The MCP 2026-07-28 release candidate reworks the protocol to be stateless, moving session state into visible handles
The Model Context Protocol's 2026-07-28 release candidate makes the protocol stateless at the transport layer: state moves into explicit handles, capabilities move into negotiated extensions, and authorization rules get sharper. It is the change that makes MCP servers ordinary infrastructure instead of a special case.
Statefulness has been the practical obstacle to running MCP at scale. A stateful protocol means sticky sessions, which means a load balancer that understands the protocol, which means MCP servers could not be deployed the way every other service in an estate is deployed. Making state explicit turns them into things that can sit behind a normal ingress and scale horizontally.
Moving capabilities into negotiated extensions matters for a different reason. A fixed capability set forces the specification to grow every time someone needs something; a negotiation mechanism lets vendors ship extensions without a spec revision. That is the difference between a protocol that ossifies and one that survives contact with enterprise requirements.
The sharpened authorization rules are the part enterprises will read first. Agent plumbing has been deployed ahead of its security model for eighteen months, and the gap has been filled by convention. Convention does not survive an audit. Explicit rules in the specification are what let a platform team say yes.
Agentic AI Foundation — MCP Is Growing Up → · Spronta — The State of WebMCP: July 2026 →