MCP's 2026-07-28 spec deletes sessions and the initialize handshake — rewrite your server before the RC window closes
The final MCP 2026-07-28 revision removes protocol-level sessions and the `Mcp-Session-Id` header (SEP-2567), removes the `initialize`/`notifications/initialized` handshake in favor of reading protocol version and capabilities from `_meta` on every request plus a mandatory `server/discover` RPC (SEP-2575), and moves Tasks to the `io.modelcontextprotocol/tasks` extension with polling via `tasks/get` instead of blocking `tasks/result` (SEP-2663). Practically: mint your own server-issued handles and pass them as ordinary tool arguments, drop sticky routing and session affinity from your load balancer, and bind each handle to a specific user so you can verify the caller is the creator. The stateless shift kills protocol-level session hijacking but moves the entire auth boundary onto you — new `ttlMs`/`cacheScope` fields on list endpoints are the one free win.
Source
↳ Follow the thread