MCP 2026-07-28 is a protocol reset around a smaller core.
Earlier HTTP MCP deployments established a session, returned a session identifier, and expected later tool calls to preserve that state. The new core uses a direct request-response model. A tool call can arrive as a normal HTTP workload with the protocol version and method declared on the request, without forcing the server to keep session affinity.
That change matters for deployment. Stateless servers fit serverless, edge, load-balanced, and horizontally scaled infrastructure without a separate session-routing problem. A failed instance no longer owns invisible protocol state that the next request needs.
Richer behavior has not disappeared. MCP Apps and Tasks now live under a versioned extensions framework. Apps can render interactive UI in a conversation. Tasks support long-running work. The distinction keeps the core transport small while giving optional capabilities a formal compatibility path.
Authorization is the other production boundary. The release aligns MCP with normal OAuth 2.0 and OIDC systems, including enterprise identity providers. Anthropic is also rolling out enterprise-managed authorization, connector observability, and private-network tunnels across Claude products.
The useful migration is architectural. Keep individual tools stateless when possible. Put durable job state in an explicit task or application layer. Treat authorization and observability as infrastructure contracts, not attributes hidden inside a tool description.
New Runtime has already tracked stateless MCP handlers and OAuth boundaries separately. This specification explains why those threads converge: stateless transport reduces operational complexity, while explicit extensions prevent that simplicity from erasing long-running work.