AI 標準與代理基礎設施
MCP 2026-07-28 Removes Handshake and Sessions as Remote Tool Servers Move to Stateless Requests
The new MCP places the protocol version, capabilities, and client information in every request, removing the `initialize` handshake and `Mcp-Session-Id`. This simplifies horizontal scaling but introduces a breaking change that requires coordinated upgrades to clients, servers, and gateway rules.
The official `2026-07-28` Model Context Protocol specification makes the core transport stateless: the `initialize`/`initialized` handshake and `Mcp-Session-Id` have both been removed, while the protocol version, client capabilities, and identification data are now included in the `_meta` field of every JSON-RPC request. Servers must implement `server/discover`, allowing clients to query versions and capabilities in advance. Streamable HTTP additionally requires the `Mcp-Method` and `Mcp-Name` headers, enabling load balancers, rate limiters, and API gateways to route requests without parsing the JSON body.
For operations teams, remote MCP servers no longer depend on sticky sessions or a shared session store for protocol sessions. Applications that need to preserve state across calls must instead have tools explicitly generate a handle, which the model passes back in subsequent parameters. This improves observability and composability, while returning responsibility for handle authorization, lifecycle management, and leakage risks to the application layer.
Long-running workflows have also been redesigned. Tasks has moved from the core protocol to an independently versioned extension and now uses `tasks/get`, `tasks/update`, and `tasks/cancel`. When a server requires additional information, it first returns an `InputRequiredResult`; after collecting the input, the client resends the original request. Tool schemas have also been upgraded to full JSON Schema 2020-12, with support for composition, conditionals, and `$ref`. Implementers must, however, limit schema depth and validation time to prevent malicious schemas from consuming excessive resources.
This is not merely a version-string change. Legacy Tasks behavior, error codes, HTTP GET subscriptions, and initialization flows all present compatibility risks; Roots, Sampling, and Logging have also been marked as deprecated. Engineering teams should first test both endpoints with the official conformance suite, then plan a phased migration and verify that OAuth `iss` validation, cache scope, and tracing fields are not lost along the proxy chain.