Is this the MCP v2 release?

Not officially — but co-creator David Soria Parra said on Sept 28, 2026 that 'some people jokingly call it a v2, and I think in spirit that's accurate': the biggest change ever made to the protocol, and the step that makes MCP usable by the largest players. Note the distinction: the 2026-07-28 spec revision removed initialize and Mcp-Session-Id; the Sept 28 release finalizes the stateless architecture and adds auth hardening, the deprecation policy, and the extension graduations.

What does MCP going stateless mean for my MCP server?

Your server no longer maintains protocol sessions: the initialize handshake and Mcp-Session-Id are gone. Per-request _meta carries protocol version, client info, and capabilities on every request; server/discover replaces the capability exchange. Any request can land on any instance — you can run behind plain HTTP load balancers with no sticky routing and no session store. The tradeoff: cross-call state becomes explicit handles your server mints and accepts as ordinary tool arguments, and payloads get slightly bigger (compressible). Most developers build on official SDKs (TypeScript, Python, C#, Rust, Java), which absorb the migration.

How does the Sept 28 MCP update connect to payment authorization?

Two honest connections. First, the new Enterprise Managed Authorization extension (built with Okta) lets organizations make their corporate identity provider the authoritative gatekeeper for MCP server access — identity-side gating, now standardized. Second, statelessness makes million-tool-call-per-day MCP server farms cheap to run; where tool calls are billed per call (x402 micropayments), every call is a payment decision, and the scored confidence gate — >=0.80 auto-execute, 0.50-0.79 hold for human review, <0.50 block — is the authorization layer that judgment lives in.

Which MCP features are deprecated and when can they be removed?

The 2026-07-28 cohort: Roots (local-filesystem concept that never generalized), Sampling (server asking the client to run LLM calls — a backwards trust dependency), Logging (use stderr/OpenTelemetry), and Dynamic Client Registration (use explicit OAuth registration). Under the new policy a feature must sit in Deprecated for at least 12 months before removal — so nothing from this cohort can be removed before July 2027 at the earliest. The policy was calibrated with Google, Microsoft, and Amazon.

SCRIPTMASTERLABS · THE X402 / MCP / AI-AGENT PEDIA · SEP 28, 2026

What Is the New MCP Update?

Q: What is the new MCP update (September 2026)?

On September 28, 2026, the Agentic AI Foundation shipped MCP's biggest-ever release under Linux Foundation stewardship: a fully stateless architecture (any request can land on any server instance behind standard load balancers), hardened OAuth authorization (mandatory issuer validation closing mix-up attacks), a formal 12-month deprecation policy, and two capabilities graduated to official extensions — MCP Apps (server-rendered interactive UIs) and MCP Tasks (long-running async work with durable handles) — plus multi-round-trip request negotiation and the Okta-built Enterprise Managed Authorization extension.

Q: Which MCP features are deprecated and when can they be removed?

The 2026-07-28 cohort: Roots (local-filesystem concept that never generalized), Sampling (server asking the client to run LLM calls — a backwards trust dependency), Logging (use stderr/OpenTelemetry), and Dynamic Client Registration (use explicit OAuth registration). Under the new policy a feature must sit in Deprecated for at least 12 months before removal — so nothing from this cohort can be removed before July 2027 at the earliest. The policy was calibrated with Google, Microsoft, and Amazon.

The short answer: on September 28, 2026, the Agentic AI Foundation (a Linux Foundation directed fund) shipped the biggest release in MCP's history — finalized stateless architecture, hardened OAuth authorization, a formal 12-month deprecation policy, and MCP Apps + MCP Tasks graduated to official extensions. Co-creator David Soria Parra said "some people jokingly call it a v2, and I think in spirit that's accurate."

The part nobody is saying: statelessness makes million-tool-call-per-day MCP server farms cheap to run — and where tool calls are billed per call, every single one becomes a payment decision. The per-call confidence gate is the authorization layer that judgment lives in.

