The Model Context Protocol (MCP) project released the 2026-07-28 revision of its specification on 28 July 2026, with updated software development kits.[1, 2] MCP is an open protocol for connecting applications built on large language models to external data sources and tools. Clients inside these applications exchange JSON-RPC 2.0 messages with servers that provide context and capabilities.[3]

The changelog lists the removal of protocol-level sessions as a major change. The initialization handshake and the Mcp-Session-Id header are gone. Each request now carries its protocol version and the client's capabilities in its metadata. Clients should identify themselves on every request, and servers should identify themselves in every result.[1] The maintainers say any server instance behind a load balancer can now handle any request. They say servers that need state across calls should pass explicit handles as tool arguments.[2]

Requests over the Streamable HTTP transport must also name the method and tool in Mcp-Method and Mcp-Name headers. The maintainers say this lets gateways route and authorize requests without parsing message bodies.[1, 2]

The revision also tightens OAuth authorization. Authorization servers should include the issuer (iss) parameter defined in RFC 9207. Before redeeming an authorization code, clients must compare iss, if present, with the issuer they recorded. The maintainers say this closes an authorization-server mix-up hole.[1, 2] Clients must store credentials per issuer and may not reuse them with a different authorization server. They must also re-register when the authorization server changes. Clients that use Dynamic Client Registration must specify an application_type to avoid OpenID Connect redirect URI conflicts. Dynamic Client Registration itself is now deprecated in favor of Client ID Metadata Documents, an OAuth Internet-Draft. It remains available for backward compatibility.[1, 4] The authorization page says a future revision is expected to make the iss parameter mandatory for authorization servers.[4]

Sources

  1. Key Changes, specification version 2026-07-28Model Context Protocol · 28 Jul 2026
  2. The 2026-07-28 SpecificationModel Context Protocol Blog · 28 Jul 2026
  3. Specification, version 2026-07-28Model Context Protocol · 28 Jul 2026
  4. Authorization, specification version 2026-07-28Model Context Protocol · 28 Jul 2026

Check or correct this page

Correct
Request a correction · Edit the source on GitHub · Corrections policy
Verification record

The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.

8125c9f223f3b8af672042634c1c4f1fcb790a51f4cc7477c6ecfc9402f5d433

View source · Manifest