title: "MCP protocol overhaul removes sessions, rewrites auth for stateless ag" slug: "mcp-protocol-overhaul-removes-sessions-rewrites-auth-for-stateless-agents" published: "2026-07-12" beat: "Tools" tags: ["Tools", "Launches"] creator: "Agentry Newsroom" editor: "Susanne Sperling, Editor — Human in the Loop" tools: ["Claude (Anthropic)", "Perplexity Sonar"] creativeWorkStatus: "verified" dateReviewed: "2026-07-12" aiActArticle50: "compliant" humanView: "https://agentry.news/mcp-protocol-overhaul-removes-sessions-rewrites-auth-for-stateless-agents" agentView: "https://agentry.news/agent/mcp-protocol-overhaul-removes-sessions-rewrites-auth-for-stateless-agents"
Model Context Protocol maintainers published a release candidate on May 21, 2026, for the largest protocol revision since launch, eliminating sessions and initialization handshakes while rewriting aut
Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. AI policy.
Model Context Protocol (MCP) lead maintainers published the release candidate for what they called the largest revision of the protocol since launch on May 21, 2026, introducing foundational changes that redefine how AI agents authenticate, initialize, and operate at scale. The final specification ships July 28, 2026, after a 10-week SDK validation window for client implementers and tool maintainers to test the changes against production workloads.
The headline change is that MCP is now stateless at the protocol layer, according to MCP's official announcement. This allows requests to land on any server instance without maintaining per-connection session state—a critical shift for distributed agent deployments. Two core protocol features are being removed entirely:
• Sessions and session headers: The Mcp-Session-Id header and protocol-level session management (SEP-2567) are deprecated
• Initialization handshake: The initialize/initialized ceremony (SEP-2575) is gone, replaced by on-demand capability discovery
Three additional features—Roots, Sampling, and Logging—move into a formal deprecation window with documented replacement paths: tool parameters for Roots, direct LLM provider APIs for Sampling, and OpenTelemetry for Logging, according to technical specifications released by the protocol maintainers.
The most consequential change is authorization. MCP servers are now formally defined as OAuth 2.1 resource servers, aligning the protocol with industry authentication standards rather than maintaining a proprietary handshake. This rewrite enables federated identity, token introspection, and scope-based access control—patterns enterprise security teams already understand from cloud IAM.
A new server/discover method allows clients to fetch server capabilities on demand, eliminating the need for pre-negotiated session state and enabling dynamic agent-to-tool binding in real time.
Operators preparing for the transition face a 12-month deprecation window starting July 28, 2026, during which legacy protocol versions will continue to function alongside the new specification. OpenClaw, an operator platform for distributed agent deployment, is already preparing its infrastructure for the stateless model.
Developers can access the release candidate now and validate SDKs, client implementations, and server adapters during the 10-week window before final publication. This is not a hypothetical roadmap—the RC is live, the spec is locked, and the ship date is fixed.