MCP 2026-07-28: The Session Layer Is Gone

The Model Context Protocol has deleted its own session layer. The Mcp-Session-Id header is gone from the Streamable HTTP transport, and a server that relied on it to remember anything between calls is now broken against the current spec.

This is the 2026-07-28 revision, the largest rewrite since MCP launched in 2024. I spent the last week reading the changelog against a server I run. The migration is small if your tools were already pure functions, and a lot of work if they were not.

Table of contents

• What changed in 2026-07-28
• Why sessions were removed
• Server-minted handles
• Multi Round-Trip Requests
• Cacheable tool lists
• SDK status
• Migration order
• Who has the most work
• FAQ
• Sources

What changed in 2026-07-28

Five things landed together, and only the first one breaks code.

The spec also gained a feature lifecycle and a deprecation policy. The 2026-07-28 deprecations were the first processed under it, so the next removal should come with notice instead of showing up as a surprise in a changelog.

Why sessions were removed

A session ties a client to one server process. That is fine on a laptop and miserable in production. Every MCP deployment behind a load balancer had to solve sticky routing, and with sticky routing a dead node takes live conversations down with it.

When the release candidate went out, Google's developer blog said that removing transport-level session management gives you a stateless core that scales on ordinary HTTP load balanced infrastructure. Cloudflare described MCP as now fully stateless, with the specification, interaction model, and SDKs all rewritten around that.

The cost is real. Every server call now carries its own complete context, and nothing is implied by the connection. If a tool needs to know what happened three calls ago, the arguments have to say so.

Server-minted handles

People get this part wrong on the first read. The spec kept the ability to hold state and removed the transport that used to hold it for you.

The mechanism, introduced as SEP-2567, is a server-minted handle passed as an ordinary tool argument. Your server creates an opaque string and hands it back in a result, and the client passes it into the next call like any other parameter.

{
  "name": "query_dataset",
  "arguments": {
    "cursor_handle": "ds_7f21a9c4",
    "limit": 100
  }
}

This beats a session in three ways. The model can see the handle, so the client can reason about it and log it. The handle is scoped to one workflow rather than one connection, so a client reconnect does not invalidate it. And you can expire it yourself, setting the TTL instead of inheriting whatever the transport decided.

If you are debugging a handle payload that came back mangled, a strict parser beats a text editor. I keep the JSON Formatter open in a tab for this, since a trailing comma in a tool result can eat twenty minutes.

Multi Round-Trip Requests

A stateless protocol has an awkward case: a tool that needs to ask the user something halfway through. Elicitation used to depend on the connection staying open, which is exactly what the rewrite removed.

Multi Round-Trip Requests, or MRT, turn a mid-call question into a retryable round instead of a paused connection. The server responds with what it needs, the client gathers it, and the client calls again with the answer included.

LangChain shipped support in early September and described it in a way I find useful: the mid-call elicitation becomes a LangGraph interrupt. Think of it as a resumable pause in your orchestration layer rather than a held socket.

Microsoft made a similar point when the C# SDK hit v2.0, saying MRT is why interactive tools no longer require a long-lived session. If you maintain a tool with a confirmation step, an OAuth handoff, or a "which of these 12 rows did you mean" branch, this is the API you migrate to.

Cacheable tool lists

tools/list, resources/list, and prompts/list no longer vary per connection. That one line in the changelog has a bigger cost impact than anything else in the release.

Under the old model, a client had to assume the catalog might differ per connection, so it re-fetched on every run. Now the catalog is cacheable, and LangChain pointed out that a tool catalog no longer has to be re-fetched on every run.

For a local server that is a rounding error. An agent doing hundreds of runs a day against a remote server with 60 tools drops a large block of tokens from every run, because the tool schemas used to be pushed into the model's context each time. To see the saving in currency instead of tokens, the API Cost Calculator does the per-million math against current provider rates.

SDK status

The Tier 1 SDKs shipped alongside the spec instead of trailing it, which is new for MCP.

If you are on Rails, the Ruby gem is the one to note. It is the first stable release, and the maintainers committed to breaking changes only in major versions under a documented versioning policy.

Migration order

This order follows how likely each step is to bite you, which differs from the order the changelog lists them.

1. Grep your server for Mcp-Session-Id. Every hit is a break.
2. Find any state your tools read that did not arrive in the arguments. That is your handle list.
3. Mint handles for those, return them in results, and accept them as parameters.
4. Convert anything that blocks on user input to MRT.
5. Bump the SDK last, after you know what your own code assumes.

Step two takes the real time. In-memory maps keyed by session ID are the common pattern, and they look harmless until you run two replicas.

The client side is easier. If you are configuring an MCP client rather than writing a server, the config file shape did not change in this revision, and our LM Studio mcp.json guide still applies as written.

Who has the most work

Ad tech, by the look of it. Trade coverage at the end of July said the removal forced a rebuild of agent servers across that sector, because every call now has to carry its own context instead of leaning on a persistent connection. Any server that streamed state into a connection and read it back out is in the same position.

Local single-user servers barely notice. Remote multi-tenant servers with per-connection auth caches have the most work.

I am mildly annoyed at the timing. A rewrite this size, six weeks after the previous revision, is a lot to absorb. But the sticky-session problem was not going to fix itself, and a protocol that cannot sit behind a normal load balancer was going to hit a wall somewhere.

Start with the session removal, since it is the only breaking change, and the audit it implies of every place your tools read state outside the arguments will take most of your week. Then learn MRT properly. Interactive tools were the weakest part of MCP, and a retryable round is a sturdier design than a paused connection.

FAQ

What is the latest MCP specification version?

2026-07-28. It removed protocol-level sessions, added Multi Round-Trip Requests, made list results cacheable, standardized header-based routing, and introduced a formal extensions framework.

Does this break my existing MCP server?

Only if it used the session header or relied on per-connection state. A server whose tools are pure functions of their arguments needs an SDK bump and nothing else.

What replaces elicitation on a stateless connection?

Multi Round-Trip Requests. A mid-call request for input becomes a retryable round: the server asks, the client gathers the answer, and the call is repeated with the answer in the arguments.

Do I need to change my mcp.json?

No. This revision changed the transport and the server interaction model, not the client configuration format.

Sources

• MCP 2026-07-28 specification changelog
• The next generation of MCP, Cloudflare
• Scaling AI agent infrastructure with the MCP stateless updates, Google Developers Blog
• Announcing v2.0 of the official MCP C# SDK, Microsoft
• MCP in LangChain: stateless protocol, elicitation and more
• MCP roadmap and governance update