The Model Context Protocol just went through its biggest architectural overhaul since it launched. The 2026-07-28 release candidate moves MCP to a stateless core — dropping persistent sessions, deprecating Roots, Sampling, and Logging, and introducing MCP Apps, Tasks, and tightened OAuth requirements. If you run AI agents that pull company context over MCP, you need to understand what this means before the deadline hits.
What changed: sessions are gone
The headline change is straightforward: MCP is becoming stateless at the protocol layer. Previously, MCP relied on persistent sessions — a client would connect to a server, establish a session, and maintain state across multiple interactions. That model is being replaced by a stateless core where each request is self-contained.
According to Developers Digest's breakdown of the spec, the 2026-07-28 revision is the largest since launch and includes:
- Stateless protocol core — no more persistent session state at the transport layer
- Deprecated primitives — Roots, Sampling, and Logging are being removed
- MCP Apps — a new formalization for how agents package and deploy capabilities
- Tasks — a structured primitive for long-running, async operations
- Tougher OAuth — stricter authorization requirements across the board
Medium's analysis frames it plainly: MCP killed the session, and that matters more than it might first appear.
Why going stateless is actually the right call
Persistent sessions were a pragmatic early choice, but they created real production headaches. Any server that held session state became a bottleneck. Horizontal scaling required sticky sessions or shared state stores. A dropped connection meant lost context. For developers running MCP servers at any meaningful scale, session management was the tax you paid just to keep things working.
Stateless design eliminates that tax. Each request carries everything the server needs to respond. You can scale MCP servers horizontally without coordination overhead. Requests can be routed to any instance. Recovery from failure is trivial — there is no session to restore.
The New Stack's coverage of the 2026 MCP roadmap notes that production scaling and reliability were among the biggest pain points the community flagged. Stateless design directly addresses both.
The tradeoff is that anything relying on implicit session state now has to be explicit. If your agent workflow assumed the server remembered something from a previous call, that assumption breaks.
What actually breaks in your current setup
For teams running MCP servers today, the practical impact depends on how much your implementation leaned on session state.
If you built stateless servers already, the migration is mostly additive — adopt Tasks for async work, update OAuth flows, remove deprecated primitives.
If your servers hold session state, you have real migration work. Specifically:
- Any server-side context accumulated across calls needs to move client-side or into an explicit context store
- Workflows that relied on Sampling or Roots need to be rewritten
- Logging integrations built on the deprecated MCP Logging primitive need new plumbing
- OAuth implementations need to meet the new stricter requirements
The Developers Digest migration checklist is the most concrete public resource for server authors working through this. The deadline is July 28.
What MCP Apps and Tasks actually give you
The new primitives are worth understanding on their own terms, not just as replacements for what's being removed.
MCP Apps formalize how agent capabilities are packaged and distributed. Think of them as a standardized unit of deployment — a way to describe what a server does, what it needs, and how clients should interact with it. This matters for teams managing multiple MCP servers across different data sources, because it creates a common interface for discovery and configuration.
Tasks are the answer to a real gap in the original spec: long-running operations. If an agent needs to kick off a process that takes minutes rather than milliseconds — running a report, indexing a large document set, waiting on an external API — there was no clean way to handle that asynchronously. Tasks provide a structured primitive for exactly this pattern: start a job, get a task ID, poll or receive a callback when it's done.
For business context use cases — where an agent might need to pull and synthesize data across multiple sources — Tasks are a meaningful improvement over the previous workarounds.
What this means for your company context layer
Here is where the architectural shift has direct implications for how AI agents access company knowledge.
A business context layer for AI — the kind that ingests data from Slack, Gmail, Notion, Google Drive, HubSpot, Salesforce, and similar tools and exposes it as MCP servers — sits exactly at the intersection of this change. The stateless shift affects how that layer is architected and how agents consume it.
The key design implication: context must travel with the request, not live on the server. Under the old session model, a server could accumulate context about a user's session over time — what they'd asked before, what permissions had been checked, what data had already been fetched. That pattern is gone. The context layer now needs to be designed so that each request is fully contextualized from the start.
