Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-25 · high
Remote servers can sit behind plain round-robin load balancers instead of needing sticky sessions, closing a validation window open since May 21.
Why now: The spec finalizes July 28, three days after this July 25 coverage.
MCP's spec finalizes July 28, closing a ten-week validation window, and strips out session management and handshakes entirely, per the MCP blog. For anyone running a remote server, that swaps sticky sessions, a shared session store, and gateway deep packet inspection for plain round-robin load balancing.
New Mcp-Method and Mcp-Name headers make that possible. Gateways can route requests by reading the headers instead of opening the message body, so routing decisions move from session state to header inspection.
Authorization gets the same treatment. Six proposals fold in OAuth 2.0 and OpenID Connect, including issuer validation and refresh token handling. Auth flows stop being a bespoke MCP thing and start looking like every other API you already secure.
Not everything survives the cut. Roots, Sampling, and Logging are formally deprecated, though a new policy guarantees at least a 12-month removal window before anything breaks. Tasks and MCP Apps move the other direction, graduating into versioned extensions.
Each link below shares sources, entities, or timing with this story.
The 2026-07-28 Model Context Protocol spec published today, and it removes two things every MCP server currently depends on: the initialize/initialized handshake and the Mcp-Session-Id header. Both are gone. Not deprecated. Gone from the core. (Model Context Protocol Blog) Wha...
You have one week. If you run an MCP server in production, stop what you're doing and read the release candidate. The Model Context Protocol's 2026-07-28 spec is the largest revision since the protocol launched, and the headline is architectural: the initialize/initialized han...
The Model Context Protocol's 2026-07-28 revision is the biggest change since the protocol existed. The core is now stateless request/response instead of a bidirectional stateful session. Authorization aligns with OAuth 2.1 and OpenID Connect. MCP Apps and Tasks moved under a v...
Eighteen days. That's how long you have. The 2026-07-28 MCP specification release candidate removes the session concept from the protocol layer entirely. The initialize / initialized handshake is gone. The Mcp-Session-Id header is gone. Protocol version, client identity, and c...
Ten days. That's the window. The MCP 2026-07-28 release candidate drops the initialize/initialized handshake entirely. Protocol version, client info, and capabilities now ride in _meta on every request, with a new server/discover method if you want to fetch capabilities upfron...
The protocol that powers 14,000+ servers just made a breaking architectural change. If you run an MCP server, your migration clock started four days ago. The Model Context Protocol specification release candidate, locked May 21, removes the initialize/initialized handshake and...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.