What the 2026-07-28 MCP update changes
The Agentic AI Foundation, part of the Linux Foundation, published a substantive revision to the Model Context Protocol (MCP) on the 2026‑07‑28 release, aiming squarely at enterprise adoption of AI automation. MCP — originally open‑sourced by Anthropic in November 2024 and used by agents built on models such as GPT‑5.6 Sol and Claude Opus 5 — defines how AI applications connect to data sources, tools and other applications in a client‑server model. The new specification reworks the protocol’s architecture, adds enterprise‑friendly policies, and introduces security and operational extensions intended to ease large‑scale deployments.
From stateful sessions to stateless, load‑balanced services
The headline technical move in the update is the elimination of MCP’s legacy stateful architecture in favor of an approach more like HTTP services, where network requests do not need to retain session state. As Caitie McCaffrey, a Microsoft software engineer and core MCP maintainer, explained in her blog post, "Historically, running MCP at scale required sticky routing or shared state to maintain continuity across sessions." That requirement, she wrote, "made large‑scale production deployments complex to implement and operate even when the capabilities being exposed were stateless."
By removing the overhead of managing session state, the revised protocol enables organizations to run MCP servers behind standard load balancers and on existing Kubernetes and DevOps tooling. The change targets one of the most practical operational pain points for enterprises that want to integrate model‑based agents with corporate infrastructure without building bespoke routing or shared‑state layers.
Security tweaks: SEP 2468, issuer validation and central authorization
The specification adds Specification Enhancement Proposal (SEP) 2468, which mandates inclusion and validation of an issuer (iss) parameter in authorization responses. The iss check is designed to prevent OAuth Mixup Attacks — scenarios that can arise when an OAuth client connects to multiple OAuth providers via multiple MCP servers and an attacker controls one of those servers. Verifying the issuer should make it harder for a compromised MCP server to convince a client that a token from another server is legitimate.
Complementing SEP 2468, the release includes support for the Enterprise Managed Authorization extension. That extension "makes it possible to manage MCP servers through a central identity provider," a capability likely to matter to organizations that already govern access and policy centrally and want to extend those controls to model‑driven agents.
Tasks, routing and cache behavior: operational resilience and developer tradeoffs
The update converts long‑running tool calls and batch operations into an explicit tasks extension, shifting them from blocking requests to asynchronous, durable operations. McCaffrey summed up the practical benefit: "Because a task is durable and addressed by a stable handle, clients can persist task IDs to durable storage so that polling can resume after a crash or restart — no fragile, long‑lived connections held open while waiting for work to finish, which the old blocking model forced on clients and servers that did not want to implement it."
Other additions include header‑based routing and cacheable list results, both aimed at improving performance and scalability. Taken together, these changes emphasize operational resilience at scale but come with migration costs: developers who wrote MCP code that depends on session identifiers will need to revise implementations to fit the new stateless model.
What this means for technologists, enterprise engineers, and SDK authors
- Technologists and security teams: Expect to test SEP 2468 issuer checks and the Enterprise Managed Authorization extension as part of threat analyses and identity integration work; the iss validation specifically defends against OAuth Mixup Attack vectors described in the specification.
- Enterprise engineering and procurement leaders: The Specification Feature Lifecycle and Deprecation Policy — including a guaranteed minimum period of 12 months between deprecation and removal — gives procurement and operations teams a predictable timeline for migrations and reduces the cadence of emergency updates to MCP servers.
- SDK authors and implementers: The shift away from session identifiers and toward durable task handles will require code changes. The new release documents a lifecycle and deprecation policy precisely because "large companies want clear roadmaps and timelines when it comes to software changes," the documentation explains.
Conclusion
The 2026‑07‑28 MCP revision addresses the practical obstacles enterprises have faced when putting model‑centric agents into production: sticky routing, fragile long‑lived connections, and unclear timelines for protocol changes. It pairs architectural rework with security hardening and a timetable for deprecation that favors larger implementers. The tradeoff is migration work for code that assumed session state; the reward is a specification designed to operate behind standard load balancers, integrate with central identity providers, and recover more gracefully from crashes. For organizations ready to invest in that migration, MCP’s latest release offers a clearer path to scaling model‑driven automation.