The distinction the current field doesn't make

Search "MCP update" today and you'll get July stories: Medium's migration map (Sept 14), hackernoon's deprecation read, Nordic APIs (Sept 3), GitHub migration notes. All cover the 2026-07-28 spec revision — the removal of the initialize handshake and Mcp-Session-Id. Today's VentureBeat exclusive is a different release: the Sept-28 package finalizes the stateless architecture at enterprise scale and adds auth hardening, the deprecation policy, and the extension graduations. The statelessness was a long arc — December 2024 design discussion (Justin Spahr-Summers flagged stateful connections as poison for serverless), December 2025 maintainer commitment, July 2026 spec cut — and today's release is the capstone, not the first step.

The receipts: dated, sourced

SEPT 28, 2026 — BIGGEST MCP RELEASE EVER (AAIF)

The headline: "the largest update since Anthropic released it twenty months ago" — a sweeping architectural revision maintainers and backers say "finally makes agentic AI ready for massive enterprise production deployments." (VentureBeat, Sept 28, 2026 — exclusive interviews with Soria Parra, Den Delimarsky, and Mazin Gilbert)
Stateless, finalized: no protocol-level session, no sticky routing, no shared session store. "Your MCP client can speak to a load balancer that connects with any server." Operators run MCP servers behind the same Kubernetes/cloud-native tooling they already run. Tens of thousands of agents per deployment now architecturally possible.
Auth hardening: mandatory validation of the OAuth issuer (iss) parameter — a protocol-level defense that closes an entire class of mix-up attacks (a client tricked into associating an authorization response with the wrong identity server). Den Delimarsky, explicitly: no known exploitation — "preventive engineering, not incident response," done with the security community.
Enterprise Managed Authorization extension (built with Okta): organizations can make their corporate identity provider the authoritative gatekeeper for MCP server access — corporate credentials, not personal ones, gating which data sources a client may reach.
Apps + Tasks graduated: MCP Apps (server-rendered interactive UIs — dashboards, forms, visualizations inside AI clients) and MCP Tasks (durable task handles; clients can disconnect, crash, restart, and resume polling) are now official extensions. A third addition, multi-round-trip requests, lets server and client negotiate parameters back and forth within one logical operation.
Governance numbers: AAIF grew from ~40 members at its December 2025 inauguration to 240 — "the fastest growing foundation" in Linux Foundation history by membership, "signing up one member every day" (Gilbert). Anthropic's contribution share has fallen below half; the core maintainer group spans Anthropic, Microsoft, OpenAI, Google, and Amazon. Soria Parra on residual control: "I do have veto rights, technically" — "we have never actively used it."

THE LONG ARC (WHY "BIGGEST EVER" IS EARNED)

Dec 2024: MCP co-creator Justin Spahr-Summers opens a public design discussion — long-lived, stateful connections are limiting for serverless deployments. Engineers from Vercel, Cloudflare, Shopify, and Amazon weigh in.
Dec 2025: maintainers formally commit to the stateless direction; Anthropic donates MCP to the newly formed AAIF alongside founding projects from Block and OpenAI.
2026-07-28: the spec revision lands — initialize gone, Mcp-Session-Id gone, server/discover added, per-request _meta, first deprecation cohort (Roots, Sampling, Logging, Dynamic Client Registration).
Sept 28, 2026: the enterprise finalization — the capstone release above.

WHAT IT COST (THE MAINTAINERS WERE UNUSUALLY CANDID)

Bigger payloads: state doesn't disappear, it rides the wire with every request. Compressible, small vs a web HTTP request, but real.
Rare features gone or narrowed: out-of-band server logging — where a server could push log messages to a client at any moment — no longer works in the stateless model. The team scraped all of GitHub: "basically nobody" used it. "Probably a handful of people — quite literally a handful of people."
The 12-month policy is a promise, not a countdown: "I think it's more of a feedback period than a definite period" (Soria Parra). Nothing in the 2026-07-28 cohort can be removed before July 2027.

The field's answers — and what each lacks

Medium (Sept 14): the best migration map for the July revision — gone handshake, gone sessions, per-feature migration shapes. But it covers July, not today: no auth hardening, no Okta extension, no Apps/Tasks graduation, no gate angle.
hackernoon: the best read on the quiet headline — the deprecation lifecycle. Still a July story; no dated Sept-28 receipts, no governance numbers, no builder authorization layer.
GitHub migration notes (alexuvlab, giantswarm, signoz): excellent engineering detail, zero news context, zero payment/authorization angle.
Nobody owns the "today's release vs the July revision" distinction, the enterprise-authorization connection, or a live testable endpoint behind the claims.

