MCP Gets Its Biggest Rewrite and Other Python News for August 2026

What the New Spec Changes

The main change is that the protocol is now stateless. A client used to open with a handshake and then carry a session ID through the rest of the conversation. Both are gone. Protocol version and client capabilities now ride along on every request, and a new server/discover call fetches what a server can do.

Under the new specification, any request can land on any instance, and a plain round-robin load balancer is enough. If you only call MCP servers, then the stateless switch is what affects you the most.

If you ship an MCP server, then your migration list looks like this:

• Remove the session machinery: The handshake and the session header are both gone, so anything you built to track a client between requests goes with them.
• Validate the Mcp-Method and Mcp-Name headers: Clients now send them so gateways can route without cracking open the request body, and your server has to check that they match the request.
• Change your missing-resource error: Use the standard JSON-RPC invalid-params code, -32602, instead of MCP’s own -32002.
• Rework your server-initiated requests: Roots, Sampling, and Elicitation no longer call back to the client. Instead, your server returns a result that the client uses to make a follow-up request, which is the biggest rewrite on this list.
• Move off the experimental Tasks API: Tasks have graduated from the core spec to an extension and have gained a new lifecycle along the way.

Roots, Sampling, and Logging all entered formal deprecation, and all three keep working for now. The spec also adopted a deprecation policy promising at least a year’s notice before anything is removed, with a 90-day floor reserved for active security risks. That’s more warning than this ecosystem has offered before.

Authorization also hardened, picking up issuer validation and issuer-bound credentials on top of its OAuth 2.0 foundation.

Extensions, which existed before without any process around them, finally got one: namespaced identities and independent release cycles. That’s what let Tasks move out of the core without dragging the whole protocol along, and MCP Apps now arrives as an official extension under that process. A server can send interactive HTML that the host renders in a sandboxed iframe, so a tool call returns a real interface instead of a wall of text.

Treat third-party MCP servers with the same scrutiny you’d give any dependency. The official registry verifies who published a server through GitHub or DNS ownership, but there’s still no code-signing requirement and no review of what a server actually does, and a server you install gets to describe its own tools to your agent.

The Python SDK Renames FastMCP

The spec is only part of the story if you write Python. The MCP Python SDK reached 2.0.0 alongside it, and pip install mcp now provides the 2.x line.

The first change you’ll notice is a rename. FastMCP is now MCPServer, with no alias and no deprecation shim:

# Before, on mcp 1.x
from mcp.server.fastmcp import FastMCP

mcp = FastMCP("Demo")

# After, on mcp 2.x
from mcp.server.mcpserver import MCPServer

mcp = MCPServer("Demo")

The rest of 2.0 is broader than the rename suggests:

• Wire types are snake_case now: result.isError is now result.is_error, and tool.inputSchema is now tool.input_schema. These types have also moved into a separate mcp-types package, although mcp.types stays as a permanent alias.
• One Client replaces three layers: The old arrangement of a transport, a ClientSession, and an initialize() call now collapses into a single object that connects to a URL, a stdio subprocess, or an in-memory server object for tests.
• httpx is now httpx2: The SDK moved to the next-generation HTTP client, which is worth knowing if you pin httpx elsewhere in your dependency tree.
• Synchronous handlers run on worker threads: They no longer block the event loop. Your handler code doesn’t change, but asyncio.get_running_loop() now raises inside them.
• McpError is now MCPError: It’s the same acronym capitalization as MCPServer, so any except McpError clause needs the new spelling.

One MCPServer serves both protocol eras, so 2025-era clients keep working against a migrated server with nothing to configure. The 1.x line moves to maintenance mode with security fixes only, so if you’re not ready this month, then pin mcp>=1.28,<2 and come back to it.

One gap remains mid-migration: the Tasks extension isn’t in this release, so Tasks has left the core spec but hasn’t yet arrived in the Python SDK.

And if you reach for the standalone fastmcp package rather than the official SDK, then none of this touches you. That’s a separate project on its own 3.x line, and the rename is partly there to stop the two from being mistaken for each other.

Claude Opus 5 Turns Thinking on by Default

Anthropic released Claude Opus 5 on July 24, and the API model string is claude-opus-5. The company’s framing is that it “comes close to the frontier intelligence of Claude Fable 5 at half the price.” The arithmetic checks out: Fable 5 sits at $10 per million input tokens and $50 per million output tokens, compared to Opus 5’s $5 and $25.

