MCP 2026-07-28 Migration: What Actually Breaks and Why

Your load balancer has been doing sticky sessions for months. Every MCP client that connects gets routed back to the same server instance because the protocol requires it - the Mcp-Session-Id header is the glue holding the whole thing together. On July 28, 2026, updated clients started negotiating a new protocol version. Servers that don't speak it degrade quietly, and then stop working.

That is the practical shape of the MCP 2026-07-28 migration problem. The release is the largest revision of the protocol since launch, delivering a stateless core that scales on ordinary HTTP infrastructure, extensions including server-rendered UIs through MCP Apps and long-running work through the Tasks extension, authorization that aligns more closely with OAuth and OpenID Connect deployments, and a formal deprecation policy. None of that is small. But the question most teams building on MCP actually need answered is narrower: what breaks, in what order of urgency, and what can wait?

What the MCP session removal actually means for infrastructure

A remote MCP server that previously needed sticky sessions, a shared session store, and deep packet inspection at the gateway can now run behind a plain round-robin load balancer, route traffic on an Mcp-Method header, and let clients cache tools/list responses for as long as the server's ttlMs permits.

That sentence is doing a lot of work. Before 2026-07-28, teams running MCP at any meaningful scale had landed on one of three ugly solutions: sticky sessions at the load balancer, a Redis-backed session store, or a gateway that cracked open the request body to extract the session ID before routing. Some teams added a Redis-backed session store. Others built a gateway that inspected the request body to extract the session ID before routing. All of these solutions exist because the protocol pushed session affinity onto infrastructure.

MCP 2026-07-28 removes the mandatory handshake and protocol-level sessions. Each request now carries the required protocol version, client information, and capabilities. The infrastructure complexity was load-bearing, and now it isn't. That is the real infrastructure story - not that sessions are "gone" in the abstract, but that three concrete ops headaches disappear with them.

The non-obvious consequence: Cloudflare deprecated its own product surface. Its McpAgent primitive existed because MCP needed stateful hosting; Durable Objects were the answer. The company wrote that the new spec removes the need for McpAgent entirely - MCP servers now run as ordinary Workers. Vendors don't usually retire a differentiated primitive unless the standard genuinely got simpler.

The six breaking changes, ranked by how urgent they are

The 2026-07-28 specification eliminates protocol-level sessions, mandates two new HTTP headers, changes an error code that client code almost certainly pattern-matches against, introduces caching semantics via new response fields, locks down distributed trace propagation, and deprecates three first-class primitives.

Here is where most coverage stops at "sessions are gone" and moves on. The actual migration has a sequencing problem. Not all six changes are equally urgent:

The specification is final, but July 28 is a publish date, not a switch-off: publication does not turn anything off for implementers on 2025-11-25, and the deprecation policy buys at least twelve months for anything being phased out. The session removal is the hard break. The deprecations are a calendar item.

Any feature marked for deprecation must remain functional for at least 12 months before it can be removed. Deprecated features are tracked in a public registry with clear timelines, giving implementers a predictable window to migrate. That formal deprecation policy is genuinely new - MCP didn't have one before, and it changes the risk calculus for anyone building on the protocol.

Tasks and MCP Apps: what the extensions framework actually ships

Tasks were promoted from an experimental feature to an official extension after real-world production use drove a redesign. The new lifecycle is stateless by design: tools/call returns a task handle, and the client drives progress via tasks/get, tasks/update, and tasks/cancel. Notably, tasks/list is gone - without sessions, listing all tasks isn't a safe operation to expose.

If you shipped anything against the experimental Tasks API in 2025-11-25, that's a real migration. The Tasks extension reshapes the lifecycle around the stateless model: a server can answer tools/call with a task handle, and the client drives it with tasks/get, tasks/update, and tasks/cancel. The polling model replaces blocking - the server no longer holds a connection open waiting for long work to finish.

MCP Apps (SEP-1865) lets servers ship interactive HTML interfaces that hosts render in a sandboxed iframe. Tools declare their UI templates ahead of time, so hosts can prefetch, cache, and security-review them before anything runs. UI-initiated actions go through the same JSON-RPC audit and consent path as a direct tool call, which keeps the security model intact.

MCP Apps is worth watching but not rushing. It's the extension that lets an MCP server ship a small form or dashboard into a host UI - a Slack-connected agent could surface a ticket triage panel directly in the channel, for instance. The security design (templates declared ahead of time, same audit path as tool calls) is conservative in a good way. A teammate like Beagle, which already operates inside Slack's message surface, would interact with MCP Apps at the host side: the rendered UI feeds back through the same approval path as any other tool call.

What's genuinely new versus what the hype skips

The honest framing: the stateless core is a real infrastructure improvement, not a paper change. Combined SDK downloads across the ecosystem are now close to half a billion a month, a four times increase since the start of the year, with both the TypeScript and Python SDKs individually past one billion total downloads. TypeScript, Python, Go, and C# SDKs already support the 2026-07-28 spec, with a Rust SDK in beta. A protocol at that scale cannot afford a fake simplification - the session removal has to actually remove the complexity, and the infrastructure evidence (Cloudflare retiring McpAgent) suggests it does.

What the coverage tends to skip: the core goes stateless, session IDs disappear from the wire, and the OAuth requirements get materially stricter - seven groups of changes that will break remote servers built against today's spec. Clients that track the protocol, Claude included, will negotiate the new version; servers that don't speak it will degrade quietly and then stop working. "Degrade quietly" is the part worth taking seriously. There's no hard cutover, but there's also no grace period on the breaking changes - only on the deprecations.

The formal deprecation policy is the most underreported improvement. It is the largest revision of the protocol since launch and delivers on the 2026 roadmap - including a formal deprecation policy so the protocol can evolve without breaking what you've built. MCP moving fast without a documented deprecation process was the thing making enterprises nervous about building on it. That concern is now at least partially addressed.

MCP 2026-07-28 migration: common questions

What actually breaks immediately when clients upgrade to the new spec?

Three things break without a grace period: the session handshake (clients on 2026-07-28 can't complete an initialize exchange with an old server), the required Mcp-Method and Mcp-Name HTTP headers (gateways routing on session affinity break), and the -32002 error code (replaced by standard JSON-RPC -32602). Fix these first before anything else.

Do sampling, roots, and logging still work after July 28?

Yes. All three are deprecated, not removed. Any feature marked for deprecation must remain functional for at least 12 months before it can be removed. The earliest removal date for these primitives is July 28, 2027. Build a migration plan, but nothing stops working today.

What is the MCP Tasks extension and how is it different from the old Tasks feature?

Tasks shipped as an experimental core feature in 2025-11-25. Production use surfaced enough redesign that the right home for it is an extension rather than the specification. The Tasks extension reshapes the lifecycle around the stateless model: a server can answer tools/call with a task handle, and the client drives it with tasks/get, tasks/update, and tasks/cancel. If you built against the experimental API, you need to migrate to the polling model.

Do I need to do anything if I only use local stdio MCP servers?

The stateless changes primarily affect remote HTTP-based MCP servers. Local stdio transports are less impacted by session removal since there's no load balancer involved. But if your server uses the deprecated sampling, roots, or logging primitives, the one-year deprecation clock still applies regardless of transport.

Which SDKs already support the new spec?

All four Tier 1 SDKs - TypeScript, Python, Go, and C# - speak 2026-07-28 as of publication day.

The Python SDK published 2.0.0 on July 28, 2026, the exact day the spec landed. TypeScript went further: the maintainers split the monolithic package into separate @modelcontextprotocol/server and @modelcontextprotocol/client packages, both shipping 2.0.0 on July 27.