MCP Goes Stateless on 28 July 2026 — What Enterprise Agent Builders Must Change

Researched & Written by AlterAI

The Model Context Protocol’s largest revision since launch finalises on 28 July 2026. Spec 2026-07-28 removes protocol-level sessions, kills the initialize handshake, hardens OAuth/OIDC, and promotes MCP Apps and Tasks as official extensions. If your agents talk to tools over MCP in production, this is not a changelog footnote — it is an infrastructure cutover.

TL;DR — MCP becomes cloud-native: every request self-contained, load-balancer friendly, auth closer to OAuth 2.1. Plan your migration before 28 July — sticky sessions and casual token handling will not age well.

Why MCP had to grow up

MCP started as a brilliant local bridge for coding agents. Enterprises then dragged it into production front-doors — CRM, billing, internal APIs — where sticky sessions, shared session stores, and soft auth stop being cute and start being outages.

Maintainers (including Anthropic’s David Soria Parra in July livestreams) have been explicit: the 2026 roadmap was about productionising agentic systems. The Register and Stacklok’s enterprise guides both stress the same lesson — stateful MCP was a by-product of local IDEs; remote agent mediation needs the patterns platform teams already trust.

What changes in 2026-07-28

Breaking changes are intentional. Older clients may not speak to new servers and vice versa. Treat the RC→final window as your validation sprint — not marketing reading.

Why Alter cares (and you should too)

We run product agents on Google ADK / Vertex, with tools that reach Supabase, Cloud Run, and third-party systems through server-side proxies — never secrets in the browser. MCP (and sibling standards like A2A) sit in the same category as any tool bus: great when governed, dangerous when “just connected.”

The July 28 cut forces the same discipline we already bake into GaaS apps:

That last point aligns with how Alter ships in-chat generative UI — forms, approvals, cards — so humans stay in the loop without leaving the agent surface. See governance-as-code for agentic workflows.

Migration checklist before 28 July

1. Inventory MCP clients and servers — SDKs, versions, sticky-session assumptions.
2. Remove session dependence — push durable IDs into tool payloads; verify round-robin LB behaviour.
3. Upgrade auth — Protected Resource Metadata, PKCE where required, mandatory iss checks.
4. Pilot Tasks for long-running ops — cancel and status must work without a session store.
5. Prefetch MCP Apps templates — security-review HTML before hosts render iframes.
6. Plan deprecations — Roots / Sampling / Logging replacements on a dated roadmap.
7. Re-run stage evals — same GaaS workflows on stage cloud before any prod fan-out.