MCP Goes Stateless: Release Candidate Drops Session Headers, Adds Extensions Framework and MCP Apps

Model Context Protocol Blog·high signal

The Model Context Protocol specification release candidate, locked May 21, removes the initialize/initialized handshake and Mcp-Session-Id header, making the protocol stateless at the transport layer so any request can land on any server without sticky routing. The RC introduces an Extensions framework with two official extensions (MCP Apps for server-rendered HTML interfaces and Tasks for long-running work), six authorization hardening changes aligning with OAuth 2.0/OIDC, and a formal deprecation policy with 12-month minimum windows. Final specification publishes July 28, 2026; Tier 1 SDKs expected to ship support within the 10-week validation window.