Why this update makes the gate MORE important, not less

Three honest connections — none forced:

Enterprise Managed Authorization is identity-side gating, standardized. The protocol just shipped the corporate-IdP-as-gatekeeper pattern as an extension. That's the authorization instinct made official — now it needs the judgment layer behind it: not just who may call, but whether this particular call should fire.
Stateless scale multiplies paid tool calls. Any request landing on any instance behind a load balancer is exactly the shape of per-call-billed agent infrastructure. ProBlocks charges 0.001 USDC per x402 call; our own SML endpoints bill 0.01 USDC listings. At a million calls a day, "who pays for the failed attempt that ignored a clear instruction" stops being a thought experiment. Each call wants a scored decision — ≥0.80 auto-execute, 0.50–0.79 hold, <0.50 block — not a blanket credential.
Apps + Tasks are where the money will hide. MCP Apps renders interactive UIs inside clients — dashboards, forms, checkout surfaces. MCP Tasks runs long async jobs with durable handles. A server-rendered "Pay now" form and a resumable paid job are both payment decisions that happen inside the protocol — and the multi-round-trip request shape is the wire-level space where a confirm band (0.50–0.79) can live between negotiation and execution.

The protocol made authorization official. It made scale cheap. The judgment layer between them is the decision gate: decision-gated machine payments.

Live this morning: the gate scores paid MCP tool calls

Our confidence gate (per-call bands from /api/harness/status: ≥0.80 auto-act, 0.50–0.79 advisory, <0.50 escalate; decider local-heuristic-v1, calibrated=false — see caveats). Two stateless-era scenarios, scored ~09:20 EDT Sept 28, 2026:

RECEIPT 1 — SINGLE PAID TOOL CALL, IN BUDGET: 0.6457 → ADVISORY (HOLD)

An agent behind a load balancer calling one paid x402 MCP tool (0.001 USDC/call, signed receipts, 4.20 of a 50 USDC daily budget spent) scores 0.6457 — advisory band: hold for human review / escrow. Even the routine case doesn't auto-execute without a wired, calibrated decider.

RECEIPT 2 — UNCAPPED BULK PAID CALLS: 0.7964 → ADVISORY (HOLD)

The same surface with no spending cap, no per-call authorization, and no audit record of which decisions the agent made alone scores 0.7964 — just under the 0.80 auto-act line: held. Stateless scale doesn't buy a free pass; it buys scrutiny.

curl -s -X POST "https://scriptmasterlabs.com/api/harness/decide" \
  -H "Content-Type: application/json" \
  -d '{"state":"AI agent behind a load balancer is making millions of MCP tool calls per hour to a paid tool with no spending cap and no per-call authorization, each call billed 0.10 USDC, no budget envelope defined, no audit record of which decisions the agent made alone",
       "questions":[{"id":"authorize_bulk","type":"noul",
                     "question":"Should the agent be allowed to continue issuing paid tool calls with no per-call authorization?"}]}'

Verified live 2026-09-28 ~09:20 EDT at /api/harness/status (decider: local-heuristic-v1, calibrated=false; TypeSafe Jev API not yet wired — see caveats). The gate emits an authorization signal; it never moves money itself. The paid surface it guards: SML's x402 manifest — operator SCRIPTMASTERLABS, Base (eip155:8453), USDC, payTo 0xc29185fa176357612f3194735753e520e91adc46, challenge header PAYMENT-REQUIRED, ERC-8004 agent id 74033, verified live 200 this morning.

Do it yourself: 5 steps, this week

Find your stateful assumptions. grep your server for initialize, Mcp-Session-Id, and anything keyed to a connection. Replace capability exchange with server/discover and carry protocol version, client info, and capabilities in per-request _meta.
Make cross-call state explicit. Mint handles (draft IDs, job IDs, receipt IDs) and accept them as ordinary tool arguments. Expiring, ownable, log-searchable — the opposite of "the connection remembers."
Put yourself on the 12-month clock. If you use Roots, Sampling, Logging, or Dynamic Client Registration, plan the migration now: tool parameters/resource URIs instead of Roots, direct LLM calls instead of Sampling, stderr/OpenTelemetry instead of protocol logging, explicit OAuth registration instead of DCR. Earliest removal: July 2027.
Adopt Enterprise Managed Authorization for anything paid or corporate. Corporate IdP as the gatekeeper for MCP server access is now a standard extension, built with Okta — wire it before your auditors ask.
Gate every paid tool call with a scored decision. Credential checks say who may call; the gate scores whether this call fires — ≥0.80 auto-execute, 0.50–0.79 hold for human review, <0.50 block and escalate. At stateless scale there is no per-request human; the score is the human.

