One sentence Link to heading

The 2026-07-28 MCP spec removes the connection. Every request now carries everything the server needs.

Everything else follows from that.

MCP before and after

What changed Link to heading

Area Before (2025-11-25) Now (2026-07-28)
Handshake initialize + initialized Gone. Version and capabilities ride in _meta on each call
Discovery Learned during handshake New mandatory server/discover
Sessions Mcp-Session-Id Gone
HTTP POST + standalone GET stream, resumable POST only. No Last-Event-ID, a broken stream means retry
Routing Parse the body Mcp-Method, Mcp-Name headers, checked against the body
Server asks client sampling, elicitation, roots requests Return input_required, client retries with answers
Notifications GET stream, resources/subscribe One subscriptions/listen stream
Caching None ttlMs + cacheScope on list and read results
Tasks Core Extension
Client registration Dynamic Client Registration Client ID Metadata Documents preferred, DCR deprecated

What it means for you Link to heading

Servers get simpler to run. No session store, no sticky routing. Any instance behind any load balancer can answer any request. Gateways can route on headers without parsing JSON.

Server code gets harder to write in one place. You can’t pause a tool and ask the client a question anymore. You return input_required with a requestState, and the client calls you again. That state comes back from the client, so treat it as untrusted and sign it.

Clients do more bookkeeping. Send _meta and the headers every time, run the retry loop, re-issue requests when a stream drops.

Migration checklist Link to heading

  1. Delete initialize handling and your session store.
  2. Read protocol version and capabilities from _meta on every request.
  3. Implement server/discover.
  4. Add resultType, ttlMs and cacheScope to results.
  5. Rewrite every server-initiated question as input_required with a signed requestState.
  6. Move change notifications to subscriptions/listen.
  7. Validate Mcp-* headers against the body.

Moving clients are told to try the new protocol first and fall back to initialize on a 400, 404 or 405, so old servers keep working while you migrate. Roots, Sampling and Logging are deprecated but still functional for at least twelve months.

References Link to heading