MCP 2026-07-28 Spec Lands: Stateless Core, Governed Extensions, Tasks, and Sandboxed MCP Apps
The finalized MCP specification replaces the bidirectional stateful protocol with a request/response core, letting servers deploy on serverless and edge infrastructure. Extensions graduate from convention to a governed system with reverse-DNS identifiers, capability negotiation via extensions maps, and versioning independent of the core; Tasks becomes an official extension with a stateless lifecycle (`tools/call` returns a handle, client drives `tasks/get`/`update`/`cancel`), and MCP Apps ships server-rendered HTML in sandboxed iframes with templates declared up front so clients can prefetch and security-review before rendering. Claude is already expanding support, including enterprise-managed auth and private network tunnels.
↳ Follow the thread