The Model Context Protocol just shipped its most consequential update yet, and if you build AI agent tooling, it changes your architecture starting today. The MCP 2026-07-28 specification lands July 28 with a stateless core that finally runs behind ordinary load balancers, server-rendered MCP Apps that paint interactive UI inside sandboxed iframes, a Tasks extension for jobs that outlive a single request, and first-class OAuth/OIDC authorization. This release moves MCP from “great for local dev tools” to “shippable in production infrastructure.” Here is what changed, why it reshapes how you deploy agents, and the concrete steps to adopt it this week.
What’s actually new in the MCP 2026-07-28 specification
The headline is the stateless server model. Earlier MCP revisions leaned on a long-lived session — an SSE stream and a session ID that pinned every follow-up request to the exact process that opened it. That works on a laptop and falls apart the moment you put three replicas behind a load balancer. The 2026-07-28 revision defines a stateless HTTP transport where each request carries everything the server needs, so any replica can answer any request. There is no sticky-session requirement, so MCP servers now scale horizontally like any ordinary REST service. This Model Context Protocol stateless server model is the single biggest unlock for teams that were blocked on operational maturity.
Second, MCP Apps graduate from proposal to spec. A tool can now return a UI resource — server-rendered HTML — that the host displays in a sandboxed iframe, with a narrow, audited postMessage bridge back to the MCP host. That gives you MCP Apps interactive UI — approval forms, data tables, charts, multi-step wizards — without shipping a bespoke client plugin for every surface. The host controls the sandbox; the app never touches the host’s DOM or credentials directly. Third, the MCP Tasks extension introduces a standard lifecycle for long-running work: a tool call returns a task handle immediately, and the client polls or subscribes for status, progress, and the eventual result. That fixes the awkward pattern of pretending a ten-minute render or batch job fits inside one synchronous tool response.
Authorization is now part of the core story. The spec formalizes MCP OAuth OIDC authorization: servers act as OAuth 2.1 resource servers, tokens are validated per request (which the stateless model demands anyway), and OIDC discovery lets clients find the right authorization server. Together these four changes — stateless transport, Apps, Tasks, and auth — make the 2026-07-28 revision the biggest since MCP launched.
Why it matters
- Real horizontal scaling. MCP server load balancing no longer requires sticky sessions, so you deploy replicas behind a standard L7 balancer, autoscale on CPU or request count, and roll deploys without draining sessions. Ops teams stop treating MCP as a special snowflake.
- Stateless means resilient. When any replica handles any request, a pod restart no longer kills an in-flight conversation’s tool context. Kubernetes, Cloud Run, and Lambda-style deployments become natural targets.
- UI without a client fork. MCP Apps interactive UI lets one server render approval dialogs and dashboards that work across every compliant host, so you stop maintaining per-client extensions to get a button on screen.
- Long jobs stop lying. The MCP Tasks extension gives batch exports, deployments, and video renders an honest async contract — handle now, result later — instead of timeouts and fake “still working…” polling hacks.
- Auth you can defend in a review. OAuth/OIDC as spec lets security teams reason about MCP the way they reason about any other API: scoped tokens, per-request validation, standard discovery. That clears procurement and compliance blockers.
- A cleaner mental model for developers. Stateless request handling forces idempotent, self-describing calls, which are easier to test, cache, and trace than session-bound streams.
How to use the MCP 2026-07-28 specification today
- Pin your protocol version. Announce the new revision in your initialize handshake so hosts negotiate the stateless behavior explicitly.
{ "protocolVersion": "2026-07-28", "capabilities": { "tools": {}, "apps": {}, "tasks": {} } } - Serve the stateless HTTP transport. Handle each POST independently — no in-memory session map. Authenticate from the token on every call so any replica can serve it.
POST /mcp HTTP/1.1 Host: tools.example.com Authorization: Bearer <access_token> Content-Type: application/json MCP-Protocol-Version: 2026-07-28 {"jsonrpc":"2.0","id":1,"method":"tools/call", "params":{"name":"search","arguments":{"q":"stateless"}}} - Drop the sticky-session config. With no session affinity requirement, your load balancer just round-robins. A minimal NGINX upstream is all you need.
upstream mcp_pool { server 10.0.0.11:8080; server 10.0.0.12:8080; server 10.0.0.13:8080; } server { location /mcp { proxy_pass http://mcp_pool; proxy_set_header Authorization $http_authorization; } } - Return a task for anything slow. Hand back a task handle instead of blocking, and let the client poll
tasks/get.// tool result {"content":[{"type":"task","taskId":"tsk_92f1","status":"working"}]} // client follow-up {"jsonrpc":"2.0","id":2,"method":"tasks/get", "params":{"taskId":"tsk_92f1"}} - Ship an MCP App for interactive steps. Return a UI resource; the host sandboxes it and relays events over the postMessage bridge.
