--- title: "MCP (Model Context Protocol) in 2026: The Complete Guide" description: "The 2026-07-28 spec deleted sessions and made MCP stateless. What MCP actually is, everything that changed, how to build and host a server, and whether your product needs one." source: https://appstackbuilder.com/blog/mcp-model-context-protocol-guide-2026 retrieved: 2026-08-31 --- [Back to Blog](https://appstackbuilder.com/blog) AI Infrastructure2026-07-28 Spec # MCP in 2026: The Complete Guide On **July 28, 2026** the Model Context Protocol got its largest revision since launch: the core went **stateless**, sessions were deleted, and four features entered a deprecation window. Here is what MCP actually is, everything that changed, how to build and host a server, and how to tell whether you need one at all. 15 min read Spec 2026-07-28 Published August 2026 ## The Short Version MCP won Roughly 97M monthly SDK downloads across Python and TypeScript as of March 2026, ten thousand-plus public servers, and native support in Claude, ChatGPT, Gemini, Copilot, VS Code, and Cursor. The "which integration standard" question is settled. It went stateless No more `initialize` handshake, no more `Mcp-Session-Id`. Every request stands alone, so any request can land on any instance behind a plain load balancer. Four things are dying Roots, Sampling, Logging, and the legacy HTTP+SSE transport are deprecated. They keep working for a minimum of twelve months, so earliest removal is late July 2027. Hosting got cheap Statelessness is what makes serverless MCP genuinely viable. Cloudflare Workers is the strongest default; Vercel if you are already on Next.js; FastMCP Cloud for Python. Security is the hard part Prompt injection, tool poisoning, and confused-deputy failures are the real risks — not the protocol. OAuth 2.1 with PKCE and audience-bound tokens is the floor, not the finish line. TL;DR Selling an API or a data product? Ship an MCP server — it is a distribution channel now. Building an app on top of AI? Be a client, not a server. Either way, write it stateless from day one. ## What MCP actually is Strip away the marketing and MCP is a JSON-RPC protocol with a schema for three things a model needs from the outside world: **tools** it can call, **resources** it can read, and **prompts** it can be handed. That is nearly the whole idea. Its value is not technical elegance, it is the N-times-M problem. Before MCP, connecting five AI products to five internal systems meant twenty-five bespoke integrations, each one re-inventing tool schemas, auth, and error handling. With MCP you write five servers, and every client that speaks the protocol can use all of them. The three roles ``` [ Host ] Claude, ChatGPT, Cursor, VS Code, Copilot | the app the human is actually using | [ Client ] one connection per server, managed by the host | v [ Server ] <--> your API / database / filesystem / SaaS product tools: run_query, create_invoice, search_docs resources: file://, db://table, https://... prompts: reusable templates the host can surface ``` You almost always write the **server**. The host and client are someone else's product. The governance detail matters more than it sounds: Anthropic donated MCP to the **Agentic AI Foundation** under the Linux Foundation in December 2025, and the spec now evolves through a public Specification Enhancement Proposal (SEP) process. That is a large part of why OpenAI, Google, and Microsoft were all willing to build on it rather than ship a rival. ## What the 2026-07-28 spec changed This is the biggest revision since MCP shipped in November 2024, and most of it follows from one decision: make the core stateless so MCP runs on ordinary HTTP infrastructure instead of needing sticky, long-lived connections. ### 1\. The handshake is gone Before initialize → initialized, then Mcp-Session-Id on every request 2026-07-28 \_meta carries protocol version, client info, and capabilities per request Sessions were the thing forcing sticky routing. Without them, any request can land on any server instance behind a plain round-robin load balancer — which is what makes serverless and autoscaled MCP practical. ### 2\. Routing moved into headers Before Gateways had to parse the JSON-RPC body to know what a request was 2026-07-28 Mcp-Method and Mcp-Name headers are mandatory for Streamable HTTP Load balancers, WAFs, and API gateways can now rate-limit, authorise, and route MCP traffic without deserialising it. This is the change that makes MCP deployable behind the infrastructure enterprises already run. ### 3\. server/discover replaces handshake-time discovery Before Capabilities were exchanged once, during initialize 2026-07-28 server/discover, called on demand Capability discovery became an optional RPC rather than a mandatory first step, so a client that already knows what it wants can go straight to tools/call. ### 4\. Multi round-trip requests (MRTR) Before Servers initiated requests back to the client over an open stream 2026-07-28 resultType: "input\_required" + inputResponses on retry A server that needs more information now returns a result saying so, and the