MCP 2026-07-28 Spec: What Changes in the Protocol's Biggest Revision - Stateless Core, MCP Apps, Tasks and SDK v2

The new “2026-07-28” specification of MCP (Model Context Protocol) — the standard that connects AI models to external tools — becomes final on July 28, 2026, as its name suggests¹². When the release candidate was announced on May 21, 2026, the official blog called it the largest revision since the protocol’s launch¹. With one week to go, attention is building: TechCrunch covered the update under the headline “AI’s most important protocol is getting a little bit easier to use”³.

If you are new to MCP, our explainer What is MCP? covers the basics — in short, it is a common standard that lets AI assistants safely reach external resources such as calendars, databases, and internal tools. TechCrunch describes it as “the plumbing that lets a chatbot reach into your calendar, your database, or your internal tools”³. This article walks through what changes in the revision and how it affects existing implementations.

The Big One: A Stateless Protocol Core

The centerpiece of the revision is a stateless protocol core. MCP previously assumed an initialization handshake at connection time and session-based routing; the new spec removes both. Servers no longer need sticky sessions or shared session stores and can sit behind a simple round-robin load balancer¹. As the official blog puts it, “any MCP request can land on any server instance”¹.

This matters because it directly affects how easily MCP runs on enterprise infrastructure. Nate Barbettini, founder of MCP-focused startup Arcade, described the old model’s problem to TechCrunch: “Now every one of those machines has to know about a session ID that some other machine handed out. It’s not impossible, but it’s a serious pain.”³ With a stateless core, MCP servers can be scaled like any ordinary web service. TechCrunch’s Russell Brandom frames the revision as infrastructure work that removes barriers to enterprise AI agent deployment — addressing why MCP adoption has not spread as widely as the hype around agentic AI would suggest³.

MCP Apps and Tasks: Beyond Simple Tool Calls

The new spec formalizes the extension framework, and two extensions stand out.

MCP Apps lets servers ship interactive HTML interfaces. The UI renders inside a sandboxed iframe, and UI actions route through the same audit and consent mechanisms as direct tool calls¹. MCP, so far centered on text exchanges, officially gains screen-based interaction.

Tasks handles long-running operations and graduates from an experimental feature to an official extension. Its lifecycle has been redesigned for the stateless model, with clients driving long-running operations through dedicated methods¹. It is the foundation for handing AI agents work that takes minutes or hours.

Hardened Authorization and a Formal Deprecation Policy

On the security side, the revision includes six proposals that strengthen alignment with OAuth 2.0 and OpenID Connect, including issuer validation and application type declarations¹. That direction makes it easier to combine MCP with existing enterprise identity infrastructure.

Also notable is the introduction of a formal deprecation policy. Features move through Active, Deprecated, and Removed stages, with at least twelve months between deprecation and removal¹. The revision itself is a set of breaking changes, but the official blog states the expectation that, with deprecation windows and extensions as the standard tools going forward, implementers targeting 2026-07-28 should be able to adopt future revisions without major rewrites¹.

SDK v2: FastMCP Renamed, Packages Split

Beta SDKs supporting the new spec shipped on June 29, 2026 for the four Tier 1 languages: Python, TypeScript, Go, and C#². The changes most likely to affect your team:

SDK	Version	Key changes
Python	v2 (`mcp[cli]==2.0.0b1`)	FastMCP renamed to MCPServer; decorator-pattern API preserved²
TypeScript	v2	Split into `@modelcontextprotocol/server` / `@modelcontextprotocol/client`; Standard Schema for tool validation; ESM-only, Node.js 20+²
Go	v1.7.0-pre.1	Existing APIs preserved; stateless support via `StreamableHTTPOptions.Stateless = true`²
C#	v2.0.0-preview.1	Stable v1.x APIs keep working; breaking changes limited to deprecated capabilities (roots, sampling, logging)²

Note that the spec becoming final on July 28 does not break running servers. The official blog states that existing servers continue functioning after the specification is published².

Migration Becomes a “When,” Not an “If”

Building on the mechanics of function calling, MCP standardized how AI connects to external tools, and an ecosystem of MCP tools has grown around it. This revision marks the protocol’s shift from a trial-and-error phase to something run as enterprise infrastructure.

If your team builds or operates MCP servers, three things are worth doing now: (1) diff the final July 28 spec against your implementation, (2) test against the v2 SDK betas, and (3) revisit your deployment topology with a stateless core in mind. Nothing breaks immediately, so there is no need to rush — but with the deprecation policy setting an explicit migration horizon of at least twelve months, it is worth putting “when do we migrate” on the roadmap. For non-engineering teams evaluating AI agents, a stabilizing connection standard means one less uncertainty in the adoption decision.