What the 2026-07-28 MCP spec means for gateway buyers

What is new in the release?

The MCP blog describes the 2026-07-28 release as a move from a stateful, bidirectional protocol to a stateless request and response core. Each request now describes itself.

Streamable HTTP requests must carry Mcp-Method and Mcp-Name headers. List results are cacheable. Roots, Sampling and Logging are deprecated, as is the legacy HTTP plus SSE transport.

Why does statelessness help gateways?

Earlier versions needed a handshake and a session. A gateway in the middle had to keep each client pinned to an instance, or track session state itself.

With a stateless core, any request can land on any instance. That makes gateways look like ordinary HTTP proxies, which most platform teams already know how to run.

What do the new headers change?

Mcp-Method names the operation and Mcp-Name names the tool or resource. A gateway can route, meter and write audit records from headers alone.

Policy engines get simpler too. A rule such as deny delete calls on the billing server can match on headers before the body is parsed.

Content checks still need the body. Secret masking and prompt injection screening cannot be done from headers.

What changed in authorization?

Authorization servers should return the iss parameter per RFC 9207, and clients must validate it. This closes a mix-up attack between authorization servers.

Client credentials are bound to the issuer that minted them. They cannot be reused across authorization servers.

Dynamic Client Registration is formally deprecated in favour of Client ID Metadata Documents. DCR still works for backward compatibility but will be removed in a future version.

How did this affect our scores?

Our standards criterion now treats DCR-only support as dated. Idira and Docker MCP Gateway name DCR, and their standards scores reflect that.

Aembit names OAuth 2.1 per the MCP spec and XAA/ID-JAG, so it scores highest on standards. NewCore names MCP, SAML and OIDC, but not OAuth 2.1 or Enterprise-Managed Authorization, so it scores lower there.

What should buyers ask now?

Ask which MCP spec version the gateway implements. Ask whether it accepts CIMD client IDs and validates issuer. Ask whether it routes on the new headers.

Ask about the deprecation timeline too. A gateway that still depends on HTTP plus SSE or on Sampling has about a year to move, so plan for it.

Our RFP question list includes all of these. The spec explainers on this site link to the pages we read.