KDCube
← AI Industry News

MCP Ships Stateless as Final Spec, and AgentCore Turns It On

The MCP 2026-07-28 spec is final today: a stateless core drops the initialize handshake and session header, Tier-1 SDKs ship support now, and Roots/Sampling/Logging are only deprecated with a 12-month runway. AWS turned it on in AgentCore Gateway via one UpdateGateway call, while Kimi K3's new...

Highlights

  • The MCP 2026-07-28 specification is published as final today — a stateless request/response core that retires the initialize handshake and the Mcp-Session-Id header, letting requests land on any server instance behind a plain round-robin load balancer. (Model Context Protocol)
  • Contrary to the "features vanish tomorrow" framing of recent days, Roots, Sampling, and Logging are deprecated — not deleted — with "at least twelve months" before removal, and legacy HTTP+SSE gets the same courtesy. (Model Context Protocol)
  • AgentCore Gateway supports the new spec today, opt-in via a single UpdateGateway call, with inbound IAM (SigV4) or OAuth/JWT auth left unchanged. (AWS)
  • Anthropic is rolling MCP 2026-07-28 across Claude products and its connectors directory — no committed dates, but the stateless core is the on-ramp. (Claude)

Key Signals

  1. The stateless spec is final, and the SDKs are the story — 2026-07-28

    All four Tier-1 SDKs (TypeScript, Python, Go, C#) support the final spec immediately, with the Rust SDK in beta — so the beta-testing window builders had this week closes into GA rather than a cliff. New in the core: Multi Round-Trip Requests (MRTR) carry server-to-client prompts like user confirmations without an open bidirectional stream, and authorization hardens with RFC 9207 issuer validation plus a shift from Dynamic Client Registration toward Client ID Metadata Documents (CIMD). (Model Context Protocol)

  2. Sessions become someone else's problem — in a good way — AWS, 2026-07-28

    With Mcp-Session-Id gone, remote MCP servers "become standard HTTPS endpoints, which scale cleanly with enterprise workloads," killing the need for sticky routing or a shared session store. AgentCore Gateway ships this backward-compatibly today; existing gateways keep working, and the upgrade is a single API call. (AWS)

  3. Kimi K3's license is finally on the table — The New Stack, ~2026-07-27

    The elephant from this week's open-weights drop — the unpublished license — now reads as free use with commercial deals required for large providers, shipping as ~1.56 TB across 96 shards. The 2.8T-parameter model is open, but the footprint still means clouds and large enterprises operationalize it first. (The New Stack) (Hugging Face)

Why It Matters / What To Watch

  1. Re-plan your MCP migration around a window, not a deadline.
    • The 12-month deprecation clock on Roots/Sampling/Logging means you can ship stateless now and retire those capabilities on your own schedule — don't rip them out this week. (Model Context Protocol)
    • If you run remote servers, drop sticky-session infra and CIMD-align your auth; the beta SDKs you tested are now the GA path. (Model Context Protocol)
  2. Managed platforms are absorbing the protocol churn.
    • On AgentCore, flip to the new spec with UpdateGateway and verify auth is untouched before assuming behavior changes. (AWS)
    • For Claude connectors, watch for rollout notes rather than a hard date, and re-test tool calls against the stateless transport. (Claude)
  3. Open weights ≠ open access.
    • Before betting on self-hosted Kimi K3, price the ~1.56 TB / 96-shard footprint and read the commercial-deal clause for provider-scale use. (The New Stack) (Hugging Face)

Quick Links