Anthropic Rebuilds MCP as Stateless, Unlocking Serverless AI Agent Deployments
MCP 2026-07-28 drops sessions entirely, making servers deployable on serverless and edge infrastructure for the first time, while adding a formal extensions framework and hardened enterprise auth.
- MCP 2026-07-28 is live: the protocol drops sessions entirely, making servers deployable on serverless, edge, and standard load-balanced HTTP infrastructure.
- The
initializehandshake andMcp-Session-Idare gone; every request is now self-describing via_metaand HTTP headers. - Multi Round-Trip Requests (MRTR) enable mid-tool user confirmations (like "delete this row?") without a persistent connection.
- Three official extensions ship: MCP Apps (server-rendered UI), Tasks (async/long-running ops), and Enterprise Managed Auth (IdP-based org-wide provisioning).
- Breaking changes: Roots, Sampling, Logging, HTTP+SSE transport, and Dynamic Client Registration are all deprecated with a 12-month removal window.
- All four Tier 1 SDKs (TypeScript, Python, Go, C#) are updated today; MCP has surpassed 400M monthly SDK downloads, a 4x increase this year.
The MCP 2026-07-28 specification is now final, and it rewrites more of the protocol than any update since launch. The core change: MCP is no longer stateful. That single decision reshapes how you deploy servers, handle auth, and build tools that interact with users mid-execution.
Why sessions were a problem
Every previous MCP connection required an initialize handshake that created a session ID. Servers had to track that ID for the lifetime of the connection, which meant horizontal deployments needed sticky sessions or a shared store like Redis. Serverless and edge deployments were effectively blocked.
The new spec drops all of that. Each request now carries its protocol version, client identity, and capabilities in _meta. No session header, no handshake:
POST /mcp HTTP/1.1
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: search
{"jsonrpc":"2.0","id":1,"method":"tools/call",
"params":{"name":"search","arguments":{"q":"otters"},
"_meta":{"io.modelcontextprotocol/clientInfo":{"name":"my-app","version":"1.0"}}}}A new server/discover RPC lets clients fetch server capabilities upfront, but it is optional. Round-robin load balancing now works out of the box.
Everything else that changed
The stateless core is the centerpiece, but several other changes ship alongside it:
- Header-based routing: Streamable HTTP requests must now include
Mcp-MethodandMcp-Nameheaders, so gateways, rate limiters, and WAFs can route and meter on those headers without parsing JSON bodies.