MCP's Biggest Update Ships July 28: Stateless, OAuth, Simpler Scaling

If you run a remote MCP server for your agents, the calendar just got a hard date on it. The Model Context Protocol's next revision is at release candidate now and ships as final on 28 July 2026, and its headline is a rewrite of how servers hold state. For a small team, that is both a scaling gift and a short migration window you cannot ignore.

What is in the MCP spec update shipping July 28?#

The MCP spec update is the 28 July 2026 revision, at release candidate now per the official MCP blog. Its headline is a stateless protocol core, plus authorization aligned to OAuth 2.1 and OpenID Connect. It also adds an Extensions framework, Tasks, MCP Apps, and a formal deprecation policy, per the MCP roadmap post.

The stateless change is the one that touches your infrastructure. Per the chatforest builder guide (as of early July 2026, verify before relying), a remote MCP server that used to need sticky sessions, a shared session store, and deep packet inspection at the gateway can now sit behind a plain round-robin load balancer, route on an Mcp-Method header, and let clients cache tools/list responses. That is the difference between hand-rolling session affinity and shipping a stateless container.

The 2026-07-28 core drops sticky sessions and shared state so any replica can answer. Source: chatforest builder guide plus the MCP release-candidate post (as

The authorization change matters just as much for anyone selling to companies. Aligning MCP auth with OAuth 2.1 and OpenID Connect, per the WorkOS write-up, means enterprise identity teams get a standard they already trust instead of a bespoke token scheme. If you build agents that touch customer systems, this is the part that unblocks procurement.

What does stateless MCP actually mean for your server?#

Stateless MCP means the protocol layer no longer assumes a server remembers a client between requests. Per the chatforest builder guide, that removes the need for sticky sessions and a shared session store, so any replica can answer any request. Your scaling model becomes ordinary web scaling instead of a special case.

A starting checklist mapped from the reported breaking changes; read the release candidate for the full set. Source: MCP release-candidate and roadmap posts

Concretely, three things you used to build now go away. Sticky-session routing at the load balancer, because requests no longer have to return to the same instance. A shared session store like Redis behind your replicas, because there is no session to share. And deep packet inspection at the gateway to keep sessions coherent, because the Mcp-Method header carries what the router needs. For a solo builder, that is less infrastructure to run and less that can break at 2 a.m.

Definition drawn from the MCP release-candidate post and the chatforest builder guide (as of early July 2026, verify before relying).

The trade is that your server can no longer lean on remembered per-connection state as a shortcut. Anything you were stashing in a session now belongs in the request, a token, or your own datastore, keyed explicitly. That is a cleaner design in the long run, but it is real work if your current server assumes a warm session is always there.

What breaks, and what should you check before July 28?#

Expect real breakage, not a silent upgrade. Builder write-ups report roughly six breaking changes that production MCP servers must handle before 28 July 2026, per the chatforest guide (as of early July 2026, verify before relying). There is also a roughly ten-week window for SDK maintainers to validate, with Tier-1 SDKs expected inside it.

The table below frames the shift by area so you can map it to your own server. Treat it as a starting checklist, not the full spec, and read the release candidate itself before you cut over.

Table compiled from the MCP release-candidate and roadmap posts plus the chatforest builder guide (as of early July 2026, verify before relying).

If your agents connect to MCP tools through a workflow tool rather than a bespoke server, your exposure is smaller but not zero. Our walkthrough on wiring an n8n MCP client to an AI agent shows where the client side sits, and that client is what has to speak the new stateless protocol once your upstream servers move.

Does the July 28 update actually affect you?#

Whether it affects you depends on one question: do you operate an MCP server, or only consume one? Per the mechanics in the release-candidate and roadmap posts, server operators face the roughly six breaking changes and the stateless redesign, while pure clients mostly wait for their SDK to ship support inside the ten-week validation window.

Start from whether you operate an MCP server; every path ends at reading the official release candidate. Source: MCP release-candidate and roadmap posts (as of

If you run a server, the honest reading is to plan the migration now rather than in the last week of July. Audit where you rely on session state, confirm your Tier-1 SDK is on the validation track, and stand up a stateless test replica behind a round-robin balancer before you trust it in production. If you host your own MCP server as a solopreneur, this is the change that most affects your deployment shape.

How should a small team plan the migration?#

A small team should treat 28 July 2026 as a real deadline and stage the work backward from it. Per the roadmap post, the ten-week validation window means SDK support arrives on a schedule, so pin your SDK version, test the stateless path early, and keep the release candidate open as your source of truth rather than second-hand summaries.

The upside is worth the effort. Stateless servers scale like ordinary web services, and OAuth 2.1 with OpenID Connect gives you an enterprise-ready auth story you did not have to invent. The cost is a bounded migration you control if you start now. Read the MCP servers guide for solopreneurs for the deployment fundamentals, then verify every date and count here against the official MCP release-candidate post and the MCP roadmap before you rely on them.