The MCP Protocol Just Locked an 11-Day Breaking Change — and Every MCP Server TTL Operates Has to Migrate
The 2026-07-28 release candidate crystallized the biggest Model Context Protocol revision since launch. Six breaking changes land in 11 days: stateless core (the initialize/initialized handshake and Mcp-Session-Id header are gone), two new required HTTP headers (Mcp-Method and Mcp-Name), a JSON-RPC error-code migration from -32002 to -32602, hardened cache semantics, a W3C trace-context lockdown, and a formal 12-month deprecation window for Roots, Sampling, and Logging. Sprint math: 11 days ÷ 6 breaking changes = 1.83 days per migration. With the 2-day Tier-1 SDK validation buffer, the working budget is 2.17 days per migration. Every MCP server a small lab operates needs an audit pass before the spec ships.
Five Numbers That Define the Day
Sprint math is shown inline where a headline number is derived from a calendar window.
Pattern #12 — Graduates vs Deprecations
Stable-vs-deprecated within the same spec. Green = graduates or stays stable. Red = formal deprecation or removal. The bifurcating frame turns a calendar deadline into a concrete per-feature checklist.
What locks into the canonical protocol
| Feature | Status | Replacement / detail | Timeline |
|---|---|---|---|
| Tasks (SEP-1686) | experimental → extension | tools/call returns a handle; client drives tasks/get, tasks/update, tasks/cancel | locked in RC |
| Stateless core | stable | initialize/initialized handshake removed; Mcp-Session-Id header removed; any server instance can answer any request | shipped in RC |
| Explicit-handle pattern | stable | Tools return identifiers (basket_id, browser_id); the model threads them back as arguments. State becomes visible to the model, not hidden in server-side storage | formal in RC |
| OAuth 2.1 + OIDC (6 SEPs) | stable | RFC 9207 issuer validation; Dynamic Client Registration with application_type; credential binding to issuer; refresh-token guidance; scope step-up accumulation; .well-known discovery | locked in RC |
| MCP Apps (SEP-1865) | graduate | Server-rendered HTML UIs in sandboxed iframes; tools declare templates so hosts can prefetch, cache, and security-review before render | ships in RC |
| JSON Schema 2020-12 | stable | Composition (oneOf/anyOf/allOf), conditionals (if/then/else), and schema references ($ref) are now first-class | locked in RC |
What gets cut, obsoleted, or put on a 12-month clock
| Feature | Status | Replacement / detail | Timeline |
|---|---|---|---|
| Sticky-session routing | obsolete | Stateless core means any server instance can answer. Round-robin load balancers replace session affinity | immediate (RC) |
| L7 DPI on session | obsolete | No Mcp-Session-Id to inspect; gateway routing moves to Mcp-Method and Mcp-Name headers | immediate (RC) |
| Roots | deprecated | Move filesystem-scope negotiation to a host-owned declaration surface; no server-side API replacement | ≥12 months · mid-2027 |
| Sampling | deprecated | Server-initiated model completions are replaced by client-driven tool calls + handles | ≥12 months · mid-2027 |
| Logging | deprecated | Server-to-client log shipping replaced by structured out-of-band telemetry | ≥12 months · mid-2027 |
tasks/list | removed | No session = no safe cross-instance listing. Clients track task handles themselves | immediate (RC) |
Custom error code -32002 | removed | "Resource not found" migrates to the standard JSON-RPC -32602 "Invalid Params" | immediate (RC) |
tasks/list removal are immediate; Roots, Sampling, and Logging have a window to design replacements before mid-2027.MCP Apps (SEP-1865) — Template → Prefetch → Render
The new UI surface ships a three-step lifecycle so hosts can security-review before anything renders.
Sprint Math — How the 11-Day Window Translates
The headline budget is the calendar divided by the audit checklist. Two flavors: tight (just the 11 days) and SDK-aware (13 days including the 2-day Tier-1 SDK validation buffer).
-32002 error-code references to -32602, (d) designs replacements for Roots, Sampling, and Logging before mid-2027, and (e) pins Tier-1 SDKs to RC-supporting versions. Without an SDK that has RC support, the migration plan is not shippable.Six Moves for Builder Teams This Week
What changes in code, in deployment, and in operations before the spec ships.
Audit every production MCP server for session-store dependencies
Any code path that relies on Mcp-Session-Id, session affinity, or server-side session storage is a regression. Stateless core means no session = no problem, but the migration has to land before the spec ships.
Add the two new HTTP headers end-to-end
Mcp-Method carries the JSON-RPC method. Mcp-Name carries the tool or resource identifier. Servers reject requests where the headers and body disagree. Update SDK clients, gateway routing, and any custom middleware.
Plan the explicit-handle migration for stateful tools
Tools that need continuity return a handle. The model threads the handle back as an argument on the next call. State moves from server-side storage into the conversation context — visible, debuggable, and horizontally scalable.
Migrate -32002 to -32602 across error-handling paths
"Resource not found" is no longer a custom error code. It moves to the standard JSON-RPC -32602 "Invalid Params." Any test, alert, or dashboard keyed on the old code needs an update.
Design Roots, Sampling, and Logging replacements before mid-2027
The 12-month window is generous but the design work should start now. Host-owned declaration surfaces replace Roots. Client-driven tool calls replace Sampling. Structured out-of-band telemetry replaces server-to-client log shipping.
Pin Tier-1 SDKs to RC-supporting versions
Python and TypeScript SDKs need to be on versions that speak the new headers, the new error codes, and the stateless core. Do not ship a migration plan against an SDK that does not yet have RC support.
Cross-Channel Convergence
How today's story maps to the channels we already run.
| Story element | Daily Research | Quant | Trending Radar | Scout | Echo |
|---|---|---|---|---|---|
| MCP 2026-07-28 RC (lead) | ✓ primary · 4 sources | — | — | no briefing | no digest |
| Stateless core + explicit handles | ✓ primary | — | — | no briefing | no digest |
| MCP Apps (SEP-1865) sandboxes | ✓ primary | — | — | no briefing | no digest |
| Roots / Sampling / Logging deprecation | ✓ primary | — | — | no briefing | no digest |
| NORTHTEKDevs/genome MCP server | — | — | ✓ signal | no briefing | no digest |
| Fireworks $1.5B / Asia Q2 $42.8B | — | ✓ primary | — | no briefing | no digest |
Tiny Little Lab Read
Mcp-Session-Id. The 2026-07-28 RC makes that entire layer obsolete in a single release. State moves into the conversation context as explicit handles; routing moves to two new HTTP headers; the error code standardizes. The 11-day window is not a research deadline — it is a calendar deadline for production code paths. The teams that audit their MCP server fleets this week and ship before Jul 28 will be running stateless by default. The teams that do not will be patching a deprecated protocol for the next 12 months. Sprint budget: 1.83 days per migration. There is room, but only if the work starts now.