Anthropic unveils major stateless update to Model Context Protocol (MCP 2026‑07‑28)
Anthropic announced the fifth release of its open Model Context Protocol (MCP), version 2026‑07‑28. The specification replaces the previous state‑ful initialize/initialized handshake with a fully stateless request‑response model, removing the need for protocol‑level sessions and the Mcp‑Session‑Id header. These changes allow MCP servers to be placed behind standard load balancers and run on cloud, edge or serverless environments.
The update also tightens security by mandating RFC‑9207 issuer verification for authorisation, adds an official extensions framework, and introduces Multi Round‑Trip Requests (MRTR) that let servers request additional user input without maintaining a session. New mandatory HTTP headers (Mcp‑Method and Mcp‑Name) enable routing, rate‑limiting and firewall rules without parsing request bodies. The older HTTP+SSE transport is marked for deprecation, with a one‑year migration window.
Anthropic reported that the MCP ecosystem now sees roughly 400 million monthly SDK downloads, and co‑inventor David Soria Parra called the release the most important since the protocol’s remote‑MCP debut.
Entities: Anthropic · Claude · Cloudflare · David Soria Parra · Model Context Protocol
Claims
What the coverage asserts, and how well corroborated each claim is across sources.
- [○ 1 SOURCE] MCP monthly SDK downloads have reached about 400 million. (Anthropic claim)
- [● 3 SOURCES] The new MCP specification shifts to a stateless request/response model and removes protocol‑level sessions. (Anthropic documentation)
- [○ 1 SOURCE] David Soria Parra said the 2026‑07‑28 release is the most important MCP release since the remote MCP introduction. (Co‑inventor comment)
- [● 3 SOURCES] The specification introduces Multi Round‑Trip Requests (MRTR) for obtaining additional user input. (Specification overview)
- [● 3 SOURCES] Anthropic released the fifth specification of the Model Context Protocol, version 2026‑07‑28. (Anthropic press release)
- [○ 1 SOURCE] The update strengthens authorization by requiring RFC 9207 issuer verification. (Specification details)
- [● 2 SOURCES] New mandatory HTTP headers Mcp‑Method and Mcp‑Name are required for routing and rate‑limiting. (Specification details)
- [○ 1 SOURCE] The older HTTP+SSE transport is deprecated with a one‑year migration period. (Spec release notes)