MCP goes stateless today: the spec's biggest break since launch
Sessions vanish, so any request hits any server — but Tasks, OAuth 2.1 and your Roots/Sampling/Logging code all change with it. Here's what breaks.
Copy markdown
Sessions are gone — and so is sticky routing
The initialize/initialized handshake and the Mcp-Session-Id header are eliminated, so any request can land on any server instance. Move per-conversation state — caches, workflow progress, config — into explicit handles passed as tool arguments; the payoff is running behind a plain round-robin load balancer with no shared session store or gateway deep-packet inspection.
Tasks rebuilt for long-running work
tasks/list is removed (no session left to scope it to), and tools/call now returns server-issued task handles you drive via tasks/get, tasks/update and tasks/cancel. Any client UI that enumerates running tasks loses its data source and needs rewiring.
MCP Apps: ship UI, not just text
Extensions are first-class now, negotiated through an extensions map with reverse-DNS IDs. The official MCP Apps extension lets a server return sandboxed-iframe UI templates — declared with cacheable ttlMs on tools/list so clients prefetch and security-review them — so a tool can hand back an interactive panel instead of plain text. A real weekend build.
OAuth 2.1 now mandatory for remote servers
Six SEPs bring remote MCP servers in line with OAuth 2.1: RFC 9728 protected-resource metadata (a .well-known/oauth-protected-resource endpoint), RFC 8707 resource-bound tokens, and RFC 9207 issuer (iss) verification. If you host a remote server, budget time to wire this up.
Roots, Sampling and Logging deprecated
All three still work — annotation-only for now, with a minimum 12-month grace period — but plan the swaps: Roots to tool params plus Resource URIs, Sampling to direct LLM API calls from your server, and Logging to stderr or OpenTelemetry.
Breaking changes now; SDKs get ~10 weeks
Locked as a release candidate on May 21 and finalized today, the spec ships breaking changes immediately, with Tier-1 SDK support expected inside a 10-week validation window. Small but real: the missing-resource error code moves from -32002 to -32602, so update your error handling.