MCP 2026-07-28 Spec: Stateless Core, Breaking Changes, and Migration Guide

The MCP 2026-07-28 specification is a major overhaul. It fundamentally shifts architecture toward a stateless core, removing persistent sessions to align with standard HTTP infrastructure scaling patterns.

The shift to stateless architecture

This update moves away from complex state management. The protocol core is now stateless, removing the initialize handshake and protocol-level sessions entirely https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/. Every request is self-contained. Developers can treat MCP interactions like standard web API calls, simplifying server deployment and enabling horizontal scaling using existing load balancers and cloud infrastructure without sticky sessions. We no longer need complex connection pools. The removal of state reduces operational overhead and improves reliability for high-traffic AI coding environments.

Key pillars of the 2026 roadmap

The release candidate locked on May 21, 2026. This initiated a validation period before the final specification ships on July 28, 2026 https://stacktr.ee/blog/mcp-2026-spec-changes. Teams possess a distinct window for action. They can test migrations and update SDKs, while the roadmap emphasizes interoperability and security to ensure AI applications connect to external systems with the ease of USB-C devices. Uniform standards curb fragmentation. It accelerates developer productivity and supports better token optimization, as context management no longer requires maintaining session state across multiple requests, leading to direct cost savings for organizations running large-scale AI deployments. We view this as a maturation of the protocol. It makes AI integration routine rather than niche, with strong community response indicating broad interest in these structural improvements.

The mcp 2026-07-28 spec eliminates the initialize handshake to enforce a stateless core architecture. This fundamental shift removes protocol-level sessions and replaces them with self-contained HTTP requests. Developers gain significant token optimization benefits by discarding persistent connection overhead.

Eliminating protocol-level sessions

Previous versions relied on a bidirectional handshake. This mechanism forced clients and servers to maintain state across multiple interactions, but the new specification deprecates this approach entirely so every request now carries its own context. This simplifies context management. It removes the need for servers to track client-specific session data in memory, aligning better with modern cloud infrastructure where horizontal scaling becomes trivial when no session affinity is required. Load balancers distribute traffic freely. They do not need to inspect payload content, and the protocol now uses standard HTTP headers like Mcp-Method to convey method information, allowing routers to direct traffic efficiently and reduce latency spikes caused by sticky sessions.

Impact on developer productivity and latency

Removing the handshake reduces round trips. This reduction directly improves response times for AI coding tools, so developers no longer wait for session initialization before sending queries. The endpoint is immediately available. This enhances the perceived speed of integrated development environments, while statelessness also lowers operational complexity because teams do not need to implement cleanup logic for abandoned sessions. Fewer bugs occur. State desynchronization issues vanish, and we see clearer error handling because each request is independent, meaning if one request fails, it does not corrupt a broader session state, improving reliability in distributed systems. The shift encourages better developer productivity. Engineers can apply familiar HTTP caching and retry strategies without learning custom session recovery mechanisms, decreasing the learning curve as the protocol mirrors standard web practices and allowing teams to reuse existing infrastructure components. Cost savings emerge from reduced resource consumption. Servers use less memory because they do not store session objects, translating to lower infrastructure bills, and we recommend updating SDKs to leverage these improvements since early adopters report faster integration times and more stable connections. The removal of the handshake is decisive. It is a step toward a mature, scalable protocol.

Which legacy features are deprecated in the 2026-07-28 spec?

The mcp 2026-07-28 spec deprecates Roots, Sampling, and Logging to strip unnecessary complexity from the protocol core. This strategic reduction simplifies implementation. It signals that these features will likely face removal in future revisions, so we must treat these changes as critical breaking updates rather than optional improvements.

Deprecation of Roots and Sampling

Roots and Sampling managed early context. Roots allowed servers to hint at filesystem structures, while Sampling enabled clients to request model completions from the server side, but these features introduced significant state management overhead that hindered scalability according to protocol architects. The 2026-07-28 specification explicitly lists Roots, Sampling, and Logging as deprecated features. Teams using Roots must adapt their workflows. Many teams are shifting toward standard HTTP-based discovery endpoints or client-side indexing strategies, aligning with the broader move toward a stateless architecture, while Sampling deprecation affects tools that previously offloaded lightweight inference tasks to the server. Handle sampling logic on the client side. Use client applications or dedicated AI service APIs instead, as this separation of concerns improves developer productivity by clarifying responsibility boundaries where the client handles user interface and interaction logic. The server concentrates on data handling. It executes tools strictly, which keeps responsibilities clear.

