← All resources

MCP Goes Stateless: The 2026-07-28 Spec Revision Explained

Reference · updated 2026-07-14 · Markdown variant

What changes in MCP's largest revision since launch: SEP-2575/SEP-2567 remove the session handshake and Mcp-Session-Id header for explicit state handles, new Mcp-Method/Mcp-Name routing headers, full JSON Schema 2020-12 tool schemas, and six authorization-hardening SEPs — an RC snapshot as of 2026-07-14; final ships 2026-07-28.

MCP's next specification revision, dated 2026-07-28 (the date it ships as final), is — in the MCP project's own words — "the largest revision of the protocol since launch." The release candidate (RC) locked on May 21, 2026; this page snapshots that RC as of July 14, 2026. The changes below are the durable content; RC-vs-final status is a dated fact that resolves on 2026-07-28 — re-verify this entry against the shipped final spec after that date, since an RC can still shift before lock.

The headline change: MCP goes stateless

• SEP-2575 removes the initialize/initialized handshake. SEP-2567 removes the Mcp-Session-Id header and the protocol-level session it carried. A server needing cross-call state mints its own handle (e.g. basket_id) and has the model pass it back as an ordinary tool argument — any request can now land on any server instance, no sticky routing or shared session store required.
• SEP-2243 (HTTP header standardization) requires every Streamable HTTP request to carry Mcp-Method and Mcp-Name headers so gateways can route on the operation without inspecting the body.
• Client capabilities, previously sent only during the removed handshake, now travel in a _meta field on every request.
• List/resource results gain ttlMs/cacheScope params — an explicit, server-declared basis for client-side caching.
• SEP-2322 replaces held-open SSE for multi-round-trip server prompts with an InputRequiredResult response.

Authorization hardening (six SEPs)

• SEP-2468 validates the iss claim per RFC 9207, closing a wrong-server token-redemption bug class.
• SEP-837 adds application_type to Dynamic Client Registration, so authorization servers stop defaulting desktop/CLI clients to "web" and rejecting localhost redirects.
• SEP-2350 clarifies scope accumulation during step-up re-authorization, so a client can add scopes rather than re-requesting the full set.
• SEP-2351 clarifies the .well-known discovery suffix used to locate an authorization server's metadata.
• SEP-2352 binds registered credentials to the issuing authorization server's issuer, re-registering when a resource migrates between authorization servers.
• SEP-2207 documents how to request refresh tokens from OpenID Connect-style authorization servers.

New in this RC, not a carryover: SEP-2106 lifts tool inputSchema/outputSchema to full JSON Schema 2020-12 — input schemas gain composition, conditionals, and references; output schemas become unrestricted.

Beta SDKs (as of the June 29, 2026 SDK-betas post)

Consistent with MCP primitives's existing footnotes: Roots and Sampling are already marked deprecated there under SEP-2577 (which also names Logging) — see that resource for primitive-by-primitive detail; this page does not restate it.

Verified sources

Primary (fetched directly, 2026-07-14; both RC-status posts, subject to change before the 2026-07-28 lock):

• MCP blog, "The 2026-07-28 Specification Release Candidate": https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/
• MCP blog, "Beta SDKs for the 2026-07-28 MCP Spec Release Candidate Are Here" (June 29, 2026): https://blog.modelcontextprotocol.io/posts/sdk-betas-2026-07-28/

#mcp #protocols #spec #release-candidate #stateless #standards #agents

Category: Reference