MCP's 2026-07-28 release candidate (dubbed MCP 2.0) makes a deliberate breaking change: it removes the session entirely. Gone are the initialize handshake, Mcp-Session-Id, GET SSE endpoint, resumable streams, resources/subscribe, and more. The core becomes stateless — every request is self-describing, carrying protocol version and client capabilities in _meta and a mandatory MCP-Protocol-Version header. State that used to live in sessions now travels as explicit IDs in tool arguments (e.g., basket_id, issue_id), which is how most real-world servers already behave. Analysis of 1,000 open-source MCP servers shows 90% never used session IDs at all. The release also introduces: a Multi Round-Trip Request pattern replacing held-open SSE streams for mid-call questions; an extensions framework with namespaced capabilities for shipping experimental features outside core; a rebuilt Tasks API demoted to an extension after production feedback; sandboxed UI rendering via ui:// scheme in iframes; six OAuth 2.1 hardening changes; and operational improvements like W3C Trace Context, Mcp-Method/Mcp-Name headers, improved caching with ttlMs/cacheScope, and a formal deprecation policy with a 12-month floor. Migration impact varies: stdio-only servers need a dependency bump, gateway-backed servers need real work, and experimental Tasks users face a rewrite.