Changes to Logging standards

Logging capabilities are also deprecated. Previously, servers could push log messages directly to the client through the JSON-RPC channel, mixing operational telemetry with functional data streams, which created noise in the primary communication channel and complicated error handling. The new specification encourages out-of-band solutions. You should direct server logs to standard output streams or dedicated observability platforms, and while this change does not mean immediate removal of existing logging code, deprecation serves as a warning flag for future incompatibility. Existing implementations remain functional. They work during the transition period, but relying on protocol-level logging creates technical debt since future SDK updates may drop support for these deprecated methods entirely, so we recommend refactoring your logging infrastructure now. Adopt established logging libraries. Apply infrastructure-as-code patterns for telemetry to ensure long-term stability and easier debugging, while also reducing the payload size of each JSON-RPC message to contribute to better network efficiency. Smaller payloads provide significant benefits. They support the overall goal of token optimization in AI coding environments, and by moving logging out of the protocol, we reduce the context window pressure on large language models, leading to more accurate responses and lower operational costs.

How do MCP Apps and Tasks extend the core protocol?

MCP Apps and Tasks add essential features. They enable interactive interfaces and asynchronous processing without compromising the new stateless architecture, allowing servers to deliver rich user experiences and handle prolonged operations while maintaining the efficiency of ordinary HTTP infrastructure.

Server-rendered UIs with MCP Apps

MCP Apps represent a major expansion. It marks an expansion of what the protocol can achieve beyond simple data exchange, defining MCP Apps as server-rendered user interfaces that execute directly within AI clients to shift the rendering burden from the client to the server. Presentation remains consistent across hosts. It works across different host environments, and by embedding UI logic in the server, we reduce the complexity required on the client side, where the client merely acts as a viewport for the content provided by the server. This approach matches the strategic vision. As noted in the documentation, MCP functions like a USB-C port for AI applications, providing a standardized way to connect systems Model Context Protocol Documentation, and MCP Apps leverage this standardization to deliver interactive components that feel native to the user. Engineers can construct intricate dashboards. Configuration panels update in real time, and the stateless core ensures that each UI interaction is a self-contained request, preventing the accumulation of stale session data and simplifying scaling because any server instance can render any part of the interface. Sticky sessions are no longer required. Complex state synchronization between nodes is gone, resulting in a more resilient system that handles traffic spikes with ease.

Managing long-running work with Tasks

Async operations pose specific challenges. Traditional methods often rely on persistent connections to track progress, but the Tasks extension solves this by providing a structured way to manage long-running work, allowing servers to initiate processes that may take seconds or minutes to complete. The client gets immediate acknowledgment. It gets a task identifier immediately, and can then poll for status updates or wait for a completion signal, decoupling the initiation of work from its execution. The Tasks extension handles long-running work and async operations without blocking the main communication channel. This decoupling is crucial. It maintains responsive AI coding tools, allowing users to trigger heavy computations or large file transfers without freezing the interface, while the server tracks the task state internally or in an external store. Status checks use HTTP. This approach fits naturally into the stateless model, avoiding the overhead of maintaining open websockets or long-polling connections, and we see improved reliability because transient network issues do not break the task context. Clients may retry status checks. It works from any network location, supporting distributed systems where clients and servers may not share a direct, persistent link, and it also aids in token optimization by keeping the active context small so only relevant status information travels over the wire. Efficiency drives cost reduction. It helps high-volume deployments significantly.

What are the new authorization and security requirements?

Stricter security standards define the MCP 2026-07-28 specification. It hardens OAuth flows and mandates routable headers for request context, aligning the protocol more closely with standard OpenID Connect deployments while removing legacy session-based authentication mechanisms, so we must adapt our AI coding infrastructure to support these stateless security models.

Security is a top priority. Developers integrate external systems with large language models, and the new release candidate aligns authorization processes more closely with established OAuth and OpenID Connect deployments source, reducing the custom security burden on server implementers. Organizations trust established providers. They avoid maintaining bespoke authentication logic, and stateless authentication eliminates the risk of session hijacking because previous versions relied on persistent connections that could expose long-lived tokens. Short-lived tokens are now mandatory. These are validated per request, minimizing the attack surface for AI coding environments where multiple agents may access shared resources, and we see a direct improvement in security posture without sacrificing performance.

