The Source
David Soria Parra, Den Delimarsky (Lead Maintainers), "The 2026-07-28 Specification", Model Context Protocol official blog, finalized 2026-07-28. The release candidate shipped 2026-05-21, followed by a ten-week validation window.
This review covers a protocol specification, not an academic paper. MCP runs an open governance process — every change is tracked as a public SEP proposal — but it remains a de-facto vendor-driven standard launched by Anthropic, and the adoption figures below are the project's own numbers with no independent verification. Read accordingly.
What Changed
In one sentence: MCP abandoned stateful protocol design. The initialize/initialized handshake and the Mcp-Session-Id header are gone (SEP-2575, 2567); every request now carries protocol version, client identity, and capabilities self-descriptively in _meta. When a server needs user input mid-operation, it returns an input_required result — a multi-round-trip request (MRTR) — instead of holding an open stream. The Mcp-Method and Mcp-Name HTTP headers become mandatory (SEP-2243), letting gateways route and instrument without parsing JSON bodies, and list/resource responses gain ttlMs and cacheScope cache hints (SEP-2549).
| Aspect | Before (2025-11-25) | Now (2026-07-28) |
|---|---|---|
| Protocol model | Session-based, stateful | Stateless request/response |
| Server-initiated requests | Held open streams | MRTR (input_required round-trips) |
| Routing | JSON body parsing | Mcp-Method / Mcp-Name headers |
| Auth registration | Dynamic Client Registration | CIMD (Client ID Metadata Documents) |
| Load balancing | Shared store required | Round-robin capable |
Long-running work graduates from an experimental core feature to the standalone io.modelcontextprotocol/tasks extension (SEP-2663): tools/call returns a task handle, managed via tasks/get (polling), tasks/update, and tasks/cancel — while tasks/list is removed, because without sessions a server cannot safely scope a task listing. Roots, Sampling, and Logging are officially deprecated (minimum 12-month removal grace, SEP-2577), the missing-resource error code moves from -32002 to the JSON-RPC-standard -32602, and tool schemas migrate to JSON Schema 2020-12 (SEP-2106).
On adoption, the project reports roughly 500 million monthly downloads across Tier 1 SDKs, over 1 billion cumulative downloads each for the TypeScript and Python SDKs, and about 20% of Honeycomb's monthly interactive queries now coming from agents.
Reliability and Maturity Assessment
The process has matured. A ten-week RC validation window was honored, and the release lands alongside a feature lifecycle policy (Active → Deprecated → Removed, 12 months minimum), mandatory conformance testing (SEP-2484), and an SDK tier system — making the project's way of breaking things predictable. Every change being traceable to an SEP number also helps verification.
Three caveats. First, all adoption figures are self-reported with no independent audit. Second, this is the second major redesign in roughly eight months since 2025-11-25, and migration fatigue among implementers is real — users of the 2025-11 Tasks API in particular must move to the new lifecycle with no compatibility path. Third, the cost of statelessness is transferred to implementers: with tasks/list gone, task inventories and audit trails must now be built by each client.
Reviewer's Verdict: The Standard Surrendered to Web Infrastructure
The essence of this revision is not new features — it is MCP reshaping itself to the grammar of web infrastructure: load balancers, gateways, WAFs, HTTP caches. Session removal, header routing, cache hints, and round-robin support read as a requirements list from large-scale operators asking to run MCP with their existing tooling. We read this as the protocol crossing from the demo stage into the infrastructure stage.
Equally telling is the direction of the deprecations. Roots, Sampling, and Logging were all features where the server reached into the client's LLM, filesystem, or logs — and every replacement path (direct LLM provider APIs, tool parameters, OpenTelemetry) pushes that responsibility back to the client/host. MCP is converging on a narrower role: a tool-connection protocol. Standards that shrink their ambitions tend to survive, so we consider this the right call — but as tasks/list shows, the cost of statelessness didn't disappear; it moved into implementers' backlogs. Lose the handle, lose the task.
What to Do About It
- Fix your migration window — inventory every dependency on Roots, Sampling, and Logging now, and schedule replacements (tool parameters, provider APIs, OpenTelemetry) within the 12-month grace period. 2025-11 Tasks API users get no grace: the new lifecycle is mandatory.
- Build a task-handle register — with no tasks/list, clients must durably persist issued handles and own their tasks/get polling and recovery. Lost handle = lost task is the new default.
- Exploit header routing — mandatory Mcp-Method/Mcp-Name headers enable per-method rate limits, audit, and blocking at the gateway, and let you retire JSON-parsing proxies.
- Do the mechanical fixes — update error-code matching from -32002 to -32602, upgrade schema validators to JSON Schema 2020-12, and wire W3C Trace Context (traceparent) propagation into your observability pipeline.
Conclusion
The 2026-07-28 specification marks MCP's transition from "the lingua franca of agent demos" to "a component of operating infrastructure." The standard trimmed itself to fit the web's grammar, and in exchange, state management landed on implementers. With a 12-month grace period and SEP traceability, planned migration is feasible — what teams need now is not feature-chasing but a dependency inventory keyed to the deprecation list. For an operations-checklist take on this spec, see the companion blog post below.