Model Context Protocol (specification 2026-07-28)

What Model Context Protocol (specification 2026-07-28) actually is

• Revision 2026-07-28 was published on 28 July 2026 and is the current specification. It replaces revision 2025-11-25 and is the largest change to the protocol since its launch.
• Stateless core: the initialize / notifications/initialized handshake is gone. Every request now carries its own protocol version, client capabilities and client identity in _meta (io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientCapabilities, io.modelcontextprotocol/clientInfo). SEP-2575.
• Sessionless transport: protocol-level sessions and the Mcp-Session-Id header are removed from Streamable HTTP. Servers that need state across calls mint their own handles and pass them as ordinary tool arguments. SEP-2567.
• New server/discover RPC: servers MUST implement it to advertise supported protocol versions, capabilities and identity. Clients MAY call it before anything else, or use it as a backwards-compatibility probe.
• Multi Round-Trip Requests (MRTR): servers can no longer send their own requests to the client. Instead a handler returns an InputRequiredResult with resultType input_required and an inputRequests field; the client retries the original request with inputResponses. This replaces server-initiated sampling/createMessage, elicitation/create and roots/list. SEP-2322.
• subscriptions/listen replaces the HTTP GET stream and resources/subscribe / resources/unsubscribe. It is one long-lived POST response stream carrying only the change notifications the client opted in to.
• Formal extensions framework: an extensions field is added to ClientCapabilities and ServerCapabilities, so optional features are negotiated per request instead of living in the core protocol.
• Tasks is now an official extension (io.modelcontextprotocol/tasks) instead of an experimental core feature. The redesign replaces the blocking tasks/result with polling via tasks/get, adds tasks/update for client-to-server input mid-flight, and removes tasks/list. SEP-2663. Spec lives in the modelcontextprotocol/ext-tasks repository.
• Cacheable list results: tools/list, prompts/list, resources/list, resources/read and resources/templates/list now require ttlMs and cacheScope fields via a new CacheableResult interface. SEP-2549.
• Header-based routing: Streamable HTTP POSTs must carry MCP-Protocol-Version, Mcp-Method and Mcp-Name headers so gateways can route without parsing the body. Tools can mirror parameters into Mcp-Param-* headers via x-mcp-header. SEP-2243.
• Authorization hardening (not a new auth model): the OAuth-based authorization spec already existed and is built on OAuth 2.1 draft-ietf-oauth-v2-1-13, RFC 6750, RFC 8414, RFC 8707, RFC 9728 plus OpenID Connect Discovery 1.0. New in this revision: RFC 9207 issuer validation, OAuth Client ID Metadata Documents as the preferred registration path, Dynamic Client Registration (RFC 7591) formally deprecated, required application_type in DCR, and client credentials keyed to the issuing authorization server.
• Feature lifecycle policy: every feature now has an Active / Deprecated / Removed state with a minimum twelve-month window between deprecation and removal. SEP-2596.
• Deprecated in this revision: Roots, Sampling and Logging (SEP-2577), the HTTP+SSE transport, and OAuth Dynamic Client Registration.

Limits and catches

• Removed methods: ping, logging/setLevel, notifications/roots/list_changed, resources/subscribe and resources/unsubscribe no longer exist at 2026-07-28 and are rejected with MethodNotFound. Log level moves to a per-request io.modelcontextprotocol/logLevel field in _meta.
• SSE stream resumability is gone: the Last-Event-ID header and SSE event IDs are removed. A broken response stream loses the in-flight request and the client MUST re-issue it with a new request ID.
• GET and DELETE on the MCP endpoint now return 405 Method Not Allowed. An Mcp-Session-Id header on a request must be ignored, and a Last-Event-ID header must be ignored.
• Every result must carry a resultType field (complete or input_required). Clients must treat a missing field from an older server as complete.
• Error codes were renumbered: resource-not-found moves from -32002 to -32602, HeaderMismatch from -32001 to -32020, MissingRequiredClientCapability from -32003 to -32021, UnsupportedProtocolVersion from -32004 to -32022.
• A header/body mismatch on Streamable HTTP is a hard failure: 400 Bad Request with JSON-RPC error -32020 HeaderMismatch.
• MCP Apps is NOT part of this revision. It is a separate extension announced on 26 January 2026, with its own spec version 2026-01-26 in the modelcontextprotocol/ext-apps repository. The 2026-07-28 changelog does not mention it.
• SDK coverage is uneven. The Java SDK 2.0.0 still tracks the 2025-11-25 revision. The Python SDK 2.0.0 ships without the Tasks extension. The Swift and PHP SDKs have no release that references 2026-07-28.
• Backwards compatibility is preserved but is per-SDK opt-in in different ways: TypeScript v2 never speaks 2026-07-28 unless you ask, Go v1.7.0 only serves it over HTTP when Stateless is set to true, and C# v2.0.0 flips Stateless to true by default.

What does Model Context Protocol (specification 2026-07-28) cost?

Free and open. MCP is an open protocol specification, not a paid product. The spec, schema and all official SDKs are published on GitHub under an open source license.

Prices verified August 2026, we re-check every 60 days.