MCP Latest Spec Drops Stateful Sessions, Adds OAuth and Extension Framework

Anthropic released the fifth version of the Model Context Protocol today, moving MCP from a bidirectional stateful protocol to a stateless request/response model. The 2026-07-28 spec also adds authorization with OAuth 2.0 and OIDC compliance and formalizes a versioned extensions framework for capabilities like interactive UIs and long-running tasks. The updates are rolling out across Claude products, including the desktop app and API.

The stateless core is the most significant architectural change. Previously MCP servers maintained persistent sessions with clients. The new model treats each request independently, which means servers can run on serverless and edge infrastructure without managing session state. Deployment and scaling become simpler—no sticky sessions or state synchronization. Netlify’s VP of Applied AI Sean Roberts called the change “a first-class HTTP workload with no session management to work around,” noting the spec aligns MCP with the rest of his platform’s model.

Authorization now follows standard OAuth 2.0 and OpenID Connect. Servers can integrate with enterprise identity providers like Microsoft Entra or Okta without custom workarounds. Claude’s own enterprise-managed auth feature—where admins provision MCP connectors through their IdP and users get zero-touch access—aligns with this spec change.

The extensions framework packages MCP Apps and Tasks as versioned additions to the core protocol. Apps let servers render interactive UI directly in a Claude conversation (e.g., real-time previews), while Tasks support long-running work without tying up the connection. The core protocol itself stays stable; new capabilities ship as extensions rather than spec revisions.

Anthropic reports MCP has exceeded 400 million monthly SDK downloads, a 4× increase over the past year. Claude’s connectors directory now lists over 950 MCP servers, used by millions daily. The company also released an observability dashboard for connector developers, showing adoption, error rates, and latency across Claude surfaces. A research preview, MCP tunnels, allows Claude to reach MCP servers inside private networks without exposing public endpoints.

The stateless shift is supported by early ecosystem adopters. Figma’s VP of Engineering Josh Clemm noted their stateless architecture can now scale alongside MCP usage. Intuit’s Chief Architect Chris Kasten cited enterprise scale and the ability to deliver agentic experiences to 100 million consumers. Paul D’Ambra, a product engineer at an unnamed firm, pointed to easier analytics on tool usage.

Developers can explore the spec and SDKs now; support across Claude products is rolling out gradually. How quickly third-party hosts update their SDKs and whether the extensions framework gains wide adoption outside Anthropic’s ecosystem remain open questions.