MCP Just Deleted Its Own Session Layer

The Model Context Protocol shipped its 2026-07-28 specification yesterday, and the headline is not a new feature. It is a subtraction. MCP is now stateless at the protocol layer for the first time in its history — sessions gone, the initialization handshake gone, three original primitives marked for deletion.

This is the largest revision the protocol has taken since it launched, and it is the first shipped under new management: MCP is now governed by the Agentic AI Foundation, a Linux Foundation directed fund whose platinum members include Anthropic, OpenAI, Block, Google, and Microsoft. A protocol donated by one lab is now maintained by a consortium of its competitors, and the first thing that consortium did was rip out the architecture underneath it.

What statelessness actually means here

Under the old design, an MCP connection opened with a mandatory initialize/initialized handshake. That established persistent session state, tracked across requests via an Mcp-Session-Id header. Capability negotiation happened once, up front, and everything after it assumed the server remembered who it was talking to.

That is a clean model on a laptop. It is a nightmare in a data center.

Every production MCP deployment ended up carrying the same tax: sticky load-balancer routing so a client kept hitting the same instance, a shared Redis store so instances could pretend to be one server, and request-body inspection at the gateway because the routing key lived inside the JSON-RPC payload rather than anywhere a load balancer could cheaply read it. Teams were building session-affinity infrastructure to support a protocol whose sessions carried almost no useful information.

The new design makes every JSON-RPC request self-contained. Client metadata rides inside a _meta object in the request envelope, so any server instance can serve any request with no prior knowledge of the caller. Round-robin works. Autoscaling works. A server can be replaced mid-conversation and nothing notices.

The handshake is removed outright. Capability negotiation moves to an on-demand server/discover method that clients call when they actually need it, rather than as a mandatory toll on every connection. And where state genuinely must persist, the spec now insists it be explicit: the server mints an identifier and returns it in the result, so the handle is a value the client holds rather than a fact the protocol quietly maintains on its behalf.

That last shift is the philosophical one. Hidden state became visible state. Everything that survives a request now has a name.

Three features on the clock

SEP-2577 deprecates three of the protocol's original capabilities, with the earliest removal window set at July 28, 2027 — a full year of runway.

Roots, the filesystem abstraction, goes first. It assumed the server could reason about the client's local directory structure, which stopped being coherent the moment MCP servers started running in someone else's cloud. The migration is unglamorous and correct: pass paths as tool parameters.

Sampling — the mechanism letting a server call back into the client's LLM — is deprecated on trust grounds. It inverted the security model, letting a tool provider spend the client's tokens and steer the client's model. Servers that need inference should now call an LLM API directly, with their own key and their own bill.

Logging is deprecated as redundant. Use stderr or OpenTelemetry, which every operator already runs.

Two transport-layer deprecations land alongside them: Dynamic Client Registration and the HTTP+SSE transport, both superseded — the latter by Streamable HTTP.

Authorization gets serious

The auth rewrite is the part enterprises actually asked for. OAuth 2.1 and OpenID Connect alignment becomes mandatory, including robust issuer validation per RFC 9207 — closing off a class of token-confusion attacks that the previous spec left to implementer discretion.

More consequential for anyone deploying at scale: a new Enterprise-Managed Authorization extension lets IT administrators provision MCP servers centrally, rather than each user individually consenting to each tool. And incremental scope consent lets a server request additional permissions mid-session instead of demanding the full union of everything it might ever need at connect time.

That second one matters more than it sounds. Up-front scope requests push every server toward asking for maximum privilege, because asking twice was impossible. Incremental consent makes least-privilege the path of least resistance.

Extensions, and the governance underneath them

The spec introduces a formal extensions framework, and two extensions ship with it.

MCP Apps lets a server declare an interactive HTML interface that renders in a sandboxed iframe inside the chat surface, communicating bidirectionally over JSON-RPC via postMessage. Dashboards, forms, document review — surfaces a text-only tool call could never express.

Tasks standardizes long-running asynchronous work. Servers return a CreateTaskResult with a durable taskId that survives connection drops; clients poll tasks/get, supply input via tasks/update, and cancel via tasks/cancel. An input_required state makes genuine multi-step workflows expressible. In a stateless protocol, this is how you get durability back — as an explicit, addressable object rather than an implicit connection.

Underneath both sits SEP-2596, a feature lifecycle policy: anything deprecated stays functional for at least 12 months, tracked in a public registry with published timelines. Paired with a new conformance-suite requirement, this is the least exciting and most important thing in the release. It is what lets a protocol change without every change being a crisis.

Beta SDKs for Python, TypeScript, Go, and C# target the new spec, and AWS AgentCore Gateway already advertises support.

The read

Protocols that survive tend to get smaller before they get bigger. MCP spent its first stretch accumulating capability at the speed the agent ecosystem was accumulating hype, and it collected features — sampling, roots, protocol-level logging — that made sense for a local desktop integration and stopped making sense the moment the servers moved to production.

The 2026-07-28 spec is a correction of scope, not an expansion of it. The protocol is admitting what it is: a transport for tool calls between untrusted parties across a network, where the network has load balancers and the parties have security teams. Everything that assumed a warm connection to a trusted peer on the same machine got cut.

The bet is that a stateless core plus a governed extension surface scales better than a stateful core plus ad-hoc additions. Given that MCP now has to serve five competing platinum sponsors without any one of them being able to bend it, that is likely the only bet available.