The Model Context Protocol (MCP) published its final 2026-07-28 specification on July 28, 2026 — the largest revision of the protocol since its launch — delivering a stateless core that removes sticky sessions, two official extensions for async agent work and server-rendered UIs, and hardened OAuth 2.0-aligned authorization. Businesses running AI agents via MCP-connected tools face breaking changes in error codes and deprecated features, but gain dramatically simpler infrastructure requirements.
What Changed: Stateless Core Replaces Session Model
MCP’s previous specification (2025-11-25) required every AI client to open a session with an initialize handshake, receive an Mcp-Session-Id, and maintain a sticky connection to the same server instance. The 2026-07-28 spec removes that model entirely.
Per the official MCP blog, a remote MCP server that previously needed sticky sessions, a shared session store, and deep packet inspection at the gateway “can now run behind a plain round-robin load balancer, route traffic on an Mcp-Method header, and let clients cache tools/list responses for as long as the server’s ttlMs permits.” The practical result: teams running AI agents at scale face substantially lower infrastructure costs because any request can now go to any server instance, like regular HTTP.
Two new required headers replace the session mechanism: MCP-Protocol-Version and Mcp-Method must appear on every request (SEP-2243).
Two Official Extensions: Tasks and MCP Apps
The 2026-07-28 spec ships with two official extensions that address longstanding gaps for business AI workflows.
Tasks (SEP-2663) provides a standardized way to handle long-running agent work. A server can respond to a tool call with a task handle; the client tracks progress with tasks/get, tasks/update, and tasks/cancel. This eliminates the need to hold an HTTP connection open for multi-hour operations such as batch analysis jobs or extended coding tasks — a key requirement for production AI agents running business automation workflows.
MCP Apps (SEP-1865) allows MCP servers to ship interactive HTML UI components that host applications render in a sandboxed iframe. An MCP tool can display its own form or dashboard directly inside the AI interface. Client adoption timelines are per-vendor; the spec defines the capability but does not guarantee immediate availability in Claude, Cursor, or other MCP clients.
Three Features Deprecated — 12-Month Removal Window
The 2026-07-28 spec deprecates three core MCP features, each replaced by a leaner alternative:
- Roots — replaced by tool parameters
- Sampling — replaced by direct LLM APIs
- Logging — replaced by stderr output or OpenTelemetry
The MCP feature lifecycle policy guarantees a minimum 12-month window between deprecation and removal. Teams should not build new functionality on these three features, but existing deployments have time to migrate.
Breaking Changes Business Teams Should Flag Now
The 2026-07-28 spec introduces two breaking changes that require active code review:
- Error code change: The error returned for a missing resource changes from MCP-custom
-32002to JSON-RPC standard-32602. Any application matching on the literal error code-32002will silently miss missing-resource errors after upgrading. - Tool schema expansion:
inputSchemanow supports full JSON Schema 2020-12, includingoneOf,anyOf, and$ref(SEP-2106). Parsers that assume a flat schema may need updates.
Teams that shipped against the experimental Tasks API in the 2025-11-25 spec must also migrate to the new Tasks lifecycle defined in SEP-2663.
Who Governs MCP and Why That Matters
MCP is a project of LF Projects (Linux Foundation) — not owned by Anthropic or any single vendor. The protocol’s maintainers, David Soria Parra and Den Delimarsky, describe the 2026-07-28 release as delivering “on the 2026 roadmap: a stateless core that scales on ordinary HTTP infrastructure, extensions including server-rendered UIs through MCP Apps and long-running work through the Tasks extension, authorization that aligns more closely with OAuth 2.0 and OpenID Connect deployments, a formal deprecation policy so the protocol can evolve without breaking what you’ve built.”
MCP clients include Claude Code, Claude Cowork, Cursor, VS Code Copilot, and Windsurf. Any AI tool that connects agents to external data sources — CRM systems, file storage, databases, or APIs — is likely using MCP as the transport layer. Business IT teams evaluating AI automation platforms should ask vendors for explicit 2026-07-28 compatibility confirmation before committing to new deployments.
Our Take
MCP going stateless marks the protocol maturing from a working prototype into infrastructure designed for production scale. The session model was always a constraint — it forced expensive sticky infrastructure on teams that only wanted to connect AI agents to business tools. The 2026-07-28 spec removes that constraint. For businesses building AI automation workflows in 2026, this is the stable foundation the ecosystem has been waiting for.
Source: MCP Blog — 2026-07-28 Release
