MCP just shipped its largest revision ever, and most servers won't survive it

The Model Context Protocol's 2026-07-28 revision is the biggest change since the protocol existed. The core is now stateless request/response instead of a bidirectional stateful session. Authorization aligns with OAuth 2.1 and OpenID Connect. MCP Apps and Tasks moved under a versioned extensions framework so interactive UIs and long-running work stop requiring core protocol surgery. Anthropic confirmed it's live across Claude products and put MCP at 400M monthly SDK downloads, 4x growth this year.

Stateless is the headline because it's the deploy story. Long-lived connections meant you couldn't put an MCP server on Lambda, Cloudflare Workers, or any edge runtime without fighting the transport. That's over. Anthropic also shipped enterprise-managed auth (admins authorize a connector once through their IdP, users inherit access at first login), a connector observability dashboard, and MCP tunnels in research preview that reach servers inside a private network with no public endpoint and no inbound firewall rule.

Now the part nobody in the announcement posts will tell you. The operator of the Glama MCP gateway posted the real numbers on HN: of 62,726 indexed open-source MCP servers, roughly 30% saw any activity in the last 30 days. The other 70% are abandoned and will never migrate. They call the new protocol "wire-incompatible in both directions," which means an SDK version bump is not a migration. They also confirmed state persistence was the single largest source of bugs in their gateway, which is the strongest argument for the stateless move I've seen anywhere.

The SDKs already shipped. MCP Python SDK v2.0.0 went stable July 28 and pip install mcp now resolves to 2.x, with v1.x on security-fixes-only. FastMCP is renamed MCPServer. A single Client object replaces the transport + ClientSession + initialize() stack. One server speaks both the new stateless wire and every 2025-era client with no configuration. OpenTelemetry tracing is on by default, protocol types split into a standalone mcp-types package, and Streamable HTTP now rejects bodies over 4 MiB with a 413. The TypeScript SDK went 2.0.0 on July 27 and fixed a wire mismatch that was hard-failing connections against modern-only servers.

Concrete work if you operate a server. Server-initiated calls are gone: roots/list, sampling/createMessage, and elicitation/create become the Multi Round-Trip Request pattern, where you return an InputRequiredResult and the client re-issues with inputResponses attached (spec changelog). Every result carries a required resultType. Roots, Sampling, and Logging are deprecated on a twelve-month clock. And the sneaky one: tools/list now takes ttlMs and cacheScope, and the spec says servers SHOULD return tools in deterministic order. If you're building that list by iterating a hash map, you're reshuffling the prompt prefix and busting the model's prompt cache on every single call. That's a free win sitting in most codebases right now.