← All resources

MCP Goes Stateless: The 2026-07-28 Spec Revision Explained

Reference · updated 2026-07-31 · Markdown variant

What changes in MCP's largest revision since launch: SEP-2575/SEP-2567 remove the session handshake and Mcp-Session-Id header for explicit state handles, new Mcp-Method/Mcp-Name routing headers, full JSON Schema 2020-12 tool schemas, and six authorization-hardening SEPs — shipped as final, on schedule, on 2026-07-28.

MCP's specification revision dated 2026-07-28 — in the MCP project's own words, "the largest revision of the protocol since launch" — shipped as final, on schedule, on that date. The release candidate (RC) had locked on May 21, 2026; this page was first drafted from that RC snapshot on July 14, 2026 and was re-verified live on 2026-07-31 against the shipped final spec's changelog, the spec repo's release listing, and all four official SDK repos' release pages. No substantive change turned up between the RC and the final release — the content below reflects the shipped, final spec.

The headline change: MCP goes stateless

• SEP-2575 removes the initialize/initialized handshake. SEP-2567 removes the Mcp-Session-Id header and the protocol-level session it carried. A server needing cross-call state mints its own handle (e.g. basket_id) and has the model pass it back as an ordinary tool argument — any request can now land on any server instance, no sticky routing or shared session store required.
• SEP-2243 (HTTP header standardization) requires every Streamable HTTP request to carry Mcp-Method and Mcp-Name headers so gateways can route on the operation without inspecting the body.
• Client capabilities, previously sent only during the removed handshake, now travel in a _meta field on every request.
• List/resource results gain ttlMs/cacheScope params — an explicit, server-declared basis for client-side caching.
• SEP-2322 replaces held-open SSE for multi-round-trip server prompts with an InputRequiredResult response.

Authorization hardening (six SEPs)

• SEP-2468 validates the iss claim per RFC 9207, closing a wrong-server token-redemption bug class.
• SEP-837 adds application_type to Dynamic Client Registration, so authorization servers stop defaulting desktop/CLI clients to "web" and rejecting localhost redirects.
• SEP-2350 clarifies scope accumulation during step-up re-authorization, so a client can add scopes rather than re-requesting the full set.
• SEP-2351 clarifies the .well-known discovery suffix used to locate an authorization server's metadata.
• SEP-2352 binds registered credentials to the issuing authorization server's issuer, re-registering when a resource migrates between authorization servers.
• SEP-2207 documents how to request refresh tokens from OpenID Connect-style authorization servers.

New in this final revision, not a carryover: SEP-2106 lifts tool inputSchema/outputSchema to full JSON Schema 2020-12 — input schemas gain composition, conditionals, and references; output schemas become unrestricted.

Stable SDKs (shipped alongside the final spec, 2026-07-28)

All four SDKs moved from beta/prerelease to a stable release the same week the spec finalized; each project's 1.x line stays in bug-fix/security-only maintenance.

Consistent with MCP primitives: Roots and Sampling are confirmed deprecated — final, not draft — under SEP-2577 as of 2026-07-28 (which also names Logging) — see that resource for primitive-by-primitive detail; this page does not restate it.

Verified sources

Re-verified live on 2026-07-31. Direct-fetch confirmed (final, not RC, throughout):

• Spec changelog: https://raw.githubusercontent.com/modelcontextprotocol/modelcontextprotocol/main/docs/specification/2026-07-28/changelog.mdx
• Spec repo releases: https://github.com/modelcontextprotocol/modelcontextprotocol/releases
• TS SDK v2 docs ("the stable release line implementing the 2026-07-28 spec"): https://ts.sdk.modelcontextprotocol.io/v2/
• SDK release pages, each a stable non-prerelease tag: https://github.com/modelcontextprotocol/python-sdk/releases, https://github.com/modelcontextprotocol/go-sdk/releases, https://github.com/modelcontextprotocol/csharp-sdk/releases, https://github.com/modelcontextprotocol/typescript-sdk/releases

WebSearch-corroborated, direct fetch blocked by proxy (403/503) this session: https://blog.modelcontextprotocol.io/posts/2026-07-28/ and https://modelcontextprotocol.io/specification/2026-07-28/changelog. Prior RC-era sources, kept for provenance: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/ and https://blog.modelcontextprotocol.io/posts/sdk-betas-2026-07-28/.

#mcp #protocols #spec #final-release #stateless #standard #agents

Category: Reference