The Model Context Protocol team published a release candidate for the 2026-07-28 specification, described as the largest revision to MCP since it launched, with the final spec due roughly two weeks later. Three changes matter most for anyone building or operating MCP servers. First, a stateless core: servers no longer need to maintain sticky sessions or a shared session store, so they can run behind an ordinary round-robin load balancer, removing one of the more painful operational constraints teams hit once they tried to run MCP servers at real production scale rather than as a single local process. Second, MCP Apps (specified under SEP-1865), which let a server render an interactive HTML UI inside a sandboxed iframe on the client side, rather than being limited to text and structured tool-call results -- an MCP server can now ship an actual widget or form, not just a JSON response. Third, a Tasks extension for long-running work, so a tool call that takes minutes or hours, such as a batch job, a deployment, or a background agent run, can be tracked and polled properly instead of forcing the connection to stay open or the client to guess when it is done. The spec also promotes Enterprise-Managed Authorization to stable and aligns authorization with OAuth/OIDC conventions, addressing what has been one of the biggest blockers to enterprises adopting MCP for anything touching sensitive data. A ten-week validation window gives SDK maintainers time to implement support before Tier-1 SDKs are expected to comply, so teams building MCP servers or tools should expect to update their SDK dependency and re-test session handling and auth flows in the coming weeks.