MCP 2026-07-28: Stateless Core, Stronger Auth, and Versioned App/Task Extensions
Claude expanded support for the new MCP 2026-07-28 specification, the protocol's most significant architectural shift since launch: MCP moves from a bidirectional, stateful protocol to a request/response model. Practically, this means MCP servers can now deploy on serverless and edge infrastructure — platforms that don't hold persistent connections open — which was awkward or impossible under the old stateful design.
What else the spec adds
- Stronger OAuth and OIDC authorization — a more robust auth story than MCP's earlier, more ad-hoc approaches.
- Versioned extensions for Apps and Tasks — giving these capabilities their own evolution path independent of the core spec.
- Embedded UI, enterprise-managed auth, observability, and private network tunnels — new connector-level features building on the more robust core.
MCP servers previously needed to run as always-on processes to maintain their stateful connections — a real infrastructure cost for low-traffic servers. Deployability on serverless/edge platforms means a rarely-used internal MCP server no longer needs dedicated always-on compute, potentially cutting hosting costs meaningfully for teams running many narrow-purpose servers.
MCP has now surpassed 400 million monthly SDK downloads — a 4× increase this year — reinforcing its position as the de facto standard for connecting AI agents to external tools and applications.