Jonathon's AI Wiki

MCP 2026-07-28 Spec — Stateless Core, First-Class Extensions, Auth Hardening

8 min read

Source: ai-research/claude-blog-mcp-2026-07-28-spec.md (Anthropic, “Bringing MCP 2026-07-28 to Claude”, 2026-07-28), ai-research/modelcontextprotocol-2026-07-28-release.md (MCP blog, “The 2026-07-28 Specification”, 2026-07-28), raw/x-account-claudedevs-2082164248697069935.md, raw/reddit-1v97e2v.md

The fifth spec release of the Model Context Protocol, 2026-07-28, shipped on July 28, 2026 — the release candidate had been locked since May 21, 2026, giving SDK maintainers a ten-week validation window. It is the largest revision since MCP launched: the protocol core goes stateless (bidirectional stateful becomes request/response), authorization is hardened toward production OAuth 2.0/OIDC, a formal deprecation policy lands, and extensions become a first-class versioned framework. Anthropic announced same-day that support is rolling out across Claude products.

Key Takeaways

  • The protocol is now stateless at the core. The initialize/initialized handshake and the Mcp-Session-Id header are retired (SEP-2575, SEP-2567). Every request is self-describing — protocol version, client identity, and capabilities travel inline in _meta — so any request can land on any server instance behind a plain round-robin load balancer, with no sticky routing and no shared session store.
  • Serverless and edge deployment become first-class. Per Anthropic, moving to a request/response model means servers “can now deploy on serverless and edge infrastructure” — the session-management overhead that horizontal scaling had to work around is gone from the protocol.
  • Extensions are formalized, with three named examples: MCP Apps (interactive UIs rendered in-conversation; the launch thread describes them as sandboxed iframe UIs), Tasks (long-running/async work, now the io.modelcontextprotocol/tasks extension), and Enterprise Managed Authorization (EMA — org-wide connector provisioning through identity providers). Capabilities can now be added without changing the core protocol.
  • Auth aligns with production OAuth 2.0/OIDC. RFC 9207 issuer validation, issuer-bound client credentials, application_type so authorization servers stop rejecting localhost redirects for desktop/CLI apps — and Dynamic Client Registration (DCR) is formally deprecated in favor of client metadata documents (CIMD). Anthropic’s framing: MCP servers connect to enterprise identity systems like Entra or Okta “without workarounds.”
  • A formal deprecation policy with a twelve-month minimum window. Roots, Sampling, and Logging are deprecated (SEP-2577) but keep working for at least twelve months; the legacy HTTP+SSE transport gets the same year-long offramp. New implementations should not adopt any of them.
  • SDKs shipped day one. All four Tier 1 SDKs (TypeScript, Python, Go, C#) speak 2026-07-28 at release, with migration notes for the breaking parts; the Rust SDK supports it in beta.
  • Scale context: MCP passed 400M monthly SDK downloads (4x growth this year) per Anthropic; the MCP blog cites close to half a billion monthly across Tier 1 SDKs, with TypeScript and Python each crossing 1 billion total downloads. Claude’s connectors directory lists 950+ MCP servers.

The stateless core — what actually changed

Versus the prior session-state model (2025-11-25 and earlier, where a client had to initialize first and carry a session ID):

  • No handshake, no sessions. initialize/initialized and Mcp-Session-Id are gone. Each request carries its protocol version, client info, and capabilities in _meta (e.g. _meta["io.modelcontextprotocol/clientInfo"]).
  • Optional discovery. A new server/discover RPC lets a client learn server capabilities up front, but it is not required.
  • Load-balancer-friendly by construction. Any request can hit any instance with no shared storage — the MCP blog’s example is a bare POST /mcp carrying MCP-Protocol-Version: 2026-07-28 plus routing headers.
  • Header-based routing. Streamable HTTP requests must now include Mcp-Method and Mcp-Name headers (SEP-2243), so gateways, rate limiters, and WAFs can route and meter without parsing JSON bodies.
  • Multi Round-Trip Requests (MRTR, SEP-2322) replace the server-initiated elicitation/create, sampling/createMessage, and roots/list calls that needed a held-open stream. A tool needing mid-call input returns resultType: "input_required" with the requests it needs answered; the client retries the original call with answers in inputResponses.
  • Cacheable list results. tools/list, prompts/list, resources/list, and resources/read responses now carry ttlMs and cacheScope (SEP-2549) so clients can cache tool catalogs and cut re-fetching.
  • Stateless protocol ≠ stateless application. The maintainers’ recommended pattern for cross-call state: mint an explicit handle from a tool and have the model pass it back as an argument. They found this works better than session state hidden in the transport — the model can see the handle and thread it between tools.

