Protocols & Standards

MCP 2026-07-28: The Stateless Rewrite

The newest MCP specification removes protocol-level sessions and the initialize handshake. Switch between revisions to compare how a single tool call travels through each, then review what was removed, added, and deprecated.

2025-11-25 · stateful
2026-07-28 · stateless
Step 1

initialize → notifications/initialized

A handshake establishes the connection and negotiates protocol version and capabilities once, up front.

Step 2

Server issues Mcp-Session-Id

Every subsequent request carries the session header. The connection itself holds meaning, so infrastructure must preserve it.

Step 3

tools/list may vary per connection

List results are session-scoped, so a response cannot safely be cached and reused for another client.

Step 4

Server-initiated requests flow back down

Needing roots, sampling, or elicitation, the server sends its own request over the open connection and waits.

Step 5

Broken stream resumes via Last-Event-ID

SSE event IDs allow redelivery, so an interrupted response can pick up where it stopped.

Infrastructure consequence

Load balancer affinity required

Requests must route back to the replica holding the session.

List responses not shareable

Per-connection variation makes intermediary caching unsafe.

Restarts drop conversations

Session state lives in the server process.

Step 1
handshake removed

server/discover (optional, up front)

Servers MUST implement it to advertise supported versions, capabilities, and identity. Clients MAY call it first, or skip it entirely.

Step 2
no session header

Each request carries its own context in _meta

protocolVersion, clientCapabilities, and clientInfo travel with every call. Servers identify themselves in each result via serverInfo.

Step 3
now cacheable

tools/list is connection-independent

Results carry ttlMs and cacheScope. Tools SHOULD be returned in deterministic order to improve prompt cache hit rates.

Step 4
server-initiated requests removed

Multi Round-Trip Requests (MRTR)

The server returns resultType: "input_required" with inputRequests. The client retries the original request, supplying inputResponses.

Step 5
resumability removed

A broken stream loses the request

No Last-Event-ID, no redelivery. Clients MUST re-issue as a new request with a new request ID.

Infrastructure consequence

Any replica serves any request

No affinity, no shared session store, restarts are survivable.

Intermediaries can cache

ttlMs and cacheScope tell a gateway exactly what is safe.

Route and meter on headers

Mcp-Method and Mcp-Name are required on POST — no body parsing.

Per-request metadata overhead

Version, capabilities, and identity re-sent on every call.

Retries move to your code

Idempotency and checkpointing become application concerns.

Tracing is standardised

OpenTelemetry traceparent conventions documented for _meta.

Changes against 2025-11-25

Removed

  • Protocol sessions and Mcp-Session-Id
  • initialize / notifications/initialized
  • ping
  • logging/setLevel
  • notifications/roots/list_changed
  • HTTP GET endpoint, resources/subscribe and unsubscribe
  • SSE resumability and Last-Event-ID
  • notifications/elicitation/complete

Added

  • server/discover — servers MUST implement
  • subscriptions/listen — one opt-in stream
  • MRTR pattern and InputRequiredResult
  • Required resultType on all results
  • extensions on client and server capabilities
  • CacheableResult: ttlMs, cacheScope
  • Required Mcp-Method and Mcp-Name headers
  • Feature lifecycle and 12-month deprecation policy

Deprecated

  • Roots → pass paths via tool parameters
  • Sampling → call the LLM provider directly
  • Logging → stderr or OpenTelemetry
  • HTTP+SSE transport → Streamable HTTP
  • includeContext: thisServer / allServers
  • OAuth Dynamic Client Registration → Client ID Metadata Documents
Deprecated features stay functional for a minimum twelve-month window, but new implementations should not adopt them.