← Back to Dashboard
1. CRITICAL: April 2026 STDIO RCE2. Agentic AI Foundation (AAIF)3. MCP Release Candidate (May 2026)4. MCP Stable Release (July 2026): What Shipped5. MCP 2026 Roadmap, Working Groups & Enterprise SOE/AOE
MCP Stable Release (July 2026): What Shipped
2026-07-28 Ships: MCP Goes Fully Stateless
On July 28, 2026, the MCP working groups shipped the stable 2026-07-28 revision, officially superseding 2025-11-25 as the current protocol version. It goes further than the RC in the previous lesson - even the connection handshake itself is now gone.
💡 Key Insight:
2026-07-28 removes the initialize / notifications/initialized handshake entirely. Every request now carries its own protocol version and capabilities - there is no connection setup step left at all.What Changed Since the RC
| Change | Detail |
|---|---|
| No handshake | Every request carries protocolVersion and clientCapabilities in its _meta field. Servers return serverInfo in the result's _meta instead of during a one-time handshake. |
| server/discover | New mandatory RPC - servers MUST implement it so clients can query supported versions, capabilities, and identity up front, or use it as a compatibility probe over stdio. |
| Sessions removed | The Mcp-Session-Id header and protocol-level sessions are gone from Streamable HTTP. Servers needing cross-call state now mint their own opaque handles and pass them back as ordinary tool arguments. |
| subscriptions/listen | Replaces the HTTP GET stream plus resources/subscribe and resources/unsubscribe with one long-lived stream that clients opt into per notification type. |
| Tasks becomes an extension | The experimental Tasks primitive is no longer core protocol. It ships as the official io.modelcontextprotocol/tasks extension, replacing the blocking tasks/result call with polling via tasks/get plus a new tasks/update. |
| MRTR pattern | "Multi Round-Trip Requests" replace server-initiated calls like roots/list, sampling/createMessage, and elicitation/create. Servers return an InputRequiredResult; clients retry the original request with inputResponses. |
Formal Deprecations (12-Month Window)
- Roots, Sampling, and Logging - still functional, but new implementations should migrate away: pass paths via tool parameters or resource URIs instead of Roots, call the LLM provider's API directly instead of Sampling, and use stderr or OpenTelemetry instead of the Logging feature.
- HTTP+SSE transport - formally reclassified as Deprecated under the new feature lifecycle policy (it had only been discouraged since 2025-03-26). Migrate to Streamable HTTP.
- OAuth Dynamic Client Registration (RFC 7591) - deprecated in favor of Client ID Metadata Documents, though it remains available for authorization servers that don't yet support the newer mechanism.
🎯 Pro Tip: If you maintain an MCP server today, the highest-priority migration is dropping any reliance on Mcp-Session-Id or the initialize handshake - both are fully removed in 2026-07-28, not merely deprecated.
🧪 Knowledge Check
Press 1-4 to select1 of 3
What is the single biggest change in the MCP 2026-07-28 stable release compared to earlier versions?
A new binary wire format replacing JSON-RPC
Removing the initialize/notifications/initialized handshake entirely, making even connection setup stateless
Switching from Streamable HTTP to WebSockets
Requiring every server to run on port 443