- The Model Context Protocol shipped its 2026-07-28 specification, the largest change since Anthropic released it 20 months ago, now stewarded by the Linux Foundation backed Agentic AI Foundation.
- Six enhancement proposals remove the session model entirely, replacing the initialize handshake with header based routing on every request.
- Authorization now aligns with OAuth 2.1 and OpenID Connect, the change that makes MCP viable behind an enterprise API gateway rather than only on a developer laptop.
MCP 2026-07-28 removes the session model with six proposals
The Model Context Protocol, the standard that lets AI agents call external tools and data, received its largest revision to date on July 28. The update was published by the Agentic AI Foundation, a directed fund under the Linux Foundation that now stewards the protocol Anthropic first released in late 2024.
The headline change is architectural. MCP no longer manages sessions at the protocol layer. Six Specification Enhancement Proposals work together to remove the session model, and the initialize and initialized handshake that opened every connection is gone. Clients now attach MCP-Protocol-Version, Mcp-Method and Mcp-Name headers to each request instead. The spec also adds Multi Round-Trip Requests, cacheable list results and a formal extensions framework.
MCP is redesigned around a stateless core so the protocol works equally well on a developer's laptop and behind an enterprise API gateway.From the 2026-07-28 Model Context Protocol specification
Why a stateless core makes MCP enterprise-ready
Sessions were the quiet blocker to serious deployment. A stateful handshake means every load balancer, gateway and retry has to pin a client to one server instance, which is awkward at scale and fragile in production. By moving state out of the protocol, the new spec lets an MCP server sit behind ordinary web infrastructure and scale horizontally like any other stateless API.
- Session model removed across six SEPs, no more initialize handshake
- Per-request headers: MCP-Protocol-Version, Mcp-Method, Mcp-Name
- Authorization aligned to OAuth 2.1 and OpenID Connect
- New capabilities: Multi Round-Trip Requests, cacheable list results, formal extensions framework
- Updated Tier 1 SDKs, with a 10 week window from release candidate to final spec
The authorization overhaul matters as much as the plumbing. Aligning MCP with OAuth 2.1 and OpenID Connect gives security teams a known model for who an agent is and what it may touch, the exact question that stalls agent rollouts inside large companies. The 10 week validation window signals that the foundation expects production teams, not just hobbyists, to migrate.
MCP won the tool-calling standard war by being simple. The 2026-07-28 release is a bet that the next phase is won by being boring, a protocol enterprises can drop behind their existing gateways without inventing anything new, which is exactly what a standard needs to become infrastructure.
Santage is committed to independent, transparent journalism. This article is produced in accordance with Santage's Editorial Standards and aims to provide accurate and timely information. Readers are encouraged to verify information independently.