Project update Developer tools 12 Oct, 22:38

MCP 2026-07-28 Spec: What Server Builders Must Change

The 2026-07-28 MCP spec drops sessions and the initialize handshake and adds server/discover. Here is what changed for server builders and what to check first.

By Woodander Media Published Oct 12, 2026, 22:38 · 2 min read · Updated Oct 26, 2026

The Model Context Protocol published its 2026-07-28 revision as a stable release on July 28, 2026. The big shift: no more sessions and no initialize handshake. Every request now stands alone. If you maintain an MCP server or client, plan time to test against it.

This summary follows the official changelog in the specification repository, which lists changes since the 2025-11-25 revision. Read the full text before you change code.

What changed in the protocol?

Sessions are gone. Streamable HTTP no longer has protocol-level sessions or the Mcp-Session-Id header. A server that needs state across calls issues its own handle and the client passes it as a normal tool argument.
No handshake. The initialize exchange is removed. Each request carries the protocol version and client capabilities in _meta, and a version mismatch returns UnsupportedProtocolVersionError.
server/discover. A new call that servers must implement. It advertises supported versions, capabilities and identity.
subscriptions/listen. One long-lived response stream now carries change notifications, replacing the old GET endpoint and the subscribe and unsubscribe calls.
Removed calls. ping, logging/setLevel and notifications/roots/list_changed are out. Log level now rides on each request.
Resumable SSE is gone. If a stream breaks, the client reissues the request with a new ID.

What is deprecated?

Roots, Sampling and Logging still work during a deprecation window, but the changelog says new implementations should not add them. The old HTTP+SSE transport is deprecated in favor of Streamable HTTP. OAuth Dynamic Client Registration is deprecated as a registration method in favor of Client ID Metadata Documents. The new feature lifecycle policy sets a minimum twelve-month deprecation window.

What else should you check?

Tasks moved out of core into an extension, with polling through tasks/get instead of blocking on a result.
Server-initiated requests such as sampling and elicitation now follow a multi round-trip pattern: the server returns an input_required result and the client retries with its answers.
Every result needs resultType, either "complete" or "input_required". Clients should treat older servers that omit it as complete.
Cache hints (ttlMs and cacheScope) are required on list and read results.
Streamable HTTP POSTs must include Mcp-Method and Mcp-Name headers.
Error codes moved: resource not found is now -32602, and several MCP codes were renumbered into -32020 to -32099.

What should you do this week?

Read the changelog top to bottom and list which items touch your server.
If you store anything per session, redesign it around handles passed as arguments.
Add server/discover and test version negotiation against a client on the old revision.
Stop adding Roots, Sampling or Logging to new work.
Keep your old revision running until your clients have moved.

If you are choosing how to host the models your agents call, see our guide to running a local LLM server and browse the AI Agents & Infrastructure hub. Which of your servers keeps state in a session today?

Woodander Media — The Woodander Media editorial team All Developer tools news →