Summary
On July 28, 2026, the Model Context Protocol team finalized its 2026-07-28 specification, its largest revision since launch, promoting the earlier release candidate to a final spec. MCP is now stateless at the protocol layer, so any request can hit any server instance behind an ordinary load balancer with no handshake or session id. The revision adds an Extensions framework with MCP Apps (SEP-1865) for server-rendered interactive HTML UIs in sandboxed iframes, a Tasks extension for long-running work, hardened OAuth/OIDC-aligned authorization, and a formal deprecation policy. Some changes are not backward compatible.
What changed
MCP published the final 2026-07-28 specification (moving beyond the release candidate): protocol-level statelessness (no handshake or session id), an Extensions framework with MCP Apps and a Tasks extension, hardened OAuth/OIDC authorization, and a formal deprecation policy, with some intentional breaking changes.
Why it matters
MCP has become the default way agents connect to tools and enterprise systems, with roughly 97 million monthly SDK downloads. A stateless core lets MCP servers scale on standard HTTP infrastructure without sticky sessions or shared session stores, sharply lowering the operational bar for enterprise deployment, while MCP Apps and Tasks extend the protocol from single tool calls toward interactive UIs and durable long-running work. Finalization moves the ecosystem from preview to a coordinated migration, including the breaking changes.
Evidence excerpt
The final MCP specification will be published on July 28, 2026 ... a stateless core that scales on ordinary HTTP infrastructure, extensions including server-rendered UIs through MCP Apps and long-running work through the Tasks extension, and authorization that aligns more closely with OAuth and OpenID Connect.