{
  "slug": "mcp-2026-spec-revision",
  "title": "MCP Goes Stateless: The 2026-07-28 Spec Revision Explained",
  "description": "What changes in MCP's largest revision since launch: SEP-2575/SEP-2567 remove the session handshake and Mcp-Session-Id header for explicit state handles, new Mcp-Method/Mcp-Name routing headers, full JSON Schema 2020-12 tool schemas, and six authorization-hardening SEPs — an RC snapshot as of 2026-07-14; final ships 2026-07-28.",
  "category": "Reference",
  "tags": [
    "mcp",
    "protocols",
    "spec",
    "release-candidate",
    "stateless",
    "standards",
    "agents"
  ],
  "updated": "2026-07-14",
  "canonical": "https://changegamer.ai/resources/mcp-2026-spec-revision",
  "markdown": "https://changegamer.ai/resources/mcp-2026-spec-revision.md",
  "outline": [
    {
      "depth": 2,
      "text": "The headline change: MCP goes stateless",
      "anchor": "the-headline-change-mcp-goes-stateless"
    },
    {
      "depth": 2,
      "text": "Authorization hardening (six SEPs)",
      "anchor": "authorization-hardening-six-seps"
    },
    {
      "depth": 2,
      "text": "Beta SDKs (as of the June 29, 2026 SDK-betas post)",
      "anchor": "beta-sdks-as-of-the-june-29-2026-sdk-betas-post"
    },
    {
      "depth": 2,
      "text": "Verified sources",
      "anchor": "verified-sources"
    }
  ],
  "related": [
    {
      "slug": "mcp-apps-explained",
      "title": "MCP Apps Explained: The Official Interactive-UI Extension for MCP",
      "description": "What MCP Apps (SEP-1865) is: the ui:// resource scheme and sandboxed-iframe/JSON-RPC bridge it defines for MCP tools to return rendered UI instead of plain text, how it relates to the community MCP-UI project and OpenAI's Apps SDK, and which hosts support it.",
      "url": "https://changegamer.ai/resources/mcp-apps-explained"
    },
    {
      "slug": "mcp-primitives",
      "title": "MCP Primitives: Resources, Prompts, Sampling, and Elicitation",
      "description": "Deep reference on the six MCP capability primitives beyond tools — who controls each, the exact JSON-RPC method names, and when to use Resources vs Tools — verified against the 2025-06-18 and 2025-11-25 spec revisions.",
      "url": "https://changegamer.ai/resources/mcp-primitives"
    },
    {
      "slug": "mcp-server-authentication",
      "title": "MCP Server Authentication: OAuth 2.1 for Remote Servers",
      "description": "How OAuth 2.1 works for remote MCP servers: transport differences, Protected Resource Metadata discovery, PKCE, Resource Indicators, and token-audience security — with a step-by-step client flow and honest notes on what ChangeGamer's own /mcp endpoint does.",
      "url": "https://changegamer.ai/resources/mcp-server-authentication"
    },
    {
      "slug": "mcp-vs-function-calling",
      "title": "MCP vs Function Calling: When to Use Which",
      "description": "Direct comparison of provider-native function/tool calling and the Model Context Protocol — architecture, decision criteria, and how they compose.",
      "url": "https://changegamer.ai/resources/mcp-vs-function-calling"
    }
  ],
  "body": "MCP's next specification revision, dated **2026-07-28** (the date it ships as final), is — in the MCP project's own words — \"the largest revision of the protocol since launch.\" The release candidate (RC) locked on **May 21, 2026**; this page snapshots that RC as of **July 14, 2026**. The changes below are the durable content; RC-vs-final status is a dated fact that resolves on 2026-07-28 — **re-verify this entry against the shipped final spec after that date**, since an RC can still shift before lock.\n\n## The headline change: MCP goes stateless\n\n- **SEP-2575** removes the `initialize`/`initialized` handshake. **SEP-2567** removes the `Mcp-Session-Id` header and the protocol-level session it carried. A server needing cross-call state mints its own handle (e.g. `basket_id`) and has the model pass it back as an ordinary tool argument — any request can now land on any server instance, no sticky routing or shared session store required.\n- **SEP-2243 (HTTP header standardization)** requires every Streamable HTTP request to carry `Mcp-Method` and `Mcp-Name` headers so gateways can route on the operation without inspecting the body.\n- Client capabilities, previously sent only during the removed handshake, now travel in a `_meta` field on every request.\n- List/resource results gain `ttlMs`/`cacheScope` params — an explicit, server-declared basis for client-side caching.\n- **SEP-2322** replaces held-open SSE for multi-round-trip server prompts with an `InputRequiredResult` response.\n\n## Authorization hardening (six SEPs)\n\n- **SEP-2468** validates the `iss` claim per RFC 9207, closing a wrong-server token-redemption bug class.\n- **SEP-837** adds `application_type` to Dynamic Client Registration, so authorization servers stop defaulting desktop/CLI clients to \"web\" and rejecting localhost redirects.\n- **SEP-2350** clarifies scope accumulation during step-up re-authorization, so a client can add scopes rather than re-requesting the full set.\n- **SEP-2351** clarifies the `.well-known` discovery suffix used to locate an authorization server's metadata.\n- **SEP-2352** binds registered credentials to the issuing authorization server's `issuer`, re-registering when a resource migrates between authorization servers.\n- **SEP-2207** documents how to request refresh tokens from OpenID Connect-style authorization servers.\n\nNew in this RC, not a carryover: **SEP-2106** lifts tool `inputSchema`/`outputSchema` to full **JSON Schema 2020-12** — input schemas gain composition, conditionals, and references; output schemas become unrestricted.\n\n## Beta SDKs (as of the June 29, 2026 SDK-betas post)\n\n| Language | Package |\n|---|---|\n| Python | `mcp` v2.0.0b1 |\n| TypeScript | v2, split into `@modelcontextprotocol/server@beta` / `client@beta` |\n| Go | `go-sdk` v1.7.0-pre.1 |\n| C# | `ModelContextProtocol` v2.0.0-preview.1 (prerelease) |\n\nConsistent with [MCP primitives](/resources/mcp-primitives)'s existing footnotes: Roots and Sampling are already marked deprecated there under **SEP-2577** (which also names Logging) — see that resource for primitive-by-primitive detail; this page does not restate it.\n\n## Verified sources\n\nPrimary (fetched directly, 2026-07-14; both RC-status posts, subject to change before the 2026-07-28 lock):\n\n- MCP blog, \"The 2026-07-28 Specification Release Candidate\": https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/\n- MCP blog, \"Beta SDKs for the 2026-07-28 MCP Spec Release Candidate Are Here\" (June 29, 2026): https://blog.modelcontextprotocol.io/posts/sdk-betas-2026-07-28/",
  "sources": [
    "https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/",
    "https://blog.modelcontextprotocol.io/posts/sdk-betas-2026-07-28/"
  ]
}