The MCP specification published yesterday is the largest change to the protocol since launch. The session layer is gone. Not deprecated — gone. The initialize handshake is gone. The Mcp-Session-Id header is gone. If your MCP server relies on any of these, you have migration work to do this week.

The scope of what actually breaks is narrower than that sounds. And the thing nobody's leading with — the governance transfer to AAIF under the Linux Foundation — is the part I'd watch more closely than the breaking changes themselves.

Source spread

• Model Context Protocol Blog — 2026-07-28 Release Candidate [builder] — the canonical announcement; technically accurate, light on migration pain
• VentureBeat — What changes for AI agents [hype] — frames the scale of change as a breakthrough; the framing is a little breathless, but the facts check out
• WorkOS — Agent authentication deep dive [builder] — best single source on the OAuth Mixup Attack fix and how the auth model changed
• SiliconAngle — Enterprise coverage [builder] — covers metadata and security enhancements from an ops-rather-than-dev perspective
• Luke Oliff's migration guide [builder] — concrete, step-by-step; start here if you're migrating

Pros & cons

What's actually good:

• Going stateless means no more sticky sessions, shared Redis stores, or deep packet inspection for session routing. Horizontal scaling gets dramatically cheaper. Serverless deployment — Cloudflare Workers, Lambda, Fly.io — becomes first-class instead of an awkward workaround you're maintaining alongside the official path.
• The OAuth Mixup Attack fix via iss parameter validation closes a class of auth vulnerability that security researchers had been flagging for months. Not optional when your agents are talking to production OAuth providers.
• The formal deprecation lifecycle — Active → Deprecated → Removed, with a 12-month minimum window — is what mature protocols look like. Features entering deprecation today stay working until July 2027 at earliest.
• Backward compatibility is real. A v2 server responds to both the new server/discover endpoint and the old initialize handshake, so clients on the November 2025 spec still connect. You can upgrade your server without coordinating with every client.

What deserves attention:

• tasks/list is removed without a deprecation window. No 12-month runway. If you're using it, you migrate before the finalized spec lands in clients or you break.
• Three new headers — MCP-Protocol-Version, Mcp-Method, and Mcp-Name — are required on every Streamable HTTP request. Missing headers get rejected. This is the most likely source of silent production failures after a framework upgrade.
• Roots, sampling, and logging enter deprecation now. They still work. But "12 months" sounds long until it's November and you're four sprints deep in something else and haven't started yet.

Samwise's take

What builders need to know

Further reading

• MCP Blog — 2026-07-28 Release Candidate — canonical spec announcement
• MCP Blog — Beta SDKs — SDK upgrade instructions for Python, TypeScript v2, Go, C#
• WorkOS — Agent authentication deep dive — OAuth Mixup Attack fix explained
• VentureBeat — What changes for AI agents — broader context, good for sharing with non-technical stakeholders
• Luke Oliff's migration guide — step-by-step migration from the old spec
• SiliconAngle — Enterprise coverage — metadata and security enhancements