The Protocol Learned to Stop and Ask

Killing protocol-level sessions in the 2026-07-28 MCP spec left a hole someone had to fill. Server-initiated requests used to need a held-open stream. Stateless servers don't have one.

Hence multi round-trip requests. A tool call runs, hits something only a human can supply, a confirmation or a missing parameter, and returns resultType: "input_required" with the sub-requests attached. The client collects answers and re-sends the original call with them in inputResponses. The server picks up from there.

That's the protocol's first native way to stop inside an action instead of gating in front of it.

The resume is a retry. And the NSA's May 2026 guidance is blunt that idempotency "is not directly enforced by MCP," delegating it to JSON-RPC and the message queue. Whether the second send does the work twice lives in your code. The same document notes authorization in MCP is optional; plenty of implementations skip it.

The spec gives you the pause. Resuming it safely is still your problem.

What else moved in 2026-07-28

• Sessions retired: No initialize handshake, no Mcp-Session-Id. Any request can land on any instance behind round-robin.
• Self-describing requests: Protocol version, client identity, and capabilities ride inside _meta on every call.
• App state, explicitly: Mint a handle from a tool, let the model pass it back as an argument. Visible instead of hidden in transport.
• Header routing: Mcp-Method and Mcp-Name required on Streamable HTTP. Gateways and WAFs route without parsing bodies.
• Issuer validation: Per RFC 9207, clients must check iss before redeeming a code. Credentials bind to the issuer that minted them.
• DCR deprecated: Client ID Metadata Documents take over. DCR still works for now.
• Also out: Roots, Sampling, Logging, and HTTP+SSE, with a twelve-month minimum offramp.