GitHub MCP Server adds stateless support for the July 28 MCP spec

GitHub has updated its MCP Server ahead of the July 28, 2026 Model Context Protocol specification release. The change matters because the new MCP core removes protocol-level sessions and the initialize handshake, which changes how remote tool servers scale, route, and validate agent traffic.

The update is not just GitHub adding another compatibility badge. It is an early production implementation from a major MCP server operator, tied to a release candidate that the MCP project describes as the largest protocol revision since launch.

GitHub removes Redis sessions from its MCP Server

GitHub says its MCP Server now supports the next MCP spec and has removed Redis sessions from the request path. Database writes during initialize are gone, and GitHub says database reads no longer happen on every call. For users, the expected effect is faster connections without losing server behavior. For platform teams, the more useful signal is architectural: a remote MCP server can move closer to ordinary stateless HTTP infrastructure.

The July 28 spec removes the Mcp-Session-Id header and the protocol-level session. Instead of pinning a client to the server instance that created a session, a request can land on any compatible instance. That makes round-robin load balancing and simpler horizontal scaling more realistic for hosted MCP servers.

Stateful applications still have a path. The MCP release candidate recommends explicit handles, such as a browser ID, basket ID, or task handle, passed through normal tool arguments when a workflow needs continuity.

The July 28 spec changes routing, caching, and validation

The stateless core adds transport details that matter in production. MCP requests now carry method information in HTTP headers such as Mcp-Method and Mcp-Name, letting gateways, load balancers, and rate-limiters route calls without inspecting every JSON-RPC body. The same spec work also defines caching metadata for list and resource-read results, so clients can know how long a tools/list response remains fresh.

GitHub says it avoided deep packet inspection in its own implementation by using the required headers for logging and secret scanning. That is a practical security and operations detail for teams running MCP behind shared gateways: useful request metadata can be made visible at the HTTP layer while the SDK still owns protocol validation.

The release candidate also documents W3C Trace Context propagation, which gives implementers a standard place for trace metadata as a tool call moves from host application to client SDK, MCP server, and downstream services.

MCP Apps and Tasks move through the extension track

The July 28 release also formalizes MCP extensions. The release candidate names MCP Apps and Tasks as official extensions, which separates fast-moving capabilities from the core protocol.

MCP Apps let servers provide interactive HTML interfaces for hosts to render in sandboxed iframes. The security-relevant part is that tools declare UI templates ahead of time, so hosts can prefetch, cache, and review them before runtime. UI-triggered actions still go through the same JSON-RPC and consent path as direct tool calls.

Tasks now use a lifecycle built for the stateless model. A server can return a task handle from tools/call, and the client can drive it with tasks/get, tasks/update, and tasks/cancel. The old experimental tasks/list shape is removed because the project says it cannot be safely scoped without sessions.

Agent-tooling teams should test against conformance suites

GitHub points builders to the official conformance suite, draft specification, and tier-one SDK implementations. That is the right next step for teams maintaining MCP clients, servers, gateways, or agent platforms that depend on remote tools.

The migration check is concrete. Look for code that assumes initialize, stores or forwards Mcp-Session-Id, matches the old missing-resource error code, or built against the experimental Tasks API. Also review authorization handling: the release candidate tightens OAuth and OpenID Connect behavior, including issuer validation and Dynamic Client Registration details.

The final MCP spec is scheduled for July 28, 2026. GitHub supporting it before that date gives teams a live reference point, but it does not remove the need to test custom servers and clients against the draft docs and conformance suite before switching production traffic.

Sources and methodology: this article uses GitHub's July 23 changelog as the primary source and the official Model Context Protocol release-candidate post for implementation context. For adjacent agent-tooling workflows, see LinkLoot's guide to AI agent tools.