By ByteBot
The Model Context Protocol shipped its biggest revision since launch on July 28, 2026, and it is a breaking change. The stateless spec removes the session handshake, kills session IDs, mandates two new HTTP headers on every request, and deprecates three features that a lot of existing servers depend on. If you run an MCP server, this affects you now.
The Two Changes That Break Things
The headline architectural shift: MCP moves from a stateful, session-based protocol to a stateless request/response model. That sounds abstract until you see what it removes.
First, the initialize/initialized handshake is gone (SEP-2575). That two-step exchange where client and server traded protocol versions and capabilities at connection setup? Removed. Protocol version, client identity, and capabilities now ride in a _meta field on every individual request. If you have logic that depends on that handshake completing before you serve requests, rewrite it.
Second, Mcp-Session-Id is gone (SEP-2567). No more session headers, no more sticky sessions, no more pinning a client to a specific server instance. Any request can now land on any server behind a plain round-robin load balancer. For servers that maintained per-session state, you need explicit, server-minted handles passed as tool arguments instead.
On the request side, two new headers are now mandatory on all Streamable HTTP requests (SEP-2243): Mcp-Method and Mcp-Name. A tool call looks like this in practice:
Mcp-Method: tools/call
Mcp-Name: searchThis lets gateways, WAFs, and rate limiters route and meter MCP traffic without parsing JSON bodies. It is a real operational improvement, and it is now required.
The Payoff: MCP Becomes Normal HTTP
Here is the thing critics calling this “just REST now” are missing: operational simplicity is not a downgrade. It is the whole point.
Before this spec, running a remote MCP server at scale meant sticky sessions, shared session stores, and infrastructure complexity that had nothing to do with your actual server logic. Cloudflare put it plainly when they shipped day-zero support: “Servers now run in a single Worker with no sticky sessions, open streams, or Durable Objects needed.” Google updated their AI agent infrastructure the same day. The ecosystem moved fast because the old model was genuinely painful to operate.
Stateless MCP scales horizontally on standard HTTP infrastructure. Serverless is viable, edge deployment works, and hosting costs drop when you stop paying for session management overhead.
What Was Added
The spec is not only subtractive. Two new patterns fill the gaps left by removing long-lived connections.
Multi Round-Trip Requests (MRTR) handle situations where a server needs more information before completing a request. Instead of holding a connection open, the server returns “I need X,” and the client sends X in the next request. No streaming required. This is a clean fit for AI agent workflows that need clarification mid-task.
Tasks are the solution for genuinely long-running work. The server returns a durable handle, the client polls for completion. This replaces the old pattern of holding SSE connections open for minutes at a time, and it makes edge deployment practical for agent backends.
List responses also gained caching support. tools/list, prompts/list, resources/list, and resources/read now carry ttlMs and cacheScope with deterministic ordering, reducing redundant round-trips for clients that frequently poll server capabilities.
The Deprecation Clock: Roots, Sampling, and Logging
Three features are deprecated in this release via SEP-2577: Roots (filesystem boundary advertising), Sampling (server-initiated model calls via the client), and Logging (protocol-level log notifications). They are not removed — the spec guarantees a minimum 12-month grace period, putting the earliest removal date at July 28, 2027.
The replacements: use tool parameters instead of Roots, call your LLM provider API directly instead of Sampling, and use stderr or OpenTelemetry for logging. If you are starting a new MCP server today, do not adopt any of these three features.
Auth Is No Longer Optional
The 2026-07-28 spec formally makes MCP servers OAuth 2.1 resource servers. PKCE is required for all authorization code flows (S256 only). The implicit grant and Resource Owner Password Credentials grant are gone. Bearer tokens cannot travel in query strings. Refresh tokens must be sender-constrained or one-time-use. Your server must emit WWW-Authenticate on every 401 response.
The spec authors’s advice: replace custom auth code with the official SDK auth helpers, which implement all of these requirements correctly. Rolling your own OAuth 2.1 is not recommended.
What to Do Now
Update your MCP SDK. Strip session management. Add the required Mcp-Method and Mcp-Name headers. Move capabilities to _meta on requests. Audit your auth layer against OAuth 2.1 requirements. Keep a legacy path running while your clients catch up, then remove it once conformance tests pass.
The full spec announcement has the complete changelog and SDK upgrade notes. Cloudflare, Google, and Microsoft were ready on day zero. The Tier 1 SDKs all ship the new spec. The community is moving — this is not a spec you can wait out.
