MCP Specification 2026-07-28 Goes Final: Stateless Core, Hardened Identity, OAuth Alignment

The Model Context Protocol working group published the final 2026-07-28 specification on July 28 — the most significant revision since MCP launched. The headline is a removal: MCP no longer has sessions. The stateless, request-response core eliminates the initialize handshake and Mcp-Session-Id, making MCP scale on ordinary HTTP infrastructure rather than requiring persistent connection management. Each request now carries its own protocol version and capability information. Additional changes: client credentials are now bound to the specific authorization server that issued them (SEP-2352); authorization aligns more closely with OAuth and OpenID Connect deployments; MCP Apps enable server-rendered UIs; the Tasks extension supports long-running work; a formal deprecation policy enables protocol evolution without breaking existing deployments. For KM directors and legal engineers building or evaluating MCP-connected knowledge systems: the stateless core is the change that makes MCP production-viable at scale — no session management overhead, standard HTTP infrastructure, compatible with existing load balancers and API gateways. The identity hardening (credential-to-issuer binding) is directly relevant to legal MCP deployments where ethical walls and client-matter access restrictions must be enforced at the protocol layer.