Model Context Protocol adopts stateless core in landmark July 2026 update

Model Context Protocol stateless architecture Multi Round‑Trip Requests authorization enhancements SDK downloads

Anthropic released the fifth version of the Model Context Protocol (MCP) on 28 July 2026. The new specification removes the historic initialize/initialized handshake and the Mcp‑Session‑Id header, making the protocol stateless so that each request carries all required metadata. This change allows MCP servers to run behind ordinary load balancers and simplifies deployment on server‑less, edge, and cloud environments.

The update also introduces Multi Round‑Trip Requests (MRTR) to replace the previous server‑pushed elicitation pattern, adds mandatory HTTP headers Mcp‑Method and Mcp‑Name for routing and rate‑limiting, and strengthens authorization by requiring RFC 9207 issuer verification. The older HTTP+SSE transport is deprecated with a one‑year migration window. Monthly SDK downloads for MCP now approach half a billion, reflecting broad adoption across major platforms such as Amazon Bedrock, AWS, Cloudflare, Microsoft, and others.

Industry leaders including David Soria Parra highlighted the release as the most significant MCP change since its introduction. Early adopters have already enabled the new version in gateways like Amazon Bedrock AgentCore, confirming compatibility and the expected scalability benefits.

Entities

Agentic AI Foundation · Amazon Web Services · Anthropic · Anthropic PBC · David Soria Parra · Health-ISAC · Health‑ISAC · Microsoft · Model Context Protocol · Model Context Protocol (MCP) · Wiz

Claims

What the coverage asserts, and how many sources carry each claim.

[○ 1 SOURCE] The MCP update improves the authorization mechanism that regulates AI applications’ access to external systems. siliconangle.com
[○ 1 SOURCE] Roughly 10 % of exposed MCP servers expose a sensitive backend. www.wiz.io
[○ 1 SOURCE] AI and MCP servers reachable from the internet became a new attack surface for the health sector in Q2 2026. healthsystemcio.com
[○ 1 SOURCE] The latest MCP update replaces the handshake workflow with a stateless protocol core that embeds metadata directly into requests. siliconangle.com
[○ 1 SOURCE] Approximately 70 % of exposed MCP servers return their full tool catalog to an anonymous caller. www.wiz.io
[○ 1 SOURCE] Around 42 % of exposed MCP servers return real data when a tool is called. www.wiz.io
[○ 1 SOURCE] MCP is present in roughly 80 % of cloud environments. www.wiz.io
[○ 1 SOURCE] Health‑ISAC sent 193 Targeted Alerts during the quarter, including 92 alerts about misconfigured or dangling DNS records. healthsystemcio.com
[○ 1 SOURCE] MCP monthly SDK downloads have reached about 400 million. www.news9live.com
[● 3 SOURCES] The new MCP specification shifts to a stateless request/response model and removes protocol‑level sessions. www.news9live.com · tech-noisy.com · gigazine.net
[○ 1 SOURCE] David Soria Parra said the 2026‑07‑28 release is the most important MCP release since the remote MCP introduction. tech-noisy.com
[● 3 SOURCES] The specification introduces Multi Round‑Trip Requests (MRTR) for obtaining additional user input. www.news9live.com · tech-noisy.com · gigazine.net