---
schema_version: "newruntime-agent-readable-v0.2"
type: "post"
stable_id: "post:mcp-2026-stateless-core"
slug: "mcp-2026-stateless-core"
title: "MCP 2026 Makes The Protocol Stateless"
description: "The 2026-07-28 MCP specification moves the protocol to a stateless request-response core, formalizes extensions, and hardens enterprise authorization."
retrieval_nugget: "The 2026-07-28 MCP specification moves the protocol to a stateless request-response core, formalizes extensions, and hardens enterprise authorization. MCP 2026-07-28 is a protocol reset around a smaller core. Earlier HTTP MCP deployments established a session, returned a session identifier, and expected later tool calls to preserve that state. The new core uses a direct request-response model."
status: "published"
published_at: "2026-08-01"
updated_at: "2026-08-01"
record_date: "2026-08-01"
date_kind: "published_at"
topics: ["mcp","protocols","authorization","agent-infrastructure"]
source_urls: ["https://blog.modelcontextprotocol.io/posts/2026-07-28","https://claude.com/blog/bringing-mcp-2026-07-28-to-claude"]
visuals: [{"id":"mcp-2026-stateless-core","kind":"editorial-diagram","role":"hero","src":"https://newruntime.com/images/posts/mcp-2026-stateless-core.webp","alt":"Hand-drawn split diagram where a sticky session protocol becomes one stateless HTTP request, with apps, tasks, and enterprise authorization attached as versioned extensions.","caption":"MCP 2026 reduces the core to stateless HTTP and moves richer behavior into explicit extensions.","credit":"New Runtime synthesis from the MCP and Claude release notes","source_url":"https://blog.modelcontextprotocol.io/posts/2026-07-28","generated_with":"gemini-3.1-flash-image","width":1600,"height":900,"legend":[{"label":"Stateless core","description":"Each tool request carries the protocol information it needs without server-side session affinity."},{"label":"Extensions","description":"Apps and Tasks evolve under a versioned framework instead of expanding the core protocol."},{"label":"Authorization","description":"OAuth 2.0, OIDC, and enterprise identity integrations become first-class deployment concerns."}]}]
routes: {"html":"https://newruntime.com/posts/mcp-2026-stateless-core/","markdown":"https://newruntime.com/posts/mcp-2026-stateless-core.md","json":"https://newruntime.com/posts/mcp-2026-stateless-core.json"}
source_format: "markdown"
---

# MCP 2026 Makes The Protocol Stateless

## Retrieval answer

The 2026-07-28 MCP specification moves the protocol to a stateless request-response core, formalizes extensions, and hardens enterprise authorization. MCP 2026-07-28 is a protocol reset around a smaller core. Earlier HTTP MCP deployments established a session, returned a session identifier, and expected later tool calls to preserve that state. The new core uses a direct request-response model.

MCP 2026-07-28 is a protocol reset around a smaller core.

Earlier HTTP MCP deployments established a session, returned a session identifier, and expected later tool calls to preserve that state. The new core uses a direct request-response model. A tool call can arrive as a normal HTTP workload with the protocol version and method declared on the request, without forcing the server to keep session affinity.

That change matters for deployment. Stateless servers fit serverless, edge, load-balanced, and horizontally scaled infrastructure without a separate session-routing problem. A failed instance no longer owns invisible protocol state that the next request needs.

Richer behavior has not disappeared. MCP Apps and Tasks now live under a versioned extensions framework. Apps can render interactive UI in a conversation. Tasks support long-running work. The distinction keeps the core transport small while giving optional capabilities a formal compatibility path.

Authorization is the other production boundary. The release aligns MCP with normal OAuth 2.0 and OIDC systems, including enterprise identity providers. Anthropic is also rolling out enterprise-managed authorization, connector observability, and private-network tunnels across Claude products.

The useful migration is architectural. Keep individual tools stateless when possible. Put durable job state in an explicit task or application layer. Treat authorization and observability as infrastructure contracts, not attributes hidden inside a tool description.

New Runtime has already tracked stateless MCP handlers and OAuth boundaries separately. This specification explains why those threads converge: stateless transport reduces operational complexity, while explicit extensions prevent that simplicity from erasing long-running work.