Skip to content
NewsProduct launch

MCP 2026-07-28 specification finalizes stateless core, removes session handshakes for serverless deployments

· by Pondero Newsdesk

The short version

The Model Context Protocol published its 2026-07-28 specification on July 28, eliminating initialize handshakes and protocol sessions so any MCP request can land on a plain round-robin load balancer with no shared storage required.

MCP 2026-07-28 specification finalizes stateless core, removes session handshakes for serverless deployments

The Model Context Protocol published its 2026-07-28 specification on July 28, with lead maintainers David Soria Parra and Den Delimarsky describing it as the largest revision since the protocol launched. The defining change retires the initialize handshake and protocol-level sessions entirely, so any MCP server can now sit behind a plain round-robin load balancer with no shared state required.

What changed

Before this release, every MCP session opened with an initialize/initialized exchange and tracked state via an Mcp-Session-Id header. The 2026-07-28 spec removes both of those. Each request now carries its own protocol version, client identity, and capabilities in a _meta field. Clients that want to enumerate a server's capabilities upfront can call the new optional server/discover RPC, but no request requires prior context to complete. Any call can land on any server instance behind a commodity load balancer.

A new Multi Round-Trip Requests (MRTR) mechanism handles the flows that previously needed a held-open stream. When a tool needs user input mid-call, the server returns resultType: "input_required" with the specific fields needed. The client then retries the original call with answers attached in inputResponses. Elicitation, sampling, and roots-list requests all move to this pattern, ending the requirement for persistent bidirectional connections.

Gateway routing gets a concrete improvement too. Streamable HTTP requests must now include Mcp-Method and Mcp-Name headers, so proxies and WAFs can route and meter calls on headers without inspecting JSON bodies. On the caching side, list responses from tools/list, prompts/list, and resources/list now carry ttlMs and cacheScope hints, letting clients cache tool catalogs across reconnects without re-fetching on every session.

Authorization also tightens. Issuer validation per RFC 9207 is now mandatory, closing an authorization-server mix-up vulnerability. Dynamic Client Registration starts a formal shift toward Client ID Metadata Documents (CIMD). A 12-month minimum deprecation window now applies to future breaking changes.

TypeScript, Python, Go, and C# SDKs are all updated with migration notes. Per the MCP launch post, both the TypeScript and Python SDKs crossed 1 billion total downloads, with close to half a billion downloads a month across all Tier 1 SDKs.

Why it matters

The stateless core is the change that most directly expands where MCP servers can run. Managing sticky sessions or shared state on the transport layer ruled out standard serverless platforms and most off-the-shelf load balancers. Teams that wanted production reliability had to build session-routing infrastructure on top. With 2026-07-28, a Lambda-equivalent or a bare round-robin cluster works without that overhead.

For operators already running MCP integrations, the 12-month deprecation window is the part to track. Tier 1 SDKs preserved backward compatibility in this release, so existing servers do not break now. That initialize handshake is formally deprecated, though, and the removal clock started July 28. Pinning to old SDK versions covers the near term. Planning the migration before the window closes is the more deliberate approach.

GitHub shipped support ahead of the official release date, stripping Redis session writes from every initialize call and moving logging reads to the new headers. AWS confirmed AgentCore Gateway supports the 2026-07-28 spec as of July 30.

What to watch next

IDE adoption is the near-term question: whether Cursor, Cline, and other MCP client tools ship 2026-07-28 compatible updates through August. AAIF (Agentic AI Foundation) governance output for the next spec cycle is the other thread to follow as formal stewardship of the protocol moves outside any single vendor.

Sources