The Model Context Protocol spec dated 2026-07-28 is the release most teams building connectors will be migrating against this quarter, and its headline change is subtractive. Per the MCP project's own release notes, the new spec delivers a stateless protocol core, an Extensions framework, Tasks, MCP Apps, authorization hardening, and a formal deprecation policy. Google's developer blog, writing on the stateless work it led, is specific about what disappeared: the `initialize`/`initialized` handshake (SEP-2575) and the logical `Mcp-Session-Id` header (SEP-2567) were removed entirely.
That is not a cosmetic change for anyone running enterprise search or a knowledge-base connector at scale.
What you gain, and what you now own
The operational win is obvious. With no handshake and no session ID, any request can hit any replica. You stop pinning connections to instances, stop replicating session tables across regions, and stop paying the reconnection tax when a pod cycles. GitHub, which shipped support in its MCP Server ahead of the spec date, framed it exactly this way — the stateless core makes deployments easy to scale.
The cost is that the state did not vanish; it moved. Anything that used to ride implicitly in a session — the user's working set, prior query context, which documents were already surfaced, cursor positions in a long result — is now your application's problem. If you were leaning on session identity to scope permissions or cache retrieval results, you need an explicit design: a request-scoped identity token plus a durable store you control. Teams who built thin MCP wrappers over a vector index will feel this least. Teams who built conversational retrieval with server-side session memory will feel it most.
Long-running work gets a defined home rather than an implicit one: Tasks moved out of the experimental core into the `io.modelcontextprotocol/tasks` extension with a poll-based transport. For indexing and crawl jobs, that is the right shape — poll a task handle instead of holding a connection open.
Auth is consolidating too
Dynamic Client Registration is now formally deprecated in favor of CIMD; it still works for backward compatibility but is slated for removal. Cloudflare's write-up notes the release also introduces a formal feature lifecycle classifying features as Active, Deprecated, or Removed — which finally gives connector maintainers a scheduling signal instead of guesswork. On the buyer side, Anthropic shipped enterprise-managed authorization for Claude's MCP connectors, letting admins control connector auth centrally rather than per-user.
Where this meets retrieval
Microsoft's direction lines up: Azure AI Search knowledge bases are queryable via API or MCP, with agentic retrieval generally available in the 2026-04-01 REST API and the portal still preview-only. Microsoft is candid that agentic retrieval adds latency versus a single-query pipeline, buying multi-part questions, conversational context, and LLM paraphrasing in exchange.
The pattern: connectors get dumber and cheaper to scale, retrieval backends get smarter and permission-aware. Plan your state layer accordingly.