TITLE: The AI Agent Protocol Just Rewrote Its Rulebook DATE: 2026-07-28 COMPANY: Anthropic / MCP TOPIC: Agent Systems SUMMARY: The Model Context Protocol published its largest specification revision since launch on July 28, 2026, dropping persistent sessions entirely and shipping two major extensions: Tasks, which enables long-running background agent work, and MCP Apps, which delivers server-rendered UIs inside agent workflows. The update affects every AI agent tool connecting to enterprise systems and introduces breaking changes that require migration from older deployments. WHAT CHANGED: The Model Context Protocol, originally released by Anthropic in late 2024 as a standard for connecting AI models to external tools and data sources, published its 2026-07-28 specification on July 28, 2026. The update was the result of a multi-month process involving Tier 1 SDK maintainers and represents the most significant architectural change the protocol has seen since its initial release. The headline change is the elimination of the protocol-level session. Previously, MCP required a persistent connection between client and server, with a handshake that established a session ID and exchanged capability information once at the start. That design created a dependency on sticky routing: load balancers had to send every request from a given client to the same server instance. For organisations running agents at scale, this was an infrastructure overhead and a single point of failure. The new spec removes the session model entirely. Clients now send protocol version, client information, and capability metadata with every request via a `_meta` field. There is no handshake, no session ID, and no requirement for sticky routing. A remote MCP server can now run behind a plain round-robin load balancer, which reduces infrastructure complexity and cost significantly. Alongside the stateless core, two extensions have been promoted from experimental to first-class status. The Tasks extension redesigns how long-running agent work is handled: instead of maintaining an open connection for the duration of a job, servers return a task handle from a `tools/call`, and clients drive execution through `tasks/get`, `tasks/update`, and `tasks/cancel` calls. The MCP Apps extension enables server-rendered interfaces delivered as HTML templates in sandboxed iframes, with all interactions flowing back through the existing JSON-RPC protocol. --- WHY IT MATTERS: The infrastructure cost of running agents at scale just dropped. The stateless design means organisations no longer need session stores, sticky routing configuration, or complex connection management to run MCP-based agents reliably. The operational overhead that made large-scale agent deployment expensive is substantially reduced. Long-running automation is now a first-class capability. The Tasks extension solves a genuine operational problem: before this spec, agents that needed to run multi-step jobs, wait for human approvals, or process large data sets had to maintain open connections throughout. The new task handle model decouples job execution from connection lifetime, which makes background automation workflows both more reliable and easier to reason about. Enterprise security objections to MCP adoption have a cleaner answer. The six authorisation changes in this spec bring MCP into full alignment with OAuth 2.0 and OpenID Connect standards. For organisations whose IT or security teams have blocked MCP-based tooling on authorisation grounds, this update removes the most commonly cited technical objection. MCP Apps changes the economics of internal agent tooling. Building a custom interface for an internal agent tool previously required a separate frontend development effort. The MCP Apps extension allows servers to deliver those interfaces directly, within the existing protocol, without maintaining a separate UI layer. For operators building internal automation, this is a meaningful reduction in development overhead. Breaking changes create a transition risk window. The removal of the session handshake and the Tasks API redesign are genuine breaking changes. Older MCP servers that have not migrated will behave differently from new ones, and teams relying on mixed infrastructure may hit compatibility issues. The 10-week migration window given to Tier 1 SDK maintainers means major frameworks should be compliant, but vendor-built and internally maintained MCP servers will need active migration work. Governance policies are maturing. The 12-month deprecation window policy and the formal extensions framework signal that MCP is moving from a fast-moving experimental protocol to something enterprises can build long-term infrastructure on. That shift in protocol governance is as significant as any individual technical change. --- DAVID & GOLIATH ANALYSIS: MCP has been one of the least discussed but most consequential developments in enterprise AI over the past 18 months. Most operators who use AI agents every day have no idea what MCP is, which is exactly how good infrastructure works. It runs underneath the tools, connects the pieces, and stays out of sight. The 2026-07-28 spec is a signal that the foundational layer of enterprise AI agent infrastructure is maturing, and that is worth paying attention to. The stateless change is the most immediately practical development for operators thinking about scaling AI automation. The argument against running dozens of concurrent agents used to include the infrastructure complexity of managing persistent sessions at scale. That argument is weaker today. If your team has been running one or two AI agents cautiously and wondering whether more is feasible, the answer has become simpler. What this spec does not solve is the human layer: knowing which tasks to automate, designing the right agent workflows, and building the internal capability to manage agents in production. That is still the hard part. But removing infrastructure friction is a necessary precondition for getting to that work, and this update does that meaningfully. --- RELEVANT SYSTEMS: AI Growth Engine, Employee Amplification Systems, Secure AI Brain SOURCE URL: https://davidandgoliath.ai/daily-ai-briefing/mcp-2026-07-28-spec-release-stateless-enterprise-agents FEED URL: https://davidandgoliath.ai/daily-ai-briefing/feed --- Published by David & Goliath | https://davidandgoliath.ai Daily AI Briefing: one AI development per day, decoded for business operators. This is a structured companion file optimised for LLM retrieval and citation.