Protocol Signal | Monday
MCP Spec Release Candidate Drops July 28: Stateless Core, Extensions Framework, MCP Apps
2026-07-12 · Source
The official Model Context Protocol blog published the release candidate for the next MCP specification on July 12, 2026, with the final spec shipping July 28. The update is the largest revision since the protocol launched. The headline change: MCP becomes stateless at the protocol layer. The initialize handshake and Mcp-Session-Id header are removed. Protocol version, client info, and capabilities now travel in a _meta field on every request, meaning any request can land on any server instance without sticky routing or shared session stores. A new server/discover method lets clients fetch server capabilities on demand. Routing becomes cleaner operationally: new Mcp-Method and Mcp-Name headers let load balancers route without inspecting request bodies. The spec also introduces an Extensions framework with formal governance, reverse-DNS IDs, and independent versioning; MCP Apps, which lets servers ship interactive HTML interfaces rendered in a sandboxed iframe; and a Tasks extension replacing the old SSE-based model. Three features are formally deprecated under a new feature lifecycle policy: Roots, Sampling, and Logging. The release was authored by David Soria Parra and Den Delimarsky, with the release candidate locked May 21 after a ten-week SDK validation window.
Why it matters: Stateless MCP is the architectural shift that makes the protocol viable for production infrastructure. Sticky sessions and shared session stores were the primary reason teams were hesitant to scale MCP deployments behind standard load balancers. Removing that constraint means MCP servers can now be treated like ordinary HTTP services: horizontally scalable, cloud-native, deployable on commodity infrastructure. The Extensions framework addresses the second major pain point: unofficial extensions proliferated without governance, making interoperability unpredictable. A formal process with delegated maintainers and independent versioning gives enterprises a stable surface to build on. The deprecation of Sampling and Logging also signals maturity: the spec is shedding early-design decisions that did not hold up in production and replacing them with standard tooling (LLM provider APIs, OpenTelemetry). For teams building on MCP today, this is the release to plan around.
Brief Items
Google Adds Remote MCP Support to Gemini Managed Agents
Google shipped four new capabilities for Managed Agents in the Gemini Interactions API on July 7. The most consequential for the MCP ecosystem: agents can now connect directly to remote MCP servers as tools. Instead of writing custom proxy middleware to reach internal databases or private APIs, developers register a remote MCP server with a name, URL, and auth headers, and the agent calls it from inside its isolated cloud sandbox. The update also adds background execution (agents run asynchronously server-side, returning an ID immediately), custom function calling via a requires_action state, and credential refresh that rotates access tokens without resetting sandbox state. The Interactions API has been generally available since June 2026. Read more
JetStream Launches Verified MCP Catalog and Governance Layer for Enterprise Agents
JetStream Security launched the JetStream Verified MCP catalog and AI Hub on July 13, targeting enterprises adopting third-party MCP servers. The catalog includes more than 100 verified MCP server images that have been analyzed, hardened, and cryptographically attested using proprietary semantic scanning that identifies credential leakage, unicode smuggling, and obfuscated malware. The AI Hub provides a unified governance control point for MCP and LLM traffic, handling authentication, authorization, policy enforcement, and content inspection before and after each call. It also discovers shadow MCP servers running outside central oversight and tracks configuration drift when an agent deviates from its approved blueprint. Backed by Redpoint Ventures and the CrowdStrike Falcon Fund. Read more
Agent Commerce Weekly · agentcommerceweekly.com