Hacker News front pageJul 29, 2026, 02:35 UTC+8

MCP 2026-07-28 spec drops sessions and handshakes for a stateless core

MCP 2026-07-28 Specification: transport going stateless

MCP shifts from a stateful bidirectional protocol to a stateless request/response model. Every request carries its own protocol version, client identity, and capabilities—no initialize handshake or Session ID needed. Multi Round-Trip Requests let tools ask for user input mid-call without holding a stream open. Method and tool names travel in HTTP headers so gateways can route without parsing JSON. List responses now include TTL and cache scope. Authorization hardens with RFC 9207 issuer validation and a move from DCR to client metadata documents. TypeScript and Python SDKs have crossed 1B total downloads, with nearly 500M monthly. The post doesn't spell out what the Tasks extension does beyond listing it alongside MCP Apps and EMA in the formal extensions framework.

Why it matters: MCP's shift from stateful to stateless is an architectural change that affects every MCP-based agent deployment. MRTR and header-based routing directly address production scaling pain points. Not scoring higher because this is a spec release, not a runnable product update — re...

Read the original ↗Export Markdown

Take

The big deal here is MCP finally dropping the stateful handshake that made server deployments a pain. No more initialize/initialized dance, no more Session ID—each request carries its own protocol version, client identity, and capabilities in _meta. Any request can hit any instance behind a plain round-robin load balancer. That alone makes running MCP in production way less annoying.

Multi Round-Trip Requests are the other practical win: tools can ask for user input mid-call without holding a bidirectional stream open. Method and tool names now sit in HTTP headers (Mcp-Method, Mcp-Name), so gateways can route and authorize without parsing JSON bodies. List responses get TTL and cache scope hints, which means clients can cache tool catalogs and keep prompt caches stable across reconnects.

On auth, they're moving from Dynamic Client Registration to client metadata documents and adding RFC 9207 issuer validation—tighter security, less runtime negotiation. The SDK numbers are wild: TypeScript and Python both crossed 1B total downloads, with nearly 500M monthly. The post lists Tasks as a new extension alongside MCP Apps and EMA, but doesn't explain what Tasks actually does. I'd wait for the follow-up doc on that one.

Source: Hacker News front page · blog.modelcontextprotocol.io
Published: Jul 29, 2026, 02:35 UTC+8 · Jul 29, 2026