← Back to Dashboard
1. CRITICAL: April 2026 STDIO RCE2. Agentic AI Foundation (AAIF)3. MCP Release Candidate (May 2026)

MCP Release Candidate (May 2026)

📚 2026 Critical Updates & Security10 min140 XP

The Largest Revision Since Launch

On May 22, 2026, the MCP working groups announced the MCP Release Candidate (RC) — the biggest single revision to the protocol since its original launch. The final release is scheduled for July 28, 2026.

⚠️ Breaking Changes: The RC includes breaking changes from earlier versions. Migration documentation is available in the RC specification. Plan your upgrade path now.

Key Architectural Changes

ChangeWhat It MeansImpact
Stateless CoreEliminates sticky sessions and session IDs from the core protocol. MCP servers can now run behind standard round-robin load balancers using plain HTTP.🔴 Biggest architectural change — simplifies deployment at scale dramatically
Extensions FrameworkNew capabilities are negotiated as extensions rather than being baked into the core specification.🟡 Enables faster iteration without breaking the core protocol
Tasks ExtensionFormal support for long-running asynchronous operations (evolved from SEP-1686 Tasks Primitive).🟢 Critical for agent workflows that span minutes or hours
Enhanced AuthorizationAligns MCP auth with modern OAuth 2.1 and OpenID Connect standards.🟢 Enterprise-ready SSO and identity federation
Formal Deprecation PolicyEstablishes long-term stability guarantees with defined deprecation timelines.🟢 Confidence for production deployments

The Stateless Shift — Why It Matters

Before the RC, MCP servers were inherently stateful — each client-server pair maintained a session, requiring sticky routing in load balancers. This made horizontal scaling painful:

// BEFORE (stateful — requires sticky sessions):
Client A ──▶ Load Balancer ──▶ Server Instance #3 (pinned)
Client B ──▶ Load Balancer ──▶ Server Instance #1 (pinned)

// AFTER RC (stateless — standard round-robin):
Client A ──▶ Load Balancer ──▶ Any Server Instance
Client B ──▶ Load Balancer ──▶ Any Server Instance

With the stateless core, MCP servers are now plain HTTP services that can be deployed, scaled, and load-balanced with existing infrastructure — no special session affinity required.

Migration Checklist

  • ☐ Review the RC specification and breaking changes
  • ☐ Identify any session-dependent logic in your servers
  • ☐ Migrate stateful features to use the new Extensions Framework
  • ☐ Update auth flows to align with OAuth 2.1 / OIDC
  • ☐ Test against the RC SDK before the July 28 final release
💡 Key Insight: The move to a stateless core is the single most impactful change for production MCP deployments. It means MCP servers can now be treated like any other stateless HTTP microservice — deployed on Kubernetes, Cloud Run, Lambda, or any container platform without special session handling.
🧪 Knowledge Check
Press 1-4 to select1 of 3
What is the single biggest architectural change in the MCP Release Candidate?
New tool types
Eliminating sticky sessions — making the core protocol stateless so servers can run behind standard load balancers
Adding WebSocket support
Changing from JSON to Protocol Buffers
Watch: 139x Rust Speedup
MCP Release Candidate (May 2026) | 2026 Critical Updates & Security — MCP Academy