--- title: "MCP Deleted the Handshake: Inside the 2026-07-28 Spec" pubDatetime: 2026-07-30T03:23:00.000Z description: "The new Model Context Protocol spec removes the initialize handshake and session IDs, making the transport stateless. All four Tier 1 SDKs shipped day one, and the wire format is not backward compatible with 2025-11-25." tags: [mcp, protocols, ai-agents, anthropic, developer-tools, 2026, 2026-q3, 2026-07] --- > [!tldr] TL;DR > The Model Context Protocol published its [2026-07-28 specification](https://blog.modelcontextprotocol.io/posts/2026-07-28/) two days ago, and it deletes the `initialize`/`initialized` handshake and the `Mcp-Session-Id` header outright. Clients now carry protocol version and capabilities on every request in `_meta`, which makes a server deployable on any stateless edge or serverless runtime. The wire format is not backward compatible with 2025-11-25: a new client and an old server cannot talk unless one side implements fallback or translation. All four Tier 1 SDKs (TypeScript, Python, Go, C#) shipped support the same day, Rust is in beta, and Anthropic says Claude support is "rolling out" rather than done. If you maintain a server, read the [changelog](https://modelcontextprotocol.io/specification/2026-07-28/changelog) before you read anything else. Two months of release-candidate soak, then MCP removed the first two messages every connection ever sent. The handshake is gone (SEP-2575), sessions are gone (SEP-2567), and what used to be negotiated once at connection setup now rides along on every single request inside `_meta`. The [release-candidate post](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/) in May called this "the largest revision of the protocol since launch," and for once that reads as an understatement. ## What statelessness buys, and what it costs The payoff is deployment. A stateful protocol pins a client to one server process for the life of a connection, which is precisely the shape that load balancers, Lambda functions and edge workers are bad at. Strip the session and any request can land on any instance. Header-based routing (`Mcp-Method` and `Mcp-Name`) goes further: a proxy can dispatch on HTTP headers without parsing the JSON-RPC body at all. The rest of the release follows from that constraint. List results become cacheable via `ttlMs` and `cacheScope`, since a client that re-sends capability data on every call may as well stop re-fetching tool lists too. Authorization gets hardened with RFC 9207 issuer validation and Client ID Metadata Documents. Tasks and Enterprise-Managed Authorization are promoted to formal extensions. Then there is Multi Round-Trip Requests (SEP-2322), which exists because statelessness took away the obvious way to ask the user a question halfway through a tool call. MRTR splits one logical operation across several JSON-RPC exchanges. The state moved rather than vanished: server-side session bookkeeping becomes client-side and protocol-level bookkeeping. The Register, [writing five days before the final spec landed](https://www.theregister.com/devops/2026/07/23/model-context-protocol-prepares-to-break-with-its-stateful-past/5276722), quotes a technical lead conceding "it's going to be a lot of uplift to make this correct." ## MRTR breaks latency correlation in observability tools Here is a concrete instance of that uplift. Observability tooling for MCP keys on the JSON-RPC request ID to match a response back to its request and compute a duration. Under MRTR, one user-visible operation spans multiple IDs, so the tooling measures fragments of a call instead of the call. The maintainer of mcpsnoop [documented the failure mode](https://github.com/kerlenton/mcpsnoop/blob/main/docs/2026-07-28-mrtr-breaks-latency.md) in detail. It is a narrow break, and one writeup is one writeup. The assumption it trips over, one request ID per operation, is a common one, though observability tooling is the only place anyone has shown it breaking so far. Architectural wins land unevenly. ## Deprecated features now run on a clock Roots, Sampling, Logging and the legacy HTTP+SSE transport are all deprecated in this revision. None of them stop working today. SEP-2596 introduces a formal policy giving deprecated features a minimum of 12 months before removal, which is the first time MCP has committed to a removal timeline in writing rather than case by case. That is governance maturing, and it is worth more than any single feature in the release. A protocol pulling in close to half a billion downloads a month, per the announcement, cannot keep making breaking changes by vibes. The 12-month floor gives maintainers something to plan against. ## Nobody has to migrate on 2026-07-28's schedule Compatibility requires both sides to share a supported protocol era, or for one side to deliberately implement fallback or translation. A 2025-11-25 server and a 2026-07-28 client have no common ground on the wire. Scale matters here, and the honest answer is that nobody has published an independent count of how much of the ecosystem this touches. The one figure circulating comes from the maintainer of the Glama registry, whose index holds 62,726 open-source servers with roughly 30% pushed to in the last 30 days. Treat that as one registry's view rather than a census. Even on those terms it implies a long tail of servers that work fine, get no attention, and will quietly stop working against upgraded clients. Anthropic's own position is instructive. Its [adoption post](https://claude.com/blog/bringing-mcp-2026-07-28-to-claude) says support is "rolling out across Claude products soon," with MCP tunnels still labelled research preview. The organisation that co-authored the spec shipped the SDKs on day one and is staging the product rollout behind them. Copy that ordering. ## What to do this week Practical sequence for anyone with a server in production: - Read the [2026-07-28 changelog](https://modelcontextprotocol.io/specification/2026-07-28/changelog) first. Every change carries a SEP number, so you can trace the reasoning for anything that surprises you. - Pin your SDK version deliberately rather than letting a minor bump move your protocol era. - If you rely on Roots, Sampling or Logging, you have at least 12 months, and you should still start now. - Check whether your tracing assumes one JSON-RPC ID per operation. MRTR invalidates that assumption. The stateless rewrite is the right call on the technical merits. Sessions were the reason MCP servers were awkward to deploy on the infrastructure most teams already run, and that reason is gone. What the announcement is quieter about is that the bill for it lands on thousands of small maintainers who did nothing wrong, in the form of a wire-incompatible upgrade they did not ask for. Both of those are true at once, and the 12-month deprecation policy suggests the maintainers know it. --- *Sources: [The 2026-07-28 Specification (MCP blog, 28 July 2026)](https://blog.modelcontextprotocol.io/posts/2026-07-28/) · [Specification 2026-07-28 changelog](https://modelcontextprotocol.io/specification/2026-07-28/changelog) · [The 2026-07-28 Release Candidate (21 May 2026)](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/) · [Bringing MCP 2026-07-28 to Claude (Anthropic)](https://claude.com/blog/bringing-mcp-2026-07-28-to-claude) · [MRTR breaks latency measurement (mcpsnoop docs)](https://github.com/kerlenton/mcpsnoop/blob/main/docs/2026-07-28-mrtr-breaks-latency.md)* *Coverage: [Model Context Protocol prepares to break with its stateful past (The Register, 23 July 2026)](https://www.theregister.com/devops/2026/07/23/model-context-protocol-prepares-to-break-with-its-stateful-past/5276722) · [HN: MCP 2026-07-28 Specification, transport going stateless](https://news.ycombinator.com/item?id=49088058)* *Related on this blog: [Nobody Configured It. Hermes Agent Phoned Parallel Anyway.](/posts/hermes-agent-search-provider-security) · [The Managed-Agent Landscape: Twelve Ways to Not Run Your Own Agent](/posts/managed-agents-landscape)*