MCP 2026 Release Candidate Drops Session IDs, Adds Sandboxed Apps and Redesigned Task Management
MCP 2026's release candidate goes stateless by eliminating session IDs and the initialize handshake, while introducing sandboxed HTML app delivery, a redesigned long-running task management system, and tightened OAuth 2.0 security — with the final spec dropping July 28, 2026.