client retries the original call with answers attached. Server-to-client questions no longer require holding a stream open, which is the last piece of state that had to die. ### 5\. List results are cacheable Before tools/list re-fetched on every connection 2026-07-28 ttlMs and cacheScope on tools/list, prompts/list, resources/list, resources/read Servers now tell clients how long a listing stays valid and how widely it can be shared. On a large tool catalogue this removes a meaningful chunk of per-conversation latency and token cost. ### 6\. Extensions became the shape of the protocol Before Everything competed for space in the core spec 2026-07-28 io.modelcontextprotocol/tasks, MCP Apps, Enterprise Managed Authorization The core stays small and universal; anything else ships as a namespaced extension with its own lifecycle. Tasks moved out of the experimental core to poll-based tasks/get plus a new tasks/update, tasks/list was removed outright, and change notifications consolidated into a single subscriptions/listen stream. ### 7\. Authorization hardened around OAuth 2.1 Before Dynamic Client Registration, loose issuer handling 2026-07-28 RFC 9207 iss validation, application\_type in DCR, credentials bound to the issuing AS MCP servers are now formally OAuth 2.1 resource servers. Dynamic Client Registration is deprecated in favour of Client ID Metadata Documents (CIMD), and clients must validate the iss parameter — closing a family of mix-up attacks. ### Deprecated, not deleted: Roots, Sampling, Logging, HTTP+SSE All four still work today, and the spec commits to a **minimum twelve-month window** — so the earliest they can be removed is **late July 2027**. Nothing you shipped is broken. But do not build anything new on Sampling (asking the client's model to complete something on the server's behalf) or on the legacy SSE transport, and start planning the move off them now rather than in a panic next summer. ## MCP Apps: tools that return a UI The most product-visible addition is **MCP Apps** (SEP-1865), which lets a server ship an interactive HTML interface that the host renders in a **sandboxed iframe**. A tool can return a date picker, a seat map, a chart, or a confirmation form instead of a paragraph of text the model has to describe. This is the same architectural idea behind OpenAI's Apps SDK, which is itself built on MCP and launched with Booking.com, Canva, Coursera, Figma, Expedia, Spotify, and Zillow. If you have wondered how a third party puts a real interface inside someone else's chat product, this is the mechanism. The practical caveat: it is an _extension_. Support varies by host, so treat a rendered UI as progressive enhancement and make sure your tool still returns sensible structured text when nobody renders it. ## Building a server, the 2026 way The SDKs hide most of the protocol churn. Your job is to define tools with tight schemas and to keep **zero state between requests** — no in-memory session map, no per-connection cache, nothing that assumes the next call reaches the same process. ### TypeScript ``` npm install @modelcontextprotocol/sdk zod // server.ts — every handler is pure w.r.t. connection state import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"; import { z } from "zod"; const server = new McpServer({ name: "invoices", version: "1.0.0" }); server.registerTool( "find_invoice", { title: "Find invoice", description: "Look up an invoice by number. Read-only.", inputSchema: { number: z.string().describe("e.g. INV-2026-0142") }, }, async ({ number }, { authInfo }) => { // authInfo comes from the verified bearer token on THIS request. const invoice = await db.invoices.find(number, authInfo.userId); return { content: [{ type: "text", text: JSON.stringify(invoice) }] }; } ); ``` ### Python ``` pip install fastmcp from fastmcp import FastMCP mcp = FastMCP("invoices") @mcp.tool def find_invoice(number: str) -> dict: """Look up an invoice by number. Read-only.""" return db.invoices.find(number) if __name__ == "__main__": mcp.run(transport="http") # Streamable HTTP, not the deprecated SSE ``` ### The four mistakes that make a server useless * ✗**Exposing 60 tools.** Every tool definition burns context on every turn and every extra option degrades selection accuracy. Ship the eight tools that cover 90% of intent, and prefer one tool with an enum over six near-duplicates. If you want the real number rather than a rule of thumb, the Tokens tab in [MCP Agent Studio](https://mcpplaygroundonline.com/mcp-agent-studio) prices your schemas before you send a single message. * ✗**Returning raw API JSON.** A 40KB payload with 300 fields is a context bomb. Return the fields a human would have read, and paginate loudly. * ✗**Vague descriptions.** The description _is_ the API. "Gets data" will be called at random; "Returns the last 30 days of paid invoices for the authenticated org" will not. * ✗**Holding connection state.