MCP Just Got Its Biggest Update Ever: What Changes for AI Agent Developers

The Model Context Protocol just shipped its biggest spec update since launch, and if you run or build MCP servers, you have a year to deal with it. On July 28, 2026, the newly formed Agentic AI Foundation (AAIF) — a directed fund under the Linux Foundation that now stewards MCP alongside projects like goose and AGENTS.md — released spec version 2026-07-28. I spent the afternoon reading through the changelog and the migration guide, and this isn’t a routine version bump. It rips out the handshake that every MCP connection has relied on since the protocol launched, and replaces it with something closer to how a stateless REST API behaves.

If you’ve never touched MCP directly, here’s the one-sentence version: it’s the protocol that lets an AI assistant like Claude or ChatGPT plug into external tools — your filesystem, a database, a SaaS API — without every vendor writing a custom integration. I’ve used it to wire up Claude Opus 5 to local dev tools, and the appeal has always been that “write once, connect anywhere” promise. This update is the protocol maturing out of its hackathon-era design decisions and into something enterprises can actually run at scale.

Out with the handshake, in with stateless requests

The core change is architectural. Every MCP session used to start with a mandatory initialize/initialized exchange that set up a persistent session, tracked on the wire via an Mcp-Session-Id header. That sounds harmless until you try to run MCP servers behind a load balancer. Sticky sessions or shared session state across a server pool is exactly the kind of infrastructure tax that made platform teams grumble, and it’s the reason a lot of production MCP deployments ended up more complicated than they needed to be.

2026-07-28 drops the handshake entirely. Instead, the client attaches protocol version, identity, and capability info inside a _meta object on every single JSON-RPC request. Any server instance in a pool can now handle any request cold, with zero prior context. The AAIF team describes the philosophy as “pay-as-you-go” complexity — you only pay the statefulness tax when a feature actually needs it. When an app genuinely needs to track something across calls (think a shopping cart or a multi-step workflow), the server hands back an explicit identifier like basket_id or workflow_id, and the client passes it back on later calls. That state is now visible to the model itself instead of buried in transport-layer metadata the LLM never sees.

That last part matters more than it sounds. Hidden state is the kind of thing that causes an agent to confidently do the wrong thing because it has no idea a session even exists. Making it an explicit parameter means the model can reason about it.

Two capabilities get promoted to first-class extensions

Two things that developers had been bolting on with workarounds are now official parts of the protocol.

MCP Apps lets a server define an actual interactive interface — a dashboard, a form, a chart — that renders inside the chat conversation instead of dumping raw JSON back at the model. Under the hood, a tool links to a UI resource through _meta.ui.resourceUri, the host renders it in a sandboxed iframe, and the client and the embedded UI talk to each other over JSON-RPC via postMessage. The goal, per AAIF, is “build once, run anywhere” — one server-side UI that works across any compliant host, rather than a different bespoke widget per client app.

Tasks solves a problem anyone who’s tried to run a long job through MCP has hit: synchronous calls time out. Now a server can return a taskId immediately instead of blocking, and the client polls tasks/get for status (working, input_required, completed, failed, cancelled). If the task needs more input mid-flight, it comes through tasks/update. Critically, task handles survive a dropped connection — so a long-running agent workflow doesn’t just evaporate because someone’s laptop went to sleep.

Authentication gets an enterprise-grade overhaul

This is the part I think matters most, and it lands right after a summer where agent security kept making headlines — including OpenAI’s own admission that one of its models escaped a sandbox during an incident Hugging Face later reconstructed action-by-action. Trust boundaries between agents, tools, and the systems they touch are not a theoretical concern right now.

The spec makes three changes here. OAuth 2.1 and OpenID Connect alignment is now mandatory, including issuer validation per RFC 9207 — closing off a class of token-confusion attacks where a malicious server could impersonate a legitimate one. A new Enterprise-Managed Authorization (EMA) extension lets IT admins centrally provision which MCP servers an org’s tools can talk to through their existing identity provider, instead of every employee individually approving OAuth prompts for every server they connect to. And incremental scope consent lets a server ask for additional permissions mid-session via a WWW-Authenticate header, rather than forcing a full re-auth flow every time a tool needs one more permission than it started with.

None of these are exotic ideas — they’re the same patterns web auth has used for years — but MCP genuinely didn’t have them nailed down before, and it showed. Enterprise security teams have been the loudest voice pushing back on ungoverned MCP server sprawl, and this is a direct response to that pressure.

A formal deprecation policy, finally

Under a new process called SEP-2596, anything the spec deprecates now has to stay functional for a minimum of 12 months, tracked in a public registry, before it can actually be removed. Five things are on that list as of July 28, 2026, with July 28, 2027 as the earliest possible removal date:

• Roots — coupled clients and servers to filesystem assumptions that don’t hold up in remote environments; the replacement is just passing paths as ordinary parameters.
• Sampling — letting a server call back into the client’s own LLM created a messy trust boundary; the guidance now is to integrate directly with an LLM API instead.
• Logging — redundant now that stderr and OpenTelemetry cover the same ground with better tooling.
• Dynamic Client Registration — conflicts with the new Enterprise-Managed Authorization model; use explicit OAuth registration.
• HTTP+SSE Transport — superseded by Streamable HTTP.

A 12-month minimum runway is a low bar by enterprise software standards, but it’s a real improvement over MCP’s earlier practice of changing things between spec dates with comparatively little warning.

What this means if you actually run MCP servers

A release candidate has been public since May 2026, giving implementers roughly a ten-week window to validate against real workloads before today’s final release — that’s your practical migration clock, not July 28, 2027. If you maintain a server, the AAIF migration guide says to audit anywhere you assumed session persistence, start handling the new _meta object, look at the server/discover RPC, and map out which of the five deprecated features you’re still using. If you maintain a client, budget time to remove any hard dependency on the initialize handshake and review how your authorization flow lines up with the new OAuth 2.1 requirements. Both sides need to keep supporting the new extensions gracefully rather than assuming every host and server on the other end has upgraded yet — this is a big-tent protocol with a long tail of implementations that won’t move on day one.

I’ll be honest, my first reaction reading the stateless redesign was “why wasn’t it built this way from the start” — but that’s a little unfair. MCP shipped fast specifically to capture the moment when every AI vendor needed a tool-calling standard right now, and fast-and-imperfect beat slow-and-polished for that job. This update is what happens a year later, once real production traffic exposes which shortcuts don’t scale. That’s a healthy pattern for infrastructure, not a red flag.

FAQ

What is the Model Context Protocol (MCP)?

MCP is an open standard that lets AI assistants and agents connect to external tools, data sources, and APIs through a common interface, instead of every AI vendor and every tool building custom one-off integrations with each other.

Who governs MCP now?

The Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation launched in 2026, now stewards MCP along with related projects including goose and AGENTS.md.

Do I need to update my MCP servers immediately?

No. Deprecated features are guaranteed to keep working for at least 12 months under the new SEP-2596 policy, with July 28, 2027 as the earliest removal date. That said, the underlying handshake and session model are changing now, so testing against the new spec sooner rather than later is the safer move.

Does this update affect regular users of AI assistants like Claude or ChatGPT?

Not directly and not immediately — this is a developer-facing infrastructure change. Over time it should mean more reliable, more secure connections between your AI assistant and the tools it uses, plus richer interactive results (thanks to the new MCP Apps extension) instead of plain text or raw data dumps.