Issue #8 · August 1, 2026 · ~5 min read

MCP just became boring infrastructure

Welcome back to Zero to MVP Weekly. Same deal: one signal, one tool, one MVP idea — five minutes, every Saturday. No link dumps. This week the plumbing changed, and for once that's the interesting part. Let's go.

1. The signal of the week

The Model Context Protocol stopped being a session protocol and became plain HTTP. It's the least exciting thing that happened this week and the one most likely to change what you ship.

On July 28 MCP released the 2026-07-28 specification — its largest revision since the standard appeared. The initialize/initialized handshake is gone. The Mcp-Session-Id header is gone. Every request now carries its own protocol version, client identity and capabilities in _meta, and the spec states the consequence plainly: "Any request can now land on any server instance behind a plain round-robin load balancer without needing shared storage."

Four other changes matter as much as the headline:

Multi Round-Trip Requests. A server can return resultType: "input_required" along with the questions it still needs answered; the client retries with inputResponses. This replaces server-initiated requests that used to require a held-open stream. Read it for what it is: a protocol-level "confirm this before I do it."
Header-based routing. Streamable HTTP requests now require Mcp-Method and Mcp-Name headers, so a gateway can route, throttle and meter without parsing the JSON body.
Caching. tools/list, prompts/list, resources/list and resources/read responses carry ttlMs and cacheScope.
Auth hardening. RFC 9207 issuer validation is required, Dynamic Client Registration gives way to Client ID Metadata Documents, and client credentials are bound to the issuing authorization server. MCP servers are now positioned as OAuth 2.1 resource servers.

Roots, sampling, logging and the legacy HTTP+SSE transport are deprecated, with "a twelve-month minimum window so you can plan upgrades instead of reacting to them." The TypeScript, Python, Go and C# SDKs support the new spec today; Rust is in beta. AWS shipped AgentCore Gateway support the same day, behind a single UpdateGateway call.

Here's why a spec revision leads this issue. Until Tuesday, running an MCP server in production meant sticky sessions, awkward serverless behaviour, and state you had to rebuild after every crash — so most MCP servers stayed on someone's laptop, and the ones that shipped stayed read-only. Now an MCP server is a normal HTTP service: Workers, Fly.io, a Bun process behind a load balancer, scale to zero, no session store. The cost of exposing your product to agents just fell to roughly the cost of shipping a REST API. And MRTR closes the gap that made the useful tools too dangerous to expose — the tool can now stop halfway and ask.

One caveat to keep us honest: "breaking change" is doing less work here than it sounds. The SDK maintainers' own line is that "existing clients and servers nothing breaks today, and nothing breaks on July 28 either." Python v2 servers answer both protocols from one endpoint, TypeScript and Go require an explicit opt-in to serve stateless, clients speaking 2026-07-28 fall back to the old handshake against old servers, and v1 branches get security patches for at least six months. Nothing forces you to move — which, historically, means most servers won't for a year. The work is real where you used roots, sampling or session-bound tasks.

2. My take

Boring is the tell: load balancers, cache headers and long deprecation windows appear when a protocol stops being an experiment and starts carrying real money. MCP is becoming less exciting — and far more important.

3. Tool worth trying

GPT-5.6 Luna, at its new price.

On July 30, three weeks after the GPT-5.6 family launched, OpenAI cut Luna from $1 / $6 to $0.20 / $1.20 per million tokens — an 80% reduction — and Terra from $2.50 / $15 to $2 / $12. Sol stays at $5 / $30, now with a premium Fast mode.

It connects to this week's signal more directly than it looks. The thing you'd expose through an MCP server is rarely one clever call; it's a loop — classify the request, pull the right resource, extract fields, summarize, route. Those steps don't need judgment, they need to be cheap enough that you don't think about them. At twenty cents per million input tokens, the arithmetic on "should this step be a model call at all" changes.

Since the cut I've been running medium-complexity coding tasks on Luna — a step above the mechanical work I just described — and I like what comes back. The part worth noticing is the arithmetic: you can make noticeably more calls than you used to and still come out ahead.

Two limits regardless. A price cut is not a capability change — Luna is still the small model, and the ceiling is real even if it sits higher than the price suggests. Find where it breaks on your own work before you trust it there, because that kind of quality decay is the kind you don't notice for a month. And prices this volatile mean whatever you hard-code today is wrong by October.

4. MVP idea of the week

A "confirm before it bites" MCP server template.

Problem: every builder who wants their app agent-drivable hits the same wall. The tools worth exposing are the destructive ones, and until this week there was no clean way to make an agent stop and ask before the irreversible step. So people ship read-only MCP servers, and nobody uses them.
Solution: an opinionated stateless MCP server template where every tool declares a risk level, and anything above "read" returns resultType: "input_required" with a human-readable summary of exactly what it is about to do, plus a signed, expiring confirmation token. Deploys to Workers, Fly or a plain Bun process. No session store.
For whom: solo builders and small SaaS teams who want to be agent-drivable without a support queue full of "the agent deleted my project."
Minimal v1: one repo. Four example tools, one of them genuinely destructive. The MRTR confirm flow. OAuth 2.1 resource-server setup per the new spec. A deploy button. No dashboard, no cloud.
Demand check: publish the destructive-tool demo — the agent asking before it deletes — as a sixty-second clip. Then watch whether people ask for the template or ask you to build their server. The first is a repo; only the second is a business.
Why now: MRTR shipped on July 28 and this pattern was not expressible in the protocol before it. Being the reference implementation for a two-week-old primitive is a position you cannot buy back later.

5. Useful links

Model Context Protocol — The 2026-07-28 Specification — the primary. Read the MRTR and authorization sections even if you never migrate; that's the design of the next two years of agent tooling.
MCP — Beta SDKs for the 2026-07-28 release candidate — the practical companion: what actually breaks, what's opt-in, and the exact package versions to install.
AWS — How AgentCore Gateway supports the MCP 2026-07-28 spec — the same spec from the operator's side. Useful if you care about routing and metering rather than writing the server.
Anthropic — Investigating incidents in our cybersecurity evaluations — the week's other story, and the argument for MRTR in one document: models that were told they had no internet, had internet, and one of them published a package to PyPI that fifteen real systems ran. Read it as an incident-response template.
InfoWorld — OpenAI drops GPT-5.6 Luna and Terra API prices by up to 80% — the numbers behind this week's tool block, and a reminder to re-price your pipeline more often than you'd like.