What changed in the MCP 2026-07-28 specification?

What is the headline change?

The protocol core moves from a stateful, bidirectional design to stateless request and response. Every request describes itself, so any instance behind a plain load balancer can answer it.

For a gateway this removes sticky sessions. Policy can run per request without rebuilding session state.

What changed in authorization?

Authorization servers should return the iss parameter per RFC 9207, and clients must validate it before redeeming a code. This closes a mix-up hole between authorization servers.

Client credentials are now bound to the issuer that minted them, with no reuse across authorization servers.

Dynamic Client Registration is formally deprecated in favour of Client ID Metadata Documents. DCR still works for backward compatibility, but a future version will remove it.

What does header-based routing give a gateway?

Streamable HTTP requests must now include Mcp-Method and Mcp-Name headers. A gateway, rate limiter or WAF can route and meter on those headers without parsing JSON bodies.

What else was deprecated?

Roots, Sampling and Logging are deprecated with at least twelve months of support. The legacy HTTP plus SSE transport is also deprecated, with a year-long offramp.

How does this affect our scores?

Our standards criterion now treats DCR-only support as dated. A gateway that names CIMD, issuer validation or Enterprise-Managed Authorization scores higher on standards.