MCP 2026-07-28 Specification: AWS AgentCore Gateway Adapts to a Stateless Agent Protocol

Amazon Web Services has announced immediate support for the MCP 2026-07-28 specification in Amazon Bedrock AgentCore Gateway. In an official AWS Machine Learning Blog post published on July 28, 2026, AWS describes this release as the largest and most significant revision of the Model Context Protocol since its launch.

The central change: MCP becomes a stateless protocol designed to scale on ordinary HTTP infrastructure.

This matters because MCP is becoming a key protocol for connecting AI agents to tools, APIs, files, databases and enterprise services. Any major compatibility change affects developers working with Claude, Gemini, Copilot, Amazon Bedrock, private MCP servers and automation platforms.

The critical question is not whether stateless MCP is cleaner on paper. The real question is whether the MCP 2026-07-28 specification improves scalability without pushing too much complexity into applications, agents, authentication flows and state management.

What did AWS announce for AgentCore Gateway?

AWS says AgentCore Gateway, a capability of Amazon Bedrock AgentCore, can now support the MCP 2026-07-28 specification. Developers can enable the new version by calling UpdateGateway and adding 2026-07-28 to the gateway’s supported protocol versions. Existing clients continue to work as long as they request a protocol version still advertised by the gateway.

That detail is important. AWS is not forcing an immediate migration. AWS AgentCore Gateway can advertise multiple MCP versions at the same time, such as 2025-11-25 and 2026-07-28. Clients select the version on each request. A client requesting the new version receives the new behavior; a client requesting an older supported version stays on the previous behavior.

AWS documentation describes Amazon Bedrock AgentCore Gateway as a fully managed AI gateway that provides a single secure entry point for agentic traffic. It connects agents to tools, other agents and large language models, while converting APIs, AWS Lambda functions and existing services into MCP-compatible tools.

This makes the announcement more than a compatibility update. AWS is positioning AgentCore Gateway as a governance, routing and authentication layer between AI agents and enterprise tools.

Why the MCP 2026-07-28 specification is a major update

The biggest change in the MCP 2026-07-28 specification is the move to stateless communication. In earlier Streamable HTTP versions of MCP, interactions began with an initialize/initialized handshake. The client and server exchanged protocol versions and capabilities, then the server issued an Mcp-Session-Id header that later requests had to carry.

That session model created scaling friction. A session could bind a client to the server instance that created it. To scale horizontally, operators needed sticky sessions, a shared session store, or both.

With MCP 2026-07-28, each request carries the protocol version, client information and client capabilities inside its _meta parameter. A tool call becomes self-contained: it does not require a prior protocol session and can be routed to any compatible server instance.

The official Model Context Protocol specification also now describes the base protocol with stateless, self-contained requests and per-request capability negotiation. MCP itself is defined as an open protocol that connects LLM applications with external data sources and tools.

For cloud infrastructure, this is a big architectural shift. Remote MCP servers become closer to ordinary HTTPS endpoints that can sit behind load balancers, API gateways, serverless runtimes and standard monitoring systems.

Stateless MCP does not remove application state

The most important nuance is that “stateless protocol” does not mean “stateless application.” AWS explicitly says that removing the protocol session does not prevent stateful applications. When a server needs continuity across calls, it can pass an explicit application-level ID as a tool parameter.

This is both cleaner and more demanding. Instead of hiding continuity inside an MCP protocol session, developers must design state explicitly. A shopping basket, code migration, long-running analysis, compliance investigation or multi-step workflow may still need a persistent handle. The difference is that the handle belongs to the application, not to the protocol session.

That is a good trade-off for scalable systems, but it is not free. Poorly designed state handling can create confusing workflows, lost context, excessive permissions or data leakage between tasks. The MCP 2026-07-28 specification reduces one layer of infrastructure complexity, but it also forces teams to be more disciplined about application state.

Routing, caching and tracing become easier for HTTP infrastructure

AWS highlights another important change: MCP 2026-07-28 exposes request intent through standard headers such as Mcp-Method and Mcp-Name. That means load balancers, API gateways, proxies, rate limiters and monitoring tools can understand the operation without parsing the JSON-RPC body.

