The release candidate locked May 21 and gave the ecosystem 10 weeks to prepare. Yesterday, the final 2026-07-28 spec went live. The breaking changes we covered two weeks ago are now in effect — sessions gone, initialize handshake removed, Mcp-Session-Id header gone, error code -32002 changed to -32602, legacy HTTP+SSE transport officially deprecated. If you act on one thing: update any code that catches that error code before your MCP server breaks on a client that's already updated.
But the breaking changes aren't the interesting part. The interesting part is what shipped alongside them.
Twelve companies on day one
AWS, Cloudflare, Figma, Google Cloud, Microsoft, Netlify, Supabase, Xero, Honeycomb, Replit, Runlayer, and Manufact all announced support the same day the spec dropped. That's a coordinated launch, not coincidence — it means these teams were working against the release candidate for weeks and had their implementations ready before the final version was even out.
The practical takeaway: this isn't a spec you evaluate and maybe adopt in Q4. When your accounting software (Xero), your design tool (Figma), your cloud provider (AWS, Google Cloud), and your hosting platform (Netlify, Cloudflare) all converge on the same protocol on the same day, the decision is made for you.
The download numbers make the same point differently. The TypeScript SDK crossed 1 billion total downloads. So did the Python SDK. Tier 1 SDKs are now running at roughly 500 million downloads per month combined. That's the kind of scale that locks in a standard — the same way JSON stopped being optional for APIs around 2010.
MCP went from "interesting developer protocol" to infrastructure in about 18 months. Yesterday was the official declaration.
What the MCP Apps extension actually does
Two new extensions shipped with the final spec. The Tasks extension — contributed by AWS — adds poll-based support for long-running work via tasks/get, tasks/update, and tasks/cancel. That fills a real gap: before this, there was no clean way to track a multi-minute operation without holding an open connection.
The MCP Apps extension is the stranger and more interesting one. It allows MCP servers to return server-rendered HTML, displayed inside sandboxed iframes within AI clients. That means a tool inside Claude or another MCP-supporting client could show an actual styled approval form, a summary table, or a picker — not a text-formatted list, but rendered UI. The server doesn't need a web presence. The AI client hosts the frame.
For most people using AI tools today, this won't be visible yet. But it changes what's buildable. A business tool that connects to your CRM through MCP could surface a structured approval interface right inside your AI assistant's window, without redirecting you to a separate app. The category it enables is "embedded mini-apps inside AI clients," and that's genuinely new territory.
Caching is now in the protocol
Smaller but worth knowing: list responses are now cacheable at the protocol level. MCP servers can return ttlMs and cacheScope parameters alongside tool and resource lists, letting clients hold those lists for a set window before re-fetching.
In practice, this cuts API calls. When an AI client needs to know what tools a server has available, it no longer asks every time. It asks once, caches the answer, and only re-asks when the TTL expires. For workflows with lots of short agent runs — lead qualifiers, content checks, scheduled monitors — that adds up. Fewer calls means lower API costs and faster response starts.
Every request no longer starts with a capabilities handshake. That's not dramatic, but over thousands of runs a week it's real money.
The deprecation clock is running
Roots, Sampling, and Logging entered a 12-month minimum deprecation window when the spec shipped. Nothing breaks yet. The earliest any of these gets removed is July 2027, and that's only if the next spec cycle actually removes them.
Roots gives way to standard tool parameters and resource URIs. Sampling — which let MCP servers request LLM completions directly — gives way to calling the provider's API yourself. Logging moves to stderr on stdio transports, or OpenTelemetry for structured output. None of these are bad migrations; they're just migrations.
If you're not sure whether your MCP integrations use any of the three, whoever built them should check now. Not because anything is broken, but because finding out in June 2027 that you need to migrate production infrastructure before a deadline is worse than finding out today when nothing is on fire. If you need someone to look at your current setup, that's part of the AI automation work we do.
What this means for your business tools
Most small businesses aren't building MCP servers — they're using software that does. If you're on Claude Desktop, VS Code, Cursor, Figma, or Linear, your tools update themselves and you're already on the new spec or will be shortly. Same goes for any cloud services in that day-one list.
Where it shows up in practice is in capability. The stateless architecture means the AI tools connecting to your business software can now run on cheaper, simpler infrastructure — which eventually means lower prices or higher feature budgets for the same cost. The caching addition means faster connections. The MCP Apps extension opens a category of richer business-tool integrations that didn't exist a week ago.
None of that requires you to do anything today. But if you're evaluating whether to build AI-connected workflows for your business this year, the answer to "is MCP a safe foundation to build on?" just got a lot cleaner. Twelve major vendors didn't coordinate a simultaneous launch on a protocol they expect to abandon.
If you want to understand whether any of this applies to what you're building or considering, the plain-English MCP explainer covers the basics, and you're welcome to just ask — we'll tell you honestly whether your specific situation warrants any action.
Sources
- MCP 2026-07-28 Specification — MCP Blog, July 28, 2026
— Cole