MCP just went stateless. Here's what the new roadmap builds next.

The Model Context Protocol team published an updated roadmap this week, and it's worth reading beyond the headline. The previous roadmap from March targeted four areas: transport evolution, agent communication, governance, and enterprise readiness. They delivered on all four.

The changes landed in the 2026-07-28 spec release — and the biggest one is architectural.

"Protocol-level sessions and the initialization handshake are gone, so a server can scale horizontally without holding state."

That's not a minor tweak. That's MCP crossing from "interesting protocol" to "just another HTTP workload you can run anywhere."

What actually shipped

Stateless + sessionless by default — servers no longer hold per-client state. Horizontal scaling is now trivial (SEP-2575, SEP-2567)
server/discover — clients can probe supported versions and capabilities before connecting
Cacheable list results — less round-trip chatter for tool discovery (SEP-2549)
Tasks extension reworked — moved into an official extension after early adopter feedback (SEP-2663)
Multi Round-Trip Requests — replaced server-initiated requests so elicitation works on stateless servers (SEP-2322)
Enterprise auth hardened — issuer validation, issuer-bound client credentials, Client ID Metadata Documents (CIMD), and Enterprise-Managed Authorization now stable

What the new roadmap prioritises

Five areas, each with dedicated Working Groups:

Agentic messaging primitives — server-initiated events (webhooks and channels, so clients stop polling), plus maturing Tasks into the core spec. The goal: MCP handles long-running agentic loops natively.

HTTP-native transport unification — unify stdio and Streamable HTTP under one transport model. A local MCP server and a cloud-hosted one should behave identically.

Agent identity — this is the one worth watching. Today auth is built around a human approving in a browser. That doesn't work for agent-to-agent calls or unattended cloud workloads. The roadmap targets DPoP, Workload Identity Federation, and standard token exchange — with active engagement in IETF OAuth and WIMSE standards bodies.

Improved primitives — two specific problems: tools/call responses can carry output in multiple forms with no contract for which one clients use, and large tool catalogs (100+ tools) waste context tokens before a user asks anything. Progressive discovery is the proposed fix.

SDK developer experience — conformance testing, better docs, making it easier to build MCP clients and servers whether you're writing the code yourself or pointing an agent at the libraries.

What to do

Running MCP servers? The stateless shift is the most operationally significant change. Review SEP-2575 if you haven't — your deployment model may be able to simplify significantly.
Building agent-to-agent flows? The agent identity work is directly relevant. Watch the DPoP and Workload Identity Federation threads — pasting API keys between agents is the pattern they're replacing.
Shipping large tool catalogs? Progressive discovery is coming. Hold off on complex client-side filtering hacks and track SEP progress.
Want to contribute? Each priority area has a Working Group with open seats. Discord is the entry point.