MCP drops sessions and retires three core features
The new MCP specification kills the initialize handshake, removes the Mcp-Session-Id header and puts Roots, Sampling and Logging on the way out. Servers built on the old model need rework.
- The 2026-07-28 specification removes the initialize and initialized message exchange along with the Mcp-Session-Id header. The protocol is now stateless.
- Roots, Sampling and Logging are deprecated, together with the old HTTP and SSE transport.
- A new policy guarantees at least 12 months between a deprecation notice and removal, so the earliest exit date is July 28, 2027.
- Tier 1 SDKs pull close to half a billion downloads a month.
Running an MCP server in production? July 28 just added an item to your backlog. The Agentic AI Foundation published a new version of the specification behind the protocol that lets AI models talk to tools, databases and services, and the first thing on the list is that sessions are gone.
The release is tagged 2026-07-28 and arrives after ten weeks of validation, counting from the release candidate published on May 21, 2026. The lead specification maintainers are David Soria Parra and Den Delimarski.
Why sessions had to go
Every connection used to open with an initialize and initialized exchange, after which the server tracked the client through the Mcp-Session-Id header. That tied a client to one server instance, and keeping it working at scale meant sticky routing or shared state between instances.
That layer is now removed. Each request carries what it needs inside a _meta field: protocol version, client identity and capabilities. A server that wants to know what the client supports calls server/discover. In plain terms, an MCP server can now sit behind an ordinary load balancer with no memory of who called first.
Caitie McCaffrey, a software engineer at Microsoft and one of the protocol’s lead maintainers, described the old setup in a statement issued with the release:
Running MCP at scale has previously required sticky routing or shared state to maintain continuity across sessions.
Server-initiated requests give way to Multi Round-Trip Requests. When a server needs something extra from the client, it no longer holds a stream open. It returns a response saying what is missing, and the client repeats the call with the answers attached. Elicitation, sampling and roots all change shape because of it.
Routing moves into the Mcp-Method and Mcp-Name HTTP headers, so a gateway can decide where a request goes without parsing the JSON body. Tool, prompt and resource lists pick up ttlMs and cacheScope fields, which makes them cacheable.
What actually stops working?
Nothing breaks today, but the exit list is now official:
- Roots, Sampling and Logging
- the legacy HTTP plus SSE transport
- Dynamic Client Registration, replaced by Client ID Metadata Documents
Alongside it comes a formal lifecycle policy: at least 12 months must pass between a deprecation notice and the removal of a feature. For everything added to the list this week, the earliest removal date is July 28, 2027. A year is enough time to migrate, provided the work starts while the old feature still answers.
On the security side, proposal SEP 2468 makes validation of the iss parameter in authorization responses mandatory, following the RFC 9207 standard. The target is the OAuth Mixup attack, which becomes possible when one client reaches several identity providers through different MCP servers.
Tasks moved out of the experimental core into a separate extension, io.modelcontextprotocol/tasks, with tasks/get and tasks/update calls.
How many developers this touches
Enough of them. Tier 1 SDKs for TypeScript, Python, Go and C# have been updated, while the Rust SDK is still in beta. Those SDKs account for close to half a billion downloads a month, and TypeScript and Python have each passed a billion downloads in total.
The ownership history explains part of the tone. Anthropic open-sourced MCP in November 2024 and donated it in December 2025 to the Agentic AI Foundation, a Linux Foundation fund co-founded by Anthropic, Block and OpenAI. Moving a protocol from a single vendor to a foundation usually slows decisions down, yet this release carries the sharpest cut so far.
Soria Parra summed the release up in one line:
The new release is MCP’s most important since remote MCP first launched over a year ago.
If your server still runs on the old model, start by listing every place that depends on Mcp-Session-Id or on connection-level state. The clock on that work is already running.
