The 2026-07-28 Model Context Protocol spec ships in six days, and it is the biggest change to the protocol since it launched. It removes the two things every remote MCP server was built around: the initialize handshake and the protocol-level session. After the 28th, every request is self-contained, and any replica has to be able to answer any call.
If you read one line: the SDK betas are installable today, so the migration is a boring branch this week instead of an incident next week — do it now, in this order.
This is the do-it-in-order checklist. Each step links to the deep dive behind it. If you only connect to MCP servers and don't host one, you get this for free from your updated SDK — stop here. The rest is for people who run a remote server.
Day 1 — Install the beta and run the codemod#
The official SDKs shipped betas on June 29: Python mcp 2.0.0b1, a rebuilt TypeScript v2 (now two packages, @modelcontextprotocol/server and @modelcontextprotocol/client), Go 1.7.0-pre.1, and C# 2.0.0-preview.1. TypeScript is the big lift — the codemod npx @modelcontextprotocol/codemod@beta v1-to-v2 . does the mechanical rename-and-import work. Python is the gentlest: FastMCP becomes MCPServer and the @mcp.tool() decorator carries over unchanged.
Done looks like: the server builds and boots on the v2 package. → Install, migrate, run stateless (Python & TypeScript)
Day 2 — Kill the sticky session#
This is the step that actually breaks things. If your load balancer pins a client to the replica that started its conversation, or you keep a shared session store keyed by session ID, that assumption is now wrong. Set the balancer to plain round-robin, drop the affinity cookie, and confirm nothing reads a session map on the hot path.
Done looks like: no request depends on "the replica that answered last time." → What the stateless core breaks and why it's worth it
Day 3 — Relocate the per-turn state#
State that used to live on the server between calls has to go somewhere. Two options: an explicit state handle the client passes back on the next request, or the Tasks extension for genuinely long-running work. Pick per tool. A quick tool call should carry its own state; a ten-minute job should become a Task the client polls.
Done looks like: no in-memory session map; every call reconstructs its context from the request. → Explicit state handles · Run a long tool call as a Task
Day 4 — Re-verify authorization#
The 2026-07-28 revision also hardens auth toward OAuth and OpenID Connect, and the Enterprise-Managed Authorization extension is now stable — the IdP grants agent access centrally, no per-server consent screen. Re-run your auth-code flow against the new checks. If you sell into enterprise, test the IdP grant path now; it's the difference between "one admin enables the server once" and "500 users each click allow."
Done looks like: auth passes under the new checks; the EMA path works if you need it. → The 2026-07-28 authorization changes
Day 5 — Load-test stateless#
The whole point is that any replica answers any request. Prove it: put 100+ concurrent clients behind a round-robin balancer and confirm no call fails because it landed on a "cold" replica. This is where a migration that looked clean on Day 2 shows the one tool that still cheats.
Done looks like: green under concurrency, no affinity dependency. → Load-test stateless MCP behind a round-robin balancer
Day 6 — Ship a compatibility window, not a cutover#
Don't force every client to move on the 28th. A v2 server can serve both the old and new protocol revisions from one endpoint, so your clients migrate on their own clock. Turn that window on. Hard cutovers are how a spec upgrade becomes a support fire.
Done looks like: one endpoint, both revisions, clients migrate themselves.
The reason this is worth a week of your time isn't the spec — it's the bill. A stateless server runs on ordinary HTTP: a plain load balancer, no deep packet inspection at the gateway, cache-able tools/list. That's the infrastructure a team of one can actually afford to keep running. The handshake was load-bearing complexity, and July 28 deletes it. Spend the six days.
