The Agentic AI Foundation, a directed fund under the Linux Foundation, published the 2026-07-28 Model Context Protocol specification on July 28, the largest revision since Anthropic released the open standard 20 months ago. The headline change removes MCP's stateful session model entirely: the initialize/initialized handshake and the Mcp-Session-Id header are both gone, meaning any server instance can now handle any request without sticky load-balancer routing or a shared session store. Six Specification Enhancement Proposals worked together to complete the transition.
The practical effect is that MCP servers can now run behind an ordinary round-robin load balancer and deploy on serverless and edge infrastructure, removing overhead that had forced every production MCP deployment to maintain sticky routing, shared Redis session stores, or deep packet inspection at the gateway layer. Alongside the transport change, the spec hardens authorization by aligning more closely with OAuth 2.1 and OpenID Connect enterprise practices, introduces Resource Indicators to address delegation and "confused deputy" problems, and formalizes an extensions framework covering MCP Apps and a new Tasks capability.
MCP has grown rapidly since its release: its Tier 1 SDKs now see close to half a billion downloads a month, with both the TypeScript and Python SDKs individually crossing 1 billion total downloads. The specification introduces new governance guarantees, including a formal feature-lifecycle policy and a conformance-suite requirement, intended to limit breaking changes going forward; maintainers describe this release's backward-incompatible changes as a deliberate one-time foundation reset rather than the new norm. A 10-week validation window is available for SDK maintainers and server implementers to migrate before the changes take full effect in production.
