By The MCP 2026-07-28 specification dropped on July 28, and Claude added support for it in its August release notes. It’s the largest change to the Model Context Protocol since launch — and it ships three breaking changes. If you have a deployed MCP server, your to-do list just got items on it.
What Broke
The spec removes two things developers relied on and changes one error code that’s easy to miss:
1. The Initialize Handshake Is Gone (SEP-2575)
The initialize/initialized exchange that every MCP session started with has been removed entirely. The client info, protocol version, and capabilities that used to be negotiated once at the start now travel in a _meta field on every request. A new server/discover method handles capability negotiation when a client needs it up front. If your server reads from initialization state, it needs to read from _meta instead.
2. Session IDs Are Gone (SEP-2567)
The Mcp-Session-Id header is removed. There are no protocol-level sessions anymore. Any state that needs to survive across multiple requests must be explicit — return an opaque handle from one tool call and pass it into the next one. If you’re relying on shared session stores for horizontal deployments, that infrastructure requirement is now gone from the protocol layer. Remove it from your server, too.
3. Error Code Changed
Invalid parameters errors changed from -32002 to -32602. If you have hardcoded checks for -32002, they’ll silently stop matching. It’s the kind of bug that only surfaces under error conditions, which means it’ll be annoying to find in production. Fix it now.
Also deprecated in this release: Roots, Sampling, and Logging primitives. Not removed yet, but they’re on their way out.
What You Get in Return
Removing sessions isn’t just simplification — it unlocks infrastructure capabilities that weren’t possible before.
Routing headers: Every Streamable HTTP request now carries Mcp-Method and Mcp-Name headers (SEP-2243). Your gateway, rate limiter, or WAF can route and meter traffic without opening the request body. This matters for teams running MCP at scale behind reverse proxies.
Caching: List and resource read results now carry ttlMs and cacheScope (SEP-2549), modeled on HTTP Cache-Control. Clients know how long a tools/list response is valid and whether it’s safe to share across users. You no longer need a long-lived SSE stream just to avoid re-fetching the tool list on every request.
Distributed tracing: W3C Trace Context — traceparent, tracestate, baggage — is now standardized in _meta (SEP-414). A trace that starts in your host application follows a tool call through the client SDK, the MCP server, and anything the server calls downstream, showing up as one span tree in your OpenTelemetry backend. Agent debugging got meaningfully better.
OAuth 2.1: MCP servers are now formally OAuth 2.1 resource servers and must implement OAuth 2.0 Protected Resource Metadata (RFC 9728). Enterprise identity — Okta, Microsoft Entra ID — connects natively. The new Enterprise-Managed Authorization (EMA) extension lets an organization’s IdP control which MCP servers employees can access, replacing per-server consent screens with a token relay. Okta, Asana, Atlassian, Canva, and others are shipping it now.
Serverless Works Now. Really.
The headline infrastructure implication of stateless MCP: you no longer need sticky sessions or shared session stores for horizontal deployments. Any request can land on any server instance. Cloud Run, Lambda, Azure Container Apps, Cloudflare Workers — all work behind a plain round-robin load balancer with no session gymnastics required.
AWS updated AgentCore Gateway to support 2026-07-28 with a single UpdateGateway API call. Cloudflare released Agents SDK v0.20.0 with spec support. Google published a guide on scaling AI agent infrastructure with the stateless updates. The platform ecosystem moved fast on this one.
SDK Changes by Language
The official SDKs have been updated. The breaking changes are in the Python and TypeScript packages:
- Python v2:
FastMCPis renamed toMCPServer. The decorator API is unchanged. - TypeScript v2: The monolithic SDK is split into
@modelcontextprotocol/serverand@modelcontextprotocol/client. It’s now ESM-only. - Go and C# SDKs: Both updated; C# v2.0 announced on the .NET Blog.
Backward compatibility is handled: a v2 server still answers the legacy initialize handshake, so clients on the 2025-11-25 spec continue connecting without changes. Upgrading your server doesn’t strand your users.
The “Just REST” Argument
Developer reaction split between those calling this a scaling win and those saying MCP just rediscovered REST. The critics aren’t wrong — stateless, routable headers, cacheable responses, OAuth resource servers. That’s REST vocabulary.
Here’s the ByteIota take: it’s the right call regardless. MCP was designed for local stdio connections. As it scaled to remote, production, enterprise deployments, the session model became a liability. Redesigning the protocol to reflect the infrastructure reality it’s actually running on isn’t a retreat — it’s engineering judgment. If your criticism of MCP two years ago was that it was overengineered, this release vindicates you and still requires your migration work.
Prioritize the OAuth 2.1 changes first. They’re a security requirement, not an optimization. Then tackle statelessness on a scheduled timeline. The spec is finalized; the migration window is open.
