MCP Spec Finalized: Major SDK Overhaul and Version Locking Before Installation

On July 28, 2026, the Model Context Protocol (MCP) released a new specification that supersedes the 2025‑11‑25 version. The headline change is the shift from a stateful bidirectional connection to a completely stateless request‑response model: the previous initialize handshake and Mcp-Session-Id are removed, and protocol version and client capabilities are now sent in the _meta field of each request. Servers must issue a handle for cross‑call state.

This redesign frees deployment: remote servers can sit behind ordinary load balancers without sticky sessions or shared session stores.

Breaking Changes

The changelog lists nine major breaking changes. Items 1‑3 cover the stateless transition and are widely discussed. Items 4, 5, 7, 8, 9 are less obvious but each can cause existing code to fail.

Server‑initiated requests removed

Three server‑initiated calls ( sampling/createMessage, elicitation/create, roots/list) that relied on a long connection are gone. They are replaced by a multi‑round‑trip request (MRTR) workflow:

Client calls a tool.

Server returns resultType: "input_required" with an inputRequests description.

Client resends the original request, placing answers in inputResponses.

Because the original request is fully replayed, tools must be idempotent; non‑idempotent write operations will break under the new spec.

Notification changes

The old HTTP GET endpoint for server‑pushed notifications is removed. Clients now open a long connection via subscriptions/listen and declare which of the four notification types they want: toolsListChanged, promptsListChanged, resourcesListChanged, resourceSubscriptions. Each notification carries a io.modelcontextprotocol/subscriptionId marker. Notifications that follow a specific request ( notifications/progress, notifications/message) continue to flow in the request’s response stream.

SSE resume removed

Item 9 deletes Server‑Sent Events (SSE) resume support. The Last-Event-ID header and SSE event IDs are gone; if a stream is cut, the client must issue a new request with a fresh ID.

Other removals

The ping endpoint and logging/setLevel are removed. Log level is now supplied per request in _meta.io.modelcontextprotocol/logLevel. If a request lacks this field, the server must not send notifications/message.

SDK Updates

All four official SDKs (TypeScript, Python, Go, C#) were updated on the day the spec was finalized.

Python SDK

The PyPI package mcp now defaults to version 2.0.0 (released July 28). Version 1 remains at 1.29.0 for bug fixes and security patches. Major breaking changes include:

Class rename: FastMCP → MCPServer.

Field name conversion from camelCase to snake_case (e.g., inputSchema → input_schema, mimeType → mime_type).

HTTP client switched from httpx to httpx2, altering exception types.

Parameters such as host and port moved from the constructor to the run() method.

Example migration snippet:

# v1
from mcp.server.fastmcp import FastMCP
mcp = FastMCP("Demo")

# v2
from mcp.server.mcpserver import MCPServer
mcp = MCPServer("Demo")

TypeScript SDK

The previous single package @modelcontextprotocol/sdk (v1.30.0) has been split into multiple packages, all at version 2.0.0:

@modelcontextprotocol/server

@modelcontextprotocol/client

@modelcontextprotocol/core

@modelcontextprotocol/node

@modelcontextprotocol/hono

@modelcontextprotocol/server-legacy

Migration requires updating imports and dependencies; a provided codemod script can automate the renaming.

Other Notable Changes

Dynamic Client Registration (DCR) is deprecated; replace with CIMD and client‑ID metadata.

Deprecation tracking now uses a formal registry with Active, Deprecated, and Removed states; a feature stays Deprecated for at least 12 months before removal.

Recommended Migration Steps

Verify that your gateway, CDN, WAF, and load balancers forward the custom headers Mcp-Method and Mcp-Name unchanged; otherwise every request will be rejected.

Lock SDK versions to avoid accidental upgrades (e.g., pip install "mcp>=1.28,<2" for Python).

Ensure all tools are idempotent because MRTR will replay the original request.

Monitor the official deprecation list for any features you still rely on.

The protocol now does less for you, so your code must handle more responsibilities, but the payoff is genuine deployment flexibility.

Related Links

Specification: https://modelcontextprotocol.io/specification/2026-07-28/

Changelog: https://modelcontextprotocol.io/specification/2026-07-28/changelog

Deprecation registry: https://modelcontextprotocol.io/specification/2026-07-28/deprecated

Python SDK repo: https://github.com/modelcontextprotocol/python-sdk

TypeScript SDK repo: https://github.com/modelcontextprotocol/typescript-sdk