MCP publishes the 2026-07-28 specification with a stateless core

Background

The Model Context Protocol (MCP) is a shared interface through which AI applications reach external tools and data sources. In the design that came before this release, MCP was a bidirectional, stateful protocol: a client and a server kept a session open, and the server could send requests back to the client over that same session^[1]. Per-session state makes interactive features easy to build, but it also ties each exchange to one particular server process. A stateful session is a little like a phone call: once connected, either side can speak at any moment, but the conversation belongs to that one line. A request/response protocol is closer to sending letters: each message has to state what it wants, and any instance able to read it can answer.

What changed

On 28 July 2026 the project published the 2026-07-28 specification^[1]. Its highlight is a stateless protocol core that turns MCP from a bidirectional stateful protocol into a request/response protocol^[1]. Every request is self-describing, with an optional discovery call, so any request can land on any instance behind a plain round-robin load balancer^[1].

Key details

Routing information moved into HTTP headers: method and tool names travel in the Mcp-Method and Mcp-Name headers, so gateways can route and authorise on headers directly^[1]. Gateways sit in front of servers and often have to decide where a request goes and whether it is allowed before any application code runs, which is what header-carried information makes possible.

The two cases in which a server needs something from the client — sampling, where the server asks the client for model output, and elicitation, where it asks the user for input — move to Multi Round-Trip Requests instead of open bidirectional streams^[1]. Rather than pushing a request down a live connection, such an exchange is completed as a series of ordinary request/response round trips, which is what the stateless core allows.

List responses carry cache hints and a deterministic order, so clients can cache tool catalogs and keep prompt caches stable across reconnects^[1]. A tool list that comes back in the same order each time can be stored and reused instead of being fetched again before every call.

The release also formalises an extensions framework, with Tasks joining MCP Apps and Enterprise Managed Authorization as extensions^[1].

Scale and impact

The project says its Tier 1 SDKs see close to half a billion downloads a month, with the TypeScript and Python SDKs passing 1 billion total downloads^[1]. At that volume the deployment shape of the protocol reaches a great deal of code: with a stateless core, the instance that handles a request no longer has to be the process where a session began, and a gateway can route a request on headers before the server sees it^[1].

None of this changes what MCP is for — connecting AI applications to tools and data — but it changes where the work of keeping track of a conversation happens: from a live session to the messages themselves.