代理工具
MCP 2026-07-28 Removes Handshake and Sessions as Remote Tool Servers Move to Stateless Requests
The new MCP places the protocol version, capabilities, and client information in every request, removing the `initialize` handshake and `Mcp-Session-Id`. This simplifies horizontal scaling but introduces a breaking change that requires coordinated upgrades to clients, servers, and gateway rules.
The official 2026-07-28 Model Context Protocol specification makes the core transport stateless: the initialize/initialized handshake and Mcp-Session-Id have both been removed, while the protocol version, client capabilities, and identification data are now included in the _meta field of every JSON-RPC request. Servers must implement server/discover, allowing clients to query versions and capabilities in advance. Streamable HTTP additionally requires the Mcp-Method and Mcp-Name headers, enabling load balancers, rate limiters, and API gateways to route requests without parsing the JSON body.
For operations teams, remote MCP servers no longer depend on sticky sessions or a shared session store for protocol sessions. Applications that need to preserve state across calls must instead have tools explicitly generate a handle, which the model passes back in subsequent parameters. This improves observability and composability, while returning responsibility for handle authorization, lifecycle management, and leakage risks to the application layer.
Long-running workflows have also been redesigned. Tasks has moved from the core protocol to an independently versioned extension and now uses tasks/get, tasks/update, and tasks/cancel. When a server requires additional information, it first returns an InputRequiredResult; after collecting the input, the client resends the original request. Tool schemas have also been upgraded to full JSON Schema 2020-12, with support for composition, conditionals, and $ref. Implementers must, however, limit schema depth and validation time to prevent malicious schemas from consuming excessive resources.
This is not merely a version-string change. Legacy Tasks behavior, error codes, HTTP GET subscriptions, and initialization flows all present compatibility risks; Roots, Sampling, and Logging have also been marked as deprecated. Engineering teams should first test both endpoints with the official conformance suite, then plan a phased migration and verify that OAuth iss validation, cache scope, and tracing fields are not lost along the proxy chain.