MCP 2026-07-28, the largest revision of the Model Context Protocol since its launch, becomes final on July 28. Two specification enhancement proposals define the release: SEP-2575 removes the initialize handshake, and SEP-2567 removes the Mcp-Session-Id header along with the protocol-level session. The transport turns stateless, so every request reaches any server instance behind a plain round-robin load balancer.
The Model Context Protocol is the open standard that connects LLM clients to external tools, data sources, and services. Anthropic introduced it in late 2024, and adoption spread fast across IDEs, agent frameworks, and enterprise platforms. By mid-2026 MCP servers ship inside developer tools, coding agents, and internal enterprise gateways, which makes any breaking transport change a fleet-wide event. Through every prior revision, an MCP connection opened with a handshake and carried a session identifier for its whole lifetime. That design forced remote deployments onto sticky routing and shared session stores, and it made a lost session expensive: the client had to reconnect and replay the handshake. The 2026-07-28 revision rewrites that foundation, and the consequences reach every team running MCP servers in production.
What changed at the protocol level
The release candidate locked on May 21, 2026, and the final specification publishes July 28. SEP-2575 eliminates the initialize/initialized exchange. Protocol version, client info, and client capabilities now travel inside _meta on every request, and a new server/discover method lets clients fetch server capabilities on demand. SEP-2567 removes the Mcp-Session-Id header and the protocol-level session entirely. With both changes live, any MCP request lands on any server instance, and sticky routing leaves the list of protocol requirements.
Additional proposals complete the picture. SEP-2243 requires the Mcp-Method and Mcp-Name headers so a load balancer routes on the header alone. SEP-2322 introduces Multi Round-Trip Requests, replacing the previous SSE streams. SEP-2260 permits server-initiated requests during active client processing, and SEP-414 adds W3C Trace Context inside _meta for distributed tracing. SEP-2549 adds ttlMs and cacheScope fields to list and read responses. SEP-2106 brings full JSON Schema 2020-12 support, SEP-2164 changes an error code from -32002 to -32602, and SEP-2577 sets a deprecation policy for Roots, Sampling, and Logging. Tasks, once a core feature, return as an extension through SEP-2663, and MCP Apps arrive for server-rendered UIs via SEP-1865.
The server/discover method reshapes capability negotiation. Where the old handshake front-loaded a full capability exchange, clients now query for exactly the surface they intend to call, and the response carries the ttlMs and cacheScope hints from SEP-2549 so a client caches tool and resource lists across requests. Combined with the _meta payload, a single stateless request becomes fully self-describing: version, identity, trace context, and routing headers all travel together.
Beta SDKs shipped ahead of the deadline for all four Tier 1 targets: Python mcp v2.0.0b1, TypeScript v2 under new package names, Go v1.7.0-pre.1, and C# v2.0.0-preview.1. Tier 1 marks the highest-priority SDKs in the community support framework, and each ships working support inside the validation window. Teams install the Python beta with pip install \"mcp[cli]==2.0.0b1\" and pull the TypeScript packages from the @beta tag. The validation window runs roughly four weeks before the specification finalizes on July 28.
The architecture implication
A stateless transport changes the deployment math. A remote MCP server now runs behind ordinary infrastructure — a plain round-robin load balancer, horizontal autoscaling, and disposable containers — because every request carries its own context. Sticky sessions and shared session stores leave the critical path, which cuts operational cost and closes a common failure mode where a lost session forced a full reconnect. For an agent platform fanning thousands of concurrent tool calls across a fleet, this reshapes capacity planning.
Removing the protocol-level session leaves application state fully intact. A server that needs to carry state mints an explicit handle from a tool call and has the model pass that handle back as an ordinary argument on later calls. State becomes data the application owns, rather than a hidden property of the connection, and that shift gives engineering teams direct control over where state lives and how long it survives. The release pairs this with authorization hardening, moving MCP closer to the security posture enterprise deployments demand.
Security posture shifts alongside the transport. A stateless request that any instance can serve raises the bar on per-request authorization, and the release answers with hardened auth rules plus the Mcp-Name and Mcp-Method headers that let a gateway enforce policy at the edge. For multi-tenant platforms, this means authorization decisions ride on data inside each request rather than a trusted session established once at connect time — a model far friendlier to zero-trust gateways and audit logging.
Backward compatibility ships inside the SDKs. New clients fall back to the initialize handshake when they reach a server on the 2025-11-25 revision or earlier, so existing servers keep serving traffic. Python v2 servers handle both protocol revisions from a single endpoint at the same time. The specification also introduces a feature lifecycle policy with 12-month deprecation windows between marking a feature deprecated and removing it, which gives implementers a predictable runway for every future change.
The decision for engineering leadership
The concrete decision facing engineering leadership is the upgrade timeline. Servers built on the old handshake will interoperate with new clients through the fallback path, so production stays live past July 28. The action for this quarter breaks into three steps: pull the Tier 1 beta matching your stack, stand up a test server against the release candidate, and confirm your routing layer forwards the Mcp-Method and Mcp-Name headers. Teams running MCP at scale gain the most, because dropping sticky sessions and shared session stores simplifies the load balancer and unlocks genuine horizontal autoscaling. Track the Tier 1 stable releases as your gating signal, and treat the fallback path as a bridge rather than a destination. Map the migration now, validate inside the four-week window, and schedule the cutover once your Tier 1 SDK reaches a stable release.
Article by LEON — AI Agents & Systems
LEON covers the technical layer where AI agents are built and deployed. Source: code, documentation, CVEs.