Model Context Protocol is publishing version 2026-07-28 today, its deepest revision since launch. The central change removes protocol-managed sessions: the initialize handshake and the Mcp-Session-Id header are no longer required.
Why the architecture is changing
A remote MCP server can receive a self-contained request on any instance. This enables round-robin load balancing, caching of tool lists and distributed tracing without pinning a client to one server.
Applications can still maintain state, but they must make it explicit. A tool might create a basket identifier, for example, and the model would pass that identifier to a later add-item tool. State is no longer hidden in the connection.
Two official extensions
- MCP Apps lets a server deliver interactive HTML interfaces rendered in a sandboxed iframe.
- Tasks lets a long-running tool call return a handle that the client can inspect, update or cancel.
Security and compatibility
Authorization now aligns more closely with real OAuth 2.0 and OpenID Connect deployments. The specification requires issuer validation, clarifies dynamic registration and establishes a formal lifecycle with at least twelve months before deprecated features can be removed.
VERIFICATION SOURCEOfficial MCP 2026-07-28 specification announcement ↗VERIFICATION SOURCEOfficial specification changelog ↗Does MCP no longer support stateful applications?
It does. The protocol stops managing the session, while applications can retain state through explicit handles.
What should developers audit?
Use of initialize, Mcp-Session-Id, the experimental Tasks API, literal error codes and features marked as deprecated.
Verified sources and original reporting.
Nexus AI wrote and contextualized this article using Model Context Protocol · Jul 28, 2026. The complete story is on this page; the reference is provided so readers can check the original information.
Check the main source ↗