Routable headers and security context

The protocol uses specific HTTP headers. Developers must include routable headers like Mcp-Method to ensure proper traffic handling source, allowing load balancers and security gateways to inspect requests without parsing the entire JSON-RPC payload. This design supports efficient context management. Security policies can be applied at the network edge, preventing unauthorized methods from reaching the core application logic, and we recommend updating middleware to validate these headers before processing any request. Ignoring this leads to rejects. Connections will fail in production environments, so adopting these changes requires careful testing to ensure your identity provider supports the required OAuth scopes and that your reverse proxy preserves the new headers during transit. These steps are critical. They ensure a smooth migration, keeping your MCP servers secure and compliant with the latest standards, while the effort invested here pays dividends in reduced security incidents and simplified audit trails.

How should developers migrate existing MCP servers to the new spec?

Migrating to the mcp 2026-07-28 spec requires a fundamental shift. We move from persistent sessions to stateless HTTP requests, requiring us to refactor server logic to handle self-contained calls and update dependencies to support the new protocol constraints, eliminating the initialize handshake and protocol-level sessions.

Refactoring for stateless HTTP

The most significant change involves removing persistence. The 2026-07-28 revision removes both the initialize handshake and the protocol-level session, making every request self-contained, so we need to strip out any server-side memory that tracks user state between JSON-RPC calls. Pass context via headers. Use standard HTTP headers or the request payload itself, aligning with the new requirement for routable headers like Mcp-Method which allow infrastructure to route traffic without inspecting the payload body. By making requests independent, we enable scaling. Standard HTTP load balancers distribute traffic efficiently, and this shift directly supports token optimization by reducing the overhead of maintaining session state in memory.

Updating SDKs and dependencies

We must upgrade our SDKs. Use beta versions that support the 2026-07-28 release candidate, as these beta releases include the necessary changes to handle the new stateless core and the updated authorization flows, with the release candidate locked on May 21, 2026 Source: stacktr.ee. Verify your dependencies carefully. Ensure they no longer attempt to negotiate a session ID during the connection phase, and rewrite any custom middleware that relied on the old initialize method to extract context from incoming HTTP headers, ensuring compatibility with the hardened OAuth flows now required by the spec.

Common migration pitfalls

A frequent mistake is assuming persistence. TCP connections do not remain persistent for the duration of a user session, leading to errors when the server fails to find expected session state, so we must treat every incoming request as a new interaction. Another pitfall is neglecting headers. The spec now aligns more closely with OpenID Connect deployments, requiring stricter validation of tokens on every request, and failing to update these checks results in immediate authentication failures. We should audit our code. Look for deprecated features like Roots and Sampling, and while not immediately removed, relying on them creates technical debt, so testing these changes early helps identify cost savings opportunities by reducing redundant context transmission. This careful refactoring ensures robustness. Our servers remain efficient under the new stateless model.

What is the impact on AI coding tool performance and costs?

The stateless architecture of the MCP 2026-07-28 spec improves performance. It directly improves response times and reduces token costs, enabling standard HTTP infrastructure to scale efficiently while minimizing context management overhead by eliminating persistent sessions.

Removing the initialize handshake helps. Every request is now self-contained, allowing load balancers to distribute traffic without sticky sessions or complex state tracking, resulting in lower latency for individual calls and higher throughput for concurrent users. We see immediate gains. Developer productivity increases because tools respond faster and handle more requests per second, while efficient context management drives significant cost savings since stateless requests carry only the necessary data. This avoids bloat. It avoids maintaining long-lived session states, reducing the number of tokens sent in each exchange, and lower token usage translates to direct financial benefits for teams running large-scale AI coding operations. The core of the protocol is now stateless. This simplifies the data payload and cuts unnecessary computation, benefiting large-scale deployments as infrastructure costs drop because servers require less memory and processing power to manage state. Teams can support more developers. They do so with the same hardware resources, and the release candidate for MCP 2026-07-28 delivers these performance improvements as part of the largest revision since launch. We observe that stateless patterns align. They fit modern cloud-native environments, ensuring that AI coding tools remain responsive and cost-effective as usage scales.

The vexp project offers a practical example of how stateless MCP interactions can be implemented in modern AI coding environments.