By The MCP specification just received its biggest overhaul since launch. On May 21, the release candidate for the next version — designated 2026-07-28 — was locked. The headline: sessions are gone, and any request can now land on any server instance. The final spec publishes July 28. If you’re running a production MCP server, you have ten weeks to migrate.
Sessions Are Gone — Both of Them
Two SEPs do the heavy lifting here. SEP-2575 removes the initialize/initialized handshake that every MCP connection previously required. SEP-2567 removes the Mcp-Session-Id header and the protocol-level session along with it.
What replaces them: protocol version, client info, and capabilities now travel in _meta on every request. A new server/discover method handles capability negotiation when a client needs it. Every request is self-contained. Any server instance can handle any request. You can run your MCP server behind a plain round-robin load balancer, and it just works.
This sounds like a simplification — it is — but it’s also a breaking change. The stateful handshake had become load-balancer poison: routing required body inspection, sticky sessions blocked autoscaling, and a server restart blew up every active session. The new design aligns with how production HTTP is actually deployed.
What Breaks in Your Current Setup
Audit your servers before July. The migration requirements are real:
- Session-pinned state: Any server storing state in memory tied to a session ID needs to externalize that state or switch to explicit handles. Implicit session scope is gone.
- Old Tasks API: If you shipped anything against the experimental Tasks API from the 2025-11-25 spec, that API is removed. The replacement is the new Tasks extension — the migration is non-optional.
- Load balancer config: Remove sticky session rules. The Streamable HTTP transport now requires
Mcp-MethodandMcp-Nameheaders on every request, so gateways can route on operation type without parsing the body. - Initialization-dependent code: Anything relying on capability exchange at connection time needs to shift to
server/discoveror per-request_meta.
State Doesn’t Disappear — It Gets Explicit
Removing sessions doesn’t mean removing state. It means state has to be intentional. Servers that need to carry context across multiple calls return an explicit handle from a tool. The model carries that handle and passes it back as an ordinary argument on subsequent calls. State is visible, auditable, and no longer an invisible side effect of session scope.
This is a design improvement. Implicit session state was a footgun — it worked locally but became a reliability problem at scale. Explicit handles make the dependency clear and let any server instance pick up where another left off.
New Features: Tasks Extension and MCP Apps
The RC also ships two new extensions under the Extensions framework, which lets new capabilities stabilize as opt-in additions before graduating to the core spec.
The Tasks extension replaces the removed experimental Tasks API with a cleaner lifecycle. A server answers tools/call with a task handle instead of blocking. The client drives execution via tasks/get, tasks/update, and tasks/cancel. Task states are predictable: working, input_required, completed, failed, cancelled. Task creation stays server-directed — the server decides when a call should become a task.
MCP Apps lets servers return interactive HTML interfaces that hosts render in a sandboxed iframe. Claude Desktop, ChatGPT, VS Code Copilot, and Cursor all support it. Communication between the UI and the host runs over JSON-RPC via postMessage. Tools declare their UI templates ahead of time so hosts can prefetch, cache, and security-review them before anything executes.
Three Deprecations, One Safety Net
Roots, Sampling, and Logging are deprecated in this release — but they still work. The new deprecation policy (SEP-2596) guarantees a minimum 12 months between deprecation and the earliest possible removal. All three remain callable until at least July 28, 2027.
The replacements: tool parameters or resource URIs for Roots, direct LLM API integration for Sampling, and stderr or OpenTelemetry for Logging. You have time to plan. Start now rather than scrambling when the removal window opens.
MCP Is Growing Up
MCP crossed 97 million installs in March 2026. It now ships seven official language SDKs and supports more than 10,000 community servers. The stateless RC is the clearest signal yet that the protocol is being hardened for the infrastructure it’s actually running on — not just prototyped against.
The question for every developer building on MCP right now: does your server assume a session? If the answer is yes, July 28 is your deadline.
