MCP goes stateless: the 2026-07-28 specification is released

The Model Context Protocol project released the stable 2026-07-28 revision of the specification on July 28, describing it as the largest revision since the protocol launched. The headline change is a stateless protocol core: the initialize/initialized handshake and the Mcp-Session-Id header are retired, every request carries its protocol version, client identity, and capabilities in _meta, and a new server/discover RPC (which servers must implement) advertises capabilities to clients that want them up front.

Server-initiated requests are redesigned as Multi Round-Trip Requests: a request that needs mid-call input returns an input_required result and the client retries with answers attached. Streamable HTTP requests must now carry Mcp-Method and Mcp-Name headers for header-based routing, and list results carry ttlMs and cacheScope cache hints.

The revision also formalizes an extensions framework (Tasks, MCP Apps, and Enterprise Managed Authorization), hardens authorization with RFC 9207 issuer validation and a shift from Dynamic Client Registration toward Client ID Metadata Documents, and adopts a feature lifecycle policy with a twelve-month minimum deprecation window. Roots, Sampling, Logging, and the legacy HTTP+SSE transport enter that window now. The TypeScript, Python, Go, and C# SDKs shipped 2026-07-28 support on release day, with the announcement reporting close to half a billion monthly SDK downloads.

See the MCP 2026-07-28 revision record for the full changelog summary and the adoption tracker for who ships it.