MCP: the protocol that connects AI agents to the world makes its biggest leap
The Model Context Protocol (MCP), the open standard that allows artificial intelligence agents to connect with external tools, data and systems, has just received the most important update since its launch almost two years ago. The 2026-07-28 specification, published last 28 July under the umbrella of the Agentic AI Foundation (AAIF) —a directed fund of the Linux Foundation—, introduces a completely stateless core, OAuth 2.1 authentication, a formal extension system and a 12-month deprecation policy. These changes, although technical, have profound implications for any company deploying AI agents in production.
An architecture change that had been brewing for two years
Since its original launch by Anthropic in November 2024, MCP had become the de facto connective tissue between language models and the outside world. Tools such as Claude Code, GitHub Copilot, LangGraph and CrewAI use it so that agents can search files, query databases, execute code or interact with APIs. However, the original design included a critical limitation: it required persistent sessions between the client and a specific server, which made horizontal scaling impossible without complex solutions such as sticky sessions or shared state storage.
David Soria Parra, co-creator of MCP and lead maintainer at Anthropic, described it as «probably the biggest change we have made to the protocol», in an interview with VentureBeat. «It is a great step forward to mature it so that the big players can use it». The transition had been discussed since December 2024, when co-creator Justin Spahr-Summers opened a public debate on GitHub that received contributions from engineers at Vercel, Cloudflare, Shopify and Amazon.
Stateless core: the end of sticky sessions
The main change is that MCP abandons persistent sessions. Now every HTTP request is autonomous: the client sends all the necessary context (protocol version, method name, client capabilities) in the request headers, and the server responds without relying on state retained in memory. This means that an agent can talk to any replica of an MCP server interchangeably, without the need for session affinity.
«Before, you needed a session store and to manage session IDs. If one of your compute pods went down, requests started failing», explained Den Delimarsky, lead maintainer of the protocol. «That will no longer be a problem with the new version. It is an enormous advance». Mazin Gilbert, executive director of the AAIF, compared the change to the architectural decision that made the modern web possible: «We could not have the internet we have today if my browser could not talk to any server». According to Gilbert, this limitation was the main obstacle for companies trying to move from agent pilots to massive deployments: «There are companies deploying tens of thousands of agents, and you cannot do that without going in this direction».
Four key new features of the specification
In addition to the stateless core, the 2026-07-28 specification introduces three further significant changes. First, the official Tasks extension (io.modelcontextprotocol/tasks) allows servers to respond to slow tools with an asynchronous task identifier, so that the agent is not blocked while waiting —for example— for the generation of an image or a heavy analytical query. The client can query the status with tasks/get and cancel with tasks/cancel.
Second, MCP Apps becomes an official extension, allowing servers to send interface components (forms, tables, charts) rendered from the server. Although experimental, it opens the door to much richer visually enterprise copilots. Third, authentication is aligned with OAuth 2.1 and OpenID Connect, establishing short-lived tokens, defined scopes and refresh flows. This substantially reduces the security review work for deployments in environments with strict compliance such as HIPAA, SOC 2 or ISO 27001.
The ecosystem is already adapting
The official Python and TypeScript SDKs are already available with the implementation of the new specification. LangGraph 1.1.3 declared compatibility with the release candidate weeks ago, and the rest of the ecosystem is following the same path. For most developers, the change is transparent: the agent graph is not modified, only the underlying MCP server. But those who maintain custom MCP servers will have to migrate their state logic to external stores such as Redis or DynamoDB, and update the authentication tokens if they did not follow OAuth 2.1, for which the spec grants a 90-day deprecation window.
In short, MCP 2026-07-28 is not a minor update. It is the maturation of a standard that, following in the wake of HTTP, bets on simplicity, scalability and open governance to turn AI agents into reliable production infrastructure. As Gilbert said: «It was not the technology or the business case that was holding companies back; it was these fundamental changes». Now that they are here, the path to deploying agents at enterprise scale looks much clearer.
