MCP drops sessions in 2026-07-28 spec, David Soria Parra leads

The problem the new spec addresses is familiar to anyone who has run a remote MCP server on more than one machine. A session ID issued by the first instance is unknown to the second, so operators have relied on sticky sessions, a shared session store, or a gateway that inspects the request body. The 2026-07-28 spec removes that handshake layer, and the new Mcp-Method and Mcp-Name headers let gateways and rate limiters decide how to route a call without opening the payload. In place of transport-level state, tools return explicit handles such as basket_id or browser_id that the model carries forward as ordinary arguments. The same revision adds ttlMs and cacheScope to list responses, which tells clients how long a tool list stays fresh and whether it can be shared across users. It also deprecates Roots, Sampling, and Logging under SEP-2577, keeps them working for at least a year, and moves long-running Tasks out of the core into an Extension driven by tasks/get, tasks/update, and tasks/cancel, with tasks/list removed. A new Extensions framework negotiates capabilities by reverse-DNS ID, and the first official Extension is MCP Apps (SEP-1865) for server-rendered UI. Whether the transition goes smoothly is likely to depend on how quickly custom implementations absorb the changes, given Parra's own warning about the effort involved and Stacklok's caution that fallback or translation layers may be needed. How much the rewrite actually spreads may hinge on that migration burden and on whether operators treat the deprecated features as a temporary bridge.