The Model Context Protocol's 2026-07-28 specification finalized today, and it's the largest single revision the protocol has had. The headline change is that MCP's protocol core is now stateless: the initialize handshake and the Mcp-Session-Id header are gone, so any request can be served by any server instance. Practically, that removes the need for sticky sessions or session-affinity load balancing that MCP server operators previously had to build around; a plain round-robin balancer now works. Second, MCP Apps becomes the first officially blessed extension, letting servers return server-rendered interactive HTML UI inside a sandboxed iframe instead of only text or JSON, so a tool call can hand back an actual form, chart, or confirmation dialog rather than a client having to render one from raw data. Third, the Tasks extension was redesigned: blocking tasks/result calls are replaced with polling via tasks/get, a new tasks/update lets the client feed input into a task mid-flight, tasks/list was removed, and servers can now push task handles unsolicited. This matters for anything long-running, like an agent doing multi-minute work, where holding a connection open synchronously was never a good fit. Fourth, six separate proposals bundle into an authorization-hardening package aligned with OAuth/OIDC, and Enterprise-Managed Authorization graduates to stable, which is directly relevant to anyone deploying MCP servers behind corporate SSO. Finally, MCP now has a formal deprecation policy for the first time, giving implementers a predictable retirement path for old features instead of silent breakage. SDK maintainers get a ten-week window to validate against real workloads. Anyone running or building against an MCP server should treat this as a migration to plan for, particularly the stateless core, since it changes assumptions about where session state can live.