MCP's Biggest Spec Update Is Final: Sessions Are Gone and Stateless HTTP Is In

The July 28 MCP spec goes stateless — sessions, sticky routing, and the initialize handshake are gone; Tasks moved to an extension; W3C tracing is now built in.

The 2026-07-28 Model Context Protocol specification is final. The headline change: the session model is gone. Before, every MCP conversation required an initialize/initialized handshake, Mcp-Session-Id headers on subsequent requests, and sticky routing so load balancers could reach the same server instance. Now every request is self-contained — standard round-robin load balancing works, no shared session store needed.

Breaking changes to make now:

• Remove the initialize/initialized exchange and Mcp-Session-Id headers from your client
• Migrate from the experimental Tasks API (2025-11-25) to the revised Tasks extension lifecycle
• Update any literal error-code checks: missing-resource errors moved from -32002 → -32602

New capabilities: MCP Apps (server-rendered HTML UI in sandboxed iframes), a formal Extensions framework for opt-in features, and built-in W3C Trace Context + OpenTelemetry propagation across agent hops. Authorization also tightens with RFC 9207 iss parameter validation to block mix-up attacks.

Why it matters: The stateless core is what makes MCP viable in containerized, auto-scaling deployments. If you were running MCP servers behind a load balancer with Redis session state, you can drop that complexity now.

Sources: MCP 2026-07-28 Specification · Security Implications — SecurityWeek · modelcontextprotocol.io