MCP spec 2026-07-28 changelog (stateless protocol, MRTR, Sampling/Roots deprecated)

What it claims

The 2026-07-28 MCP revision is a breaking redesign, not an additive release. Several mechanisms that a 2025-era client or server relies on are removed outright rather than deprecated:

• the initialize handshake
• Mcp-Session-Id
• ping
• logging/setLevel
• notifications/roots/list_changed
• the HTTP GET stream
• resources/subscribe/unsubscribe
• SSE resumability (Last-Event-ID)
• notifications/elicitation/complete

Roots, Sampling, Logging, HTTP+SSE and Dynamic Client Registration are only deprecated. They keep working for a minimum twelve-month window under the newly adopted lifecycle policy (SEP-2596).

How it works

Stateless requests. Every request carries these keys in _meta:

• io.modelcontextprotocol/protocolVersion
• io.modelcontextprotocol/clientCapabilities
• io.modelcontextprotocol/clientInfo (SHOULD)

Results SHOULD carry io.modelcontextprotocol/serverInfo. A version mismatch returns UnsupportedProtocolVersionError (-32022).

server/discover is mandatory for servers. Clients may call it for up-front version selection, or as a backward-compatibility probe on STDIO.

Cross-call state. The server mints explicit handles and passes them as ordinary tool arguments (SEP-2567). List endpoints no longer vary per connection.

Multi Round-Trip Requests (SEP-2322). Every result now has a required resultType. A server that needs roots, a sampled completion or an elicitation returns resultType: "input_required" with inputRequests. The client then retries the original request with inputResponses. Results from older servers that omit resultType MUST be treated as "complete".

To correlate an elicitation across retries, a server encodes its own identifier in requestState. The elicitationId field is gone.

flowchart TD
  A[Client sends request] --> B{resultType?}
  B -->|complete| C[Use result]
  B -->|input_required| D[Fulfil inputRequests]
  D --> E[Retry original request with inputResponses]
  E --> B

Notifications.

• Change notifications move to subscriptions/listen, a single long-lived POST-response stream. Clients opt in per type: toolsListChanged, promptsListChanged, resourcesListChanged, resourceSubscriptions. Each notification is tagged with io.modelcontextprotocol/subscriptionId.
• Request-scoped notifications/progress and notifications/message stay on the originating request's response stream.
• Log level is set per request via io.modelcontextprotocol/logLevel in _meta. Servers MUST NOT emit notifications/message for requests that don't set it.

Tasks. Tasks move to the io.modelcontextprotocol/tasks extension (SEP-2663) with these changes:

• the blocking tasks/result is replaced by polling tasks/get
• tasks/update is added for client-to-server input
• tasks/list is removed
• servers may return task handles without per-request opt-in

Extensions are advertised via a new extensions field in client and server capabilities.

How to use it

Migration points the summary doesn't spell out:

• Error codes:
• Resource-not-found changes from -32002 to -32602.
• Draft codes are renumbered: HeaderMismatch -32001 → -32020, MissingRequiredClientCapability -32003 → -32021, UnsupportedProtocolVersion -32004 → -32022.
• -32000 to -32019 stays implementation-defined, and existing SDK usage is grandfathered. -32020 to -32099 is reserved for the spec.
• Streamable HTTP: POSTs must send Mcp-Method and Mcp-Name headers. Tool parameters can map to custom headers via x-mcp-header (SEP-2243). If a response stream breaks, the in-flight request is lost and MUST be re-issued with a new request ID.
• Caching: ttlMs and cacheScope ("public"/"private") are required on results from:
• tools/list
• prompts/list
• resources/list
• resources/read
• resources/templates/list

tools/list SHOULD return tools in deterministic order.

• Schemas: inputSchema and outputSchema accept any JSON Schema 2020-12 keyword, with $ref resolution requirements and bounds on composition keywords. structuredContent may be any JSON value. minimum/maximum/default in schema.json are numbers, not integers.
• Auth:
• Clients MUST validate a present iss against the recorded issuer (RFC 9207).
• Credentials must be keyed by issuer and never reused across authorization servers. Clients MUST re-register when the authorization server changes.
• Clients must set application_type during Dynamic Client Registration.
• DCR is deprecated in favour of Client ID Metadata Documents.
• Deprecated-feature replacements suggested by the page:
• Roots: pass directories via tool parameters, resource URIs or server config.
• Sampling: call LLM provider APIs directly.
• Logging: log to stderr (stdio) or use OpenTelemetry. Trace context goes in _meta as traceparent, tracestate and baggage (SEP-414).
• includeContext values "thisServer"/"allServers": omit the field or use "none".

Limits

This is a changelog. It lists changes and SEP numbers but not full wire formats. The shape of inputRequests/inputResponses, the server/discover response and the extension negotiation details are in the linked SEPs and spec pages, not here.

The page gives no SDK version support or interop matrix. The STDIO backward-compatibility story is limited to "use server/discover as a probe."

Removing SSE resumability shifts retry safety onto clients. Non-idempotent tool calls interrupted mid-stream have no protocol-level recovery.