** Under the stateless core it will work perfectly on one instance and fail the moment you scale to two. ## Test it against a real model before you ship it A server that compiles is not a server that works. The thing that actually breaks in production is **tool selection**: the model reads your descriptions, picks the wrong tool, passes a malformed argument, or burns 4,000 tokens on schemas before it says a word. None of that shows up in a unit test, and none of it shows up in `tools/list`. The fastest way to see it is [MCP Playground Online](https://mcpplaygroundonline.com/) — a browser-based playground for MCP. Paste a server URL (HTTP, SSE, or Streamable HTTP), and you get an inspector, evals, a security scanner, hosted mock servers, and a server registry with nothing installed locally. AS ### MCP Agent Studio Run your server against a real agent loop, in the browser Agent Studio is the part worth your afternoon. You chat with your own MCP server in plain English and watch a real model call your tools — every call streaming inline with the exact JSON arguments it sent and the response it got back. It is the difference between believing your descriptions are clear and proving it. 70+ models, one server Claude, GPT-5, Gemini, DeepSeek, Grok, Qwen and more. The same tool schema that Claude reads perfectly can confuse a cheaper model — and you would rather find that out before a customer does. Compare Models, side by side Fire the same prompt at up to four models in parallel and get a grid of tool-call accuracy, latency, token usage, and final output — with winner ribbons for fastest, cheapest, and most accurate. A Tokens tab that prices your schemas It shows the exact token cost of your tool definitions _before_ you send a message. This is the honest answer to "how many tools is too many" — you stop guessing and start reading a number. Evals and saved agents Auto-generated test suites produce pass/fail reports per tool with evidence, and a configuration you like can be saved as a reusable agent and exported as an API. Templates exist for GitHub, Stripe, Notion, Jira, and Slack. [Try MCP Agent Studio](https://mcpplaygroundonline.com/mcp-agent-studio)Free signup, no credit card, starter credits included. Two other tabs on the same site earn a bookmark while you are migrating to the 2026-07-28 spec: the [security scanner](https://mcpplaygroundonline.com/mcp-security-scanner) (more on that below), and the [test client](https://mcpplaygroundonline.com/mcp-test-client) validates a _client_ implementation against hosted mock servers — which is exactly what you want when you are checking whether your code still assumes a handshake that no longer exists. ## Where to host a remote MCP server A local stdio server on your own laptop needs no hosting. The moment you want other people to use it, you need a remote server with real auth — and this is where the stateless core pays off, because a serverless runtime is no longer a compromise. Best default CF ### Cloudflare Workers The strongest default for TypeScript $0 → $5/mo free tier, then Workers Paid * ✓V8 isolates: millisecond cold starts, not seconds * ✓workers-oauth-provider wraps your Worker with OAuth 2.1 * ✓Agents SDK has first-class remote MCP support * ✓Durable Objects when you genuinely do need state Best for: Any public MCP server you want strangers to connect to. V ### Vercel If your product is already Next.js $0 → $20/mo Hobby, then Pro per seat * ✓The MCP handler is just another route in your app * ✓Streamable HTTP supported; wrap with your own OAuth verification * ✓Shares your existing auth, database client, and env vars * ✓Preview deployments give you a per-PR MCP endpoint Best for: Adding MCP to a SaaS you already ship on Vercel. FM ### FastMCP Cloud The one-command Python path Free personal tier paid tiers for teams * ✓Deploy a FastMCP server straight from a Git repo * ✓Built-in OAuth and monitoring, no auth code to write * ✓Automatic CI/CD on push * ✓Zero infrastructure decisions to make Best for: Python servers, internal tools, and shipping something today. RW ### Railway / Render / Fly When you need a real container $5 → $20/mo usage-based * ✓Long-running process with a filesystem and local state * ✓Heavy or native dependencies that will not run on an edge runtime * ✓Headless browsers, ML libraries, big binaries * ✓Predictable pricing under sustained load Best for: Servers that do real work, not just proxy an API. Feature CF Cloudflare V Vercel FM FastMCP RW Railway Cold start ms \~1s \~1s always on OAuth included ✓ ✗ ✓ ✗ Free tier ✓ ✓ ✓ ✗ Language TS/JS TS/JS Python Any Local filesystem ✗ ✗ ✗ ✓ Heavy deps ✗ limited limited ✓ Scales statelessly ✓ ✓ ✓ manual ## The security problems are real MCP gives a language model a loaded API client. OWASP now maintains an MCP cheat sheet, and the failure modes it describes are not protocol bugs — they are what happens when untrusted text meets real privileges. ### Prompt injection and tool poisoning Hostile instructions hidden inside a support ticket, a README, a calendar invite, or a web page become instructions the model follows. If your server can both read untrusted content and take a destructive action, an attacker who can write into your data can act through your agent. Split read and write surfaces, and require explicit human confirmation