MCP's biggest revision since launch ships today: stateless core, Tasks and MCP Apps become extensions
The 2026-07-28 Model Context Protocol specification — release candidate locked May 21, final publication July 28 — removes the initialize/initialized handshake and the Mcp-Session-Id header entirely, so any MCP request can land on any server instance behind an ordinary round-robin load balancer with no sticky routing or shared session store. Long-lived SSE streams are replaced by an InputRequiredResult that carries prompts plus echoed request state, and Tasks moves out of experimental core into a redesigned extension (tasks/get, tasks/update, tasks/cancel) after production use exposed design flaws. MCP Apps lets servers render interactive HTML in a sandboxed iframe with every UI action routed through the same JSON-RPC audit and consent path; six auth SEPs harden OAuth/OIDC alignment, and Tier 1 SDKs are expected to ship support inside the ten-week window.
↳ Follow the thread