Source: AWS Machine Learning Blog — 2026-07-28

Summary

The Model Context Protocol shipped its "2026-07-28" revision, described as the largest change since MCP launched: the protocol drops session pinning and initialization handshakes in favor of a stateless, header-based model, adds a governed extensions system, and hardens authorization toward standard OAuth 2.0/OpenID Connect practices. Amazon Bedrock AgentCore Gateway added support for it through a single UpdateGateway API call, without recreating gateways or touching individual target configs.

Key Takeaways

• MCP's biggest architectural change to date: it moves from a stateful, handshake-based session model to a stateless one.
• Protocol version and client capabilities now travel in HTTP request headers on every call, instead of being negotiated once during an initialization handshake and pinned to a session.
• A new governed extensions system lets the protocol add capabilities without breaking core compatibility.
• Authorization is hardened to align with production-grade OAuth 2.0 and OpenID Connect practices, rather than lighter-weight ad hoc auth.
• Amazon Bedrock AgentCore Gateway supports the new version via one UpdateGateway API call, can list "2026-07-28" alongside older supported versions, and can run multiple protocol versions concurrently without recreating the gateway or touching individual targets.

Reel Script

Hook (~15-20s, 35-45 words) MCP just quietly removed one of its core ideas — the session. If you've built anything on the Model Context Protocol, this changes how your agent talks to tools, and AWS just showed exactly what it takes to support it without a rebuild.

Core Concept (~45-90s, 105-200 words) Here's the mechanism. In the old MCP, when a client connected to a server, they did a handshake — negotiate protocol version, exchange capabilities, and then that gets pinned to a session that persists for the whole connection. It's like calling someone and agreeing up front on what language you'll speak for the entire call. The new 2026-07-28 spec throws that out. Now the protocol version and client capabilities just ride along in the HTTP headers of every single request. No handshake, no pinned session — every request is self-describing. That's what "stateless" means here: the server doesn't need to remember anything about you between calls, because each call tells it everything it needs. On top of that, MCP added a governed extensions system, so new capabilities can be added without breaking existing clients, and tightened authorization to match real production OAuth 2.0 and OpenID Connect patterns instead of lighter, ad hoc auth.

Hands-On (~45-150s, 105-350 words) Old flow: client connects, sends an initialize request, server responds with its supported protocol version and capabilities, both sides agree, and that agreement is cached as session state for every subsequent call. If you wanted to support two protocol versions at once, you basically needed separate sessions or separate infrastructure tracking which client negotiated what. New flow: every single HTTP request just carries its protocol version and capabilities in the headers. No negotiation step, no session state to manage, no risk of a stale handshake going out of sync with what the client actually supports. That's exactly why AWS could roll this out the way they did — Amazon Bedrock AgentCore Gateway added support for "2026-07-28" through a single UpdateGateway API call. They didn't have to recreate the gateway or reconfigure every downstream target, because there's no session state tied to a specific version anymore. And because each request declares its own version in headers, the gateway can serve multiple protocol versions concurrently — old clients and new clients hitting the same gateway, each just stating what they need per request.

Takeaway (~20-30s, 45-70 words) Going stateless isn't a minor version bump — it's MCP admitting that session handshakes don't scale well across fleets of agents and gateways. If you're running MCP infrastructure, this is the upgrade to actually read the spec for, not skim. Check whether your gateway can add the new version without a rebuild.

Discussion