MCP ships its biggest spec rewrite today
The 2026-07-28 Model Context Protocol spec is out: no more session handshake, plus caching, extensions and a formal deprecation policy.
Model Context Protocol maintainers David Soria Parra and Den Delimarsky shipped the 2026-07-28 specification today, the protocol’s largest revision since launch. The core change: MCP drops its stateful session handshake entirely, so any request can hit any server instance without sticky routing or a shared session store. The release candidate for this exact revision was locked on May 21, giving implementers roughly ten weeks to test before today’s ship.
Alongside the stateless core, the spec adds response caching with new routing headers, promotes Extensions to a first-class mechanism with independent versioning, folds in MCP Apps for server-rendered UI and a redesigned Tasks extension for long-running work, hardens OAuth 2.0/OpenID Connect authorization across six separate proposals, and sets a formal deprecation policy requiring at least 12 months’ notice before a feature is removed. The maintainers’ own post cites close to half a billion downloads a month across the protocol’s Tier 1 SDKs, with the TypeScript and Python SDKs each having now crossed 1 billion total downloads.
What it means for operators
This is the same revision the beta SDKs previewed last week, now actually shipped rather than staged. If your team already tested against the RC, the migration work is largely done; if you didn’t, the beta SDK availability window that felt generous a month ago is now the live spec. Anyone running an MCP server that other teams depend on, Alexa+‘s smart-home integration among them, should treat today as the point where “we’ll migrate eventually” turns into a version mismatch in production. The new deprecation policy is worth reading regardless of whether this specific change affects you, since it now governs every future breaking change to a protocol two SDKs deep into billion-download territory.