Handshake and session removed
The protocol removes the Mcp-Session-Id header and the initialize handshake. Protocol-level sticky routing is no longer required.
Protocol readiness
The MCP 2026-07-28 release remains a locked release candidate, observed 2026-07-13. The final specification is scheduled for 2026-07-28; this page does not treat it as final before that date.
Protocol changes
The release candidate moves protocol coordination from a session handshake into self-contained requests. Applications may still manage explicit state through ordinary tool arguments.
The protocol removes the Mcp-Session-Id header and the initialize handshake. Protocol-level sticky routing is no longer required.
Protocol version, client identity, and client capabilities move into a _meta object on every request.
Streamable HTTP requests require Mcp-Method andMcp-Name headers alongside the request body.
Lifecycle and extensions
The formal lifecycle supplies at least 12 months between deprecation and removal. Operators still need to identify dependencies and follow later changelogs.
These core features are deprecated under the formal lifecycle; their methods, types, and capability flags remain during the stated deprecation window.
MCP Apps and Tasks are extensions. They remain separate from the stateless protocol core and follow extension-specific lifecycles.
The candidate moves authorization closer to common OAuth and OpenID Connect deployment patterns.
Operator checklist
Work from installed servers to client releases, then keep the official changelog in the operating loop.
Record every installed server, transport, owner, and deployed SDK version before planning a migration.
Identify code, gateways, and tests that depend on Mcp-Session-Id, initialize, or sticky routing.
Check Roots, Sampling, and Logging usage against the formal lifecycle and document any replacement work.
Verify installed client versions and follow official changelogs through the final specification publication.
Client readiness
Checked 2026-07-13. This table starts fail-closed and changes only when a reviewed, client-owner source supports a more specific statement.
| Client | Readiness | Evidence note |
|---|---|---|
| ChatGPT web | Unknown | no official statement located as of 2026-07-13 |
| ChatGPT desktop | Unknown | no official statement located as of 2026-07-13 |
| Claude Code | Unknown | no official statement located as of 2026-07-13 |
| Cursor | Unknown | no official statement located as of 2026-07-13 |
| Codex | Unknown | no official statement located as of 2026-07-13 |
| Gemini CLI | Unknown | no official statement located as of 2026-07-13 |
| VS Code | Unknown | no official statement located as of 2026-07-13 |
ResolveMesh surfaces
The public catalog records reviewed client and tool requirements. It does not turn release-candidate support into a compatibility claim.
Review the seven-client by five-tool evidence matrix.
Open compatibilityRead the dated receipts for Codex with GitHub MCP and Claude Code with GitHub MCP.
Open the Codex pair Open the Claude Code pairA request records interest only; it creates no account, monitoring promise, or charge.
Open the watch-request funnelPrimary sources
Both protocol-maintainer posts were checked 2026-07-13. This guide paraphrases only the bounded fact set recorded in the approved implementation contract.
Protocol-maintainer overview of the locked release candidate, stateless core, extensions, authorization changes, deprecations, and finalization timeline; observed 2026-07-13.
Read the primary sourceProtocol-maintainer SDK readiness post for the release-candidate validation window; observed 2026-07-13.
Read the primary source