With version 2026-07-28, the Model Context Protocol (MCP) is undergoing its biggest overhaul to date. The core is becoming stateless: MCP is shifting from a bidirectional stateful protocol to a request/response model. This should make servers more reliable and scalable.
With the new version, the initialize/initialized exchange is being removed, along with the Mcp-Session-Id header. Each request now travels independently and carries the protocol version, client identity, and capabilities in _meta. If a client wants to know a server’s capabilities in advance, there is a new server/discover RPC. This is not mandatory.
The result: any request can be routed to any server instance behind a simple round-robin load balancer, without shared storage. Method and tool names are carried in the `Mcp-Method` and `Mcp-Name` headers, allowing gateways and firewalls to route based on headers rather than parsing JSON bodies.
Server-to-client requests such as sampling and elicitation have been redesigned using Multi Round-Trip Requests (MRTR). These replace the permanently open streams. If a tool requires user input midway through, the server returns `resultType: "input_required"`, and the client resends the original request, including the responses.
Authorization tackled head-on
According to the developers, authorization is the area that requires the most integration time during implementation. These vulnerabilities had previously come to light when the rapid adoption of AI agents exposed a structural weakness in MCP. Now, authorization servers must return the iss parameter in accordance with RFC 9207, which clients must validate. Dynamic Client Registration (DCR) has been formally deprecated in favor of Client ID Metadata Documents (CIMD), though DCR will continue to function for the time being.
Roots, Sampling, and Logging have been deprecated, as has the old HTTP+SSE transport. They will continue to function for at least 12 months under a new deprecation policy. The four Tier 1 SDKs (TypeScript, Python, Go, and C#) are using the new version as of today. The Rust SDK supports the spec in beta. The developers do warn of some migration costs, especially for developers who relied on session identifiers.