The Model Context Protocol’s 2026-07-28
specification goes final tomorrow — and it breaks more than it adds. Protocol-level sessions are gone. The initialize
handshake is gone. Mcp-Session-Id
is gone. Three first-class features are entering deprecation. If you run a production MCP server, especially a custom implementation, you need to know what changed before your tooling starts throwing errors you did not expect.
Sessions Are Gone. Here Is What Replaced Them. #
The original MCP spec required a multi-step ritual before any real work could happen: client sends initialize
, server responds with an Mcp-Session-Id
, client echoes that ID on every subsequent request. Simple enough locally, but disastrous at scale — it pinned every client to a specific server instance, forcing sticky load balancer routing and making horizontal scaling a mess of shared session stores and bespoke gateway logic. As Arcade founding engineer Nate Barbettini put it: “Now every one of those machines has to know about a session ID that some other machine handed out. It’s not impossible, but it’s a serious pain.”
The new spec cuts all of that. Protocol version, client identity, and capabilities now travel in _meta
on every request. A new server/discover
method — mandatory to implement — lets clients fetch server capabilities when they need them. Two new HTTP headers, Mcp-Method
and Mcp-Name
, move routing information out of the JSON-RPC body so gateways can route traffic without parsing request payloads. The upshot: any request can land on any server instance. Plain round-robin load balancing works now. Auto-scaling works. Serverless deployment works.
The Quiet Breaking Change You Will Miss #
The session removal is obvious enough that most teams will catch it. The error code change probably will not get caught until something breaks in production. Missing resource errors previously returned -32002
— an MCP-custom code. The new spec shifts this to -32602
, the JSON-RPC standard Invalid Params. Any client code that pattern-matches on -32002
will either silently swallow errors or produce wrong behavior. Run a grep on that code before July 28.
Three Features You Should Stop Using #
Roots, Sampling, and Logging are formally deprecated under SEP-2577. They remain functional through July 2027 — the new lifecycle policy mandates a 12-month runway — but new implementations should skip them entirely.
Roots— URIs clients provided to scope server operations, such as a project directory for a code-analysis server. The fix: pass scope explicitly as tool parameters or resource URIs instead.Sampling— The mechanism that let servers request model completions from the client. Its semantics were, charitably, confusing. Replace with direct LLM API calls. The new Multi Round-Trip Requests pattern (InputRequiredResult
) handles server-initiated interactions without the model-routing ambiguity.Logging— Protocol-level log notifications. Switch tostderr
on stdio transports or OpenTelemetry for structured logging.
What Is New: Tasks and MCP Apps #
The Tasks extension graduates from experimental to official. It solves a genuine gap: long-running agent work that outlives a single connection. Servers respond to tools/call
with a task handle; clients drive execution with tasks/get
, tasks/update
, and tasks/cancel
. Combined with the stateless core, multi-step workflows spanning hours no longer require persistent connections or session affinity. MCP Apps is the second new official extension: servers can now render HTML UIs in sandboxed iframes with a JSON-RPC back-channel, opening the door to richer MCP client experiences beyond raw tool invocations.
Migration: SDK Users vs. Custom Builders #
If you are on an official SDK, the upgrade path is manageable. The v2 betas are available now for Python, TypeScript, Go, and C#. Python restructures the API (FastMCP becomes MCPServer) but preserves the decorator pattern. TypeScript ships a codemod that automates most of the transition: npx @modelcontextprotocol/codemod@beta v1-to-v2 .
. Go and C# take gentler paths with compatible versioning.
Custom implementations are a different story. Anthropic’s David Soria Parra was direct: “If you built your own implementation, it’s going to be a lot of uplift to make this correct.” Budget six to twelve weeks for large deployments. The mandatory work: remove all session management code, externalize per-session state to a shared store, implement server/discover
, add the required routing headers, and audit tool schemas against full JSON Schema 2020-12 — loose schemas that previously slipped through will now be rejected.
The Governance Change That Actually Matters Long-Term #
Buried in the release notes is a commitment worth noting: a formal 12-month deprecation policy. Features must move through Active then Deprecated then Removed with a minimum 12-month window at each stage. No more surprise removals. The developer frustration with ad hoc changes throughout 2025 was real, and this policy is a direct response. For anyone planning future MCP integrations — and with 97 million monthly SDK downloads and 41 percent of software organizations in production, that is a lot of people — that procedural change is arguably more important than any single feature in this release.