MCP's 2026-07-28 spec goes stateless, drops Mcp-Session-Id

The specification arrives less than a week before the author wrote the piece on 2026-08-03, and the account is drawn from MCP's own blog and Anthropic's Claude blog. The old design assumed a client and a server process stayed connected for the whole conversation, which worked fine for local stdio connections but clashed with the stateless principle familiar from 12-Factor App guidance once operators tried to run MCP servers as redundant cloud workloads. The new spec also adds two headers, Mcp-Method and Mcp-Name, so gateways and firewalls can route and authorize tool calls without parsing the JSON body — a change the author, writing from a financial-services web background, treats as a security and performance gain. Alongside that, authentication moves toward CIMD (Client ID Metadata Documents) and RFC 9207 issuer validation, which the author frames as making MCP easier to attach to existing identity providers such as Entra or Okta. Deprecated items — Roots, Sampling, Logging, DCR and the legacy HTTP+SSE transport — get a minimum 12-month window, which the author reads as time to migrate off them rather than time to keep using them.