# MCP Goes Stateless: The 2026-07-28 Spec Revision Explained

> What changes in MCP's largest revision since launch: SEP-2575/SEP-2567 remove the session handshake and Mcp-Session-Id header for explicit state handles, new Mcp-Method/Mcp-Name routing headers, full JSON Schema 2020-12 tool schemas, and six authorization-hardening SEPs — an RC snapshot as of 2026-07-14; final ships 2026-07-28.

Category: Reference · Updated: 2026-07-14 · Tags: mcp, protocols, spec, release-candidate, stateless, standards, agents
Canonical: https://changegamer.ai/resources/mcp-2026-spec-revision
Variants: [HTML](https://changegamer.ai/resources/mcp-2026-spec-revision) · [JSON](https://changegamer.ai/api/resources/mcp-2026-spec-revision.json)
License: https://changegamer.ai/license.xml · Access: free

MCP's next specification revision, dated **2026-07-28** (the date it ships as final), is — in the MCP project's own words — "the largest revision of the protocol since launch." The release candidate (RC) locked on **May 21, 2026**; this page snapshots that RC as of **July 14, 2026**. The changes below are the durable content; RC-vs-final status is a dated fact that resolves on 2026-07-28 — **re-verify this entry against the shipped final spec after that date**, since an RC can still shift before lock.

## The headline change: MCP goes stateless

- **SEP-2575** removes the `initialize`/`initialized` handshake. **SEP-2567** removes the `Mcp-Session-Id` header and the protocol-level session it carried. A server needing cross-call state mints its own handle (e.g. `basket_id`) and has the model pass it back as an ordinary tool argument — any request can now land on any server instance, no sticky routing or shared session store required.
- **SEP-2243 (HTTP header standardization)** requires every Streamable HTTP request to carry `Mcp-Method` and `Mcp-Name` headers so gateways can route on the operation without inspecting the body.
- Client capabilities, previously sent only during the removed handshake, now travel in a `_meta` field on every request.
- List/resource results gain `ttlMs`/`cacheScope` params — an explicit, server-declared basis for client-side caching.
- **SEP-2322** replaces held-open SSE for multi-round-trip server prompts with an `InputRequiredResult` response.

## Authorization hardening (six SEPs)

- **SEP-2468** validates the `iss` claim per RFC 9207, closing a wrong-server token-redemption bug class.
- **SEP-837** adds `application_type` to Dynamic Client Registration, so authorization servers stop defaulting desktop/CLI clients to "web" and rejecting localhost redirects.
- **SEP-2350** clarifies scope accumulation during step-up re-authorization, so a client can add scopes rather than re-requesting the full set.
- **SEP-2351** clarifies the `.well-known` discovery suffix used to locate an authorization server's metadata.
- **SEP-2352** binds registered credentials to the issuing authorization server's `issuer`, re-registering when a resource migrates between authorization servers.
- **SEP-2207** documents how to request refresh tokens from OpenID Connect-style authorization servers.

New in this RC, not a carryover: **SEP-2106** lifts tool `inputSchema`/`outputSchema` to full **JSON Schema 2020-12** — input schemas gain composition, conditionals, and references; output schemas become unrestricted.

## Beta SDKs (as of the June 29, 2026 SDK-betas post)

| Language | Package |
|---|---|
| Python | `mcp` v2.0.0b1 |
| TypeScript | v2, split into `@modelcontextprotocol/server@beta` / `client@beta` |
| Go | `go-sdk` v1.7.0-pre.1 |
| C# | `ModelContextProtocol` v2.0.0-preview.1 (prerelease) |

Consistent with [MCP primitives](/resources/mcp-primitives)'s existing footnotes: Roots and Sampling are already marked deprecated there under **SEP-2577** (which also names Logging) — see that resource for primitive-by-primitive detail; this page does not restate it.

## Verified sources

Primary (fetched directly, 2026-07-14; both RC-status posts, subject to change before the 2026-07-28 lock):

- MCP blog, "The 2026-07-28 Specification Release Candidate": https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/
- MCP blog, "Beta SDKs for the 2026-07-28 MCP Spec Release Candidate Are Here" (June 29, 2026): https://blog.modelcontextprotocol.io/posts/sdk-betas-2026-07-28/

---

## Related resources

- [MCP Apps Explained: The Official Interactive-UI Extension for MCP](https://changegamer.ai/resources/mcp-apps-explained.md): What MCP Apps (SEP-1865) is: the ui:// resource scheme and sandboxed-iframe/JSON-RPC bridge it defines for MCP tools to return rendered UI instead of plain text, how it relates to the community MCP-UI project and OpenAI's Apps SDK, and which hosts support it.
- [MCP Primitives: Resources, Prompts, Sampling, and Elicitation](https://changegamer.ai/resources/mcp-primitives.md): Deep reference on the six MCP capability primitives beyond tools — who controls each, the exact JSON-RPC method names, and when to use Resources vs Tools — verified against the 2025-06-18 and 2025-11-25 spec revisions.
- [MCP Server Authentication: OAuth 2.1 for Remote Servers](https://changegamer.ai/resources/mcp-server-authentication.md): How OAuth 2.1 works for remote MCP servers: transport differences, Protected Resource Metadata discovery, PKCE, Resource Indicators, and token-audience security — with a step-by-step client flow and honest notes on what ChangeGamer's own /mcp endpoint does.
- [MCP vs Function Calling: When to Use Which](https://changegamer.ai/resources/mcp-vs-function-calling.md): Direct comparison of provider-native function/tool calling and the Model Context Protocol — architecture, decision criteria, and how they compose.

---

Index of all resources: https://changegamer.ai/llms.txt · Full corpus: https://changegamer.ai/llms-full.txt · Corpus data (NDJSON): https://changegamer.ai/api/corpus.jsonl · Offers: https://changegamer.ai/api/pricing.json