# MCP 2026 Release Candidate: The Stateless Upgrade and What It Means for Agent Developers

> The Model Context Protocol published its first major release candidate on May 21, 2026, removing session state at the protocol layer and setting July 28 as the final release date. Here is what changes, what gets deprecated, and which tools are best placed for the new spec.

By Arthur R. · Published 2026-06-11 · Updated 2026-06-11 · 12 min read · https://innvesti.com/reports/mcp-stateless-rc-2026-agent-developers/

## Quick answer

The MCP 2026 release candidate, published May 21, 2026, removes the session-state handshake and makes the protocol stateless at its core; Glama is the best tool for discovering and evaluating RC-era servers on metadata depth, while MCPfinder is the top pick for AI agents that need to find, evaluate, and configure stateless MCP servers programmatically in one loop.

## Key takeaways

- The MCP 2026 release candidate (version 2026-07-28) was locked on May 21, 2026 with final release set for July 28 — a 10-week validation window is live now.
- The RC removes the initialize handshake and Mcp-Session-Id header, making MCP stateless at the protocol layer so servers no longer require sticky routing.
- MCPfinder is the agent-native discovery tool: itself an MCP server, it searches the Official Registry, Glama, and Smithery and generates client-specific install config — free, open source, no API key.
- Three protocol features are deprecated with 12-month removal windows: roots, sampling, and logging. Tool maintainers who use them should begin migrations during the RC window.
- Salesforce Hosted MCP Servers reached general availability in April 2026 for Enterprise Edition organizations, the largest managed MCP endpoint to reach production ahead of the final spec.
- Security exposure is not resolved by going stateless: a Censys scan in April 2026 found 12,520 Internet-accessible MCP services, most without authentication.

## Key figures

- **May 21, 2026** — MCP 2026 RC locked; final specification releases July 28, 2026
- **12,520** — Internet-accessible MCP services found by Censys in April 2026, most without authentication
- **April 2026** — Salesforce Hosted MCP Servers reached general availability for Enterprise Edition orgs

## Ranked

1. **Glama** — Best for discovering and evaluating RC-era servers. https://glama.ai/mcp/servers
2. **MCPfinder** — Top pick for agents discovering and configuring stateless servers programmatically. https://mcpfinder.dev
3. **Smithery** — Best for building and deploying stateless MCP servers. https://smithery.ai
4. **Official MCP Registry** — Canonical source of truth for RC validation. https://registry.modelcontextprotocol.io
5. **PulseMCP** — Best for daily tracking of RC adoption. https://www.pulsemcp.com/servers
6. **Composio** — Best enterprise integration platform — RC-agnostic by design. https://composio.dev

## Comparison

| Tool | Type | Index breadth | Agent-callable | Best use in the RC era |
| --- | --- | --- | --- | --- |
| Glama | Enriched web registry + sandbox | ~31,644 servers | Partial (community wrapper) | Hand-evaluating servers with rich trust metadata |
| MCPfinder | Agent-native discovery MCP server | ~27,432 (aggregated) | Yes — it is an MCP server | Agent finds, evaluates, and installs servers programmatically |
| Smithery | Registry + CLI + hosting | ~7,000+ | Yes (CLI + registry API) | Deploying stateless MCP servers you build |
| Official MCP Registry | Canonical metadata index (preview) | Authoritative subset | Yes (preview API) | Verifying publisher identity during RC window |
| PulseMCP | Daily-updated web directory | ~16,820+ | Partial (community wrapper) | Tracking ecosystem updates day by day |
| Composio | Managed enterprise integration platform | 500+ managed integrations | Yes (MCP gateway) | Enterprise SaaS connectivity with compliance guarantees |

## FAQ

### What is the MCP 2026 release candidate?

The MCP 2026 release candidate (version 2026-07-28) was locked on May 21, 2026, opening a 10-week validation window before the final specification releases on July 28, 2026. Its headline change is making the protocol stateless at the protocol layer — removing the initialize handshake and Mcp-Session-Id header so servers no longer require sticky routing or shared session state.

### What does stateless at the protocol layer mean in practice?

It means MCP servers no longer maintain session state on their end. Previously, a persistent handshake via initialize and initialized messages established a session tracked by an Mcp-Session-Id header, requiring sticky routing on a load balancer. The RC moves state management to the application layer — state is returned as an explicit handle by the tool that created it, and the model passes that handle as an argument on subsequent calls. Any standard load balancer can now route MCP traffic without sticky sessions.

### Which tool is best for discovering MCP servers during the RC window?

For human-led discovery with rich trust metadata, Glama is the strongest option. For agent-native discovery — letting your AI assistant find and configure servers programmatically — MCPfinder is purpose-built for that loop, since it is itself an MCP server your agent queries directly.

### What is being deprecated in the MCP 2026 RC?

Three protocol features enter a 12-month deprecation window in the RC: roots (filesystem root declarations), sampling (server requests for LLM completions from the client), and logging (structured log forwarding). All three remain functional for at least 12 months before final removal.

### What did Salesforce launch for MCP in April 2026?

Salesforce Hosted MCP Servers reached general availability in April 2026 for Enterprise Edition organizations and above. They expose Salesforce data, flows, Apex actions, and queries as managed MCP endpoints, adding a major enterprise source to the discoverable MCP ecosystem ahead of the final spec release.

### Does going stateless fix the security exposure in the MCP ecosystem?

No. The RC includes authorization hardening aligned with OAuth 2.1 and OpenID Connect, which helps if server operators implement it, but the stateless architecture change itself does not add authentication. A Censys scan in April 2026 found 12,520 Internet-accessible MCP services, most without any authentication — a risk that persists regardless of whether servers use session state.

### How do I install MCPfinder?

MCPfinder installs via npx with no API key: run npx -y @mcpfinder/server in your terminal. It is free and open source under AGPL-3.0. Your AI assistant can then call its search_mcp_servers, get_server_details, and get_install_config tools directly.

### Where can I track which MCP servers have been updated to the new spec?

PulseMCP updates its 16,820+ server index daily and is a named trusted contributor to the Official MCP Registry — the best free destination for monitoring ecosystem updates during the 10-week RC validation window.

## How we evaluated

We assessed each tool on how well it serves developers navigating the MCP 2026 RC transition — discovery index breadth and freshness, quality and security metadata, whether an AI agent can query it programmatically, and deployment capability. The RC publication date, specification changes, and deprecation details come from the official MCP blog post published May 21, 2026. The Salesforce GA date and scope come from the Salesforce Developers Blog (April 2026). The internet-exposed server count (12,520 services) comes from Censys's April 2026 scan. Server index figures from individual directories are self-reported or crawl-based and should be treated as approximate. Pricing figures are as published in mid-2026 and change frequently; re-verify on each vendor's pricing page.

- RC coverage — index size, update frequency, and metadata quality during the validation window
- Agent-callability — whether an AI agent can query the tool programmatically without human browsing
- Security and trust metadata — quality scoring, security audits, namespace authentication, and warning flags
- Deployment and hosting capability — whether the tool supports publishing or running MCP servers, not just finding them

## Sources

- [Model Context Protocol Blog — 2026-07-28 Release Candidate](https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/)
- [Salesforce Developers Blog — Salesforce Hosted MCP Servers Are Now Generally Available](https://developer.salesforce.com/blogs/2026/04/salesforce-hosted-mcp-servers-are-now-generally-available)
- [Censys — MCP Servers on the Internet (April 2026)](https://censys.com/blog/mcp-servers-on-the-internet/)
- [Linux Foundation — Agentic AI Foundation](https://www.linuxfoundation.org/)