This matters for production deployments. In previous versions, intermediate infrastructure often had to inspect the message body to understand which method was being called. With the new headers, HTTP-layer systems can route, throttle and meter requests more easily.

The new specification also adds freshness metadata such as ttlMs and cacheScope for list and resource-read operations. Clients can cache responses like tools/list for a known duration and scope instead of holding persistent connections open to wait for invalidation events.

AWS also notes that the specification reserves W3C Trace Context keys such as traceparent, tracestate and baggage inside _meta. This allows distributed tracing to follow a call from the application to the MCP client, then to the gateway and downstream service, with visualization in OpenTelemetry-compatible collectors.

For enterprise AI agents, this is critical. If an agent calls tools in production, teams need to know which tool was invoked, by which client, with which protocol version, through which gateway and with what outcome.

Authorization gets closer to enterprise OAuth and OpenID Connect practices

AWS says the new release strengthens authorization by aligning more closely with enterprise practices for OAuth 2.0 and OpenID Connect. However, AWS also clarifies that AgentCore Gateway inbound authorization does not change with the protocol version, whether it uses IAM SigV4 or OAuth/JWT. Outbound credential providers are also unchanged.

That is reassuring for existing AWS customers. Enabling MCP 2026-07-28 should not require rebuilding the gateway’s credential or authorizer configuration.

But the strategic direction is clear. As AI agents gain access to tools, authorization becomes more important than model quality alone. A tool-using agent is not just answering questions. It can trigger API calls, manipulate data, start workflows and interact with sensitive systems.

That is why AWS AgentCore Gateway matters commercially. It gives AWS a position in the middle of the agent-tool relationship: identity, authentication, routing, translation, tool discovery and governance. That is useful for enterprise buyers, but it can also increase dependence on AWS for the agent infrastructure layer.

Server-to-client interactions are redesigned

A stateless protocol still needs a way for servers to ask clients for input during a call. AWS identifies three interactions: elicitation, where the server asks the user for information or confirmation; roots, where the server asks for available files or directories; and sampling, where the server asks the client’s model to generate a response.

Previously, these flows used persistent server-to-client connections. With the new protocol version, server-initiated requests are allowed only while the server is actively processing a client request. Multi Round-Trip Requests replace the earlier long-lived stream approach.

The upside is security and traceability: prompts shown to users can be tied to something the user or agent actually started. The downside is implementation complexity. Clients must correctly support capability declarations, request state, user answers and repeated calls.

AWS also says that progress notifications and log delivery are now request-scoped. Progress updates require a progress token on the original request, while log messages require the client to set io.modelcontextprotocol/logLevel in per-request metadata.

Error handling and deprecations will affect real migrations

The MCP 2026-07-28 specification also changes error handling. AWS says earlier protocol versions often returned HTTP 200 with errors inside the JSON-RPC body, even for transport-level failures. In the new version, transport failures use real HTTP status codes, while application-level outcomes remain in the body.

This is better for monitoring and retries. HTTP-level observability systems can distinguish routing problems from application errors without parsing the body. But it also means client code that depends on older error patterns must be audited.

AWS specifically notes several migration points: the old -32002 “resource not found” code has been reassigned to JSON-RPC’s standard -32602 Invalid Params, logging/setLevel is retired, and Roots, Sampling and Logging are deprecated under the new lifecycle policy. These features remain functional for now, but AWS recommends that new implementations avoid depending on them.

This is where the update becomes operationally sensitive. A developer can enable the new protocol version with a configuration change, but migration is not only a configuration issue. It requires testing SDKs, clients, errors, logs, capabilities and server-to-client flows.

What AWS does not say clearly enough

The first unclear point is ecosystem readiness. AWS says mainstream SDK stacks were expected to support 2026-07-28 after the release candidate window, but still advises teams to check that the MCP client SDKs used by their agent frameworks and host applications have shipped support before advertising the new version on a production gateway.

