Anthropic Releases MCP 2026-07-28 with Stateless Core and Extensions

AIDeveloper44 Team

Overview of the MCP 2026-07-28 Specification

Anthropic has announced the release of the fifth major specification for the Model Context Protocol (MCP), designated as version 2026-07-28. This update represents a shift in the protocol's architecture, moving from a stateful, bidirectional system to a stateless core. This change is intended to simplify the deployment of AI connectors on modern web infrastructure, including serverless functions and edge computing environments. Alongside these architectural changes, the update introduces a versioned extensions framework that codifies advanced capabilities like interactive user interfaces and long-running background tasks.

The Model Context Protocol serves as an open standard for connecting Large Language Model (LLM) applications to external data sources and tools. Since its inception, the protocol has seen rapid adoption, recently surpassing 400 million monthly SDK downloads. According to data provided by Anthropic, this represents a 400% growth in usage over the past year. The 2026-07-28 release aims to mature the protocol for enterprise use by hardening security and improving developer experience through more flexible hosting options.

Transition to a Stateless Core

The primary technical change in MCP 2026-07-28 is the move to a stateless request/response model. Previously, the protocol often required maintaining active sessions between the client and the server. By moving to a stateless model, MCP servers can now be deployed as standard HTTP workloads without the overhead of session management. This architecture allows developers to use serverless platforms like Netlify, AWS Lambda, or Vercel more effectively, as the server no longer needs to "remember" previous interactions to process a current request.

Sean Roberts, VP of Applied AI at Netlify, noted that this change makes MCP a "first-class HTTP workload," removing the need for workarounds in session-based routing. For large-scale deployments, this transition reduces the complexity of load balancing and scaling, as any instance of a server can handle any request if provided with the necessary context. This brings MCP closer to the architectural patterns used by modern web APIs, potentially lowering the barrier to entry for web developers building AI-powered tools.

Standardized Extensions: Apps, Tasks, and Skills

One of the most visible changes for end-users is the formalization of the extensions framework. This framework allows developers to add specialized capabilities to the core protocol without modifying the underlying standard. Three primary extensions have been graduated in this release:

• MCP Apps: This extension allows servers to render interactive UI elements—such as charts, forms, and video players—directly within the LLM conversation interface. This enables a "human-in-the-loop" experience where users can interact with data visually rather than through text alone.
• Tasks: The Tasks extension provides a framework for asynchronous execution. It supports long-running operations that might take minutes or hours to complete, providing mechanisms for polling status, mid-flight user input, and durable execution handles.
• Skills over MCP: This adds a layer of structured instructions for agent workflows, allowing LLMs to discover and consume complex sequences of operations in a standardized format.

By versioning these extensions separately from the core protocol, the MCP community can iterate on experimental features while maintaining a stable base for simple data retrieval and tool execution.

Enterprise Authorization and Security

The 2026-07-28 update addresses enterprise security requirements by aligning authorization flows with production-grade standards. The protocol now supports native OAuth 2.0 and OpenID Connect (OIDC) deployments. This hardening allows organizations to connect MCP servers directly to existing identity management systems such as Microsoft Entra ID (formerly Azure AD) or Okta. For enterprise administrators, this means MCP connectors can be provisioned and managed using the same security policies applied to other corporate applications.

In the specification documentation, Anthropic emphasizes the importance of user consent and tool safety. The protocol requires that hosts (the AI applications) obtain explicit consent before invoking tools or sharing user data with servers. The specification also notes that tool descriptions should be treated as untrusted data unless they originate from a verified, trusted server, highlighting a focus on preventing prompt injection or malicious code execution via third-party integrations.

Ecosystem Adoption and Claude Integration

The release of the new specification is being supported by a range of industry partners. Figma, Intuit, Sentry, and Zoom have already begun implementing the 2026-07-28 spec to enhance their AI integrations. For example, Figma is using the stateless architecture and MCP Apps extension to bring generated design outputs directly into the Figma canvas, allowing teams to refine AI-generated assets in a collaborative environment.

Within Anthropic’s own ecosystem, the Claude platform has expanded its support for MCP. The Claude connectors directory now lists over 950 MCP servers, used by millions of daily users. Anthropic is rolling out support for the new spec across Claude apps and its developer platform, including enterprise-managed authentication and the ability for servers to render UIs via the MCP Apps framework. This integration allows Claude users to work with external tools more fluidly, maintaining context without switching between different browser tabs or applications.

Enjoyed this?

Get more posts like this delivered to your inbox.

Subscribe