MCP's biggest spec lands Tuesday: stateless, and it breaks servers
The 2026-07-28 revision kills the session handshake, makes servers OAuth 2.1 resource servers, and deprecates Roots, Sampling and Logging.
Copy markdown
The handshake is gone
The 2026-07-28 spec drops the initialize/initialized exchange and the Mcp-Session-Id header — every request self-describes via _meta. Any instance can answer any call, so you can run MCP servers on autoscalers or serverless with no sticky routing or shared session store.
Headers a load balancer can read
Streamable HTTP now requires Mcp-Method and Mcp-Name headers, so gateways and rate-limiters route on the operation without parsing the body. Held-open SSE gives way to multi-round-trip: servers return InputRequiredResult with requestState, clients re-issue with inputResponses.
Your server is now an OAuth 2.1 resource server
MCP servers become formal OAuth 2.1 resource servers exposing Protected Resource Metadata (RFC 9728), and clients must send resource indicators (RFC 8707) so a stolen token can't be replayed elsewhere. Dynamic Client Registration is deprecated for Client ID Metadata Documents.
What breaks
Roots, Sampling and Logging are deprecated on a 12-month clock, Tasks is redesigned as an extension with a new lifecycle, and the missing-resource error code moves from -32002 to the JSON-RPC-standard -32602. Budget a migration pass before your SDK bumps.
GitHub already shipped it
GitHub updated its MCP Server to the next spec on Jul 23, days ahead of Tuesday's final — an early signal that host and server SDKs will move fast. Expect Cursor, Claude and the official SDKs to follow inside the deprecation window.