AGTBRIEF
MCP is the open protocol AI agents use to call external tools. The 2026 07 28 spec drops long lived sessions so requests can land on any instance behind a plain load balancer.
MCP, the open protocol that lets AI agents call external tools and data sources, released its 2026-07-28 specification today, and the headline change is operational: the protocol is moving from a bidirectional, stateful core to a request/response model where every request is self-describing. Method and tool names now travel in dedicated Mcp-Method and Mcp-Name HTTP headers, so ordinary gateways and load balancers can route and authorize on traffic they can actually see (The 2026-07-28 Specification).
Server-to-client calls like sampling and elicitation are rebuilt around Multi Round-Trip Requests (MRTR) instead of constantly open streams. List responses now carry cache hints and a deterministic order, so clients can cache tool catalogs across reconnects. The initialize/initialized handshake and the Mcp-Session-Id header are retired (SEP-2575, SEP-2567), and a formal twelve-month deprecation policy gives teams a planning window instead of a fire drill.
Authorization hardens too: RFC 9207 issuer validation lands, and Dynamic Client Registration gives way to Client ID Metadata Documents (CIMD). A formal extensions framework now includes Tasks alongside MCP Apps and Enterprise Managed Authorization, and the TypeScript, Python, Go, and C# SDKs ship with migration notes (SDK betas 2026-07-28).
The project reports the Tier 1 SDKs at roughly half a billion monthly downloads, with TypeScript and Python having crossed one billion total. What is not yet clear is how quickly existing deployments migrate; the clock starts now.