MCP 2026-07-28: Protocol's Largest Architectural Reset Goes Stateless
The Model Context Protocol reached a milestone on May 21 when the 2026-07-28 release candidate was locked — the biggest revision since MCP debuted. The final spec ships July 28, and the 10-week validation window is active now.
What Changed
The protocol goes fundamentally stateless. The initialize handshake is gone — metadata now travels in _meta on every request. Session IDs are removed entirely. Servers can now sit behind plain round-robin load balancers with no sticky-session requirement.
New required headers for Streamable HTTP — Mcp-Method and Mcp-Name — let API gateways route and rate-limit without inspecting the request body. Servers must reject requests where headers disagree with the body.
The extension framework is a structural improvement. Extensions now use reverse-DNS identifiers, their own ext-* repositories, and independent versioning. Two official extensions ship at launch:
- MCP Apps — server-rendered HTML in sandboxed iframes
- Tasks — long-running work with
tasks/get,tasks/update, andtasks/cancel
Deprecations With a Long Window
Three features are annotation-only deprecated (no immediate action required, but new projects should design around the future direction):
- Roots → moving to tool parameters
- Sampling → moving to direct LLM integration
- Logging → moving to OpenTelemetry
Other changes: full JSON Schema 2020-12 support, client-side caching with ttlMs/cacheScope on tools/list, and OAuth hardening requiring iss validation per RFC 9207.
Enterprise Adoption Accelerating
- ServiceNow Action Fabric MCP Server is GA
- Microsoft Copilot Studio remote MCP servers with Entra ID support
- Anthropic self-hosted sandboxes for Claude in customer-controlled environments
For infrastructure teams: the window between now and July 28 is the migration period. If you maintain MCP servers with session-based state, start refactoring now. The OpenClaw 2026.6.6 stable release (June 12) already supports the new protocol direction.