for anything irreversible. ### Confused deputy Your server holds broad privileges and acts on behalf of a user who does not. Every tool must authorise against the identity in _this_ request's token, not against the server's own credentials. Never forward a client token to an upstream API — mint a downstream token scoped to the action. ### Over-scoped tokens Servers routinely request far more OAuth scope than any of their tools need, and the aggregate becomes a single high-value target. Validate the token **audience** so you only accept tokens minted for you, and scope per tool rather than per server. ### Supply chain There are somewhere between 9,600 and 17,500 public servers depending on whose census you trust. Installing one is executing someone else's code against your data with your credentials. Pin versions, read the tool definitions before you connect, and prefer servers you or a vendor you already pay actually maintain. The baseline checklist * ✓OAuth 2.1 with mandatory PKCE — the implicit grant is gone * ✓Validate the token audience; reject tokens minted for anyone else * ✓Validate the iss parameter (RFC 9207) on every authorization response * ✓Allow-list and validate every tool input; block egress to private IP ranges * ✓Human confirmation for destructive or irreversible tools * ✓Log every tool call with the resolved user identity, not just the server identity SS ### Scan your server before someone else does MCP Security Scanner — paste a URL, get a graded report Most of the checklist above is auditable from the outside, which is exactly what the [MCP Security Scanner](https://mcpplaygroundonline.com/mcp-security-scanner) does. You give it a server URL and it runs **35+ checks** in seconds, then grades the server **A–F** so you have a number to argue with rather than a vague feeling. ✓Transport security — TLS posture and downgrade exposure ✓Authentication — is protection actually enforced, and is the challenge correct ✓Protocol compliance against the current spec ✓Injection risk — prompt injection and tool poisoning in descriptions and results ✓Information disclosure through errors, metadata, and verbose responses ✓CORS policy and security headers ✓Rate limiting ✓Stateless-era classes: requestState tampering and cache-scope leaks That last category is the reason to re-scan even a server you audited six months ago. The stateless core moved trust that used to live in a session into per-request state, and **requestState tampering** and **cache-scope leaks** are new failure modes that simply did not exist before 2026-07-28 — a server can be perfectly correct against the old spec and leak under the new one. [Scan your MCP server](https://mcpplaygroundonline.com/mcp-security-scanner)Free scan, no signup. An advanced scan goes deeper when you want a full audit before you ship. ## Do you actually need an MCP server? ### You sell an API, a database, or a data product **Build one.** This is now how agents discover and use your product, and it is a distribution channel more than a feature. Being absent from the ecosystem means an agent that could have used you uses a competitor who shipped a server. ### You have internal tools your team asks about all day **Build one, small.** An internal MCP server over your deploy status, runbooks, or analytics pays for itself fast. Start with three read-only tools on FastMCP Cloud or a Worker and see if anyone uses it before investing further. ✗ ### You are building an AI app that calls your own functions **Skip it.** If one application calls its own code, MCP adds a protocol hop, a serialisation boundary, and an auth surface in exchange for nothing. Define tools directly in your agent loop. MCP earns its keep at a trust boundary — when the caller and the callee belong to different people. ### You already run a server on an older spec **Audit, then migrate.** Grep for `initialize`, `Mcp-Session-Id`, and any per-connection state. Move off the legacy HTTP+SSE transport and stop adding Sampling or Roots. Nothing breaks today, and you have until at least July 2027 — but the stateless core affects new clients now. Point [MCP Playground Online](https://mcpplaygroundonline.com/) at the deployed URL for a fast read on where you stand. ## Building an AI product? Get the whole stack An MCP server is one piece. Use our generator to pick the rest — hosting, database, auth, LLM provider, observability — matched to your budget and team size. [Generate Your Tech Stack](https://appstackbuilder.com/build-stack?budget=100&appType=ai&teamSize=solo) ## Frequently Asked Questions ### What is MCP (Model Context Protocol) in simple terms? MCP is an open standard for connecting AI assistants to external tools and data. Instead of writing a bespoke integration for every model, you expose your functionality once as an MCP server, and any MCP-capable client — Claude, ChatGPT, Gemini, Copilot, VS Code, Cursor — can call it. It standardises the wire format for tool definitions, tool calls, and the resources a model reads. ### What changed in the 2026-07-28 MCP specification? It is the largest revision since MCP launched. The protocol