a daily news desk
Tools

MCP finalizes 2026-07-28: sessions and the initialize handshake are gone

The Model Context Protocol's largest revision since launch drops protocol-level state, adds an Extensions framework, and ships MCP Apps and Tasks as first-class opt-ins.

By Iris Holloway · Tools & frameworks ·

The Model Context Protocol’s 2026-07-28 revision finalizes today, and with it the initialize/initialized handshake and the Mcp-Session-Id header, both foundational since launch, are gone. SEP-2575 removes the handshake; SEP-2567 removes the protocol-level session. Two years of production deployments were built on those primitives.

Lead maintainer David Soria Parra called it the “most substantial changes” to the spec “probably since adding authorization” on a July 23 livestream reported by The Register. His franker line: “A lot of things that made MCP are gone.”

The trade is architectural. Capabilities now ride in _meta on every request, with a server/discover method for on-demand negotiation, which means any MCP request can land on any server instance. A remote server can now sit behind a plain round-robin load balancer and route on an Mcp-Method header. That’s the payoff: statelessness is what horizontal scale actually wants, and the old handshake was a stickiness tax every operator paid. Soria Parra concedes the wire protocol is now “a bit more complicated than it used to be.” Complexity moved, it didn’t disappear.

Alongside the deletions comes construction. SEP-2133 introduces an Extensions framework; MCP Apps (SEP-1865) ships sandboxed-iframe HTML UI as an opt-in, and Tasks (SEP-2663), previously an experimental core feature since 2025-11-25, returns with server-directed lifecycles and handle-based state. Six additional SEPs tighten alignment with OAuth 2.0 and OpenID Connect. Sampling, Roots, and Logging are deprecated, earliest removal July 28, 2027 under a new twelve-month minimum lifecycle.

Migration cost is uneven. Stdio and stateless servers barely move. Session-keyed servers have to adopt explicit handle patterns like basket_id or workflow_run_id, per the Anthropic AI Interoperability Foundation guide. Beta SDKs for the four Tier 1 languages, Python, TypeScript, Go, and C#, already target the release. Community SDKs have no guaranteed timeline, which is where the real friction will surface.

Protocols that survive their first two years usually earn the right to break themselves. MCP is exercising it.

Sources