MCP Goes Stateless: The 2026-07-28 Spec Release Candidate Drops Session IDs and the Initialize Handshake

TL;DR: The MCP 2026-07-28 spec release candidate drops the initialize handshake and session IDs — any request can now land on any server instance; beta SDKs for Python v2, TypeScript v2, Go, and C# are available now before the July 28 final.

The next Model Context Protocol specification ships July 28. The release candidate has been locked since May, and beta SDKs for all four Tier 1 languages dropped June 29. This is the largest protocol revision since launch — and it contains breaking changes for existing MCP server authors.

The headline: MCP is now stateless

The initialize/initialized handshake is gone. Protocol version, client identity, and capabilities now travel in a _meta object on every request — no upfront negotiation step. Combined with session ID removal (Mcp-Session-Id header also gone), any MCP request can land on any server instance without sticky routing.

Before (current spec): clients connect, exchange capabilities once, maintain a persistent session; horizontal scaling requires sticky sessions or shared session stores.

After (2026-07-28): stateless requests with capabilities in _meta; any instance can handle any request; deploy behind a plain round-robin load balancer, on serverless platforms, or in standard autoscaling groups.

What else changed

• Extensions framework: New capabilities ship as opt-in extensions identified by reverse-DNS IDs, negotiated via an extensions map in capabilities. Extensions version independently of the core spec.
• Tasks extension: Long-running async work as a first-party extension — servers can report progress and return results without holding a connection.
• MCP Apps: Server-rendered interactive UI in the conversation — already GA in Claude and VS Code.
• Authorization hardening: Closer alignment with OAuth 2.0 and OpenID Connect deployments.
• Formal deprecation policy: Features must stay Deprecated for ≥12 months before removal. First to be deprecated (not removed yet): Roots, Sampling, and Logging.

What to do before July 28

If you've built an MCP server: install the Python v2 or TypeScript v2 beta SDK and run your tests against it now. Any code that reads or writes session IDs, or that depends on the initialize handshake, will need updating. The 22-day window is real — don't wait for the final.

Why it matters: Stateless MCP finally makes MCP servers first-class HTTP services. No more custom infrastructure to manage sticky sessions — deploy on AWS Lambda, Cloud Run, or any serverless platform you already use for the rest of your stack.

Sources: 2026-07-28 Release Candidate — MCP Blog · Beta SDKs now available — MCP Blog · What changed in the 2026-07 MCP spec — Stacktree · MCP goes stateless on App Service — Microsoft Tech Community