The open standard behind AI tool use just had its biggest rewrite

The open standard that lets AI assistants call out to other tools is about to get its biggest rewrite since Anthropic launched it in 2024. Model Context Protocol, the wire format that connects a chat model to a filesystem, a database, or a custom API, ships its 2026-07-28 revision on Tuesday. The load-bearing change is the removal of protocol-level sessions, but the mechanism that makes that work is two new HTTP headers that let a standard load balancer route a request without inspecting the JSON-RPC body or tracking any session state, according to the MCP maintainers' release-candidate post.

The previous spec required every MCP server to keep state between requests. To scale horizontally, the operator had to either pin a client to a specific server instance (sticky routing) or build a shared session store both sides could read. The spec also failed to define how the server should tell a client it needed extra resources, which complicated routing further. The 2026-07-28 release replaces that with a stateless model: each request is self-contained, and routing is now a property of the HTTP layer, not the protocol.

Two new headers, Mcp-Method and Mcp-Name, carry the routing signal. A third header, MCP-Protocol-Version, replaces the old session continuity. Protocol version, client identity, and capabilities now ride along on every request inside a _meta parameter, and a new server/discover method lets a client fetch a server's capabilities on demand instead of negotiating them at connection time. Together, those four changes are what let an off-the-shelf load balancer route MCP traffic the way it routes the rest of the web.

The falsifier the piece has to head off is the conflation of "stateless at the protocol layer" with "stateless at the application layer." The two are not the same. David Soria Parra and Den Delimarsky, who led the rewrite, have framed the new model as moving conversation state from the server to the client: above the wire, the application still keeps track of what the user asked and what the model said. What is gone is the server-side memory of a session, not the system's memory of a conversation.

The deprecation list is where the migration cost shows up. The initialize and initialized handshake is removed (SEP-2575), along with the Mcp-Session-Id header and the protocol session itself (SEP-2567). Three little-used features are gone for good: sampling, the mechanism that let a server ask the client's model to generate a completion; roots, the way a client shared filesystem locations with a server; and chatty logging, which the new spec redirects to standard stderr, stdio, or OpenTelemetry. Tasks, the in-protocol work queue, moves out of core into a separate extension. MCP Apps, the server-rendered JavaScript UIs, arrives as the first official extension. Authorization is now aligned more closely with OAuth and OpenID Connect, per the release-candidate post.

Stacklok, the company that maintains the most widely used MCP server implementation, publishes an Enterprise Readiness Guide that gives the migration a floor: deprecated features remain functional for at least 12 months after the spec ships. The harder cut is interoperability. Servers built to the 2026-07-28 spec may not talk cleanly to clients built to the 2025-11-25 spec without deliberate fallback or translation, and that is where homebrew MCP implementations face the slog Stacklok's CEO Craig McLuckie called out. McLuckie said the move to statelessness was necessary; he did not promise it would be free.

The MCP maintainers' release-candidate post and SDK betas both went out the same day, and the 2026-07-28 final is the date the spec actually changes. Anthropic donated MCP to the Agentic AI Foundation, a Linux Foundation fund co-founded by Anthropic, Block, and OpenAI, in 2025. At the time of the transfer, the SDK was being downloaded more than 97 million times a month and at least 10,000 MCP servers had been set up by third parties. That is the install base the 12-month floor is meant to protect.

The watch item for anyone running MCP today is whether their homebrew implementation can survive the gap. The 2026-07-28 servers will reach for server/discover and read _meta on every request. The 2025-11-25 clients will still send an initialize handshake and expect a Mcp-Session-Id back. The two will talk, badly, until someone writes the translation layer. The spec ships on Tuesday. The migration clock starts the same day.