core became stateless: the initialize/initialized handshake and the Mcp-Session-Id header were removed, and every request now carries its protocol version, client info, and capabilities in \_meta. Mcp-Method and Mcp-Name headers became mandatory for Streamable HTTP so gateways can route without parsing the body, server/discover replaced handshake-time capability discovery, list results became cacheable via ttlMs and cacheScope, and Tasks and MCP Apps moved into a formal Extensions framework. Roots, Sampling, Logging, and the legacy HTTP+SSE transport are deprecated with a minimum twelve-month window. ### Is MCP stateless now, and does that break my server? The core is stateless. If your server relies on the initialize handshake, on Mcp-Session-Id, or on any per-connection state held in memory between requests, that is what breaks with new clients. Existing clients speaking older protocol versions keep working, so this is a migration rather than an outage. The upside is real: any request can land on any instance behind a plain round-robin load balancer, which makes serverless hosting and horizontal scaling straightforward and cheaper. ### Where should I host a remote MCP server? Cloudflare Workers is the strongest default for TypeScript servers: millisecond cold starts on V8 isolates, and workers-oauth-provider plus the Agents SDK handle OAuth 2.1 for you. Vercel is the pragmatic choice if your product is already a Next.js app, since the MCP handler is just another route. FastMCP Cloud is the fastest path for Python servers, with built-in OAuth and Git-based deploys on a free personal tier. Railway, Render, or Fly are right when you need a long-running container with local state or heavy dependencies. ### Do I actually need to build an MCP server? If you sell an API or a data product, yes — an MCP server is now how agents discover and use your product, and it is a distribution channel rather than a feature. If you are building an app that consumes AI, you almost certainly want to be an MCP client instead, or skip MCP entirely and call tools directly in your own agent loop. Building a server so your own single application can call its own functions adds a protocol hop for nothing. ### What are the main MCP security risks? Three dominate. Prompt injection and tool poisoning, where hostile text inside a ticket, file, or web page becomes instructions the model follows. Confused-deputy failures, where your server performs an action with its own broad privileges on behalf of a user who does not have them. And over-scoped tokens, where a server requests far more OAuth scope than any of its tools need. The baseline defence is OAuth 2.1 with mandatory PKCE, validating the token audience so you only accept tokens minted for you, never forwarding a client token to an upstream API, blocking egress to private IP ranges, and requiring human confirmation for anything irreversible. Most of that is checkable from the outside: the free MCP Security Scanner at mcpplaygroundonline.com runs 35+ checks and grades a server A-F, including the stateless-era classes like requestState tampering and cache-scope leaks. ### What are MCP Apps? MCP Apps (SEP-1865) let a server ship an interactive HTML interface that the host renders in a sandboxed iframe, so a tool can return a real UI — a form, a chart, a picker — instead of a wall of text. It shipped as an extension in the 2026-07-28 spec rather than in the core, which is the pattern the spec now uses for anything that is not universally required. ### Is MCP still controlled by Anthropic? No. Anthropic donated MCP to the Agentic AI Foundation under the Linux Foundation in December 2025, and the specification is now developed there through a public Specification Enhancement Proposal process. That governance change is a large part of why competing vendors — OpenAI, Google, Microsoft — were willing to standardise on it. ### Related Articles [Best AI Agent Sandbox 2026Where the code your tools return actually runs](https://appstackbuilder.com/blog/best-ai-agent-sandbox-2026)[Best LLM Observability & Evals 2026Tracing every tool call your server receives](https://appstackbuilder.com/blog/llm-observability-evals-2026)[LangGraph vs CrewAI vs AutoGenThe agent framework on the other end of MCP](https://appstackbuilder.com/blog/langgraph-vs-crewai-vs-autogen-2026)[Grok 4.6 vs Claude Opus 5 vs Fable 5The model deciding which tool to call](https://appstackbuilder.com/blog/grok-4-6-vs-claude-opus-5-vs-fable-5-2026)[Best Vector Database for RAG 2026What a search tool queries behind the scenes](https://appstackbuilder.com/blog/best-vector-database-rag-2026)[MCP Agent StudioTest your server against 70+ models in the browser](https://mcpplaygroundonline.com/mcp-agent-studio)[AI Agents for a One-Person BusinessPutting internal MCP servers to work](https://appstackbuilder.com/blog/ai-agents-one-person-business-2026) ### Explore More [All Blog Posts](https://appstackbuilder.com/blog)[Browse Tools](https://appstackbuilder.com/tools)[Prebuilt Stacks](https://appstackbuilder.com/stacks)[Stack Generator](https://appstackbuilder.com/build-stack)