MCP Hit 400M Downloads a Month, Then Deleted Its Own Handshake

TL;DR

The Model Context Protocol just went through its largest revision since it launched in November 2024. The 2026-07-28 specification, published Monday under the Agentic AI Foundation, the Linux Foundation home MCP moved to last December, turns MCP from a bidirectional stateful protocol into a stateless request/response one. The initialize handshake and the Mcp-Session-Id header are gone, every request is self-contained, and any server instance behind a plain round-robin load balancer can answer any call. Five features enter a minimum 12-month deprecation window, and Anthropic says support is rolling out across Claude products. If you maintain an MCP server or client, this release decides how you build and deploy for the next few years.

The handshake is dead

Until Monday, every MCP connection opened the same way: an initialize/initialized exchange, a session ID handed back in a header, and a server that remembered you between calls. That design made MCP servers stateful by default, which meant sticky routing, shared session stores, and a protocol that fought every serverless platform it met.

The new spec deletes all of it. Each request now travels on its own, carrying its protocol version, client identity, and client capabilities in a _meta object, so any instance can serve any request with no prior knowledge of the client. Clients that want to learn a server's capabilities upfront can call a new, optional server/discover RPC.

Every MCP tutorial ever written opens with a diagram of the initialize handshake. As of Monday, those diagrams are historical documents.

Servers that genuinely need continuity across calls switch to explicit handles: a tool returns an identifier, and the model passes it back as an ordinary argument on the next call. Think coat check, not regulars-only bar: instead of the server recognizing your session, it hands you a numbered ticket, and any attendant can retrieve your coat. The spec's authors argue this is strictly better than transport-level state, because the model can actually see the handle and reason about it.

Your gateway can finally see MCP

Two smaller changes matter disproportionately for anyone running MCP in production. Requests now carry Mcp-Method and Mcp-Name HTTP headers, so a gateway, rate limiter, or WAF can route and meter on headers instead of parsing JSON-RPC bodies. And list results for tools, prompts, and resources now ship ttlMs and cacheScope fields, so clients can cache them honestly instead of re-fetching on every turn.

Server-initiated requests are replaced by Multi Round-Trip Requests. When a tool needs something from the user mid-call, a confirmation or a missing parameter, it returns resultType: "input_required" with the questions it needs answered, and the client comes back with a follow-up round trip. Same capability, no long-lived bidirectional channel to babysit.

Five features on death row

The release formally deprecates five things, each with a stated replacement:

• Roots: never generalized beyond local filesystems; pass paths as tool parameters instead.
• Sampling: complicated security boundaries; call your LLM API directly.
• Logging: deprecated in favor of stderr and OpenTelemetry, which is to say, in favor of where your logs already were.
• Legacy HTTP+SSE transport: superseded by Streamable HTTP.
• Dynamic Client Registration: replaced by Client ID Metadata Documents (CIMD).

Deprecated does not mean removed. The window is a minimum of 12 months, so nothing disappears before July 28, 2027, and the four Tier 1 SDKs (TypeScript, Python, Go, C#) shipped same-day updates with migration guides, with Rust supporting the spec in beta.

Auth got stricter, on purpose

The authorization rewrite aligns MCP with OAuth 2.1 and OpenID Connect and closes several holes that mattered in practice. Clients must validate the issuer per RFC 9207 before redeeming authorization codes, registration now carries an application_type so localhost redirects stop masquerading as web apps, and client credentials are bound to the authorization server that issued them.

There is also a new Enterprise Managed Authorization extension, which lets identity providers centrally provision which MCP servers an org's users can reach. That one is aimed squarely at the companies that banned MCP connectors until someone could answer "who approved this server?"

Extensions are now a real system

The spec introduces a formal extensions framework, and the first residents are telling. Tasks graduates from experimental to the official io.modelcontextprotocol/tasks extension, with durable task IDs, poll-based tasks/get, and mid-flight interaction via tasks/update: long-running agent work is now a first-class protocol concept. MCP Apps lets servers render interactive UIs in sandboxed iframes inside a chat.

Anthropic's companion post says support is rolling out across Claude products, counts more than 950 servers in Claude's connectors directory, and previews MCP tunnels for reaching private-network servers, with Figma, Netlify, and Zoom among the partners building against the new spec. The scale numbers explain the urgency: Anthropic cites over 400 million monthly SDK downloads, a 4x jump in a year, and the MCP blog notes the TypeScript and Python SDKs alone have crossed a billion cumulative downloads. Protocols with that much traffic do not get many chances to fix their architecture.

What you should actually do

If you maintain a server: audit anything that assumes state between calls, convert it to explicit handles, read the _meta object instead of expecting a handshake, and start moving off Roots, Sampling, Logging, HTTP+SSE, and DCR now rather than in month eleven. If you maintain a client: delete your initialize logic, attach _meta to every request, and review your OAuth flow against the 2.1 and OIDC requirements.

The payoff for the migration tax is real: MCP servers become boring HTTP services you can run on serverless, on the edge, or behind whatever load balancer you already have, with no shared session store to operate. Self-hosters win here too, since a stateless server is the kind you can actually restart without breaking every connected agent.

Key Takeaways

• The 2026-07-28 MCP spec is the protocol's largest revision since launch: a stateless request/response core replaces the stateful, session-based design.
• The initialize handshake and Mcp-Session-Id are gone; requests carry version, identity, and capabilities in _meta, and state moves to explicit handles.
• Roots, Sampling, Logging, legacy HTTP+SSE, and Dynamic Client Registration are deprecated with a 12-month minimum window; earliest removal is July 28, 2027.
• New Mcp-Method and Mcp-Name headers plus cacheable list results make MCP legible to gateways, rate limiters, and WAFs.
• Authorization tightens around OAuth 2.1 and OIDC, and Tasks and MCP Apps become official extensions for long-running work and in-chat UIs.
• Anthropic is rolling the spec out across Claude products; all four Tier 1 SDKs (TypeScript, Python, Go, C#) shipped updates with migration guides.

Sources: Model Context Protocol blog, Anthropic: Bringing MCP 2026-07-28 to Claude, Agentic AI Foundation migration guide