MCP goes stateless: what the 2026-07-28 spec revision changes for anyone running a server
In brief
The Model Context Protocol revision dated 2026-07-28 landed in Claude on July 28, 2026. The core is now request/response instead of a persistent stateful connection, authorization aligns with standard OAuth 2.0 and OIDC, and MCP Apps and Tasks become versioned extensions. Existing stateful servers need work.
Contents
On July 28, 2026, Anthropic shipped support for MCP specification revision 2026-07-28 across Claude products.
MCP — the Model Context Protocol — is the open standard for connecting an AI model to external tools and data. Anthropic released it in November 2024 and donated it to the Agentic AI Foundation in December 2025. There are now 950+ MCP servers reachable from Claude.
This revision is the largest change to the protocol since it became a standard, and it is a breaking one for a specific group: anyone who wrote a server that holds state across a connection.
Change 1: the core is stateless
The old MCP core assumed a bidirectional, stateful connection. Client connects, session opens, both sides exchange messages over that live link, session closes.
The new core is request/response. Each call carries what it needs; the server does not hold a session between them.
The practical consequence is deployment. A stateful server needs a long-lived process holding connections, which means a container or a VM you keep running. A stateless server is an HTTP handler, which means it runs on serverless and edge infrastructure — Lambda, Cloudflare Workers, Vercel functions — and scales to zero when nobody is calling it.
For a team running an internal MCP server that gets used a few dozen times a day, that is the difference between an always-on box on the infrastructure bill and something that costs nearly nothing when idle.
What breaks: if your server keeps per-connection state — an open database cursor, an in-memory cache keyed by session, a partially built query the next call expects to find — that assumption is gone. State has to move somewhere the next request can reach it: a store, a token, or a request parameter. This is a refactor, not a config change.
Change 2: authorization is standard OAuth 2.0 and OIDC
Authorization in earlier revisions was close enough to OAuth to be recognizable, and different enough that connecting an MCP server to a real enterprise identity provider meant custom work.
The new spec aligns with production OAuth 2.0 and OIDC. An MCP server can now sit behind Entra ID or Okta the same way any other internal service does.
This is the change that matters most in an enterprise setting, and it is mostly good news rather than work. It removes the answer "we wrote a shim" from your security review. If your MCP server currently authenticates with a static shared key — a pattern covered in connecting Claude agents to production systems — this revision is the moment to replace it.
Change 3: Apps and Tasks are versioned extensions
Two capabilities graduate into formal, separately versioned extensions rather than living in the core:
- MCP Apps — interactive UIs served by an MCP server, so a tool can present something to interact with rather than only returning text.
- MCP Tasks — long-running operations, with a defined way to start work, report progress, and return a result later.
Versioned extensions mean these can evolve on their own schedule without a core protocol revision, and a server can declare exactly which ones it implements. If you have been hand-rolling a polling pattern for a slow tool, Tasks is the standardized version of what you built.
What to do, in order
- Find out whether your server is stateful. Grep for anything stored on a connection or session object between calls. If there is nothing, you are close to compliant already.
- Move state out. Redis, a database row, or a signed token in the request — whichever fits. The rule is that any single request must be answerable on its own.
- Replace static keys with OAuth/OIDC against the identity provider you already run. This is the step your security team will actually notice.
- Check your SDK version. The MCP SDKs carry the migration surface; upgrading them is the fastest way to see what your server is relying on that no longer exists.
- Only then look at Apps and Tasks. They are additive. Do not mix a capability upgrade into a protocol migration.
If you do not run a server
Most people reading this consume MCP servers rather than write them, and nothing about that changes — Claude's connector list works the same way. The one thing worth knowing: servers you depend on, particularly small open-source ones, now have migration work in front of them. If an internal tool built on a third-party MCP server starts failing in the coming months, this revision is a reasonable first suspect.
Try this today
If your team runs an MCP server, open its code and answer one question: could two consecutive tool calls land on two different machines with no shared memory and still work? If yes, you are stateless already and the migration is small. If no, you have found the work.
Related reading
- What MCP actually means for your business — the plain-language version
- What is an internal MCP server — why teams build their own
- Connecting Claude agents to production systems with MCP — auth patterns and failure handling
- MCP for operators — when you need one and when you do not
Sources: Bringing MCP 2026-07-28 to Claude, Anthropic, July 28, 2026, and the MCP specification 2026-07-28.