MCP 2026-07-28: What Breaks and How to Migrate

The Model Context Protocol (MCP) 2026-07-28 spec, finalized on July 28, rewrites the protocol core from stateful to stateless, deprecates Sampling, Roots, and Logging with a 12-month grace period, and introduces a formal extensions framework. Cloudflare's Agents SDK v0.20.0 and GitHub added support before release, enabling serverless deployment without special configuration. The update also aligns MCP with OAuth 2.1 and OpenID Connect, and introduces MCP Apps and Tasks extensions.

The Model Context Protocol just shipped its most significant update since launch. MCP 2026-07-28, finalized on July 28, rewrites the protocol core from stateful to stateless, deprecates three features that many production servers depend on, and introduces a formal extensions framework. If you’re running an MCP server, this post is your checklist. If you’re building one now, this is the spec to build against. The Stateless Core: The Change That Actually Matters Everything else in this release is secondary to one architectural decision: MCP is now stateless at the protocol layer. The Mcp-Session-Id header is gone. The initialize handshake that established sessions is gone. Each request is now self-contained, carrying the protocol version and client identity it needs. Any healthy server instance can handle any request. This sounds simple. The implications are not. Prior to this spec, running a remote MCP server required sticky sessions, a shared session store, and deep packet inspection at the gateway — just to keep requests routing to the right server instance. Horizontal scaling was painful. Serverless deployment was essentially off the table. Now you can run an MCP server behind a plain round-robin load balancer. You can deploy it on Cloudflare Workers or AWS Lambda with no special configuration. Cloudflare’s Agents SDK v0.20.0 https://developers.cloudflare.com/changelog/post/2026-07-27-agents-sdk-v0.20.0-mcp-sdk-v2/ , released the day before the spec, already supports it — Workers can now serve tools, prompts, and resources without Durable Objects. GitHub added support five days before release. These aren’t trailing adopters; they were ready before the ink dried. What’s Actually Deprecated And the Replacements SEP-2577 https://modelcontextprotocol.io/seps/2577-deprecate-roots-sampling-and-logging puts three MCP features on the deprecation path: Sampling , Roots , and Logging . There’s a 12-month grace period — nothing breaks until mid-2027. But if you’re building something new, don’t build on these. Sampling let servers ask the client’s LLM to do inference — a clever design for keeping model selection in the client’s hands. In practice, it created tight coupling and made servers hard to test independently. The replacement: call your LLM provider’s API directly. Anthropic SDK, OpenAI SDK, whatever fits your stack. Roots let servers declare filesystem or resource roots. The replacement is simpler: use tool parameters and resource URIs. Less magic, more debuggable. Logging was structured log emission from server to client. Servers on stdio should write to stderr now. Servers over HTTP should use OpenTelemetry — the spec now explicitly documents W3C Trace Context propagation through meta . Auth Is Finally Serious: OAuth 2.1 and OIDC Six Specification Enhancement Proposals in this release align MCP with OAuth 2.1 and OpenID Connect. MCP servers now formally position as OAuth 2.1 resource servers, with iss parameter validation per RFC 9207. Dynamic Client Registration adds an application type field that stops authorization servers from rejecting localhost redirects for desktop and CLI apps — a longstanding annoyance. The practical result: Microsoft Entra and Okta now integrate cleanly without workarounds. If your MCP server is destined for enterprise environments, this is what you’ve been waiting for. The ecosystem is converging on proper auth, and aligning now saves pain later. Extensions: MCP Apps and Tasks The 2026-07-28 spec ships a formal extensions framework using reverse-DNS identifiers negotiated via capability maps. Two extensions land in the first wave. MCP Apps SEP-1865 enables server-rendered UIs embedded inside agent and chat interfaces. Every UI-initiated action routes through the same JSON-RPC base protocol as a direct tool call — same audit path, same consent flow. No back channels. Tasks moves out of the experimental core and into the io.modelcontextprotocol/tasks extension. The lifecycle is now poll-based and client-driven: a server responds to a tools/call with a task handle, and the client drives it with tasks/get , tasks/update , and tasks/cancel . The old tasks/list is removed. Your 10-Step Migration Checklist If you have an MCP server in production, here is where to start. Refer to the official MCP 2026-07-28 release notes https://blog.modelcontextprotocol.io/posts/2026-07-28/ and the SDK migration guide https://blog.modelcontextprotocol.io/posts/sdk-betas-2026-07-28/ for the full details. - Audit your server for session state dependencies - Remove Mcp-Session-Id handling from your transport layer - Move any required state to the client or an external store - Implement OAuth 2.1, or integrate your identity provider SDK - Replace sampling calls with direct LLM API calls - Replace roots with explicit tool parameters and resource URIs - Replace MCP logging with stderr stdio or OpenTelemetry HTTP - Update your SDK: pip install mcp =2.0 for Python; new package names for TypeScript - Test with MCP Inspector, updated for the new spec - Deploy behind a round-robin load balancer — sticky sessions are no longer needed Python and TypeScript SDKs are at v2.0.0 stable. Go, Rust, and C are in beta. TypeScript v2 uses new package names — installing the old package name without pinning won’t get you v2. The Bigger Picture MCP was always the right idea: a standard protocol for connecting AI models to tools and data. The stateful architecture made production deployments genuinely hard. This release fixes that. Stateless on commodity HTTP, real OAuth for enterprise, an extensions framework that can grow without breaking the core — this is the foundation that makes MCP viable at scale, not just in demos. The 12-month deprecation window is generous. You have time. Use it to migrate deliberately, not reactively, and start building new servers on the 2026-07-28 spec today.