MCP 2026-07-28 spec update: stateless cores, cacheable tool listings, and MRTR without security pain

You want faster tool discovery and less brittle MCP infrastructure, but you also need security reviewers to stop blocking rollouts because “it’s an agent thing” with unclear routing and auth. MCP 2026-07-28 changes the integration surface area in a way that makes both outcomes possible — if you adopt the new semantics deliberately rather than “upgrading the SDK and hoping”. (blog.modelcontextprotocol.io)

What actually changed on 2026-07-28 (and why it matters operationally)

The 2026-07-28 MCP revision is a protocol shift, not just an SDK refresh: the core becomes stateless request/response over HTTP, server-to-client interactions move to Multi Round-Trip Requests (MRTR), method/tool identity becomes routable in headers, and list responses become explicitly cacheable and stable-ordered. (blog.modelcontextprotocol.io)

If you operate MCP behind any kind of gateway, mesh, WAF, or enterprise API platform, those points land as:

• You can treat MCP like any other horizontally-scaled HTTP workload (no “sticky sessions”, no “special SSE backchannel”), which is a reliability win. (blog.modelcontextprotocol.io)
• You can route and authorise on headers (Mcp-Method, Mcp-Name) rather than parsing JSON bodies inside intermediaries. (blog.modelcontextprotocol.io)
• You can cache tool catalogues and keep prompts stable, but you must not accidentally turn “cacheable” into “cross-tenant leakage”. (blog.modelcontextprotocol.io)
• You have a more explicit security story: the update includes authorisation hardening such as issuer validation guidance (via RFC 9207 issuer identification) and a shift away from Dynamic Client Registration (DCR) toward client metadata documents (CIMD). (blog.modelcontextprotocol.io)

Stateless core: the win is real, but state doesn’t disappear

The headline: requests are self-describing; the protocol no longer relies on a handshake/session model, so any request can land on any instance behind a basic load balancer. (blog.modelcontextprotocol.io)

The mistake teams make is reading “stateless” as “no state anywhere”. What actually happens is state becomes explicit, and you choose where it lives:

• If the server needs continuity across calls, it should mint an opaque handle and make it part of the tool contract (arguments in, results out). MRTR leans heavily on this pattern via requestState tokens. (aws.amazon.com)
• If you previously relied on per-connection identity, you now need to be explicit about how identity and policy attach to each request (JWT validation, audience, scopes/roles, tenant context). (github.com)

What to do (and what not to do)

Do:

• Treat MCP servers as stateless web services: autoscale, blue/green deploy, and kill instances without draining “sessions”. (blog.modelcontextprotocol.io)
• Make state explicit in schemas: if a multi-step operation needs continuity, return a server-minted handle and require it on subsequent calls.

Do not:

• Smuggle state in instance memory and hope load-balancing happens to be sticky. You will get intermittent, unreproducible failures the first time you scale or fail over.
• Put “tenant” in a global env var and assume it stays correct across concurrency. In a stateless, multiplexed world, tenant context must be request-bound.

Header-based routing: finally routable, but now headers are security-critical

In 2026-07-28, method and tool names travel in Mcp-Method and Mcp-Name HTTP headers specifically so gateways can route and authorise on headers directly. (blog.modelcontextprotocol.io)

That’s great for platform teams because it unlocks predictable routing rules:

• Split / traffic across tool shards without inspecting request bodies.
• Apply per-tool policies (rate limits, DLP, egress controls) at the gateway.
• Build allow-lists (“these tools are permitted from this client persona”).

The new failure mode is also obvious: headers become part of the security boundary. You must enforce consistency between what the headers claim and what the payload contains.

AWS’s AgentCore Gateway write-up calls out a concrete enforcement approach: if a schema marks a field as header-bound, the gateway rejects requests where header/body contradict or the header is missing. (aws.amazon.com)

Review checklist for gateways and meshes

• Enforce that Mcp-Method / Mcp-Name are present when required and match the body semantics you expect.
• Strip or normalise these headers from untrusted upstreams; only your trusted edge should set them.
• Log them for audit, but treat them as potentially sensitive (tool names can reveal capability surface area).

Cacheable tools/list: speed comes from determinism, not cleverness

The spec change that seems small but matters in production: list results carry cache hints and tools/list should be in a deterministic order so clients can cache catalogues and (critically) keep LLM prompts stable for better upstream prompt-cache behaviour. (blog.modelcontextprotocol.io)

If you have ever watched an agent “thrash” because the tool catalogue changes ordering or contents between requests, you already know why this matters. Deterministic tools/list is how you stop accidental prompt churn.

