mcp-2026-07-28-speclisted

# MCP 2026-07-28 Spec ## Purpose The MCP **2026-07-28** specification is the largest revision since the protocol launched. It moves MCP from a bidirectional, stateful protocol toward a **stateless request/response core**, so servers deploy on serverless and edge infrastructure and scale horizontally; it formalizes **versioned extensions** (MCP Apps for interactive UI, Tasks for long-running work) so capabilities can be added without touching the core; and it aligns authorization with production **OAuth 2.1 / OIDC** (covered in the `mcp-authorization` skill). This skill is the reference for the core, transport, and lifecycle so a server is shaped correctly, not merely functional. ## What changed, at a glance | Area | Before | 2026-07-28 | |---|---|---| | Transport | HTTP+SSE dual endpoint (`GET /sse` + `POST /messages`) | **Streamable HTTP**, single endpoint; HTTP+SSE removed | | Core model | Stateful, long-lived bidirectional session | **Stateless request/response** core; each request self-contained | | Deployment | Sticky, single-instance | Serverless / edge / multi-replica behind a load balancer | | Extensions | Ad-hoc | **Versioned extensions** framework (MCP Apps, Tasks) | | Auth | Custom / bearer, loosely specified | OAuth 2.1 + OIDC aligned (see `mcp-authorization`) | ## The stateless core The single most important shape change: **do not require per-connection server memory to serve a request.** A request carries what it needs; any replica can answer it. Concretely: