MCP 2026-07-28 spec: stateless core

The 2026-07-28 revision removes the initialize handshake and sessions so any server instance can answer any request, and adds Tasks and MCP Apps extensions.

Changes fast: check the latest updates too. Reviewed 17 Oct 2026.

Key ideas

• Each request carries client info, protocol version and capabilities in _meta; no Mcp-Session-Id.
• server/discover replaces handshake-time capability negotiation.
• State moves to explicit handles (IDs returned by tools and passed back as arguments).
• Tasks extension: long-running calls return a task ID; poll with tasks/get, cancel with tasks/cancel.
• MCP Apps: servers can ship sandboxed HTML UIs that hosts render in chat.
• Deprecated (earliest removal July 2027): Roots, Sampling, Logging, Dynamic Client Registration, HTTP+SSE transport.

Common mistakes

• Leaving connection-level state in servers; it breaks behind a plain load balancer.

Go deeper

• MCP 2026-07-28: what's changing and how to migrate (AAIF)