MCP 2026-07-28 release candidate makes the protocol stateless and removes the initialize handshake — six breaking changes before the July 28 lock

Model Context Protocol Blog·high signal

The spec RC drops the initialize/initialized handshake entirely; protocol version, client info, and capabilities now ride in `_meta` on every request, with a new `server/discover` method for upfront capability fetch. Remote servers that needed sticky sessions and shared session stores can now sit behind plain round-robin load balancers and route on an `Mcp-Method` header. Authorization hardens to OAuth 2.1 with mandatory Protected Resource Metadata, Tasks graduates from experimental, MCP Apps ships sandboxed-iframe HTML UIs, and a new lifecycle policy guarantees a 12-month minimum Active→Deprecated→Removed window.