The Model Context Protocol's maintainers published a release candidate for the 2026-07-28 spec, and the headline change is architectural rather than cosmetic: MCP loses its protocol-level session entirely. The release candidate blog describes it as delivering a stateless protocol core, the Extensions framework, Tasks, MCP Apps, authorization hardening, and a formal deprecation policy, calling it the largest revision of the protocol since launch. The mechanics matter for anyone routing agent traffic. Under the outgoing spec, every connection required an initialize handshake and got pinned to a server instance via an Mcp-Session-Id header — the kind of sticky routing that forces shared session stores and complicates failover. Independent analysis of the change notes a stateful protocol forces sticky sessions... Deleting sessions removes all of that... turns an MCP server into an ordinary horizontally scalable HTTP service. Servers that still need to track state across calls aren't left stranded — the maintainers point out that removing the protocol-level session does not mean your application has to be stateless. Servers that need to carry state across calls can mint an explicit handle... and have the model pass it back as an ordinary argument on later calls. That handle-passing pattern turns out to be more than a workaround: the model threading an identifier from one tool call to the next... is often a more powerful one. The model can compose handles across tools, reason about them, and hand them off between steps. The release bundles two new first-class extensions alongside the stateless core — server-rendered UIs and a long-running-task lifecycle, described as MCP Apps (server-rendered HTML UIs in sandboxed iframes with JSON-RPC channels) and a Tasks Extension (a stateless lifecycle via tasks/get, tasks/update, and tasks/cancel after a tool handles a request). Authorization also tightens: MCP servers become formal OAuth 2.1 resource servers, and the 2026-07-28 spec aligns MCP authorization with OAuth 2.1 and OpenID Connect in ways that make it meaningfully enterprise-ready. MCP servers are now formally OAuth 2.1 resource servers. The release candidate was locked May 21, 2026, with the final spec targeted for today, July 28, 2026 — giving SDK maintainers a validation window before the surface freezes for real. For teams that built routing infrastructure around sticky session IDs, this is the boundary to test against now, not after it ships.