MCP 2026 Release Candidate Drops Session IDs, Adds Sandboxed Apps and Redesigned Task Management
Summary
MCP 2026's release candidate goes stateless by eliminating session IDs and the initialize handshake, while introducing sandboxed HTML app delivery, a redesigned long-running task management system, and tightened OAuth 2.0 security — with the final spec dropping July 28, 2026.
Key Points
- The MCP 2026-07-28 release candidate introduces a stateless protocol core, eliminating the initialize handshake and session IDs so that any server instance can handle any request behind a standard round-robin load balancer.
- Two official extensions are launching: MCP Apps, which allows servers to deliver sandboxed interactive HTML interfaces, and Tasks, a redesigned extension for managing long-running operations with a new client-driven lifecycle.
- Authorization is hardened with closer OAuth 2.0 and OpenID Connect alignment, Roots, Sampling, and Logging are formally deprecated with at least 12 months before possible removal, and the final specification is set to publish on July 28, 2026.