Anthropic Rebuilds MCP as Stateless, Unlocking Serverless AI Agent Deployments
MCP 2026-07-28 drops sessions entirely, making servers deployable on serverless and edge infrastructure for the first time, while adding a formal extensions framework and hardened enterprise auth.
- MCP 2026-07-28 is live: the protocol drops sessions entirely, making servers deployable on serverless, edge, and standard load-balanced HTTP infrastructure.
- The
initializehandshake andMcp-Session-Idare gone; every request is now self-describing via_metaand HTTP headers. - Multi Round-Trip Requests (MRTR) enable mid-tool user confirmations (like "delete this row?") without a persistent connection.
- Three official extensions ship: MCP Apps (server-rendered UI), Tasks (async/long-running ops), and Enterprise Managed Auth (IdP-based org-wide provisioning).
- Breaking changes: Roots, Sampling, Logging, HTTP+SSE transport, and Dynamic Client Registration are all deprecated with a 12-month removal window.
- All four Tier 1 SDKs (TypeScript, Python, Go, C#) are updated today; MCP has surpassed 400M monthly SDK downloads, a 4x increase this year.
The Model Context Protocol's 2026-07-28 specification is now final, and it is the most significant rewrite of the protocol since it launched. The headline change is deceptively simple: MCP is no longer stateful. But the ripple effects of that decision touch everything from how you deploy servers, to how you handle auth, to what kinds of tools you can build.
The session problem, solved
To understand why this matters, you need to know what MCP looked like before. Every client-server connection required an initialize handshake that minted a session ID. That session ID had to be tracked across the lifetime of the connection, which meant your MCP server needed to remember which client was talking to it. In practice, this forced horizontal deployments to use sticky sessions (routing each client to the same server instance) or a shared session store like Redis. Serverless and edge deployments were essentially off the table.
The highlight of this release is a stateless protocol core: MCP is transforming from a bidirectional stateful protocol into a request/response stateless protocol. If you're building MCP servers, you can now scale them using a simple round-robin load balancer, removing the need to manage sticky sessions and to store shared sessions.
Here is what a request looks like in the new spec:
POST /mcp HTTP/1.1
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: search
{"jsonrpc":"2.0","id":1,"method":"tools/call",
"params":{"name":"search","arguments":{"q":"otters"},
"_meta":{"io.modelcontextprotocol/clientInfo":{"name":"my-app","version":"1.0"}}}}No session header. No handshake.
Each request now travels on its own, carrying its protocol version, client identity, and client capabilities in _meta. If a client wants to learn a server's capabilities before doing anything else, there's a new server/discover RPC for that; however, it is not required.
What actually changed under the hood
The stateless core is the headliner, but there are several other meaningful changes packed into this release: