MCP新規範解析：告別Session，AI工具協定轉無狀態 | MCP 2026-07-28 Spec: AI Tool Protocol Goes Stateless
By Kit 小克 | AI Tool Observer | 2026-07-29
🇹🇼 MCP新規範解析：告別Session，AI工具協定轉無狀態
2026年7月28日，Model Context Protocol（MCP）迎來自問世以來最大的一次規範改版。這份由 Linux Foundation 旗下新成立的 Agentic AI Foundation（AAIF）發布的 MCP 2026-07-28 規範，把整個協定從「有狀態」徹底改成「無狀態」，直接砍掉沿用已久的 Session 機制，對所有正在串接 Claude、ChatGPT 等 AI 助理工具的開發者來說，是一次不能忽略的架構地震。
什麼是 MCP 2026-07-28 規範更新？
簡單說，這次更新把「連線狀態」從協定層徹底移除，改成任何一台伺服器實例都能處理任何請求，不再需要 sticky session 或共享 session store。
過去要部署一個遠端 MCP 伺服器，得搞定 session affinity、深封包檢測路由、甚至專門的 session 資料庫，維運成本很高。新規範把狀態管理從傳輸層移到「明確的 handle」，讓模型自己看得到、管得到狀態，水平擴展、負載平衡瞬間變簡單。
Session 沒了，那工具中途要問使用者怎麼辦？
MCP 規範用新的 Multi Round-Trip Requests（MRTR）機制取代。當伺服器在工具呼叫途中需要使用者輸入時，會回傳一個 InputRequiredResult 物件，裡面帶著問題與一段 requestState，讓對話可以無狀態地繼續下去。
安全性做了哪些強化？
這次規範同步導入 SEP 2468，要求授權回應必須驗證 iss（issuer）參數，用來防堵 OAuth Mixup 攻擊——這類攻擊近年在 AI Agent 生態圈裡層出不窮，MCP 這次算是補上一個長期被忽略的洞。此外，Dynamic Client Registration（DCR）正式被標記為 deprecated，未來會被 CIMD 取代；Roots、Sampling、Logging 三項功能也一併走向淘汰，但依照新的「規範功能生命週期政策」，deprecated 到真正移除之間至少保留 12 個月緩衝期，開發者不用擔心一夜之間被斷更。
對開發者有什麼實際影響？
- 遠端部署變簡單：拿掉 session affinity，MCP 伺服器可以像一般無狀態 API 一樣水平擴展
- 快取更精細：list 與 resource read 結果現在帶
ttlMs與cacheScope，比照 HTTP Cache-Control 設計 - 初始化握手被拿掉：連線流程更輕量，但意味著舊版 SDK 需要更新才能相容
- 過渡期不算短
現在該怎麼準備遷移？
官方已釋出 2026-07-28 規範對應的 Beta SDK，建議先在測試環境驗證你現有的 MCP 伺服器或客戶端是否依賴舊版 session 機制，再逐步排入遷移排程，不用急著一次改完。
MCP 從 Anthropic 主導的內部協定，走到現在被 Linux Foundation 接手、有獨立基金會治理，某種程度上代表這個協定真的長大了，開始要扛起企業級部署的責任。好不好用，試了才知道。
常見問題 FAQ
🇺🇸 MCP 2026-07-28 Spec: AI Tool Protocol Goes Stateless
On July 28, 2026, the Model Context Protocol (MCP) shipped its largest specification change since launch. Published by the newly formed Agentic AI Foundation (AAIF) under the Linux Foundation, the MCP 2026-07-28 spec rips out the protocol's stateful session model entirely — a shift every developer wiring MCP servers into Claude, ChatGPT, or any AI agent workflow needs to know about.
What Changed in the MCP 2026-07-28 Spec?
In short: MCP is now stateless at the protocol layer. Any server instance can now handle any request — no more sticky sessions or shared session stores required.
Previously, running a remote MCP server meant dealing with session affinity, deep packet inspection at the gateway, and dedicated session storage — real operational overhead. The new spec moves state out of the transport layer into explicit handles the model itself can see, which massively simplifies horizontal scaling and load balancing.
How Do Tools Ask for Mid-Call User Input Without Sessions?
Multi Round-Trip Requests (MRTR) replace the old approach. When a server needs user input mid-call, it returns an InputRequiredResult object carrying the questions plus a requestState blob, letting the conversation continue statelessly.
What Security Changes Came With MCP 2026-07-28?
The spec adds SEP 2468, requiring validation of the iss (issuer) parameter in authorization responses to block OAuth Mixup Attacks — a class of attack that's become increasingly common across AI agent ecosystems. Dynamic Client Registration (DCR) is now formally deprecated in favor of CIMD, and Roots, Sampling, and Logging are also deprecated. A new Feature Lifecycle and Deprecation Policy guarantees at least 12 months between deprecation and actual removal, so nothing breaks overnight.
What Does This Mean for Developers?
- Simpler remote deployment: no session affinity means MCP servers scale horizontally like any stateless API
- Finer-grained caching: list and resource read results now carry
ttlMsandcacheScope, modeled on HTTP Cache-Control - Initialization handshake removed: lighter connection flow, but older SDKs need updating to stay compatible
- A real migration window: deprecated features stay functional for at least 12 months, so there's no rush
How Should Teams Prepare to Migrate?
Beta SDKs for the 2026-07-28 spec are already available. Test whether your existing MCP servers or clients depend on the old session model in a staging environment first, then schedule migration incrementally rather than all at once.
MCP has grown from an Anthropic-led internal protocol into a Linux Foundation project with independent governance — a sign it's maturing into infrastructure ready for enterprise-scale deployment. 好不好用，試了才知道 — you won't know if it works until you try it.
FAQ
Sources / 資料來源
- The 2026-07-28 Specification — Model Context Protocol Blog
- MCP just got its biggest update ever — VentureBeat
- Linux Foundation Announces the Formation of the Agentic AI Foundation
常見問題 FAQ
MCP 2026-07-28規範是什麼？
這是Model Context Protocol自問世以來最大的一次規範改版，由Linux Foundation旗下的Agentic AI Foundation發布，核心變動是把協定從有狀態改成無狀態，拿掉Session機制。
拿掉Session之後，工具呼叫中途還能要求使用者輸入嗎？
可以，新規範用Multi Round-Trip Requests（MRTR）機制取代，伺服器回傳InputRequiredResult物件加requestState，讓對話無狀態地繼續。
舊版MCP整合會馬上壞掉嗎？
不會。被淘汰的功能（如DCR、Roots、Sampling、Logging）依政策保證至少12個月的緩衝期才會真正移除，開發者有充裕時間規劃遷移。
這次更新對安全性有什麼幫助？
新規範導入SEP 2468，要求授權回應驗證iss（issuer）參數，可有效防堵近年在AI Agent生態圈中出現的OAuth Mixup攻擊。
現在該用哪個SDK版本開始測試？
官方已釋出對應2026-07-28規範的Beta SDK，建議先在測試環境確認現有MCP伺服器或客戶端是否依賴舊版Session機制，再排入遷移排程。
延伸閱讀 / Related Articles
- Claude Mythos破解HAWK密碼：AI首次拆穿後量子演算法 | Claude Mythos Cracks HAWK: AI's First PQC Break
- AI模型上市前審查框架TRAINS：白宮8月1日大限逼近 | AI Pre-Release Review Framework TRAINS: Aug 1 Deadline
- AI推理雲估值大戰：Fireworks 175億、Baseten 130億同月爆發 | AI Inference Cloud Valuations Explode: Fireworks $17.5B, Baseten $13B
AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends
留言
張貼留言