Issue #18 Protocol Signal July 20, 2026 · Monday

MCP RC Published on Official Blog Today: Eight Days to the Stateless Spec

The RC publishing on the official blog is the last signal before the July 28 hard ship date.

MCP ProtocolAgent SecurityNSA and CISA JointMCP Apps Explained: The

The Model Context Protocol team published the official release candidate post on blog.modelcontextprotocol.io on July 20, 2026, eight days ahead of the July 28 final specification ship date. The RC formalizes the complete stateless rewrite: the session handshake is gone, every request is now self-contained with protocol version, client info, and capabilities traveling inline. The practical effect is immediate for production deployments. A remote MCP server that previously required sticky sessions, a shared session store, and connection management can now run as a pure stateless HTTP endpoint behind any load balancer. The RC also ships the Extensions framework, which includes MCP Apps (SEP-1865: server-rendered UIs in sandboxed iframes), the Tasks extension for long-running work, and an authorization layer that aligns with OAuth and OpenID Connect. Roots, Sampling, and Logging are formally deprecated with the RC. The specification contains breaking changes; the RC blog post includes a migration guide and validation checklist. Final spec ships July 28.

Why it matters: The RC publishing on the official blog is the last signal before the July 28 hard ship date. Builders have eight days to validate against the stateless transport before it becomes the canonical protocol version. For the agentic commerce stack specifically, the stateless rewrite removes the last architectural reason to avoid MCP for payment-critical server-to-server calls. A paid API endpoint built on the new spec can run on standard HTTP infrastructure without session management overhead, making x402 + MCP the natural stack for machine-native commerce. The formal deprecation of Sampling in the same release is the spec choosing a side on who owns the rendering surface — MCP Apps take that role through the host client's sandboxed iframe, not through the model.

Read the full issue

Complete coverage including briefs and source links.

Read Issue #18
← All issues Subscribe for new issues →