What’s New in MCP Protocol’s Fifth Major Release (2026‑07‑28)?

The MCP protocol announced its fifth major version (2026‑07‑28), changing the core communication model from a stateful bidirectional protocol to a stateless request/response protocol. Previously, a client had to perform a handshake to obtain a session ID, binding subsequent requests to a single server instance and hindering load‑balancing. The new design makes each request independent, embedding the protocol version and client information, allowing any server instance to handle the request and enabling deployment patterns such as serverless, edge computing, or CDN‑backed fleets.

For use‑cases that require cross‑request state, the protocol recommends that the client tool generate a handle that the model can pass between tool invocations, keeping state in the business layer rather than the protocol layer.

Additional changes include MRTR (multi‑round request) to handle scenarios where user input is needed mid‑flow—for example, a Supabase MCP server can ask for cost confirmation before creating a resource or request deletion confirmation, returning a “need input” status that the client can answer in a subsequent request.

Two new request‑header fields, Mcp-Method and Mcp-Name, allow gateways and firewalls to route and authorize traffic without parsing the JSON body. Authorization is hardened by requiring verification of the issuer parameter, closing a known issuer‑confusion vulnerability. Dynamic client registration (DCR) is removed in favor of a client‑metadata document (CIMD).

Features marked as deprecated are Roots, Sampling, and Logging, each remaining usable for a 12‑month transition window; the legacy HTTP+SSE transport is also deprecated. This formal deprecation policy gives production teams a predictable upgrade path.

Four primary SDKs (TypeScript, Python, Go, C#) have been updated to the new spec, with a Rust SDK in beta. MCP’s monthly downloads approach 500 million, and the TypeScript and Python SDKs have each surpassed 1 billion cumulative downloads.

Major cloud and tool providers—including AWS Bedrock AgentCore, Microsoft Foundry, Cloudflare Workers, Google Cloud, Figma, Supabase, and Honeycomb—have announced support for the new specification. Because the change is breaking for implementations that rely on session identifiers, developers are advised to review the full changelog and migration guide, assess impact, and plan upgrades accordingly.