The MCP Protocol Broke on July 28: Why an AI Integration Needs a Maintenance Budget

On July 28, 2026, the Model Context Protocol received a new specification version, and the successor to the November 25, 2025 edition is not a polish pass. MCP is the standard through which most AI agents are connected to company data today — to the document management system, the practice management software, the ERP. The protocol is now stateless: the handshake is gone, the session header is gone, a mandatory call has been added, and HTTP+SSE is deprecated. Anyone who built an MCP integration in 2025 or early 2026 has to touch it.

More interesting than the break itself is what it reveals about the cost structure of AI projects. Eight days later, on August 5, Anthropic shut down Claude Opus 4.1 — announced on June 5. Two entirely different events with the same effect: the ground you built on is moving underneath what you built. An AI integration is therefore not a project with an end date but an installation that needs upkeep — and that is a budget line missing from most quotes I see.

At a glance

• What applies: MCP version 2026-07-28 is stateless, server/discover is mandatory for servers, and subscriptions/listen replaces the HTTP GET stream. Roots, sampling, logging and HTTP+SSE are deprecated.
• What follows: For the first time, deprecations come with a window of at least twelve months — the legacy parts may not fall away before the end of July 2027. A planning horizon, not a safety net.
• The catch: Opus 4.1 was shut down 61 days after its announcement. If you wire a model in firmly, you have two months at best.

What was dropped on July 28

Until now an MCP connection was a session with memory: a handshake via initialize, held together by the Mcp-Session-Id header. Both are gone; the protocol version and client capabilities now travel along in the _meta field on every call.

Previously (version 2025-11-25)	From version 2026-07-28	Status
Session with Mcp-Session-Id header	no session, stateless	removed
initialize handshake	details in _meta	removed
—	server/discover	mandatory for servers
HTTP GET stream, resources/subscribe	subscriptions/listen	replaced
ping, logging/setLevel	—	removed
Server-initiated requests (roots/list, sampling/createMessage)	Multi Round-Trip Requests pattern	replaced
Roots, sampling, logging	still usable	deprecated, ≥ 12 months
HTTP+SSE, resumption via Last-Event-ID	resumption removed	deprecated

Two rows of this table hurt in production. Servers must implement server/discover — a home-built server that does not know the call is no longer fully valid on the new version. And resumption of interrupted streams has been removed: a broken stream loses the request in flight, and you have to build the retry yourself. On top of that comes a hardening of authentication: the iss check per RFC 9207 is mandatory, and dynamic client registration is deprecated.

The second variant: models disappear on a deadline

The protocol break is the most visible maintenance item of the quarter, not the most frequent. The most frequent one is more mundane: the model a product is wired to disappears. Claude Opus 4.1 was announced on June 5 and shut down on August 5 — 61 days. Anthropic commits to at least 60 days and retains model weights long term; that keeps old results reproducible but does not bring the endpoint back. Gemini Robotics ER 1.6 in its preview version had it shorter: announced on July 30, shut down as of August 31, 32 days. The difference between 61 and 32 days is the difference between two company policies, not between two legal regimes.

A model swap is also rarely a line of configuration. With Claude Opus 4.7 and later, the API parameters temperature, top_p and top_k are abolished: a deviating value returns a 400 error, and in the Python SDK from version 1.0 onward they raise a TypeError. Existing code that sets a temperature — practically every project from 2024 and 2025 — breaks hard on migration. That is not a typo fix but a change in behavior you have to sign off on again. And the invoice moves too: on August 16, DeepSeek raised the output price for V4-Pro from a flat 0.87 US dollars per million tokens to up to 3.96 at peak times — anyone who costed with 0.87 is now looking at roughly 4.5 times that.

Why this is not a scandal all the same

First: the change is largely an improvement. In the expert discussion that started in late July, statelessness was assessed positively — it makes load balancing and scaling of MCP servers considerably easier. A session-bound protocol forces every request back onto the same instance.

Second: the same break delivers predictability for the first time. The new version brings a lifecycle policy with a deprecation window of at least twelve months; before that there was no committed deadline. Complaining about the break while omitting the deadline would be unfair.

Third: none of this breaks today. Roots, sampling, logging and HTTP+SSE are deprecated, not removed; an old client against an old server keeps working. The pressure arises in the surroundings: Microsoft’s AutoGen moved to the new MCP version as early as July 28, and Azure AI Foundry added an MCP connector for Claude models in August. Whoever keeps the old version does not drop out of operation but out of the support of everything moving on around them.

