● Covered by 6 sources · 8 reportsMedium impact1 negative7 neutral
Model Context Protocol (MCP) 2026-07-28 Specification Released, Adopting Stateless Core
Key points
- MCP 2026-07-28 specification introduces a stateless protocol core.
- Changes improve reliability and scalability for MCP servers.
- Multi Round-Trip Requests and header-based routing are new features.
- Updated Tier 1 SDKs (TypeScript, Python, C#) are available.
- Amazon Bedrock AgentCore's AgentCore Gateway supports the new spec.
- 21,000 internet-facing MCP server instances are exposed.
- 92% of audited production servers lack basic OAuth authentication.
- The OWASP MCP Top 10 has been formalized.
- The MCP Dev Summit is in Seoul on August 13–14, 2026.
- OX Security's 'Mother of All AI Supply Chains' report identified a systemic architectural vulnerability in MCP STDIO transport.
Stateless Core for Enhanced Scalability
The Model Context Protocol (MCP) has released its 2026-07-28 specification, marking a significant shift from a bidirectional stateful protocol to a request/response stateless core. This change is intended to improve the reliability and scalability of MCP servers, a feature frequently requested by developers. The previous stateful design required managing request routing to sticky sessions and holding open streams, which added overhead and complexity for remote MCP servers.
Key Protocol Changes and Features
The 2026-07-28 specification introduces several new features, including Multi Round-Trip Requests, header-based routing, and cacheable list results. It also includes authorization hardening, aligning more closely with enterprise practices for OAuth 2.0 and OpenID Connect, and establishes a formal extensions framework. The new protocol removes the handshake and session header, allowing any request to land on any instance, which simplifies load balancing and horizontal scaling.
SDK Updates and Industry Adoption
Accompanying the specification release are updated Tier 1 SDKs for TypeScript, Python, and C#. The C# SDK, now at v2.0, implements the 2026-07-28 revision and builds on ASP.NET Core for routing, middleware, and load balancing. Amazon Bedrock AgentCore's AgentCore Gateway now supports the new MCP version, allowing users to update their gateways to utilize the revised protocol. Existing clients remain backward compatible.
Impact on Agentic Workflows and Enterprise Adoption
MCP has seen substantial growth, with its TypeScript and Python SDKs collectively exceeding 1 billion total downloads. The protocol serves as a data and interactivity substrate for agentic workflows. The move to a stateless core is expected to address long-standing barriers to scalability, potentially removing a significant obstacle to enterprise AI adoption by simplifying server deployment and reducing operational overhead.
Updates
- 21,000 internet-facing MCP server instances are exposed.
- 92% of audited production servers lack basic OAuth authentication.
- The OWASP MCP Top 10 has been formalized.
- The MCP Dev Summit is in Seoul on August 13–14, 2026.
- OX Security's 'Mother of All AI Supply Chains' report identified a systemic architectural vulnerability in MCP STDIO transport.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub modelcontextprotocol/modelcontextprotocol GitHub modelcontextprotocol/typescript-sdk GitHub modelcontextprotocol/python-sdk GitHub modelcontextprotocol/go-sdk GitHub modelcontextprotocol/csharp-sdk GitHub modelcontextprotocol/rust-sdkHow outlets covered it
Over 21,000 internet-facing Model Context Protocol (MCP) server instances are exposed, with 92% of audited production servers lacking basic OAuth authentication, according to new research. This vulnerability landscape, coupled with critical CVEs and the OWASP MCP Top 10, has made the upcoming MCP Dev Summit in Seoul a critical meeting to address systemic security issues in the protocol.
The MCP 2026-07-28 specification removes protocol sessions, allowing for better scaling and load balancing of agent traffic. This change introduces two mandatory HTTP headers, Mcp-Method and Mcp-Name, which enable gateways to route, throttle, and meter agent traffic without parsing the request body.
The Model Context Protocol (MCP) has released its 2026-07-28 specification, transitioning from a stateful to a fully stateless protocol. This change simplifies server deployment and reduces operational overhead for developers using MCP.
A method was developed to connect cloud-hosted AI agents, specifically those on Amazon Bedrock AgentCore, with local tools and data using the Model Context Protocol (MCP). This allows AI agents to interact with user-specific local files, such as spreadsheets, which is relevant for financial professionals. The solution involves tunneling MCP messages over WebSocket and native messaging to bridge the remote client and local server.
The Model Context Protocol (MCP), an open-source standard for AI system interaction with external tools, received its largest update, making its protocol core stateless. This change addresses scalability and reliability issues, potentially removing a significant barrier to enterprise AI adoption.
The Model Context Protocol (MCP) C# SDK has been updated to v2.0, incorporating the 2026-07-28 revision of the MCP specification. This revision makes the protocol stateless by default, standardizes the HTTP surface, and introduces Multi Round-Trip Requests, which simplifies routing and horizontal scaling for MCP over HTTP workloads.
The Model Context Protocol (MCP) released its 2026-07-28 specification, making the protocol stateless and scalable on HTTP infrastructure. AgentCore Gateway, a component of Amazon Bedrock AgentCore, now supports this new version, allowing users to update their gateways to utilize the revised protocol.
The Model Context Protocol (MCP) 2026-07-28 specification has been released, transitioning the protocol from a bidirectional stateful model to a request/response stateless core. This change aims to improve reliability and scalability for MCP servers, addressing a highly requested developer feature.