MCP's 2026-07-28 Spec Goes Stateless and Deprecates Roots, Sampling, and Logging — Final Ships in One Week

Model Context Protocol Blog·high signal

The largest revision of the Model Context Protocol since launch lands July 28: the initialize/initialized handshake and the Mcp-Session-Id header are gone, meaning a remote MCP server that previously needed sticky sessions, a shared session store, and gateway deep-packet inspection can now sit behind a plain round-robin load balancer. Three core features — Roots, Sampling, and Logging — are deprecated with a minimum 12-month window, MCP Apps (server-rendered UIs in sandboxed iframes) and Tasks graduate to official extensions, and six SEPs harden OAuth 2.0/OIDC alignment including mandatory RFC 9207 iss validation. One breaking change to watch: missing-resource errors move from -32002 to the JSON-RPC standard -32602.