On July 28, 2026, the Model Context Protocol published its first-ever release candidate — a version of the spec described by maintainers as "the largest revision since launch." If you're building AI agents, integrating LLMs into enterprise tooling, or running any MCP server in production, the changes are significant enough to block existing implementations.
The Core Change: Sessions Are Gone
The most disruptive change is the removal of stateful sessions. In the previous spec, every MCP conversation opened with an initialization handshake: client and server exchanged protocol versions, capabilities, and identity. That handshake established a session that subsequent messages referenced. The 2026-07-28 RC deletes this entire model. MCP is now a stateless request/response protocol, closer to HTTP REST than to WebSocket-style persistent connections.
For developers, this is simultaneously a headache and a relief. Existing code that manages session lifecycle breaks. But the operational complexity it eliminates is substantial: MCP servers no longer require sticky sessions, shared session stores, or gateway-level deep packet inspection to route traffic correctly. A plain round-robin load balancer now works. Traffic can be routed on a new Mcp-Method header. Clients may cache tools/list responses and replay them.
Authorization Gets an Overhaul
The authentication model has been rewritten around OAuth 2.1 with Resource Indicators and mandatory issuer verification. Each request is now self-contained with a bearer token, and token validation happens per-request with no session context to fall back on. The upside is that scoped per-agent credentials become simpler to implement and audit — a running agent can't silently inherit privileges from a prior session.
Three previously core features are deprecated in this revision, though they're not removed immediately. The spec introduces a formal extension framework that will carry forward optional capabilities as the protocol matures.
What the RC Process Means
This is the first time the MCP spec has gone through a formal release candidate process. Previously, revisions shipped as direct specification updates with no pre-production review period. The RC approach signals that the project is treating this version as foundational — the beta SDKs for Python, TypeScript, and Java shipped the same day, letting integration teams validate their stacks against the new behavior before it becomes the stable baseline.
AWS has already published guidance for AgentCore Gateway on supporting the new spec, which is a strong indicator that cloud providers are treating the RC as effectively final. The stable spec is expected to follow the RC by a few weeks pending feedback.
Should You Migrate Now?
If you're running a production MCP server at any meaningful scale, the session removal is a breaking change that requires planning. The old initialization handshake path will not be supported in the final 2026-07-28 spec. Servers built on the previous model need to be refactored to treat each request as independent. The trade-off is worth it — stateless MCP is easier to scale, easier to secure, and easier to debug — but the migration is real work.
Start with the beta SDKs. The maintainers have built migration guides into the RC documentation, and the RC feedback window is the right time to surface any implementation gaps before the spec finalizes.