MCP 2026-07-28 Is Final: Recheck GitHub MCP Initialization Assumptions
The final specification removes the preview lifecycle handshake, protocol sessions, and most capability negotiation, so draft-era product guidance cannot be carried forward unchanged
Key takeaways
The Model Context Protocol project released MCP 2026-07-28 on July 28, 2026. The final specification removes the initialize lifecycle, protocol-level sessions, and most capability negotiation. Requests are self-describing, and workflows that need continuity use explicit handles rather than hidden session state. ENHE's original July 24 page had carried forward prerelease information, so this update corrects the record using the final specification and GitHub's current guidance. Teams should identify the version used by each client, server, SDK, and hosted product, test authentication and discovery behavior with non-sensitive data, verify errors and rollback, and keep human approval for high-risk tools before moving real work.
# MCP 2026-07-28 Is Final: Recheck GitHub MCP Initialization Assumptions
Published: July 29, 2026
Table of contents
- Direct answer
- Fact sources
- Assessment steps
- Why it matters
- Impact for ordinary AI users
- Related tools and tutorials
- FAQ
- Source links
Direct answer
MCP 2026-07-28 is now final. It removes the initialize lifecycle, protocol Session IDs, and most capability negotiation. Each JSON-RPC request should carry enough information for the server to complete the interaction, while workflows that need continuity use explicit handles. Clients and servers that still use MCP 2025-11-25 should not switch blindly, and product-specific behavior such as GitHub MCP must be checked against current release documentation.
Fact sources
The official MCP release post says the 2026-07-28 specification shipped on July 28, 2026. It removes the initialization handshake, protocol-level sessions, and most capability negotiation. A request now carries what the server needs for one interaction, while explicit handles represent continuity when a workflow requires it.
The final changelog also requires JSON text sequences, JSON-RPC IDs for requests, and HTTP headers for authorization and protocol context. Server discovery is optional, so a client may send an atomic request directly to a known endpoint. Dynamic client registration remains deprecated as authentication moves toward Client ID Metadata Documents.
ENHE's original July 24 page had said every connection would initialize first based on prerelease information. The final MCP specification and GitHub's current page both say initialize and sessions are removed, so this update corrects the existing record rather than creating a duplicate. Claude and AWS also announced support for the final specification.
How to check an MCP 2026-07-28 upgrade
- Record the MCP version used by every client, server, SDK, and product, separating 2025-11-25 from 2026-07-28 instead of relying on product names.
- Check whether the implementation still sends initialize or depends on Session IDs. If product documentation requires them, confirm whether it uses the older protocol or a compatibility layer.
- Test JSON-RPC IDs, HTTP authorization headers, errors, timeouts, retries, and explicit handles with sample accounts and non-sensitive data.
- Recheck discovery for tools, resources, and prompts. The final specification makes server discovery optional, so older clients cannot assume every capability is negotiated dynamically.
- Preserve least privilege, human approval, audit logs, rate limits, and revocation. Removing protocol sessions does not remove business state or security responsibility.
- Expand real use only after interoperability works, failures are diagnosable, rollback to the previous version is tested, and high-risk actions remain reviewable.
Why it matters
The release shows that a protocol draft can change materially before it becomes final. A client that waits for initialize, relies on hidden sessions, or assumes dynamic capability negotiation may fail or become difficult to diagnose. The practical task is not chasing a version number but identifying the exact contract used by each AI tool, desktop assistant, and coding agent while keeping a clear upgrade and rollback path.
Impact for ordinary AI users
Users of Claude, GitHub MCP, local MCP servers, or AgentCore Gateway may temporarily face mixed protocol generations. Content creation, document organization, coding, and team knowledge connections should begin with version checks, then test authentication, tool scope, result consistency, and recovery. The absence of a protocol Session ID does not mean a service stores no business data or that tool calls can run without approval.
Related tools and tutorials
ENHE's existing MCP terminology, remote-versus-local server selection, upgrade testing, and protocol analysis remain useful task entry points, but this July 29, 2026 update should be the factual baseline. ENHE explains public specifications and verification methods; it does not guarantee compatibility for any client, server, or cloud service.
Continue the workflow with AI news and event tracking, AI software and local tools, AI skill tutorials and safer testing, AI account services and permission boundaries.
FAQ
Does MCP 2026-07-28 still require initialize?
No. The final specification removes the initialize lifecycle. A client or server that still requires it may use MCP 2025-11-25, a preview draft, or a product-specific compatibility layer. Check the version declared by both sides.
Does removing protocol Session IDs make MCP completely stateless?
No. The protocol removes hidden lifecycle sessions but permits explicit handles for continued work. Applications, accounts, databases, and tools can still keep business state and need permissions, logs, expiry, and revocation.
Should ordinary users upgrade every MCP connection immediately?
No. Identify client and server versions, test interoperability, authentication, tool scope, errors, and rollback with sample data, then migrate real accounts and documents gradually.
