MCP Gets Its Biggest Upgrade Ever: Stateless Core, New Auth, and a Path to Enterprise Agents

The Model Context Protocol — the open standard for connecting AI agents to tools, data, and services — published its 2026-07-28 specification on Monday, representing the most sweeping architectural change to the protocol since its original launch. The update eliminates the stateful session model that has constrained MCP deployments since the beginning, introduces multi-round-trip communication for complex agentic workflows, hardens authorization, and establishes a formal governance structure for the extensions ecosystem. With over 400 million monthly SDK downloads and a 4x growth rate this year, MCP has become the de facto wiring standard for AI agents — and this release is explicitly designed for what comes next.

The Core Change: Going Stateless

The single most consequential technical change in the 2026-07-28 spec is the elimination of the protocol-level session. In prior versions of MCP, clients and servers exchanged an initialize/initialized handshake at connection start, establishing a shared session context — including an Mcp-Session-Id header — that persisted for the lifetime of the connection. This made MCP fundamentally stateful: a client was pinned to a specific server instance, which made it essentially impossible to deploy MCP behind a standard load balancer without sticky sessions and shared storage.

In the new spec, that session disappears entirely. Each request now carries its own protocol version, client identity, and client capabilities in a _meta envelope. A new server/discover method lets clients fetch server capabilities on demand rather than up front. The result: MCP servers become stateless services that can run behind a plain round-robin load balancer, scale horizontally without coordination, and tolerate restarts without dropping clients.

For enterprise deployments — where MCP servers are running as microservices inside Kubernetes clusters — this is the difference between a protocol that requires careful operational babysitting and one that behaves like any other modern HTTP API. The change also opens the door to globally distributed MCP deployments where request routing can span data centers.

Multi Round-Trip Requests

Stateless protocols face a specific challenge: how does a server ask a client a question mid-execution? In the old model, MCP’s open persistent connection made server-initiated requests straightforward. In a stateless world, there is no open connection to use.

The solution in the 2026-07-28 spec is Multi Round-Trip Requests (MRTR). When a server needs additional input from a client to complete a tool call — for example, to request confirmation before executing a destructive action, or to ask for a credential it doesn’t yet have — it can return a resultType: "input_required" response that includes a specification of what it needs. The client retries the original request with answers embedded in an inputResponses payload. The protocol handles the rest.

This pattern enables workflows that were previously only possible with complex out-of-band coordination: an AI agent can invoke a tool, be asked for additional information mid-call, provide it, and receive the result — all within a clean stateless request-response cycle. For enterprise agentic AI, where human-in-the-loop checkpoints and conditional execution are standard requirements, MRTR is significant.

Authorization Hardening

The 2026-07-28 spec represents a major tightening of MCP’s authorization model, addressing a set of weaknesses that security researchers had flagged in enterprise deployments.

The changes include: mandatory RFC 9207 issuer validation for authorization servers (preventing confused-deputy attacks in multi-tenant environments); formal support for application_type during Dynamic Client Registration (enabling secure localhost redirect handling for development tooling); credentials that are now bound to their issuing authorization server rather than floating freely; and the replacement of Dynamic Client Registration with Client ID Metadata Documents (CIMD), a more auditable credential provisioning model.

Critically, the legacy HTTP+SSE transport — the original MCP transport layer — is formally deprecated in this release. The deprecation is announced with a 12-month minimum offramp, giving existing deployments time to migrate. The newer HTTP streaming transport and the MCP stdio transport remain supported and become the exclusive supported paths going forward.

The Extensions Framework and Task Management

The spec formalizes an extensions mechanism that was previously ad-hoc. Extensions are now versioned namespaces in the form io.modelcontextprotocol/{name}, with explicit lifecycle management including the new 12-month deprecation policy.

The first extension to graduate from experimental to stable under this framework is Tasks (io.modelcontextprotocol/tasks). Tasks now use a poll-based model (tasks/get and tasks/update methods) with change notifications delivered through a subscriptions/listen mechanism. This makes it possible for AI agents to initiate long-running background operations, check on their status, and receive updates — without requiring an open connection. It’s the foundation for async agentic workflows at production scale.

Three existing protocol features — Roots, Sampling, and Logging — are simultaneously deprecated as part of a broader consolidation, with the same 12-month offramp.

Cacheable Listings

A smaller but operationally significant change: tool, prompt, and resource listings now include ttlMs and cacheScope metadata. Clients can cache the list of available tools and resources rather than re-fetching it on every request, dramatically reducing the round-trip overhead for agents that repeatedly call the same set of tools. For agents making hundreds or thousands of tool calls per session, this is a meaningful performance improvement.

The cacheScope dimension allows listings to be marked as globally cacheable (the same across all sessions), session-scoped (consistent within a single agent session), or request-scoped (may differ per call). This gives server authors a clean way to express whether tool availability is static or dynamic.

Header-Based Routing

HTTP requests under the new spec now include Mcp-Method and Mcp-Name headers that identify the protocol method being called and the specific tool or resource being accessed — without requiring the caller to parse the JSON request body. This enables API gateways, web application firewalls, and load balancers to route and meter MCP traffic by method and resource type purely at the header layer.

In enterprise environments where API gateways enforce rate limits, apply authentication middleware, and route requests to different backend pools based on operation type, this header-based metadata is the difference between MCP traffic being opaque to infrastructure tooling and being fully observable and controllable.

Governance and SDK Support

The Agentic AI Foundation (AAIF), a Linux Foundation directed fund, now formally governs the MCP specification. Founding members at the platinum tier include Anthropic, OpenAI, Block, Google, and Microsoft — the five organizations whose AI agents collectively generate the majority of real-world MCP traffic. The governance structure establishes a formal process for submitting, reviewing, and ratifying spec changes, replacing the informal Anthropic-led process that governed earlier versions.

The TypeScript, Python, Go, and C# SDK implementations have all been updated to the 2026-07-28 specification. A Rust SDK is available in beta. Java and Swift SDK updates are expected to follow within 60 days.

Developers upgrading existing MCP integrations will need to handle three breaking changes: the removal of session identifiers from request handling, the transition from Dynamic Client Registration to CIMD for credentials, and the migration away from the deprecated HTTP+SSE transport. The spec changelog includes a migration guide that the SDK authors reviewed prior to publication, and early adopter feedback during the beta period improved the upgrade path substantially.

For developers building agentic AI systems today, the 2026-07-28 spec is effectively a new foundation — one that trades the operational simplicity of a stateful protocol for the scalability, security, and composability that production-grade enterprise AI systems require.