{"slug": "mcp-goes-stateless-what-the-july-28-spec-breaks", "title": "MCP Goes Stateless: What the July 28 Spec Breaks", "summary": "The Model Context Protocol's 2026-07-28 release candidate eliminates session-based architecture, removing the Mcp-Session-Id, initialize handshake, and sticky routing requirements. The change forces MCP server operators to update their implementations by July 28 to avoid breaking changes including new required headers, removal of SSE streams, and error code updates.", "body_md": "The Model Context Protocol’s session-based architecture has been a quiet production liability since day one — and in 27 days, it’s gone. The 2026-07-28 release candidate, [locked since May 21](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/), eliminates `Mcp-Session-Id`\n\n, the `initialize`\n\nhandshake, and sticky routing requirements in one sweep. If you’re running an MCP server today, you have until July 28 to understand what breaks and what to do about it.\n\n## Why Sessions Were a Liability\n\nThe original MCP spec required a session handshake on every new connection. Servers minted an `Mcp-Session-Id`\n\nthat pinned each client to a specific instance. On paper, fine. In practice, a distributed deployment disaster.\n\nThe failure mode was subtle and nasty: pod A handled `initialize`\n\nand issued the session ID, then the SDK’s long-lived SSE GET stream silently hashed to pod B — which knew nothing about that session — and returned a 404. Teams spent days debugging what looked like a network issue. The real culprit was a protocol-level assumption that every connection lands on the same machine. The fix was load balancer stickiness, which is infrastructure duct tape over a spec problem.\n\nThe [new spec removes the assumption entirely](https://aaif.io/blog/mcp-is-growing-up/).\n\n## What Stateless MCP Looks Like\n\nAs of the 2026-07-28 spec, there is no handshake. Protocol version, client identity, and capabilities travel in a `_meta`\n\nobject on every request. Any server instance can handle any request. You can run MCP behind a plain round-robin load balancer, route traffic on the new `Mcp-Method`\n\nheader, and scale horizontally without sticky sessions or shared session stores.\n\nApplication state didn’t disappear — it moved somewhere more honest. Tools now return explicit opaque handles (think a `basket_id`\n\nor `job_id`\n\n). The model can see these handles, reason about them, and pass them forward on subsequent calls. Your server stores actual state in Redis, PostgreSQL, or wherever makes sense. The state is visible to the agent, which makes debugging substantially easier and agent behavior more predictable.\n\n## 5 Breaking Changes in MCP Stateless 2026\n\nFive things break on July 28 if you don’t act:\n\n**Session initialization removed:** The`initialize`\n\n/`initialized`\n\nhandshake is gone. Replace capability discovery with the new`server/discover`\n\nRPC.**New required headers:** All Streamable HTTP requests must include`Mcp-Method`\n\nand`Mcp-Name`\n\nheaders. These enable gateway routing without payload inspection. Omit them and your requests will fail.**SSE streams eliminated:** Long-lived GET streams for SSE are replaced by the Multi Round-Trip Request pattern. Servers return`InputRequiredResult`\n\nwith an opaque`requestState`\n\n; clients echo it back on the follow-up request.**Tasks moved to extension:** If you’re using the core Tasks feature, it’s now a separate extension (SEP-2663) with a new polling lifecycle —`tools/call`\n\nreturns a handle, clients poll with`tasks/get`\n\n. The`tasks/list`\n\nmethod is gone.**Error code change:** Missing resources previously returned`-32002`\n\n. That’s now standard JSON-RPC`-32602`\n\n. Update any error handling that keys on the specific code.\n\n## Three Deprecations — Don’t Panic Yet\n\nRoots, Sampling, and Logging are deprecated as of July 28. They still work. The spec guarantees a minimum 12-month window before removal, meaning nothing breaks until at least July 2027. But start planning: Roots moves to tool parameters or resource URIs; Sampling moves to direct LLM provider APIs; Logging moves to stderr or OpenTelemetry. None of these are urgent today, but they’re on the clock.\n\n## What’s New Worth Watching\n\nThe spec ships two official extensions. MCP Apps (SEP-1865) lets servers render HTML interfaces in sandboxed iframes — tools declare UI templates, and all actions route through standard JSON-RPC audit/consent paths. It’s the first time MCP servers can ship embedded UIs without leaving the protocol’s security model. The Tasks extension (SEP-2663) replaces the old blocking pattern with a clean polling lifecycle that actually works without sessions.\n\nThe authorization layer also got a real upgrade. Six OAuth SEPs tighten the spec: clients must now validate the `iss`\n\nparameter per [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207) to prevent mix-up attacks, and OpenID Connect `application_type`\n\ndeclarations are required during Dynamic Client Registration. If you’re running MCP in multi-tenant or multi-server environments, [audit your auth code now](https://stacktr.ee/blog/mcp-2026-spec-changes).\n\n## Migration Checklist: Before July 28\n\n- Remove session initialization logic from your server\n- Update request handling to read protocol version from\n`_meta`\n\nfields - Add\n`Mcp-Method`\n\nand`Mcp-Name`\n\nheaders to all Streamable HTTP requests - Migrate any Tasks usage to the extension polling pattern\n- Audit OAuth/OIDC client registration against the six auth SEPs\n\nSDK 1.3.0 already supports the explicit-handle pattern, so you can start building stateless-compatible tools today. Tier 1 SDKs (Python and TypeScript) are expected to ship full spec support within the 10-week validation window, which closes right around July 28.\n\nThe session model was a workaround dressed up as architecture. Good riddance.", "url": "https://wpnews.pro/news/mcp-goes-stateless-what-the-july-28-spec-breaks", "canonical_source": "https://byteiota.com/mcp-goes-stateless-july-2026-breaking-changes/", "published_at": "2026-07-01 05:07:39+00:00", "updated_at": "2026-07-01 05:27:19.986818+00:00", "lang": "en", "topics": ["ai-infrastructure", "developer-tools", "large-language-models", "ai-agents"], "entities": ["Model Context Protocol", "MCP", "SEP-2663", "SEP-1865", "Redis", "PostgreSQL", "OpenTelemetry"], "alternates": {"html": "https://wpnews.pro/news/mcp-goes-stateless-what-the-july-28-spec-breaks", "markdown": "https://wpnews.pro/news/mcp-goes-stateless-what-the-july-28-spec-breaks.md", "text": "https://wpnews.pro/news/mcp-goes-stateless-what-the-july-28-spec-breaks.txt", "jsonld": "https://wpnews.pro/news/mcp-goes-stateless-what-the-july-28-spec-breaks.jsonld"}}