Ditching "Sessions" and Going Back to Plain HTTP — MCP's Biggest Revision Yet Hands Long-Running Agents a Common Convention Called "Tasks"
MCP, the connectivity standard from Anthropic, reaches its biggest revision since launch on July 28, 2026. It removes "sessions" from the core to go stateless, and adds two extensions: "Tasks," a common convention for long-running work, and "MCP Apps," which return a UI. Breaking changes are include
The Model Context Protocol (MCP), the connectivity standard that originated at Anthropic, has reached a milestone with the "2026-07-28" specification dated July 28, 2026. Its contents were locked down as a release candidate (RC) in May, and after roughly ten weeks of validation this date was set as the target for finalization. The official blog frames it as "the largest revision since launch." MCP is a prime example of a mechanism Claude introduced that has spread widely to other developer tools, and it has served as the foundation that connects coding agents to external tools and data. This revision reworks the very design philosophy of that foundation.
Toward "Stating Your Identity on Every Exchange" — Removing Sessions from the Core
The biggest change is the removal of "sessions" from the core of the protocol. Until now, a connection began with an initialize / initialized exchange (a handshake) and kept conversational state in a header called Mcp-Session-Id. The new specification abolishes both, and instead carries client information in a piece of accompanying data called _meta that is attached to every request.
The aim is operational ease. Because there is no state to hold (stateless), a request can be processed by whichever server instance receives it. Without "sticky sessions" that pin a conversation to a particular server, or any mechanism for sharing state, you can scale out horizontally behind an ordinary load balancer. The direction is to let remotely running MCP servers be operated with the same mindset as any ordinary web service.
A New Point of Entry Called Extensions — "MCP Apps" That Return a UI, "Tasks" That Make You Wait
The other pillar is the formalization of "Extensions." An extension carries a reverse-DNS-style identifier, negotiates its enabled/disabled state through capability exchange, and can be versioned separately from the specification itself. It is a framework for bolting on functionality while keeping the core thin, and two extensions ship together this time.
| Extension | What It Does |
|---|---|
| MCP Apps | Lets a server return an interactive HTML UI inside a sandboxed iframe. Tools declare their UI templates in advance, enabling prefetching and safety review. Interactions on the screen are handled over ordinary JSON-RPC |
| Tasks | A common convention for handling long-running work. In response to a tools/call, the server returns a "task handle," and the client drives its progress with tasks/get, tasks/update, and tasks/cancel |
Tasks has been repositioned from what was previously an experimental core feature and redesigned as an extension. Instead of an immediate answer, the server returns a task ID, an initial state, and a recommended polling interval, and the client checks states such as working (in progress) / input_required (awaiting input) / completed / failed / cancelled via tasks/get. When input is needed partway through — as with waiting for human approval — values can be passed via tasks/update, allowing interactive, multi-step processing to proceed within a single task. It gives long-running agents a common way to "make you wait," so that each tool no longer implements it in its own scattered fashion.
Authentication Leans Toward OAuth, and Older Features Get a Notice of Departure
Authentication, too, has been brought closer to real-world operation. Six SEPs (specification proposals) align it with the practical use of OAuth 2.0 and OpenID Connect — for example, making validation of the iss parameter mandatory during authorization and requiring an application_type declaration for OpenID Connect. These are adjustments to make it easier to drop straight onto an enterprise identity platform.
Alongside this, the first formal deprecation policy has also been laid out. Roots, Sampling, and Logging are being deprecated, with a grace period of at least 12 months before removal. It is a set of rules for departure that lets things move forward without breaking.
The Two-Sided Nature: "It Works Even If You Don't Upgrade — But If You Do, Things Break"
For development teams, the benefits and the effort go hand in hand. This release includes breaking changes. Here are the main changes.
| What Changes | Details |
|---|---|
| Sessions | Abolishes initialize / initialized and Mcp-Session-Id, going stateless |
| Error codes | Resource-not-found changes from -32002 to the standard -32602 (Invalid Params) |
| Tasks API | Migration from the old "2025-11-25" version becomes necessary |
| Legacy features | Roots, Sampling, and Logging are deprecated (removal 12 months or more out) |
Still, the official stance is that "existing servers keep working, and upgrading is optional and can proceed incrementally." To aid migration, beta SDKs for Python (v2.0.0b1), TypeScript (v2 beta), Go (v1.7.0-pre.1), and C# (v2.0.0-preview.1) have been released ahead of time, and Python and TypeScript come with migration guides that include automated conversion (codemods). That said, a caveat is attached: you should validate under real load behind a load balancer or gateway. This is a transitional period in which the standard is moving from a "local tool" to a "connectivity layer built for distribution," and the practical implication is that if you want to keep things running, early validation is required.
A standard that began with Claude is now becoming the plumbing shared by agents across many companies. This revision is not the flashy unveiling of a new model, but it is a move that shows how the conditions for "operating coding agents continuously and safely" are steadily solidifying outside of raw model performance.
References: The 2026-07-28 MCP Specification Release Candidate (Model Context Protocol Blog) / Beta SDKs for the 2026-07-28 MCP Spec Release Candidate / SEP-2663: Tasks Extension / MCP's Largest Spec Change Since Launch (TechTimes)