Not built and finished, but readjusted: the beam carries again because someone set a new piece into it. The mark sits above the repair — where the work falls due that no specification ever provided for.

What this means for your company

Inventory the dependencies before you budget for them. Four columns are enough: which model endpoints do we call by name? Which protocol and SDK versions are we running? Which vendor, and what notice period have they committed to? And who here notices when any of it changes? The fourth column is the one most often empty. If a service provider built the integration, asking about their migration status for version 2026-07-28 is a good opportunity to obtain that inventory from them.

Treat the model swap as the normal case, not as a disruption. The model name belongs in configuration, not in code; you need a test suite on your own tasks that runs after a swap; and the contract should name the notice period and the consequences of its expiry rather than leaving it to vendor policy. How quickly a dependency turns into a trap was shown by the Fable 5 case — there the model was gone within a day, with no notice at all. That switching costs also sit in accumulated context is covered under context lock-in, and the underlying trade-off in the article on vendor lock-in in AI.

Set a fixed maintenance line and derive its size from the deadlines. No one can give you a defensible percentage — it depends on how deeply you are integrated. You can calculate with the deadlines on the table, though: twelve months of deprecation window means at least one planned migration slot per year; 60 days of committed notice means you have to be able to react within two months — at another vendor it was 32 days. The third number is your own: how long does your team need to swap a model dependency and sign it off? If that is more than two months, you do not have a budget problem but an architecture problem — and money does not solve that, decoupling does.

Conclusion

The MCP changes are technically sensible, they come with a deadline that did not exist before, and nobody has to switch anything off today. That is precisely what makes them instructive: the effort does not arise because someone made a mistake, but because the layer AI applications stand on is still young and improving. Layers like that keep moving — protocol, model, price.

So cost an AI integration like an installation, not like a project: with an inventory, with deadlines, with a line item for the rebuild that is certain to come, and with an architecture in which a model swap costs days rather than quarters. Plan for that and you will experience notices like the one from July 28 as an appointment — fail to plan for it and you will experience them as an incident.

If you want to know which of your integrations the new MCP version affects and what a realistic maintenance line looks like in your case, let’s talk. I read questions like these as a business lawyer and build the integrations in question myself.

FAQ

What changed in MCP on July 28, 2026?

Version 2026-07-28 is a breaking change: sessions along with the Mcp-Session-Id header and the initialize handshake are gone, and the protocol is now stateless. The server/discover call is newly mandatory for servers, and subscriptions/listen replaces the HTTP GET stream. Roots, sampling, logging and the old HTTP+SSE transport are deprecated.

Do I have to rebuild my existing MCP integration right away?

Not right away. The deprecated parts remain usable, and the specification introduces a deprecation window of at least twelve months for the first time, counting from July 28, 2026. The pressure comes from the surroundings: tools and platforms are moving over, and whoever keeps the old version drops out of their support.

How large should the maintenance budget for an AI integration be?

No one can give you a defensible percentage — it depends on how deeply you are integrated. Derive the size from the deadlines instead: twelve months of deprecation window means at least one migration slot per year, and 60 days of committed notice means being able to react within two months. Anyone who needs longer has an architecture problem, not a budget problem.

How often do AI models a product is wired to disappear?

Regularly, with varying notice depending on the vendor. Claude Opus 4.1 was announced on June 5, 2026 and shut down on August 5 — 61 days; Anthropic commits to at least 60 days. Gemini Robotics ER 1.6 in its preview version had 32 days. The notice period is vendor policy, not a legal entitlement.

---

Sources — as of 19.08.2026

• MCP specification 2026-07-28, changelog — https://modelcontextprotocol.io/specification/2026-07-28/changelog
• Pull request in the specification repository — https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2575
• Simon Willison on the stateless MCP version — https://simonwillison.net/2026/Jul/31/stateless-mcp/
• Anthropic: deprecations, deadlines, abolished API parameters — https://platform.claude.com/docs/en/about-claude/model-deprecations
• Anthropic: commitments on deprecations and model weights — https://www.anthropic.com/research/deprecation-commitments
• Google: Gemini API changelog — https://ai.google.dev/gemini-api/docs/changelog
• DeepSeek: API pricing overview — https://api-docs.deepseek.com/quick_start/pricing
• Microsoft AutoGen, release overview — https://github.com/microsoft/autogen/releases
• Microsoft Foundry: new Claude capabilities including an MCP connector — https://devblogs.microsoft.com/foundry/five-new-claude-capabilities-now-available-in-foundry/

This article is general information and not legal advice in an individual case. As of August 19, 2026; protocol and model deadlines move quickly, so please check the current state before making decisions.