{"content":[{ "type":"resource", "resource":{ "uri":"ui://approve/deploy", "mimeType":"text/html+mcp", "text":"<form data-mcp-action='approve'><button>Ship it</button></form>" } }]} - Wire up OAuth/OIDC. Advertise your resource metadata so clients discover the authorization server, then validate scoped tokens on each request.
GET /.well-known/oauth-protected-resource HTTP/1.1 Host: tools.example.com { "resource": "https://tools.example.com/mcp", "authorization_servers": ["https://auth.example.com"], "scopes_supported": ["tools.read", "tools.write"] }
How it compares
| Capability | MCP 2026-07-28 | Earlier MCP (session-based) | Plain REST + custom glue |
|---|---|---|---|
| Load balancing | Stateless, any replica, no affinity | Sticky session required | Stateless, but bespoke per tool |
| Interactive UI | MCP Apps in sandboxed iframe | Per-client custom extension | Build and host your own |
| Long-running jobs | Standard Tasks extension | Ad hoc polling / timeouts | Roll your own job API |
| Authorization | OAuth 2.1 / OIDC in spec | Loosely defined | Whatever you wire up |
| Cross-host portability | High — one server, many hosts | Moderate | None — you own every client |
What’s next
Expect a fast follow in the SDKs. The reference TypeScript and Python SDKs gate adoption — once they ship stateless transport helpers, a Tasks store abstraction, and an Apps renderer, most teams will migrate within a release cycle. Host support will land unevenly: the desktop and IDE clients will likely enable Apps and Tasks before every third-party host does, so plan a capability-negotiation fallback where a server degrades gracefully to plain text when a host doesn’t advertise apps or tasks.
The stateless model pushes state somewhere — usually a shared cache or database keyed by the auth subject. The interesting near-term work is patterns for that: idempotency keys on tool calls, short-lived result caches so a retried request doesn’t re-run an expensive job, and task stores backed by Redis or a queue. Community middleware will standardize these quickly, because everyone deploying more than one replica hits the same wall.
Longer term, Apps plus Tasks hint at genuinely agentic products: a tool kicks off a long job, streams progress into a live App view, and asks for human approval mid-flight — all through one protocol, portable across hosts. The 2026-07-28 revision is the foundation for that. Watch the roadmap for streaming task output, richer App capabilities like file pickers, and tighter OIDC federation for enterprise SSO.
Frequently Asked Questions
Do I have to rewrite my existing MCP server for the 2026-07-28 spec?
Not immediately. Hosts negotiate the protocol version at initialize, so an older session-based server keeps working with hosts that still support it. To get the load balancing and auth benefits, you’ll move to the stateless transport, which mainly means removing your in-memory session store and authenticating each request from its token.
What breaks when I go stateless?
Anything that assumed the same process handles every request in a conversation. Move per-user or per-conversation state into a shared store keyed by the OAuth subject, and make tool calls idempotent so retries across replicas are safe. Use idempotency keys or a short result cache for expensive operations.
Are MCP Apps a security risk?
They’re designed to limit it. MCP Apps interactive UI runs in a sandboxed iframe with no direct access to the host’s DOM or credentials, communicating only through a narrow, audited postMessage bridge. Treat App HTML as untrusted content and keep the sandbox restrictive, but the model is far safer than shipping arbitrary client plugins.
When should I use the MCP Tasks extension versus a normal tool call?
Use a normal call for anything that returns in a couple of seconds. Reach for the MCP Tasks extension when work can exceed a request timeout or needs progress reporting — batch exports, deployments, long renders, multi-step pipelines. The client gets a handle immediately and polls or subscribes for the result.
Does MCP OAuth OIDC authorization require a specific provider?
No. The spec builds on standard OAuth 2.1 and OIDC discovery, so any compliant authorization server — Auth0, Okta, Keycloak, Entra ID, or your own — works. Your MCP server acts as a resource server that validates scoped tokens per request and publishes resource metadata for discovery.
Will this work on serverless platforms?
Yes, and that’s much of the point. The stateless transport carries all context per request and MCP server load balancing needs no session affinity, so MCP servers deploy cleanly on Cloud Run, Lambda-style functions, and autoscaling container platforms. Pair it with a shared task store and cache, and you have a production-grade, horizontally scalable agent backend.
Go deeper than this article
This article covers the essentials. Our Technical & Coding eguide collection gives you the full step-by-step playbooks — prompts, workflows, and copy-paste recipes built for exactly this work.