This is actually a better model for company context. It means:
- Permissions are evaluated per-request, not assumed from session state. Every call carries the right access scope.
- Source citations travel with the response, because there is no ambient session to reconstruct provenance from.
- Indexing and retrieval are decoupled from connection state, which makes the knowledge base itself more reliable and easier to scale.
Gyld's architecture — where company knowledge is exposed as MCP servers with per-request permissioning and source citations — is well-aligned with where the protocol is heading. The stateless model reinforces the principle that context should be explicit, permissioned, and traceable, not implicit and session-bound.
A practical migration checklist
If you are running MCP servers that connect to business data, here is what to work through before July 28:
- Audit for session state. Identify any server-side state that accumulates across calls. Document what it holds and why.
- Move context client-side or into an explicit store. Anything the server currently remembers needs to be sent with each request or fetched from a durable store on demand.
- Remove Roots, Sampling, and Logging usage. Replace with the current alternatives — the spec docs cover the migration paths.
- Update OAuth flows. Review the new requirements and validate your implementation against them.
- Adopt Tasks for async work. Any long-running operation that currently blocks a connection should be refactored to use the Tasks primitive.
- Test against the release candidate spec. Don't wait for final release — the RC is the target.
Stateless vs stateful MCP: a quick comparison
| Dimension | Stateful (old) | Stateless (new) |
|---|---|---|
| Scaling | Sticky sessions or shared state store required | Horizontal scaling with no coordination |
| Failure recovery | Session loss means context loss | Each request is self-contained |
| Context handling | Accumulated server-side over session | Must be explicit in each request |
| Permission model | Can be checked at session start | Evaluated per-request |
| Long-running ops | Blocking or custom workarounds | First-class Tasks primitive |
| Migration cost | Low if already stateless | Requires refactor if session-dependent |
Key takeaways
- The 2026-07-28 MCP spec removes persistent sessions and moves to a stateless core — the largest protocol change since launch
- Roots, Sampling, and Logging are deprecated; MCP Apps and Tasks are the new primitives to adopt
- Stateless design is better for production scale, but anything relying on session state needs to be refactored before July 28
- For company context layers, stateless MCP reinforces per-request permissioning and explicit source citations — a cleaner model for business data
If you want AI agents that can actually answer questions about your business — what was promised to a customer, what the current pipeline looks like, what the team decided last week — the context layer needs to be built for how MCP works now, not how it worked at launch. Start building your company brain with Gyld and connect the apps your team already uses to the agents you're deploying.
Frequently asked questions
What is the MCP stateless protocol change in 2026?
The 2026-07-28 MCP specification removes persistent sessions from the protocol core, making every client-server interaction self-contained. Each request must carry all the context the server needs to respond. This is the largest architectural change to the Model Context Protocol since it launched.
What MCP primitives are being deprecated in the 2026-07-28 spec?
Roots, Sampling, and Logging are all being deprecated in the 2026-07-28 release candidate. Server authors using these primitives need to migrate to current alternatives before the July 28 deadline.
What are MCP Tasks and why do they matter?
Tasks are a new first-class primitive in the 2026 MCP spec for handling long-running, asynchronous operations. Instead of blocking a connection while waiting for a slow operation to complete, an agent can start a Task, get an ID, and poll or receive a callback when it finishes. This matters for business data workflows where fetching and synthesizing information across multiple sources takes meaningful time.
How does the stateless change affect company context layers built on MCP?
Context layers that expose business data as MCP servers need to ensure that permissions, identity, and retrieval context are fully specified in each request rather than accumulated in session state. This is actually a better model for business data — it makes permissioning explicit per-call and ensures source citations travel with every response rather than being inferred from session history.
Do I need to rebuild my MCP server before July 28, 2026?
If your server is already effectively stateless and doesn't use Roots, Sampling, or Logging, your migration is mostly additive — adopt Tasks, update OAuth, and align with the MCP Apps format. If your server holds session state or relies on deprecated primitives, you have real refactoring work to complete before the deadline. The Developers Digest migration checklist is the most detailed public guide available.