The second issue is translation between old and new versions. AWS says a gateway can translate ordinary tool calls between 2025-* clients and 2026-* server targets. However, this translation does not currently support server-to-client elicitation and sampling calls. If an older client calls a newer server tool that requires those mechanisms, it receives an error.

The third issue is that statelessness may shift complexity rather than erase it. It makes infrastructure scaling cleaner, but developers still need to manage application state, security context, permissions and user consent correctly.

The fourth issue is platform dependency. AgentCore Gateway can simplify version support, routing and authentication, but companies that rely heavily on it may become more dependent on Amazon Bedrock AgentCore for their agent-tool architecture.

Who can benefit from AWS AgentCore Gateway and MCP 2026-07-28?

The first beneficiaries are developers building agents that need to call enterprise tools. AgentCore Gateway can reduce the work of exposing APIs, Lambda functions and services as MCP-compatible tools. AWS documentation says Gateway supports OpenAPI, Smithy and Lambda as tool input types and provides managed ingress and egress authentication.

The second audience is enterprise cloud teams already using AWS. Gateway offers a single secure endpoint for agentic traffic, tool discovery, credential exchange, observability and auditing. AWS documentation also mentions compatibility with open-source frameworks such as CrewAI, LangGraph, LlamaIndex and Strands Agents.

The third audience is companies running private MCP servers or planning to expose internal APIs to AI agents. For them, multi-version support can make migration less risky.

Smaller teams, SaaS builders, automation consultants and agencies may benefit indirectly as frameworks adopt the new specification. But for them, the practical value depends on SDK maturity, AWS costs, documentation quality and how much of their stack already runs on AWS.

Security risks to watch

The official MCP specification is clear that MCP enables powerful capabilities through arbitrary data access and code execution paths. It says implementers must address user consent, data privacy and tool safety, and that hosts should obtain consent before exposing data or invoking tools.

That warning matters even more with MCP 2026-07-28. Stateless requests can scale better, but they can also make agent-tool systems easier to distribute widely. Every tool exposed to an agent must be treated as a real capability, not a harmless extension.

The main risks are excessive permissions, poor consent flows, weak authentication, confused application state, vulnerable tool descriptions, unsafe code execution and hidden prompt injection through external data. AWS AgentCore Gateway can help govern part of this flow, but it cannot replace secure tool design.

CritiquePlus verdict

Our verdict is clear: the MCP 2026-07-28 specification is a major infrastructure moment for AI agents. By making MCP stateless, the protocol becomes more compatible with modern HTTP infrastructure, cloud load balancing, serverless architectures and distributed observability.

AWS is moving quickly because it sees the strategic layer: whoever manages the gateway between agents and tools can shape authentication, routing, version compatibility and governance. AWS AgentCore Gateway is not just adapting to MCP. It is trying to become one of the control points for enterprise agent infrastructure.

But this update should not be treated as a simple upgrade. It contains backward-incompatible changes, altered error handling, deprecated features and partial translation limits between protocol versions. Developers should test now. Enterprises should migrate gradually with dual-version support, monitoring and rollback plans.

Key takeaways

The MCP 2026-07-28 specification is described by AWS as the biggest MCP revision so far.

The protocol becomes stateless, removing the mandatory initialization handshake and protocol-level session.

Each request can now carry protocol version, client information and capabilities.

AWS AgentCore Gateway supports multiple MCP versions simultaneously and can add 2026-07-28 through UpdateGateway.

Routing, caching, tracing and HTTP-level error handling are improved.

Migration still requires SDK checks, client testing and audits of sessions, logging, errors, Roots, Sampling and elicitation.

The biggest strategic issue is dependency: AWS AgentCore Gateway can simplify MCP governance, but it also strengthens AWS’s role in enterprise agent infrastructure.

Official sources used

AWS Machine Learning Blog — “How AgentCore Gateway supports the MCP 2026-07-28 spec”, published on July 28, 2026.

AWS Documentation — Amazon Bedrock AgentCore Gateway: A secure AI gateway for agents, tools, and models.

Model Context Protocol — official Specification page.