The final Model Context Protocol specification dated July 28, 2026 moves its modern protocol path to stateless, self-contained requests. For developers, the important point is not a generic promise of easier scaling. It is a new wire contract: clients and servers adopting this version must change how they identify capabilities, preserve state, send notifications, recover interrupted work and negotiate compatibility.
Protocol-level sessions are gone from the 2026-07-28 path, and Streamable HTTP no longer uses Mcp-Session-Id. That does not make applications stateless. A server that needs information across calls must mint an explicit handle and accept it as an ordinary tool argument, while deployments still decide how and where the handle’s backing state is stored.
The initialize and notifications/initialized handshake is also removed for the modern version. Each request carries its protocol version and client capabilities in _meta; client identity is recommended on each request, and server identity is recommended in each result. Every server must implement server/discover to advertise supported versions and capabilities, although a client may instead send its preferred request immediately and handle an unsupported-version error.
On Streamable HTTP, every client message is a separate POST to one MCP endpoint. HTTP clients must send the protocol version and standard method headers, with Mcp-Name required for selected operations, and servers must reject required header values that do not match the JSON-RPC body. The transport rules also require Origin validation and recommend authentication, so migrating the wire format is not a substitute for access controls.
The notification model changes with the transport. The standalone GET stream and resources/subscribe and resources/unsubscribe are removed from this path. Long-lived list and resource changes move to subscriptions/listen, while request-scoped progress and message notifications remain on the response stream for the request that produced them.
Streamable HTTP also drops SSE resumability through Last-Event-ID and event IDs. If a response stream breaks, the client reissues the operation as a new request with a new request ID. That rule deserves extra care around side-effecting tools: the protocol defines the retry shape, but an application still needs idempotency or reconciliation logic to avoid treating an uncertain outcome as proof that nothing ran.
Result handling changes at the schema level. Every result now carries resultType, using complete for ordinary results and input_required for an interim Multi Round-Trip Request. MRTR replaces the older pattern of a server initiating roots, sampling or elicitation calls: the server returns the inputs it needs, and the client retries the original request with inputResponses and requestState when present. Clients must interpret earlier-protocol results that omit resultType as complete.
Several discovery and resource results now carry ttlMs and cacheScope. ttlMs is a freshness hint rather than a guarantee, and cacheScope distinguishes public from private responses for shared intermediaries. Clients need to combine those fields with list-change notifications; servers should not assume a cache hint will eliminate refresh traffic.
Authorization changes tighten issuer handling. Clients must validate a returned iss value when present, store credentials under the issuer that produced them and never reuse those credentials with a different authorization server. Dynamic Client Registration clients must declare an appropriate application_type, even as DCR itself moves into deprecation in favor of Client ID Metadata Documents.
The Tasks feature no longer sits in the core protocol. It is the opt-in io.modelcontextprotocol/tasks extension, with polling through tasks/get, client input through tasks/update and durable task handles. Extensions are disabled by default and do not count toward core protocol conformance, so a specification-compliant SDK may still omit Tasks or another extension.
Roots, Sampling, Logging and Dynamic Client Registration are deprecated, not removed. The registry says they become eligible for removal in the first specification revision released on or after July 28, 2027; removal may happen later. The legacy HTTP+SSE transport is also deprecated, but it follows a separate removal schedule, so implementers should read the registry rather than apply the July 2027 date to every deprecated feature.
Compatibility therefore has to be designed, not assumed. The specification calls 2026-07-28-and-later implementations modern, 2025-11-25-and-earlier implementations legacy, and implementations that support both dual-era. Teams should inventory both endpoints and their SDKs, choose whether to support one or both eras, test version fallback and failure explicitly, and stage the migration only after each required core feature and opt-in extension works across the intended matrix.
