The MCP team has shipped the 2026-07-28 Release Candidate of the specification, pushing the Model Context Protocol fully toward a stateless protocol layer — the largest breaking change since MCP launched in 2024.

Three key changes:

  • Mcp-Session-Id header and protocol-level session removed (SEP-2567)
  • initialize/initialized handshake deprecated (SEP-2575)
  • Servers no longer required to hold SSE long connections

Multi-turn requests are reshaped as "InputRequiredResult + requestState": when the server needs additional input, it returns a structured result; the client puts the answer plus the echoed requestState back into the original request, and any instance can pick up the retry.

Engineering-friendly changes are equally critical. Two new headers — Mcp-Method and Mcp-Name — let load balancers, gateways, and rate limiters route by operation without parsing the body; tools/list and resources/read responses now carry ttlMs and cacheScope, reusing HTTP Cache-Control semantics; W3C Trace Context keys (traceparent, tracestate, baggage) are pinned in _meta, so distributed tracing keeps a single span tree across SDKs, gateways, and downstream services.

The Extension system is now formalized. SEP-2133 assigns reverse-DNS IDs to extensions, with independent ext-* repos, independent versioning, and independent maintainers. This RC promotes two extensions to official status: MCP Apps (SEP-1865) lets servers render interactive HTML UIs in a sandboxed iframe; Tasks (PR #2663) rebuilds the 2025-11-25 experimental capability around the stateless model — tool calls return a task handle, and clients drive it via tasks/get, tasks/update, tasks/cancel. On the authorization side, six SEPs align with OAuth 2.0 / OpenID Connect.

The most thought-provoking trade-off is "stateless protocol, stateful application." MCP no longer manages sessions for you, but lets servers explicitly mint handles like basket_id and browser_id in tool calls and pass them back as ordinary parameters. The team's disclosed practice shows that "the model threading handles across multi-step calls" is more powerful than a session hidden in transport metadata — the model can compose across tools, reason, and exchange handles. MCP pushes state from the protocol layer down into the model, letting the agent truly see what it holds.

Breaking changes need to be migrated quickly. The final spec ships July 28; teams running production MCP should prioritize evaluating client compatibility and the Tasks API migration path.