MCP 2026-07: OAuth, stateless core, team migration

MCP 2026-07-28: what changes (spec facts)

The MCP 2026-07-28 release candidate is framed on the official blog as the largest revision since launch. Target final: 28 July 2026. Breaking changes by design, with a validation window for SDKs.

Four blocks: (1) protocol-level stateless core, (2) first-class extensions (MCP Apps, Tasks), (3) authorization closer to OAuth / OpenID Connect, (4) formal deprecation policy (at least 12 months from deprecation to earliest removal).

If your team wires remote MCP in prod, this is not a “nice to have” note. It is an infra and security runbook.

Stateless core: protocol sticky sessions are gone

Before (e.g. 2025-11-25): initialize handshake, Mcp-Session-Id header, sticky instances and often a shared session store. After 2026-07-28: self-contained requests, protocol version per request, Mcp-Method / Mcp-Name headers to route without reading the body.

The protocol no longer manages session for you. App state uses explicit handles (e.g. basket_id) the model passes as tool args. More visible to the agent, simpler for a round-robin load balancer.

Multi Round-Trip: the server can return InputRequiredResult (elicitation) then the client retries with answers. Any instance can resume because useful state is in the payload.

MCP OAuth: what auth requires now

Several SEPs harden authorization. Team practice: clients must validate the iss parameter on auth responses (RFC 9207) to limit mix-up attacks common when one client talks to many MCP servers.

Remote servers increasingly behave as OAuth 2.x resource servers: protected resource metadata, resource indicators, credentials bound to issuer. Implementation write-ups (e.g. WorkOS) also stress client registration evolution (CIMD preferred, DCR de-emphasized).

Minimum policy: no blind token passthrough, minimal scopes, auth logs, re-register if a server changes issuer. Human approval on high-impact tools stays outside the protocol (business HITL).

Extensions: Apps, Tasks, deprecations

MCP Apps: server-rendered HTML UI in a sandboxed iframe; actions reuse the same audit path as tools. Tasks leaves experimental core for an extension with a stateless lifecycle (task handle, get/update/cancel).

Roots, Sampling and Logging are deprecated (annotation): they remain for a time under the lifecycle policy. Replacements: tool params / URIs, direct LLM APIs, stderr or OpenTelemetry.

Do not confuse “we have MCP” with “we have the right spec version + SDK tier”. Pin protocolVersion and test conformance.

SME migration checklist (1 page)

1) Inventory MCP (local stdio vs remote). 2) Who exposes what (scopes, data). 3) Target SDK and protocolVersion. 4) Auth: issuer, registration, refresh, logs. 5) Load balancing without protocol sticky sessions. 6) TTL / cache for tools lists. 7) OpenTelemetry traces. 8) Owner + cutover date + rollback.

The evergreen MCP guide explains why to wire tools. This news post dates the 2026-07 delta. Link: model-context-protocol-mcp.

Sources: official MCP RC 2026-07-28 blog; OAuth implementation notes (e.g. WorkOS). Re-read the draft changelog before cutover.

If you want to audit remote MCP and OAuth policy on a real process, we can scope in 20-40 minutes.