MCP just got its biggest update since launch, and it drops sessions entirely

The Model Context Protocol shipped its 2026-07-28 specification this week, the largest revision since the protocol launched. MCP is the standard that lets an AI assistant talk to outside tools and data, your calendar, a database, a company wiki, without every vendor inventing its own plumbing. It is now governed by the Agentic AI Foundation, a Linux Foundation fund whose platinum members include Anthropic, OpenAI, Google, Microsoft and Block.

The headline change is that MCP becomes stateless. Previously, a client and a server had to run an initialize handshake, and every following request carried a session ID. That worked fine on a laptop and badly everywhere else: because a client was pinned to whichever server instance held its session, operators needed sticky load balancing or a shared session store, and a dropped connection meant starting over. Under the new spec each request is self-contained. Protocol version, client identity and capability flags travel in a _meta field on every call, so any server in a pool can answer any request. Capability discovery moves to an on-demand server/discover call.

Two extensions ship alongside the lean core. Tasks handles long-running work: instead of blocking until a job finishes and risking a timeout, the server returns a durable taskId that the client polls, and a task can pause in an input_required state to wait for human approval before continuing. Apps lets a server declare interactive HTML that renders in a sandboxed iframe inside the chat, so a tool can show a form or a dashboard instead of returning raw JSON, with a plain-text fallback for clients that do not support it. Authorization also tightens: OAuth 2.1 and OpenID Connect discovery become requirements, and a new Enterprise-Managed Authorization extension lets IT departments provision server access centrally rather than making every employee click through OAuth prompts. Five features are proposed for deprecation, including Roots, Sampling and the HTTP+SSE transport, under a new policy that guarantees at least twelve months before removal.

There is a design idea underneath all this that is worth understanding even if you never write a line of MCP code. Hidden session state was invisible to the model. Explicit handles are not. When a server hands back a basket_id or a workflow_run_id as an ordinary value, the model can see it, reason about it, and pass it to a different tool. State moved out of the transport and into the conversation, which is arguably a better fit for how agents actually work.

What this means for you: if you just use AI assistants, expect connectors to get more reliable and, over the next months, more visual, since Apps means a tool can render a real interface in the chat rather than dumping text at you. If you maintain an MCP server, the work is concrete: audit anything that depends on initialize or Mcp-Session-Id, handle client info arriving via _meta on each request, and start migrating off the deprecated features. Beta SDKs for Python, TypeScript, Go and C# already target the new spec, and the earliest removal date for deprecated features is July 2027.

Sources

• MCP 2026-07-28: What’s Changing and How to Migrate (Agentic AI Foundation)
• Model Context Protocol (specification and SDKs)
• MCP just got its biggest update ever (VentureBeat)
• How AgentCore Gateway supports the MCP 2026-07-28 spec (AWS)