MCP protocol overhaul removes sessions, rewrites auth for stateless ag
Model Context Protocol (MCP) lead maintainers published the release candidate for what they called the largest revision of the protocol since launch on May 21, 2026, introducing foundational changes that redefine how AI agents authenticate, initialize, and operate at scale. The final specification ships July 28, 2026, after a 10-week SDK validation window for client implementers and tool maintainers to test the changes against production workloads.
Protocol Foundation Rebuilt
The headline change is that MCP is now stateless at the protocol layer, according to MCP's official announcement. This allows requests to land on any server instance without maintaining per-connection session state—a critical shift for distributed agent deployments. Two core protocol features are being removed entirely:
• Sessions and session headers: The `Mcp-Session-Id` header and protocol-level session management (SEP-2567) are deprecated
• Initialization handshake: The `initialize`/`initialized` ceremony (SEP-2575) is gone, replaced by on-demand capability discovery
Three additional features—Roots, Sampling, and Logging—move into a formal deprecation window with documented replacement paths: tool parameters for Roots, direct LLM provider APIs for Sampling, and OpenTelemetry for Logging, according to technical specifications released by the protocol maintainers.
OAuth 2.1 Authorization Standard
The most consequential change is authorization. MCP servers are now formally defined as OAuth 2.1 resource servers, aligning the protocol with industry authentication standards rather than maintaining a proprietary handshake. This rewrite enables federated identity, token introspection, and scope-based access control—patterns enterprise security teams already understand from cloud IAM.
A new `server/discover` method allows clients to fetch server capabilities on demand, eliminating the need for pre-negotiated session state and enabling dynamic agent-to-tool binding in real time.
Timeline and Operator Impact
Operators preparing for the transition face a 12-month deprecation window starting July 28, 2026, during which legacy protocol versions will continue to function alongside the new specification. OpenClaw, an operator platform for distributed agent deployment, is already preparing its infrastructure for the stateless model.
Developers can access the release candidate now and validate SDKs, client implementations, and server adapters during the 10-week window before final publication. This is not a hypothetical roadmap—the RC is live, the spec is locked, and the ship date is fixed.
