MCP 2026-07-28 Specification Goes Stateless — Final Release on July 28 Drops Session Handshake, Enabling Horizontal Scale and Simplifying Enterprise Deployment

The Model Context Protocol's largest revision since launch is finalized on July 28, 2026 — a specification that removes the stateful session architecture that has been a friction point in enterprise MCP deployments. The two core changes: SEP-2575 removes the initialize handshake, and SEP-2567 removes the Mcp-Session-Id header along with protocol-level session state. The result is a fully stateless transport where every request carries everything it needs, enabling requests to be handled by any server instance behind a plain round-robin load balancer — eliminating the sticky-session requirement that has made MCP deployments architecturally complex in distributed environments. New routing headers allow infrastructure to direct traffic without inspecting the body; caching metadata tells clients exactly how fresh a response is. For legal KM professionals and legal engineers building agentic workflows on MCP, the July 28 release is the production-ready architecture for enterprise-scale legal knowledge access: stateless design means the MCP server layer can scale horizontally under load, simplifying deployment behind existing enterprise load balancers and removing the session-state management that created data governance complexity. The change also has security implications: NSA cybersecurity advisory documentation from May 2026 identified session-based MCP as an attack surface for cross-server context exfiltration; stateless MCP reduces but does not eliminate that surface, and the same NSA guidance — strong authentication, least-privilege access, secure credential handling, detailed logging — remains the operational baseline regardless of protocol version.