The 2026-07-28 Model Context Protocol specification shipped on schedule late last month, and the fallout is landing now as SDKs and gateways catch up. Read it as infrastructure work, not a feature drop. The MCP maintainers (David Soria Parra and Den Delimarsky) describe it as the largest revision since launch: the `initialize`/`initialized` handshake and `Mcp-Session-Id` are gone, requests route on headers (`Mcp-Method`, `Mcp-Name`), and list and resource-read results can carry `ttlMs` and `cacheScope` caching metadata.
What changes if you ship a retrieval connector
If you wrapped a document store, wiki, or vector index in an MCP server, you were operating a stateful service: sticky routing, session affinity through the load balancer, state that died with the pod. Statelessly, any replica serves any request, and `tools/list` and resource reads become cacheable at your gateway or edge.
The tradeoff is that cache correctness is now your problem, and it lands exactly where knowledge systems are most fragile. A tool list is safe to cache broadly. A resource read against an ACL-filtered corpus is not — if `cacheScope` doesn't encode the identity whose permissions produced the result, you have built a cross-tenant leak with good p99 latency. Treat scope selection as an authorization decision reviewed like any other, not a perf knob.
Tasks, contributed by AWS, graduated from experimental core into the `io.modelcontextprotocol/tasks` extension (SEP-2663) with a stateless lifecycle: `tools/call` returns a handle, and the client drives `tasks/get`, `tasks/update`, and `tasks/cancel`. That's the right shape for the work retrieval teams currently smuggle through side-channel job APIs — reindexing, batch embedding, multi-hop research crawls that outlive a request timeout. Change notifications also consolidate into a single `subscriptions/listen` stream that clients opt into per type, which is the hook for index-freshness signals.
The governance half
Authorization moved toward deployed OAuth/OIDC practice, with Enterprise Managed Authorization shipping as an extension alongside Tasks and MCP Apps. The timing is not incidental: Obsidian Security raised $85M in August at a $1.1B valuation, and Reuters reported the company saying nearly 70% of its clients now let AI agents touch business data. Connector authorization is the perimeter, and it is being priced accordingly.
Migration is survivable. Roots, Sampling, Logging, and DCR carry a minimum twelve-month deprecation window, with HTTP+SSE on its own published removal schedule. Cloudflare's Agents SDK supported the spec from day zero.
Blunt read: if your policy enforcement already lives at a gateway, this revision is configuration work. If it lives inside session state on the server, you are looking at a rewrite, and the twelve-month clock is the only slack you get. Meanwhile Gemini 3.7 Flash keeps a 1M-token window at $0.75 per million input tokens under introductory pricing through year-end — cheap context does not fix permissions, which is the part of your stack this spec just made explicit.