MCP's 2026-07-28 release candidate drops sessions so any server instance can answer any request
Remote MCP servers can run behind a plain round-robin load balancer under the 2026-07-28 release candidate, due as final on July 28, 2026. It also contains breaking changes that production teams need to test first.
The Product Desk

In the post's example, a first tool call takes two requests under the 2025-11-25 spec and one request under the 2026-07-28 spec.
| Measure | Value | As of | Claim |
|---|---|---|---|
| Under 2025-11-25 | 2 requests | 2025-11-25 | 12 |
| Under 2026-07-28 | 1 requests | 2026-07-28 | 12 |
What happened
- The initialize and initialized handshake is removed under SEP-2575, so protocol version, client info and capabilities travel in _meta on every request.
- The Mcp-Session-Id header and the protocol-level session are removed too, under SEP-2567, so any request can land on any server instance.
- Servers may now send requests to the client, such as elicitation prompts, only while processing a client request (SEP-2260); earlier versions only recommended that.
Why it matters
- cost Tool authors pay for the removed session: each stateful tool has to mint a handle and accept it back, and the model has to carry it correctly between calls.
- constraint A server can no longer prompt a user on its own timing. Anything built on unprompted server messages has to be redesigned around a client call.
- contradiction The post promises a deprecation policy so the protocol can evolve without breaking what teams built, and in the same text warns that this release contains breaking changes.
- capability Gateways can route on the Mcp-Method header instead of inspecting packets, and each server sets through ttlMs how long clients may cache its tools/list.
Under 2025-11-25, a client cannot call a tool until it has opened a session with an initialize request. The server answers with an Mcp-Session-Id that every later request must carry. That pins the client to the instance that issued it [9]. In the post's own example, a first tool call takes two requests under that version and one under 2026-07-28, which any instance can handle [12][10]. The post lists what a remote server previously needed because of the pin: sticky sessions, a shared session store and deep packet inspection at the gateway [13].
The pitch is a plain load balancer. The work is whatever the server kept per session. The post says state stays possible: a server that needs state across calls can have a tool issue a handle, a basket_id or browser_id for instance, which the model then hands back like any other argument [7]. Its authors wrote that they have found the pattern "to be more than just a workable substitute for session state" [8]. The post does not include measurements behind that. Whether a given model threads a handle through a long task is something a team can learn from its own transcripts before cutover.
In our view the sensible order is staging first and production after the final text. The post calls this the largest revision of the protocol since launch [2], and the final specification ships July 28, 2026 [1]. Waiting delays the gateway savings. Moving early means building against a candidate.
To stage the work, sort each server by two facts taken from its code, not from a deck: whether it keeps per-session state, and whether it ever sends a request to the client when no client request is in flight.
- Neither: the handshake and per-request `_meta` changes are the migration [4][5]. - Session state only: redesign those tools to mint and accept handles [7]. - Outbound requests only: tie each server request to a client call that is still being processed [6]. - Both: the longest list of changes, so these servers set the schedule.
What to watch
- Whether the final specification on July 28, 2026 changes anything in the candidate's per-request _meta and header format.
- The post's Release Timeline and Validation section, which is where the full list of breaking changes sits.
- Whether client libraries ship the new per-request format before server operators plan to cut over.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap
- Insufficient
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The release candidate for MCP 2026-07-28 is available now, and the final specification ships on July 28, 2026.
- [2]
The post calls the 2026-07-28 release candidate the largest revision of the MCP protocol since launch.
- [3]
The release contains breaking changes, and the post points readers to its Release Timeline and Validation section for the details.
- [4]
The initialize/initialized handshake is removed (SEP-2575); the protocol version, client info and client capabilities now travel in _meta on every request, and a new server/discover method lets clients fetch server capabilities up front.
- [5]
The Mcp-Session-Id header and the protocol-level session that came with it are removed (SEP-2567), so any MCP request can land on any server instance.
- [6]
Server-initiated requests, such as an elicitation prompt, may now only be issued while the server is actively processing a client request (SEP-2260); earlier spec versions recommended this and it is now required.
- [7]
Servers that need to carry state across calls can mint an explicit handle (a basket_id, a browser_id) from a tool and have the model pass it back as an ordinary argument on later calls.
- [8]
The post's authors wrote that they have found the explicit-handle pattern "to be more than just a workable substitute for session state."
- [9]
In 2025-11-25, calling a tool over Streamable HTTP means establishing a session first with an initialize request; the server responds with an Mcp-Session-Id that every subsequent request must carry, pinning the client to the instance that issued it.
- [10]
In 2026-07-28, the same tool call is a single self-contained request, carrying MCP-Protocol-Version, Mcp-Method and Mcp-Name headers, that any server instance can handle.
- [11]
The release includes a formal deprecation policy "so the protocol can evolve without breaking what you've built."
- [12]
In the post's example, a first tool call takes two requests under 2025-11-25 and one request under 2026-07-28.
- [13]
A remote MCP server that previously needed sticky sessions, a shared session store, and deep packet inspection at the gateway can now run behind a plain round-robin load balancer, route traffic on an Mcp-Method header, and let clients cache tools/list responses for as long as the server's ttlMs permits.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- 2026-07-28 revision
blog.modelcontextprotocol.io
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Protocol specificationsFollow
- HTTP infrastructureFollow
- Model Context ProtocolFollow
Entities
- Model Context ProtocolFollow
- Streamable HTTPFollow