The 28 July Model Context Protocol specification revises the core architecture of the agent tooling substrate, converting a bidirectional stateful design into a request-response model. Protocol-level sessions disappear so that any server instance can accept any request without sticky routing or a shared session store. Maintainers presented the change as a direct answer to demand for reliability and scale among servers that supply context and tools to agentic workflows. The revision therefore registers as a production architecture shift inside the agent supply chain rather than an incremental feature release.[E1]
Precisely, the update retires the initialize and notifications/initialized handshake together with the Mcp-Session-Id header. Every request now travels self-contained, carrying its protocol version, client identity and capabilities inside _meta. List endpoints no longer vary by connection, and servers that still require continuity across calls must mint an explicit handle and return it as an ordinary tool argument for the model to pass back later. Version mismatches surface as an UnsupportedProtocolVersionError.[E2]
Per-request capability negotiation arrives through the new server/discover RPC, which servers must implement so clients can learn supported versions and features without a prior handshake. Routable headers complete the transport change: Mcp-Method is required on every Streamable HTTP POST and Mcp-Name appears on named tool, resource or prompt invocations. Gateways can therefore route or authorize on headers alone, and servers reject any request whose headers disagree with the body.[E1][E3]
Tasks move out of the core into a formal extension under the new extensions framework, while Roots, Sampling and Logging enter deprecation. The deprecated features remain fully usable for a minimum twelve-month window, lasting at least until July 2027, after which new implementations are expected to avoid them. The legacy HTTP+SSE transport follows the same offramp. Authorization is tightened with issuer validation and a shift toward client metadata documents, yet the specification does not declare automatic security improvement.[E1][E4]
State therefore becomes an application responsibility instead of a transport property. Operators must name, pass and own continuity across calls, typically by returning a visible handle that the model can reason about and thread between tools. The design keeps that state inspectable in logs and free of hidden session affinity, but it places the consistency burden squarely on server and client authors who previously relied on the protocol identifier. Dropping the session does not force applications themselves to be stateless.[E1][E5]
Four Tier-1 SDKs—TypeScript, Python, Go and C#—shipped full support for the 2026-07-28 revision on the release day itself. The Rust SDK offers only beta support. Migration carries real cost for code that depended on session identifiers, although early testing feedback and codemods were prepared to reduce friction. Existing servers continue to interoperate during the transition; the release does not claim universal ecosystem migration.[E1][E6]
The strongest counter-case observes that the architecture change does not erase operational work. Independent operator guides stress that sessions are gone and state is now an explicit problem for each application, that request headers, resultType fields and several methods constitute breaking changes, and that scaling benefits appear only where teams adopt the new patterns and abandon session affinity. Authorization hardening is real yet remains a set of requirements rather than a completed guarantee. The twelve-month deprecation clock gives time to plan, not an automatic escape from redesign.[E3][E5]
Inside the agent supply chain the revision repositions MCP servers as ordinary HTTP services that load balancers and serverless platforms can treat without special session logic. Production teams gain the option to run behind round-robin or edge infrastructure, provided they accept ownership of remaining state and schedule the twelve-month deprecation window. The architecture change is documented and already reflected in the four Tier-1 SDKs; its operational payoff depends on deliberate application redesign rather than passive adoption.[E1][E3]