Source links
- Model Context Protocol Blog：MCP 2026-07-28正式发布（2026-07-28）
- Model Context Protocol：2026-07-28 Changelog
- GitHub Changelog：GitHub MCP Server支持最新MCP规范（2026-07-23）
- Claude Blog：Bringing MCP 2026-07-28 to Claude
- AWS Machine Learning Blog：AgentCore Gateway支持MCP 2026-07-28
- GitHub Docs：Setting up the GitHub MCP Server
What this means for everyday users
ENHE users should record protocol versions and separately verify initialize, Session IDs, discovery, authentication, explicit handles, and rollback for each client, server, and hosted product.
Related reading
From Chat Boxes to Personal AI Companions: AI Assistants Are Entering the Desktop Execution Era
AI assistants are moving from answering questions toward continuing real tasks. AI agents, MCP tool ecosystems, personal memory, and local workbenches are pushing this shift together. For users, the real value is not another chat box, but less repeated context setup and more continuity from thinking to doing.
Copilot in Visual Studio Adds PR Exploration, a BYOM Migration, and NuGet Fixes
GitHub summarized three September updates for Copilot in Visual Studio 2026 on October 22, 2026. The Git agent can explore an attached pull request and link back to comments and files. Bring Your Own Model remains in preview but now requires the new Agent experience, and previously configured Ollama models must be added again. NuGet Audit warnings can open Copilot Chat with the NuGet MCP server to propose dependency fixes. This article gives .NET developers a cautious upgrade checklist: preserve current settings, validate each feature independently, review package and lock-file changes, run targeted tests and vulnerability scans, and keep a rollback path. Summaries and suggested fixes remain review inputs, not verified outcomes.
Bayer Shares Production Lessons From 22 Specialist Agents: HTTP Success Is Not Task Success
AWS published Bayer Crop Science’s Agentic Decision Engine case study on October 23, 2026. The production system runs 22 specialist agents over governed analytics workflows, models, logs, and visualization tools. This article turns the architecture into five reusable acceptance checks for enterprise agent teams: persist the state needed to resume work, define identity and authorization at every boundary, scope each agent’s tool catalog, distinguish transport success from task success, and release to a gated group before broader access. It also explains why Bayer’s adoption and resolution figures are evidence about one implementation, not promises for another organization. The focus is operational proof, least privilege, rollback, and observable outcomes rather than prompt polish.
GitHub Copilot in Teams Turns Notifications Into Pull Requests: What to Check Before Review
GitHub updated its Microsoft Teams app on October 23, 2026, so an issue notification in a channel, group chat, or private chat can become a Copilot task that investigates the problem, proposes a fix, and opens a pull request. This article helps development and product teams adopt the workflow without mistaking an automated pull request for shipped code. It explains the consolidated app, repository connection, the November 16 retirement of the legacy GitHub app, and the review boundary. A practical acceptance checklist asks teams to reproduce the issue, inspect changed files, run targeted tests, verify permissions, and keep merge and deployment as explicit human decisions.
IskayPet Connects SharePoint to a Managed Knowledge Base: Validate Permissions Before Answers
AWS published IskayPet’s corporate knowledge assistant case study on October 22, 2026. The system connects Amazon Bedrock Managed Knowledge Bases to existing SharePoint repositories and answers cited questions across retail operations, veterinary care, onboarding, and procurement in four languages and three countries. This article turns the case into a practical acceptance plan for knowledge owners. It checks source scope, inherited permissions, hybrid retrieval, duplicate and fragment removal, citation quality, feedback, and token cost before expansion. It also separates the customer’s reported production results from what another organization should expect. A managed retrieval stack reduces infrastructure work, but it does not remove content ownership, access reviews, evaluation datasets, or human verification of important answers.
GitHub Copilot Metrics Add OpenCode and Other Clients: Requests Are Not Prompts
GitHub added totals_by_client to the Copilot usage metrics API on October 23, 2026. Enterprise and organization reports can now show model traffic from OpenCode, Claude Code, Codex, Zed, Copilot CLI, GitHub apps, cloud agents, code review, VS Code, JetBrains, and other clients. This article helps administrators build reliable one-day and 28-day reports without confusing model calls with user prompts. It explains request, session, token, model, and selection-mode fields; separates client traffic from agent-app jobs; and adds checks for unknown identifiers, empty arrays, permissions, and coverage. The result is a governance trend report, not an exact invoice or individual productivity score.
Summary
MCP 2026-07-28 shifts the protocol from connection lifecycle state toward self-describing requests and explicit continuity. The simpler core increases the need to distinguish protocol versions, product implementations, and business state. A successful upgrade means clear contracts, constrained permissions, diagnosable failures, and tested rollback, not merely one successful connection.
Sources
Model Context Protocol Blog：MCP 2026-07-28正式发布（2026-07-28）
Model Context Protocol：2026-07-28 Changelog
GitHub Changelog：GitHub MCP Server支持最新MCP规范（2026-07-23）
Claude Blog：Bringing MCP 2026-07-28 to Claude
AWS Machine Learning Blog：AgentCore Gateway支持MCP 2026-07-28
GitHub Docs：Setting up the GitHub MCP Server