Extensions framework

  • The release “formally lock[s] in on a proper extensions framework” — a versioned path to add capabilities without touching the core protocol.
  • MCP Apps — servers render interactive UI directly in the conversation; users work with a connector inline without switching tabs. Described in the launch thread as sandboxed iframe UIs. Already live in Claude (“Interactive tools in Claude”).
  • Tasks — moves out of the experimental core into the io.modelcontextprotocol/tasks extension (SEP-2663): poll-based tasks/get, a new tasks/update, and change notifications via a single subscriptions/listen stream clients opt into per notification type.
  • Enterprise Managed Authorization (EMA) — named alongside MCP Apps and Tasks in the extensions list. On the Claude side, enterprise-managed auth lets admins provision MCP connectors org-wide through their identity provider: authorize once, users inherit access via existing IdP groups, connected on first login (zero-touch for end users).

Auth hardening (detail)

  • Authorization servers should return the iss parameter per RFC 9207; clients must validate it before redeeming a code.
  • Clients set application_type during registration so authorization servers stop rejecting localhost redirect URIs for desktop and CLI apps.
  • Client credentials are bound to the issuer that minted them.
  • DCR is formally deprecated in favor of CIMD (client metadata documents).

Rollout to Claude surfaces

  • Anthropic: “Support is being rolled out across Claude products” — “soon,” with no per-surface dates given.
  • The Claude-side MCP stack this spec lands into, per the same post: 950+ servers in the connectors directory used by millions daily; MCP Apps (in-conversation UI); enterprise-managed auth; observability dashboards for published connectors (adoption, errors, latency, per-product usage); and MCP tunnels (research preview) for reaching private-network MCP servers with no inbound firewall rules or public endpoints — see MCP tunnels.
  • Ecosystem partners quoted building on the new spec since beta: Figma, Intuit, Netlify, PostHog, Xero, Zoom.
  • First concrete Anthropic-side client movement: anthropic-sdk-python v0.120.2 (released 2026-07-28, raw/anthropic-watch-anthropic-sdk-python-tag-v0-120-2.md) ships “support mcp sdk v2 alongside v1” (PR #300) — the Anthropic Python SDK can now sit on the new-generation MCP SDK without dropping v1 compatibility.

Try It — what an MCP server owner should do now

  1. Upgrade your SDK. All four Tier 1 SDKs (TypeScript, Python, Go, C#) support 2026-07-28 today with migration notes; Rust is in beta. Expect the most migration work if you depended on session identifiers.
  2. Move session state to explicit handles. If your server keyed anything off Mcp-Session-Id, refactor to the handle-in/handle-out pattern the maintainers recommend — return a handle from a tool and accept it back as an argument.
  3. Honor the new required headers. Streamable HTTP requests now carry Mcp-Method and Mcp-Name; your gateway can route, authorize, and rate-limit on them directly.
  4. Emit cache hints. Add ttlMs and cacheScope to tools/list / prompts/list / resources/list / resources/read responses so clients stop re-fetching your catalog.
  5. Stop adopting deprecated surfaces. Roots, Sampling, Logging, and the HTTP+SSE transport still work for at least twelve months, but new implementations shouldn’t use them; server-initiated interactions move to MRTR.
  6. Modernize auth. Validate RFC 9207 iss, plan the DCR-to-CIMD move, and if you serve enterprises, look at the EMA extension so admins can provision your connector through their IdP.
  7. Use the deprecation window deliberately. The formal policy guarantees a twelve-month minimum before removals — plan upgrades instead of reacting ^[inferred: the planning framing is the stated purpose of the policy; the scheduling advice is ours].
  8. Rethink infrastructure. Stateless means serverless/edge hosting and plain round-robin load balancing are now viable deployment targets without sticky-session workarounds.

Open Questions

  • No dates or per-surface order for the Claude rollout — “rolling out soon” is all either post commits to. Which of Claude Code / claude.ai / Cowork / the Agent SDK gets 2026-07-28 client support first is unstated.
  • Claude Code’s current MCP client features documented in mcp (WebSocket transport, roots/list, elicitation dialogs, list_changed) are built on the pre-2026-07-28 stateful model; how each maps onto the stateless spec (e.g., elicitation dialogs onto MRTR) is not yet documented.
  • Whether Claude’s connectors directory will require or prefer 2026-07-28 for new submissions is not stated.
  • The full contents of the authorization changes beyond the four recovered items (the source page renders some auth prose only as token markers) — the spec changelog at modelcontextprotocol.io/specification/2026-07-28 is the authoritative list.

Graph View

Backlinks