← All resources

MCP Goes Stateless: The 2026-07-28 Spec Revision Explained

Reference · updated 2026-07-31 · Markdown variant

What changes in MCP's largest revision since launch: SEP-2575/SEP-2567 remove the session handshake and Mcp-Session-Id header for explicit state handles, new Mcp-Method/Mcp-Name routing headers, full JSON Schema 2020-12 tool schemas, and six authorization-hardening SEPs — shipped as final, on schedule, on 2026-07-28.

MCP's specification revision dated 2026-07-28 — in the MCP project's own words, "the largest revision of the protocol since launch" — shipped as final, on schedule, on that date. The release candidate (RC) had locked on May 21, 2026; this page was first drafted from that RC snapshot on July 14, 2026 and was re-verified live on 2026-07-31 against the shipped final spec's changelog, the spec repo's release listing, and all four official SDK repos' release pages. No substantive change turned up between the RC and the final release — the content below reflects the shipped, final spec.

Key facts

• MCP's 2026-07-28 spec revision — which the project itself calls "the largest revision of the protocol since launch" — became final on that date, exactly on the schedule set when the release candidate had locked on May 21, 2026, with no substantive changes between RC and final.
• SEP-2575 removes the initialize/initialized handshake, and SEP-2567 strips out the Mcp-Session-Id header along with the protocol-level session it carried, so a request can now be handled by any server instance without needing sticky routing or a shared session store — a server that still needs to track state across calls instead issues its own handle and relies on the model echoing it back as a normal tool argument on the next call.
• Under SEP-2243, gateways no longer have to open the request body to know what operation is being called — Streamable HTTP requests must now carry the operation name in dedicated Mcp-Method and Mcp-Name headers.
• Six SEPs harden authorization in this revision, covering issuer-claim validation (SEP-2468), non-web client registration (SEP-837), scope accumulation on step-up re-auth (SEP-2350), the well-known discovery suffix (SEP-2351), credential-issuer binding (SEP-2352), and refresh-token requests (SEP-2207).
• SEP-2106, new in this final revision rather than a carryover, lifts tool input/output schemas to full JSON Schema 2020-12, adding composition and conditionals to input schemas and leaving output schemas unrestricted.
• All four official SDKs — Python, TypeScript, Go, and C# — moved to a stable 2.0-line release (Go at 1.7.0) in the same week the spec became final, with each project's prior 1.x line staying in bug-fix/security-only maintenance.

The headline change: MCP goes stateless

• SEP-2575 removes the initialize/initialized handshake. SEP-2567 removes the Mcp-Session-Id header and the protocol-level session it carried. A server needing cross-call state mints its own handle (e.g. basket_id) and has the model pass it back as an ordinary tool argument — any request can now land on any server instance, no sticky routing or shared session store required.
• SEP-2243 (HTTP header standardization) requires every Streamable HTTP request to carry Mcp-Method and Mcp-Name headers so gateways can route on the operation without inspecting the body.
• Client capabilities, previously sent only during the removed handshake, now travel in a _meta field on every request.
• List/resource results gain ttlMs/cacheScope params — an explicit, server-declared basis for client-side caching.
• SEP-2322 replaces held-open SSE for multi-round-trip server prompts with an InputRequiredResult response.

Authorization hardening (six SEPs)

• SEP-2468 validates the iss claim per RFC 9207, closing a wrong-server token-redemption bug class.
• SEP-837 adds application_type to Dynamic Client Registration, so authorization servers stop defaulting desktop/CLI clients to "web" and rejecting localhost redirects.
• SEP-2350 clarifies scope accumulation during step-up re-authorization, so a client can add scopes rather than re-requesting the full set.
• SEP-2351 clarifies the .well-known discovery suffix used to locate an authorization server's metadata.
• SEP-2352 binds registered credentials to the issuing authorization server's issuer, re-registering when a resource migrates between authorization servers.
• SEP-2207 documents how to request refresh tokens from OpenID Connect-style authorization servers.

New in this final revision, not a carryover: SEP-2106 lifts tool inputSchema/outputSchema to full JSON Schema 2020-12 — input schemas gain composition, conditionals, and references; output schemas become unrestricted.

Stable SDKs (shipped alongside the final spec, 2026-07-28)

All four SDKs moved from beta/prerelease to a stable release the same week the spec finalized; each project's 1.x line stays in bug-fix/security-only maintenance.

Consistent with MCP primitives: Roots and Sampling are confirmed deprecated — final, not draft — under SEP-2577 as of 2026-07-28 (which also names Logging) — see that resource for primitive-by-primitive detail; this page does not restate it.

Verified sources

Re-verified live on 2026-07-31. Direct-fetch confirmed (final, not RC, throughout):

• Spec changelog: https://raw.githubusercontent.com/modelcontextprotocol/modelcontextprotocol/main/docs/specification/2026-07-28/changelog.mdx
• Spec repo releases: https://github.com/modelcontextprotocol/modelcontextprotocol/releases
• TS SDK v2 docs ("the stable release line implementing the 2026-07-28 spec"): https://ts.sdk.modelcontextprotocol.io/v2/
• SDK release pages, each a stable non-prerelease tag: https://github.com/modelcontextprotocol/python-sdk/releases, https://github.com/modelcontextprotocol/go-sdk/releases, https://github.com/modelcontextprotocol/csharp-sdk/releases, https://github.com/modelcontextprotocol/typescript-sdk/releases

WebSearch-corroborated, direct fetch blocked by proxy (403/503) this session: https://blog.modelcontextprotocol.io/posts/2026-07-28/ and https://modelcontextprotocol.io/specification/2026-07-28/changelog. Prior RC-era sources, kept for provenance: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/ and https://blog.modelcontextprotocol.io/posts/sdk-betas-2026-07-28/.

#mcp #protocols #spec #final-release #stateless #standard #agents

Category: Reference