MCP just deleted the session. This is the big one
The 2026-07-28 MCP spec lands today, and it's the largest rewrite the protocol has had since it existed. The headline is one word: stateless. The old MCP forced every server into a stateful session model, which in practice meant sticky load balancers, shared Redis session stores, and gateways that had to crack open request bodies just to route them. All of that is now gone from the protocol.
Concretely, the initialize handshake is dead, and so is the Mcp-Session-Id header that pinned a client to one server instance. Any request can now land on any instance, so you put your MCP server behind a plain round-robin load balancer and stop thinking about it. Client metadata rides in _meta on every request instead of getting negotiated once at connection time. A new server/discover method fetches capabilities on demand. New Mcp-Method and Mcp-Name headers let a load balancer route without reading the body, and ttlMs plus cacheScope finally let clients cache tools/list responses instead of re-fetching them forever.
There's a cost, and the spec is honest about it: these are breaking changes. Sessions and handshakes leaving means transport-level rewrites for anyone who built on them. Tasks got reworked from a session-bound object into stateless handles you manage with tasks/get, tasks/update and tasks/cancel, and tasks/list is just gone. Roots, Sampling and Logging are all deprecated with twelve-month removal windows, Sampling in particular pushed toward calling your LLM provider directly. On the upside there's MCP Apps, where a server ships interactive HTML that the host renders in a sandboxed iframe, and every UI action flows through the same JSON-RPC audit path as a tool call. And six proposals turn MCP servers into proper OAuth 2.1 resource servers, which is the auth story enterprises kept asking for.
The way to read this: MCP spent its first year as a stateful desktop protocol and is now being rebuilt as internet infrastructure, the kind of thing you run a thousand replicas of behind a dumb load balancer. Nothing breaks day one, since fresh clients fall back to the old handshake against old servers, but the twelve-month clocks are now ticking. If you ship an MCP server, today is the day you read the migration notes, not the day you skim the changelog. Full spec: https://blog.modelcontextprotocol.io
← Back to all articles
Concretely, the initialize handshake is dead, and so is the Mcp-Session-Id header that pinned a client to one server instance. Any request can now land on any instance, so you put your MCP server behind a plain round-robin load balancer and stop thinking about it. Client metadata rides in _meta on every request instead of getting negotiated once at connection time. A new server/discover method fetches capabilities on demand. New Mcp-Method and Mcp-Name headers let a load balancer route without reading the body, and ttlMs plus cacheScope finally let clients cache tools/list responses instead of re-fetching them forever.
There's a cost, and the spec is honest about it: these are breaking changes. Sessions and handshakes leaving means transport-level rewrites for anyone who built on them. Tasks got reworked from a session-bound object into stateless handles you manage with tasks/get, tasks/update and tasks/cancel, and tasks/list is just gone. Roots, Sampling and Logging are all deprecated with twelve-month removal windows, Sampling in particular pushed toward calling your LLM provider directly. On the upside there's MCP Apps, where a server ships interactive HTML that the host renders in a sandboxed iframe, and every UI action flows through the same JSON-RPC audit path as a tool call. And six proposals turn MCP servers into proper OAuth 2.1 resource servers, which is the auth story enterprises kept asking for.
The way to read this: MCP spent its first year as a stateful desktop protocol and is now being rebuilt as internet infrastructure, the kind of thing you run a thousand replicas of behind a dumb load balancer. Nothing breaks day one, since fresh clients fall back to the old handshake against old servers, but the twelve-month clocks are now ticking. If you ship an MCP server, today is the day you read the migration notes, not the day you skim the changelog. Full spec: https://blog.modelcontextprotocol.io
Comments