MCP Protocol’s Biggest Update: State Eliminated, Claude Leads Adoption

Why the Change Was Necessary: Problems with the Stateful Architecture

The original MCP design required an initialize/initialized handshake and a persistent Mcp-Session-Id for every request, which forced sticky routing, shared session storage (e.g., Redis), complex gateway parsing, and long‑lived bidirectional streams, making serverless or edge deployment difficult.

Core Change 1: Handshake and Session Removed

The new 2026‑07‑28 version drops the handshake entirely and retires the Mcp-Session-Id header. Each request now carries all metadata (protocol version, client identity, capabilities) in the _meta field, making the request self‑describing. A typical request looks like:

POST /mcp HTTP/1.1
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: search

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search","arguments":{"q":"otters"},"_meta":{"io.modelcontextprotocol/clientInfo":{"name":"my-app","version":"1.0"}}}}

This enables any instance to handle a request without sticky routing or shared session storage.

Core Change 2: Multi‑Round‑Trip Requests (MRTR) for Confirmation Flows

Scenarios that previously relied on server‑initiated elicitation/create, sampling/createMessage, or roots/list over a persistent stream now use MRTR. The server returns resultType: "input_required" with a question; the client collects user input and resubmits the original call with the answer in the inputResponses field. Supabase cites MRTR as the solution that finally allows safe elicitation in a stateless environment.

Core Change 3: Three Practical Adjustments

Request‑header routing: new Mcp-Method and Mcp-Name headers let gateways, rate‑limiters, and WAFs route and authorize without parsing the JSON body.

Cacheable list results: interfaces like tools/list, prompts/list, resources/list, and resources/read now include ttlMs and cacheScope fields for client‑side caching decisions.

JSON‑RPC‑aligned error codes: the custom -32002 is replaced by standard -32602 (Invalid Params), requiring code updates that hard‑coded the old value.

Extensions Framework Formalized

New capabilities are released as versioned extensions (e.g., MCP Apps, Tasks, Enterprise Managed Authorization) that can be validated independently before being merged into the core spec.

MCP Apps : servers can render interactive UI directly in the conversation.

Tasks : moved from experimental to stable, using io.modelcontextprotocol/tasks with tasks/get and tasks/update, and notifications via subscriptions/listen.

Enterprise Managed Authorization (EMA) : supports centralized IdP‑driven access for organizations.

Authentication Hardened to Production‑Grade OAuth

Issuer validation (RFC 9207) now requires the iss claim to be checked before exchanging authorization codes.

Dynamic client registration (DCR) adds application_type to solve localhost redirect issues.

Credentials are bound to the issuing server, preventing cross‑server reuse.

DCR is deprecated in favor of the Client ID Metadata Document (CIMD) with a 12‑month deprecation buffer.

Deprecated Capabilities

Roots, Sampling, Logging, and the legacy HTTP+SSE transport are marked deprecated (SEP‑2577) but will remain functional for at least 12 months; new projects should avoid them.

Claude’s Adoption

Anthropic announced that Claude‑series products will be the first to support the 2026‑07‑28 spec, leveraging MCP Apps, EMA, a developer observability dashboard, and an experimental MCP tunnel that connects Claude to private MCP servers without exposing public endpoints.

Ecosystem Reaction

Companies such as Figma, Netlify, PostHog, Xero, AWS, and Cloudflare praised the stateless core for reducing complexity, improving scalability, and simplifying integration.

What This Means for Developers

Code that hard‑codes Mcp-Session-Id or relies on session semantics must be migrated.

Any use of elicitation, sampling, or roots must be refactored to the MRTR pattern.

Update error‑handling logic to expect -32602 instead of -32002.

Avoid new development against deprecated capabilities; plan migration before the 12‑month buffer expires.

Follow the published submission process if you wish to list your MCP server in Claude’s connector directory.