How to implement caching without causing an incident

Treat tool discovery like any other high-value metadata endpoint:

1. Decide the cache key. In enterprises it is rarely “just the server URL”. A safer baseline is: - protocol version - server build/version - auth principal class (user vs app) - tenant / org - policy bundle version (what’s allowed)

1. Apply TTLs and scope carefully. The spec’s direction is to make list responses cacheable, but you should still assume: - Tool visibility can be permissioned. - Tool schemas can include hints about sensitive header-bound inputs.

1. Make tools/list stable and boring. - Stable order (sort by name, then version, etc.). (github.com) - No per-request randomness. - No “helpful” dynamic descriptions that depend on the user’s recent activity.

Do not:

• Cache tools/list across tenants or across identity classes unless you can prove it is identical. This is how you end up advertising privileged tools to the wrong place.

MRTR: multi-step tools without long-lived streams

Prior to this revision, server-initiated interactions (elicitation/sampling/roots) typically meant holding an SSE stream open back to the client. That is operationally awkward for many remote deployments.

MRTR (SEP-2322) changes the model: server-to-client requests are handled in the context of a client-initiated request, and any necessary continuity is externalised via an opaque requestState token returned to the client and replayed on retry. (github.com)

The key operational consequence is: you can support multi-step tool calls without sticky sessions or always-on bidirectional channels.

MRTR implementation guidance

• Keep requestState opaque and integrity-protected (sign it or store it server-side and issue a handle). If it can be tampered with, you have a privilege escalation vector.
• Decide how you expire MRTR state. You need a TTL and a clear user experience for “this confirmation expired, please retry”.
• Ensure idempotency: retries are normal in MRTR flows.

Auth hardening: how to pass security reviews faster (and safer)

The 2026-07-28 update explicitly calls out authorisation hardening, including issuer validation alignment with RFC 9207 and moving away from Dynamic Client Registration towards client metadata documents (CIMD). (blog.modelcontextprotocol.io)

That lines up with what security researchers are seeing in the wild: recent measurement work on OAuth-enabled remote MCP servers reports widespread authentication flaws, with DCR-related issues being particularly common in their sample. (arxiv.org)

A pragmatic enterprise pattern: inbound vs outbound auth

One of the cleanest ways to make this reviewable is to split:

• Inbound authentication: the agent/client authenticates to your MCP server/gateway.
• Outbound authentication: your MCP server authenticates to downstream SaaS, internal APIs, or external MCP servers.

Microsoft’s Azure MCP Server documentation describes this explicitly, including token validation expectations and the fact that application tokens cannot be used for On-Behalf-Of because there is no user identity to exchange. (github.com)

Controls reviewers actually care about

• JWT validation: issuer, audience, expiry, signature, and scopes/roles.
• Clear persona separation: user-delegated tokens vs app/service tokens, and what each can do.
• Egress governance: if MCP tools can call downstream services, you need allow-lists, per-tool scopes, and logs.

If you do nothing else, do this:

• Disable or tightly constrain Dynamic Client Registration unless you have a compelling reason and expertise to run it safely.
• Require deterministic tool listing and a stable policy layer so “what tools exist” is reviewable and auditable.

Every prompt a user sees should trace back to something they or their agent started.

That principle is now reinforced at the protocol level by constraining when server-initiated interactions can occur (MRTR only within active request processing), which is helpful both for user trust and audit narratives. (aws.amazon.com)

Putting it together: a reference rollout plan

1. Upgrade transports and SDKs to 2026-07-28 with stateless mode enabled (don’t run “hybrid semantics” longer than necessary). (github.com)

1. Put a gateway in front that: - Enforces Mcp-Method / Mcp-Name header correctness. - Applies per-tool allow-lists. - Terminates auth and injects identity context in a controlled way.

1. Implement cacheable discovery safely: - Deterministic tools/list output. (github.com) - Cache keys include tenant and principal class.

1. Adopt MRTR only for tools that genuinely need it: - Elicitation/confirmation flows. - Long-running operations where you want explicit progress and retry semantics.

1. Write the security review pack up front: - Threat model: tool poisoning, prompt injection, privilege escalation in multi-server flows (these are recurring themes in MCP security literature). (arxiv.org) - Concrete controls: token validation, scope mapping, egress restrictions, audit logs, and cache boundaries.

Where codeversols fits (briefly)

If you’re adopting MCP 2026-07-28 in a real enterprise environment, most of the work is not “write a tool” — it’s designing the routing, caching and auth boundaries so you can scale without creating an unreviewable integration blob. codeversols helps teams ship that platform layer (gateway policies, stateless server patterns, and secure auth flows) alongside product work across web, mobile, AI and cloud.

Close

MCP 2026-07-28 gives you a cleaner operational model: stateless servers, routable headers, cacheable listings, and MRTR instead of long-lived streams. The win is faster discovery and simpler scaling; the cost is that your gateway and auth design become the real protocol implementation. Treat headers and caching as part of the security boundary, make state explicit, and MRTR becomes an enabler rather than a new class of production incident.