Model Context Protocol Drops Sessions in Largest Spec Overhaul Since Launch

The Model Context Protocol’s stateful session model, the design that forced every production MCP deployment to maintain sticky load balancer routing, shared Redis session stores, and request body inspection at the gateway, is being removed from the protocol entirely. The 2026-07-28 specification finalizes tomorrow, making MCP stateless at the protocol layer for the first time since Anthropic introduced it in November 2024.

Six Specification Enhancement Proposals drive the change. SEP-2575 removes the initialize/initialized handshake, and SEP-2567 removes the Mcp-Session-Id header and the protocol-level session that came with it. The protocol version, client identity, and client capabilities that used to be exchanged once at connection time now travel in a _meta field on every individual request. A new server/discover method lets clients fetch server capabilities on demand.

What Changes for Deployed Agents

The practical effect is immediate. A remote MCP server that previously needed sticky sessions, a shared session store, and deep packet inspection at the gateway can now run behind a plain round-robin load balancer. According to lead maintainers David Soria Parra and Den Delimarsky in the official release candidate announcement, the protocol “no longer manages that state for you, but it doesn’t prevent you from managing it yourself.”

Under the current finalized specification (2025-11-25), every MCP client must open a session with an initialize request before any tool call. The server responds with an Mcp-Session-Id header that every subsequent request must carry. That session ID pins each client to whichever server instance issued it, making horizontal scaling impossible without sticky routing or a shared store so any instance can look up state created by another.

In 2026-07-28, the same tool call is a single self-contained request. New Mcp-Method and Mcp-Name headers (SEP-2243) let load balancers and rate-limiters route on the operation without inspecting the body. Any server instance can handle any request.

Stateless Protocol, Stateful Applications

The more consequential change is less visible. Servers that need to carry state across multiple tool calls can mint an explicit handle, a basket_id, a browser_id, a workflow_run_id, from a tool and have the model pass it back as an ordinary argument on later calls.

When state lives inside transport metadata, it is invisible to the agent. The model cannot reason about it, cannot compose handles from one tool with handles from another, and cannot hand off state between steps in a multi-agent workflow. Moving state into explicit tool returns makes it a first-class input the model can work with. Parra and Delimarsky wrote that in practice this pattern has turned out to be “often a more powerful” substitute for session state, not merely an equivalent one.

Extensions, Apps, and Authorization

The same release formalizes the Extensions framework (SEP-2133). Extensions now carry reverse-DNS IDs, negotiate through an extensions map on client and server capabilities, live in their own repositories with delegated maintainers, and version independently of the core specification.

Two official extensions ship with the release. MCP Apps (SEP-1865) lets servers ship interactive HTML interfaces that hosts render in a sandboxed iframe. Tasks, previously an experimental core feature, graduates to an extension with a redesigned lifecycle around the stateless model: a server answers tools/call with a task handle, and the client drives it with tasks/get, tasks/update, and tasks/cancel.

List and resource read results now carry ttlMs and cacheScope fields (SEP-2549), modeled on HTTP Cache-Control. W3C Trace Context propagation is also documented, locking down traceparent, tracestate, and baggage key names so distributed traces correlate across SDKs and gateways.

Six additional SEPs harden authorization to align more closely with how OAuth 2.0 and OpenID Connect deployments work in production.

Migration Cost

This release contains breaking changes. Anyone who shipped against the 2025-11-25 experimental Tasks API will need to migrate to the new lifecycle. The initialize/initialized handshake no longer exists. Teams running agents on the current spec will need to update clients and servers to handle the new _meta field and server/discover method.

The Agentic AI Foundation, the Linux Foundation directed fund with Anthropic, OpenAI, Block, Google, and Microsoft among its platinum members, governs the protocol. OpenAI, Google DeepMind, Microsoft, AWS, and hundreds of enterprise software vendors had adopted MCP by mid-2026. The release candidate is available now. The final specification ships July 28, 2026.