The Model Context Protocol's biggest revision since launch ships today. The 2026-07-28 spec finalizes a stateless protocol core, moves long-running work into a redesigned Tasks extension, introduces MCP Apps for server-rendered UIs, and hardens authorization with a package of six SEPs. The release candidate has been public since late May, Tier 1 SDKs are expected to land support within the validation window, and if you run remote MCP servers, your infrastructure just got dramatically simpler: no more sticky sessions, no shared session store, plain round-robin load balancing, cacheable tools/list responses.
This is genuinely good engineering. It's also about to make a problem you already have significantly worse.
What the stateless core actually changes
Under the old spec, a remote MCP server was a stateful thing. Sessions had to be pinned, gateways needed deep packet inspection to route correctly, and horizontal scaling meant session-store gymnastics. That friction acted as a natural rate limiter on how many tools organizations exposed to their agents. Standing up a new MCP server was enough work that teams thought twice.
The 2026-07-28 spec removes that friction almost entirely. A stateless server behind a round-robin load balancer, routing on an Mcp-Method header, with clients caching tool lists for whatever ttlMs the server permits — that's a deployment story any platform team can execute in an afternoon. The Extensions framework means capabilities like Tasks and Apps compose cleanly instead of bloating the core. The formal deprecation policy means enterprises can finally build on MCP without worrying the ground will shift underneath them.