Honest caveats

Today's release details come from a single outlet's exclusive (VentureBeat, Sept 28, 2026) — interviews, not a second independently verified source; treat AAIF numbers as reported-by-Gilbert.
The "July vs today" distinction is our framing from the community migration field and the VentureBeat piece — the protocol team hasn't published a canonical "release notes" delta yet.
The gate receipts are from SML's local-heuristic-v1 decider (calibrated=false, TypeSafe Jev API not wired) — an honest demo of the pattern, not a calibrated production score.
Enterprise Managed Authorization is an extension, not core spec — adoption is ecosystem-dependent.

Claim receipts

Every factual claim on this page, atomized for machines. Cite the receipts, not the prose.

CLAIM	EVIDENCE	VERIFIED
Sept 28, 2026: AAIF shipped the largest MCP release ever — stateless finalized, auth hardened, 12-month deprecation policy, Apps + Tasks graduated	VentureBeat	2026-09-28
Stateless: no protocol session, no initialize, no Mcp-Session-Id — any request can land on any instance behind standard load balancers	VentureBeat	2026-09-28
Mandatory issuer (iss) validation closes OAuth mix-up attacks; maintainers: preventive, no known exploitation	VentureBeat	2026-09-28
Enterprise Managed Authorization extension (built with Okta): corporate IdP as authoritative gatekeeper for MCP server access	VentureBeat	2026-09-28
MCP Apps + MCP Tasks graduated to official extensions; multi-round-trip requests added	VentureBeat	2026-09-28
12-month deprecation policy; 2026-07-28 cohort (Roots, Sampling, Logging, DCR) can't be removed before July 2027	hackernoon	2026-09-28
AAIF: 40 → 240 members since Dec 2025; Anthropic's contribution share below half	VentureBeat	2026-09-28
SML x402 manifest live: Base eip155:8453, USDC, PAYMENT-REQUIRED, payTo 0xc29185fa176357612f3194735753e520e91adc46, ERC-8004 agent 74033	SML x402 manifest	2026-09-28
SML gate scored paid-MCP-call patterns 0.6457 (advisory) and 0.7964 (advisory) this morning; decider local-heuristic-v1, calibrated=false	harness status	2026-09-28

FAQ

What is the new MCP update (September 2026)?
The Agentic AI Foundation's Sept-28 release: finalized stateless architecture, OAuth mix-up attack hardening, a formal 12-month deprecation policy, and MCP Apps + MCP Tasks as official extensions, plus the Okta-built Enterprise Managed Authorization extension and multi-round-trip requests.

Is this MCP v2?
Not officially — but co-creator David Soria Parra said "in spirit that's accurate." Note: the 2026-07-28 spec revision removed the handshake; the Sept-28 release is the enterprise finalization of the same long arc.

What does stateless mean for my MCP server?
Drop the initialize handshake and Mcp-Session-Id. Carry protocol version and capabilities in per-request _meta, use server/discover, run behind plain load balancers, and make cross-call state explicit handles.

How does the Sept 28 update connect to payment authorization?
Enterprise Managed Authorization makes corporate-IdP gating an official extension; stateless scale multiplies per-call-billed tool calls; MCP Apps/Tasks put payment surfaces and resumable paid jobs inside the protocol. Each paid call wants a scored gate: ≥0.80 auto-execute, 0.50–0.79 hold, <0.50 block.

Sources: VentureBeat "MCP just got its biggest update ever" (Sept 28, 2026, exclusive); medium.com @toksoz migration map (Sept 14, 2026); hackernoon.com deprecation read; nordicapis.com (Sept 3, 2026); GitHub migration notes (alexuvlab, giantswarm, signoz); live SML receipts tested 2026-09-28 ~09:20 EDT (harness + x402 manifest).

SCRIPTMASTERLABS · THE X402 / MCP / AI-AGENT PEDIA