Model Context Protocol Drops Session State in Its Biggest Change Yet

The maintainers of the Model Context Protocol (MCP) released a new version of the protocol specification on July 28, 2026, dated 2026-07-28. The update strips out the concept of sessions, which MCP had relied on since its launch, and replaces it with a stateless model built around individual requests. The maintainers call it the biggest overhaul since authorization was added.

MCP is an open standard that Anthropic introduced in 2024 to standardize how language models and AI agents connect to external tools, databases, and corporate systems. In December 2025, Anthropic handed the protocol over to the Agentic AI Foundation, a body run by the Linux Foundation and co-founded with Block and OpenAI, backed by Google, Microsoft, AWS, Cloudflare, and Bloomberg. Since then, MCP has become one of the fastest-growing standards in the AI ecosystem, with support in ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot, and Visual Studio Code.

The End of Sessions

Until now, every interaction with an MCP server required creating and maintaining a session identified by the Mcp-Session-Id header, which forced so-called sticky sessions, shared state stores, and deep packet inspection at network gateways. The new specification removes that requirement entirely. Information about the protocol version, client identity, and client capabilities now travels in the _meta field attached to every single request, similar to how Anthropic's stateless Messages API works for Claude.

In place of earlier requests that required open streams, such as elicitation/create or sampling/createMessage, the spec introduces a Multi Round-Trip Requests mechanism. It lets a tool ask the user for additional data mid-task, without needing to keep a connection open for the entire duration of the operation.

Routing and Caching at Scale

Requests must now carry Mcp-Method and Mcp-Name headers, letting API gateways and rate-limiting mechanisms route traffic without parsing JSON-RPC payloads. List responses gained ttlMs and cacheScope fields, letting clients decide for themselves how long to keep results cached. On the authorization side, the spec implements RFC 9207, enforces token issuer validation, and replaces Dynamic Client Registration with Client ID Metadata documents.

These are probably the most significant changes we've made to the specification since we added authorization - David Soria Parra, Anthropic technical staff, MCP co-creator

What's Leaving the Protocol Core

Sampling, a feature letting MCP servers ask the model to complete text, was judged confusing and hard to implement correctly. Roots, a mechanism for pointing clients to relevant file system locations, was called a niche use case by the protocol's creators. Logging has been replaced by standard stderr, stdio, and OpenTelemetry channels. The Tasks feature for managing long-running operations moved from the core into a formal extension with its own release cycle, based on polling via tasks/get and tasks/update. Deprecated elements will keep working for at least twelve months, but older and newer implementations may not interoperate without additional fallback mechanisms.

The four Tier 1 SDKs, TypeScript, Python, Go, and C#, support the new specification immediately, while the Rust SDK is available in beta. The team stresses that developers who keep their SDKs regularly updated will migrate smoothly, while those who built their own custom implementations face substantial work.

If you built your own implementation, you have quite a bit of work ahead of you to get it right - David Soria Parra, Anthropic technical staff

The Bill for Enterprises Deploying Agents

Craig McLuckie, CEO of Stacklok and a co-creator of Kubernetes, called the change a natural consequence of the protocol maturing. In his view, MCP's statefulness was a byproduct of its early days, when the protocol mostly handled local developer tools running on a developer's own machine. Today, companies use MCP to broker access to production systems, which demands a cloud-native architecture capable of consistent policy control and deployment at scale.

An MCP server running the new specification can sit behind an ordinary round-robin load balancer, with no shared state store and no need to track which node handles a given session. For teams responsible for AI agent infrastructure at scale, that means simpler deployments and lower failure risk when scaling up the number of concurrent connections.

For Polish development teams, who in recent months have increasingly connected coding agents to internal company systems via MCP, the change means reviewing their own integrations, especially where MCP servers were written from scratch instead of built on existing libraries. The twelve-month transition window gives them time, but companies planning new deployments should design for the stateless model from the start.