MCP 2026-07-28: Sessions Gone — What Breaks and What to Do

The Model Context Protocol killed its own session model ten days ago. The 2026-07-28 specification drops the initialize handshake, eliminates Mcp-Session-Id, and marks Sampling, Roots, and Logging deprecated — on a 12-month removal clock. Anthropic’s protocol lead David Soria Parra called it “the most substantial changes we have made to the specification, probably since adding authorization.” If you run an MCP server today, this is not optional reading.

What Actually Changed

The original MCP design was honest about its origins: a protocol for developers using local coding tools. That made sense in 2024. It does not make sense in 2026, when 78% of enterprise AI teams have MCP-backed agents in production and 97 million SDK downloads happen every month. The stateful model broke load balancing, made serverless painful, and required shared session storage that every ops team quietly hated.

The 2026-07-28 spec fixes this by making every request self-contained. Protocol version, client identity, and capabilities now travel in the _meta field and via HTTP headers on every request. The old flow:

client → initialize
server → Mcp-Session-Id: xyz123
client → tools/call + Mcp-Session-Id: xyz123  (tied to that pod forever)

The new flow:

POST /mcp HTTP/1.1
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: search

Any server instance handles that request. No sticky routing. No session store. A standard round-robin load balancer works immediately. The official spec post has the full breakdown.

What You Actually Gain

The “breaking changes” framing is accurate but incomplete. Here is what the new model unlocks:

• Serverless and edge deployments — Cloud Run, Lambda, Vercel can now host MCP servers. Spin-to-zero is viable. Pod restarts no longer kill sessions because there are no sessions.
• Simpler infrastructure — Redis session stores, sticky routing rules, and connection affinity configuration all go away. Real operational cost eliminated.
• Faster deployments — Rolling updates no longer require draining connections. Deploy, route new requests to new pods, done.
• Better fault tolerance — A crashed instance no longer orphans a client connection mid-session.

Craig McLuckie, CEO of Stacklok, put it plainly: the stateful design “was a by-product of its origin as a way to support developers using coding tools that tend to run locally.” The protocol outgrew its origins. This update is the correction. Google’s engineering blog covers the scaling implications in detail.

Three Features Deprecated: Understand the Replacements First

The deprecations are where developers will make mistakes if they move too fast.

Sampling — server-initiated model completions — is the one worth pausing on. The replacement is Multi Round-Trip Requests (MRTR). Instead of the server reaching out to the model, the server returns an InputRequiredResult with a requestState blob. The client collects user input and retries. Because requestState is stateless, any server instance handles the retry. A deletion confirmation under MRTR:

// Server pauses, requests confirmation
{
  "resultType": "input_required",
  "inputRequests": {
    "confirmation": {"type": "elicitation", "message": "Delete 3 files?"}
  },
  "requestState": "opaque-blob-here"
}

// Client sends user answer — any instance picks it up
{
  "inputResponses": {"confirmation": true},
  "requestState": "opaque-blob-here"
}

Roots — filesystem/workspace boundaries — is labeled “very niche” in the spec itself. If you do not know you are using it, you probably are not. Logging moves to stderr, stdio, or OpenTelemetry, which is where it should have been anyway. All three have 12-month removal windows. Understand MRTR before removing Sampling.

Migration: Where to Start This Week

If you have a production MCP server, this is the right sequence:

1. Inventory session dependencies. Run rg 'Mcp-Session-Id|initialize|initialized' across your codebase. That output is your migration scope.
2. Pin the beta SDK in a branch. Python: pip install mcp==2.0.0b1. TypeScript: npx @modelcontextprotocol/codemod@beta v1-to-v2 — the codemod handles package restructuring automatically.
3. Move application state to explicit handles. Tools should return an identifier (e.g., "browser_id": "browser_7f32") that subsequent calls reference. The model sees handles and can reason about them. Hidden session state is opaque to it.
4. Make mutation tools idempotent. Without session affinity, retry scenarios become more common. Use transaction IDs or deduplication records.
5. Implement header validation. Confirm Mcp-Method and Mcp-Name headers match the JSON-RPC body on every request. Skipping this is a security gap.
6. Test with a real load balancer. Spin two instances behind round-robin, run a multi-step tool flow, confirm continuity. This is the integration test that matters.

The TypeScript SDK was restructured into focused packages: @modelcontextprotocol/server, @modelcontextprotocol/client, and adapters for Node, Express, Hono, and Fastify. The Python SDK answers both protocol revisions from a single endpoint, giving you a backward-compatible transition window. Full migration docs are in the SDK beta announcement.

The Timeline

The spec published July 28. Tier 1 SDKs — TypeScript, Python, Go, and C# — shipped 2026-07-28 support simultaneously. Deprecated features run on a 12-month clock: Sampling, Roots, and Logging remain functional until at least July 2027. Legacy and new protocol versions can coexist if your server implements dual-era support.

But “can coexist” is not a migration strategy. Triage now, prototype on the beta SDK, and get production-ready before this becomes a fire drill. The TypeScript SDK migration guide and the official spec are the right starting points.