MCP drops sessions as the 2026-07-28 spec moves agent tools onto plain HTTP

MCP servers no longer have to treat session affinity as part of the protocol contract. The Model Context Protocol team published the 2026-07-28 specification on July 28, 2026, shipping a stateless protocol core along with Multi Round-Trip Requests(MRTR), header-based routing, cacheable list results, authorization hardening, a formal extensions framework, and updated Tier 1 SDKs.

The architectural change is direct. Earlier Streamable HTTP deployments used an initialize handshake and Mcp-Session-Id, which pushed server authors toward sticky routing or shared session stores. The new spec moves protocol version and capabilities into each request, so any server instance behind a round-robin load balancer can handle the call. That makes MCP look much more like ordinary HTTP infrastructure instead of a special long-lived connection shape.

The release matters because MCP has already become a large developer substrate. The maintainers say Tier 1 SDKs are seeing close to half a billion downloads per month, while both the TypeScript and Python SDKs have crossed 1 billion total downloads. A protocol shift at that scale affects AI coding tools, enterprise connectors, local assistants, and hosted agent gateways at the same time.

MRTR is the other practical piece. It gives clients and servers a defined way to exchange additional input inside a tool workflow without relying on transport-level session state. Header routing and cacheable list results make gateways, WAFs, observability systems, and serverless platforms easier to wire in. The extension framework also moves fast-changing features such as MCP Apps and Tasks outside the core protocol while keeping them versioned.

The old 2025-11-25 implementations do not disappear overnight, and teams will still need to read migration notes before changing production servers. But the default mental model has changed. New MCP deployments should be designed as horizontally scalable HTTP services first, with explicit state handles only where the application actually needs continuity across calls.