MCP 2026-07-28: The AI agent protocol goes stateless — what this means for your software

On 28 July 2026, the Model Context Protocol received its biggest update since launch: a stateless core, new Multi Round-Trip Requests and OAuth hardening make AI agent integrations easier to run and more secure. What changes, what gets deprecated, and when migration is worth it.

Companies that use AI agents in their operations — whether it is Claude Code in software development, an internal assistant connected to a database, or an automated workflow that calls external services — are most likely relying on the **Model Context Protocol (MCP)**. Since its launch in late 2024, this open protocol has become the de facto standard for connecting AI assistants to external tools and data sources: it powers Claude Desktop, Claude Code and a growing number of enterprise integrations.

On 28 July 2026, the MCP team published specification `2026-07-28` — the largest change to the protocol since its launch. The core change affects the architecture itself: MCP moves from a stateful, session-based protocol to a fully stateless request/response model. This article explains what that means in practice and why it matters for companies running their own AI integrations.

What changes concretely

The five most important changes in specification `2026-07-28` ([source: MCP Blog](https://blog.modelcontextprotocol.io/posts/2026-07-28/)):

• Stateless core: Every request is now self-describing — an MCP server no longer needs a running session context. Deployments behind standard round-robin load balancers become straightforward, without custom sticky-session routing. Practical benefit: simpler horizontal scaling, lower infrastructure overhead.
• Multi Round-Trip Requests (MRTR): A tool can ask the user a question mid-execution — for example, request a confirmation or collect a missing parameter — without holding a permanently open bidirectional stream. This enables structured, interactive agent workflows.
• OAuth 2.0 / OIDC alignment: MCP server authorisation now follows RFC 9207 and standard OAuth flows. Native connection to enterprise identity systems such as Microsoft Entra or Okta becomes possible without workarounds — a significant step toward production-ready enterprise deployments.
• Cacheable list responses: Tool and resource list results now carry cache hints. Fewer redundant calls in agent loops and better performance — particularly relevant when external APIs are metered.
• Routing headers: Method and tool name now travel as HTTP headers, so gateways and rate limiters can route without parsing JSON bodies.

What gets deprecated and how long it stays supported

The new specification marks several currently common features as deprecated: Roots, Sampling, Logging and the legacy HTTP+SSE transport. The minimum support window is 12 months — these features will remain available in mainstream clients and SDKs until at least July 2027. Existing integrations in custom software projects that use them have time to migrate, but should schedule it on their roadmap.

Concrete use cases for mid-sized software teams

Which scenarios benefit most from the update?

• Scalable internal AI assistants: Companies running a Claude-based assistant for 50+ employees benefit directly from the stateless core — no sticky sessions, standard load balancers, simpler cloud deployment.
• Interactive approval workflows: MRTR lets agents request a confirmation mid-process — for example, surface a purchase suggestion for sign-off before executing it — without separate back-channel infrastructure.
• Enterprise-secure integrations: Organisations using Microsoft Entra or Okta as their identity provider can now connect MCP servers natively without workarounds. This reduces integration effort substantially and aligns with common compliance requirements.
• Agent pipelines with database access: Cacheable list responses measurably reduce redundant database queries in agent loops — relevant wherever external calls have a cost or introduce latency.

Before migrating: checklist

• SDK version: Beta SDKs for TypeScript, Python, Go and C# are available. For production deployments, wait for the stable release — migration guides are already included.
• Identify breaking changes: The `initialize` handshake and persistent sessions are gone entirely. Custom MCP servers and clients need to be rebuilt for the stateless model.
• Audit your deprecation exposure: Do your current integrations use Roots, Sampling or the HTTP+SSE transport? Add these to your migration plan — the 12-month window gives you adequate time.
• Load balancer configuration: Removing session affinity may simplify existing infrastructure — check whether routing adjustments are needed or can now be simplified.
• Identity integration (OAuth): If you use Entra or Okta, native auth integration can be planned as a parallel task alongside migration — the security benefit is substantial.

A stateless MCP makes AI agents operationally manageable like any other API — scalable, load-balanceable and without special routing.

Verdict: migrate now or wait?

For most companies: wait for the stable release, but plan now. The beta SDKs are ready for evaluation environments; for production use, the final release is advisable. Developers starting new MCP server builds today should target the new specification directly — retrofitting later costs more than building right the first time.

Immediate action makes sense if you are building scalable agent infrastructure or need enterprise identity integration.