Fetching from the wire…
Public story · 2026-07-31 · high
The July 28 update lets remote servers run behind ordinary load balancers, but it silently renames an error code and removes tasks/list.
Why now: The spec finalized July 28, and this catches the error code and tasks/list changes before most server maintainers read past the sessions headline.
MCP's July 28 spec removed the initialize handshake and protocol-level sessions entirely, per the official changelog. The new spec requires every server to implement server/discover. Each request carries its own protocol version and client capabilities inside a _meta field instead of a handshake struck once at connection time.
Any server that kept state tied to a connection needs a rewrite under the new spec. Cross-call state has to travel as an explicit handle passed inside ordinary tool arguments, not as something the protocol tracks for you. In exchange, stateless servers can sit behind plain round-robin load balancing, which is the point of the redesign.
A mismatched protocol version returns a hard UnsupportedProtocolVersionError under the new spec, instead of failing the handshake quietly. Two other changes won't show up until something breaks. The "resource not found" error moved from the custom code -32002 to the standard JSON-RPC code -32602, and the tasks/list method is gone entirely in the July 28 spec.
If your server checks for -32002 anywhere, or calls tasks/list, that code path is dead on the new spec. Same goes for anything that assumes a session survives between calls, since there's no session left to survive on.
The statelessness pitch is the headline here. The real damage is in two silent renames buried in the changelog: an error code swap and a missing method. Those will break more running servers than the removed handshake ever does. The spec finalized July 28, and this catches those two changes before most server maintainers read past the sessions headline.
Each link below shares sources, entities, or timing with this story.
The Model Context Protocol's 2026-07-28 revision is the biggest change since the protocol existed. The core is now stateless request/response instead of a bidirectional stateful session. Authorization aligns with OAuth 2.1 and OpenID Connect. MCP Apps and Tasks moved under a v...
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
The 2026-07-28 Model Context Protocol spec published today, and it removes two things every MCP server currently depends on: the initialize/initialized handshake and the Mcp-Session-Id header. Both are gone. Not deprecated. Gone from the core. (Model Context Protocol Blog) Wha...
If you run a production MCP server, you have a hard deadline. The 2026-07-28 spec removes the protocol-level session model entirely, and it's a breaking change. The MCP release candidate makes every request carry its own protocol version, client info, and capabilities (Model C...
Notion's Developer Platform 3.5 on May 13. ServiceNow Action Fabric MCP Server on May 5. Figma's agentic design via MCP in their May release. Google Workspace MCP Server in preview. Four platforms serving hundreds of millions of users, all shipping production MCP support in a...
1. Set package cooldown to 72 hours across all your package managers. pnpm: resolution-time=72h, uv: --exclude-newer, npm via .npmrc. This single config change would have protected you from the LiteLLM attack. Willison's survey covers all seven managers. 2. Install Lasso Secur...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.