of completing. This result carries inputRequests (what the server needs) and an opaque requestState the client must echo back. The client re-issues the original call with inputResponses and the echoed state. Any server instance can resume. No session affinity needed.
The features developers most relied on persistent connections for — sampling, elicitation — now work over plain stateless HTTP. The operational workarounds required to deploy these in production are gone.
What Actually Breaks in Your Server
Here is the concrete list of what needs to change in an existing MCP server:
- Initialization gates — Logic that waits for the handshake to complete before processing requests. Remove it: the handshake does not exist.
- Session-keyed state — Any cross-call state keyed to
Mcp-Session-Id. Rewrite to use server-minted handles passed as tool arguments. - Sticky session configuration — Load balancer rules pinning sessions to specific instances. No longer needed.
- SSE transport dependencies — HTTP+SSE is now formally deprecated. Migrate to Streamable HTTP.
The Python SDK v2 migration guide is the most involved — maintainers describe it as a “major rework.” TypeScript, Go, and C# also have v2 releases with dedicated migration documentation. All four ship 2026-07-28 support as of release day.
What You Gain
Running a remote MCP server before 2026-07-28 meant sticky session affinity at the load balancer (which kills autoscaling), a shared session store for horizontal scale, and often deep packet inspection at the gateway to route on session IDs. The operational overhead was real and expensive.
After the update: a plain round-robin load balancer is sufficient. Mcp-Method and Mcp-Name HTTP headers let gateways route and authorize without touching the request body. Serverless deployments on Lambda, Cloudflare Workers, or Vercel Edge work without modification. AWS AgentCore Gateway, Microsoft App Service, and Google Cloud all confirmed 2026-07-28 support on release day.
Tool catalog caching (SEP-2549) is a quieter improvement with real cost impact. tools/list and prompts/list responses now carry ttlMs and cacheScope fields. Clients cache the tool catalog across reconnects, which keeps upstream LLM prompt caches stable and cuts inference costs on reconnect-heavy workloads.
The Grace Period
A v2 server answers the legacy initialize handshake alongside server/discover, so existing clients on the 2025-11-25 spec keep connecting without changes. You can upgrade servers first and migrate clients separately.
Roots, Sampling, and Logging are deprecated, not removed. The HTTP+SSE transport is deprecated. The deprecation policy guarantees a minimum 12-month window — nothing disappears before July 2027. That is a reasonable runway given the size of the change.
Per the official MCP announcement, 97 million monthly SDK downloads are in scope for this migration. The stakes of a botched rollout are real. The backward compatibility bridge and the 12-month window exist for exactly this reason. Start migrating now, while the runway is long.
