MCP goes stateless: the session handshake is gone, SDKs ship today
The July 28 spec drops session IDs for round-robin scaling, hardens OAuth against mix-up attacks, and lands in the TypeScript, Python, Go and C# SDKs.
Copy markdown
The session handshake is gone
The 2026-07-28 spec removes the Mcp-Session-Id header and the initialize/initialized handshake, so any server instance can serve any request. That means plain round-robin load balancing and no shared session store — MCP is now a first-class stateless HTTP workload.
Your auth code has homework
Clients must now validate the token issuer (RFC 9207) and bind each token to a specific server (RFC 8707), closing mix-up and confused-deputy attacks. Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents.
Elicitation without a live socket
Multi Round-Trip Requests replace server-initiated streams: a server returns resultType 'input_required' and the client retries with the answer attached. Sampling and elicitation no longer need a persistent bidirectional connection.
Adopt today, migrate over a year
All four Tier-1 SDKs — TypeScript, Python, Go and C# — ship 2026-07-28 support now, with Rust in beta. Roots, Sampling and Logging are deprecated but guaranteed a 12-month minimum support window, so upgrades aren't a fire drill.
Elsewhere: a 124B open model free until tomorrow
Ant Group's Ling-3.0-flash (124B MoE, ~5.1B active, Apache 2.0) is free on OpenRouter through August 3 — a weekend of no-cost hybrid-reasoning calls before production pricing lands.