The change that’s most likely to surprise you is quieter than the price tag, and you’ll notice it as a bug before you read about it in the release notes. On Opus 5, adaptive thinking is on by default. On Opus 4.8 and 4.7, leaving out the thinking parameter meant no thinking at all:

import anthropic

client = anthropic.Anthropic()
response = client.messages.create(
    model="claude-opus-5",
    max_tokens=16000,
    messages=[{"role": "user", "content": "Refactor this module."}],
)

That request now spends thinking tokens, and max_tokens caps thinking plus response text together. If you set that ceiling tightly around the answer you expect from an older model, then your responses can start truncating mid-sentence with no obvious cause.

Give max_tokens headroom. You can also pass thinking={"type": "disabled"}, although only at an effort of high or lower, which you set through output_config—pairing it with xhigh or max returns a 400. Anthropic’s guidance is to lower the effort level rather than switch thinking off.

If the anthropic package is new to you, then How to Use the Claude API in Python walks through the request shape from the start.

The Rest of the Month’s Releases

Here are the other models worth knowing about:

• Kimi K3 put 2.8 trillion parameters behind what Moonshot AI calls the first open model at that scale. The weights run to well over a terabyte even in MXFP4 quantization, so self-hosting means a cluster rather than a laptop, and every request runs a reasoning pass that bills as output. Simon Willison’s write-up prices a single pelican SVG at 25 cents. Eight days after it landed, Nvidia, Microsoft, Meta, and twenty-two others signed a joint letter, “Open Weights and American AI Leadership,” urging Washington not to restrict open-weight models, with Google and OpenAI adding their names a day later.
• Claude Fable 5 returned on July 1 after export controls suspended it worldwide in June, with a new classifier that Anthropic says blocks the specific technique behind those controls in over 99 percent of cases. It’s still Anthropic’s top capability tier above Opus 5, and thinking can’t be switched off at all.
• GPT-5.6 became generally available on July 9 as three models rather than one: Luna, Terra, and Sol, in order of increasing capability. The Responses API picked up programmatic tool calling, which lets the model write JavaScript to orchestrate your tools in OpenAI’s own sandbox instead of round-tripping every call through the conversation.
• Gemini 3.6 Flash shipped on July 21 alongside two 3.5-class siblings, a Flash-Lite and a cybersecurity-tuned Flash Cyber. The story here is what didn’t ship, since the Gemini 3.5 Pro flagship that developers have been waiting on remains unreleased, leaving Flash a full version ahead of it.
• Meta Muse Spark 1.1 arrived on July 9 with something more surprising than the model: Meta’s first paid hosted API. For a company that built its reputation on open weights, and whose Muse Spark line launched closed-weight back in April, putting a price on hosted access completes Meta’s shift toward closed, paid models. Muse Spark 1.1 itself is aimed at agent orchestration.
• Inkling is the first model from Thinking Machines Lab, the outfit founded by former OpenAI CTO Mira Murati. It’s a mixture-of-experts model under Apache 2.0, and the lab is refreshingly blunt about positioning it as a strong base for fine-tuning rather than a frontier competitor.

Python 3.15 Ships Its Final Beta

Python 3.15.0 beta 4 arrived on July 18 carrying around three hundred bugfixes, build improvements, and documentation changes since beta 3, and it’s the last beta. From here the schedule is short: release candidate 1 on August 4, release candidate 2 on September 1, and the final release on October 1.

No new features have landed since the feature freeze back in May, so that article is still the tour of what’s coming.

What has changed is how much time you have left. If you maintain a library, then the window for finding breakage in your own code is closing, and beta 4 is your last low-stakes chance to catch it.

The JIT Team Answers the Steering Council

Last month we covered the Steering Council putting CPython’s JIT on a six-month clock: write a standards-track PEP, or the JIT comes back out of main.

The answer arrived on July 2 as PEP 836, titled “JIT Go Brrr: The Path to a Supported JIT Compiler for CPython” and authored by Savannah Ostrowski, Ken Jin, and Brandt Bucher.

It lays out a roughly two-and-a-half-year plan starting with Python 3.16 and running through 3.17. The JIT would move from today’s trace-based recording to method-based compilation and hit at least a 20 percent improvement over the free-threaded interpreter alone by 3.17. It would also avoid regressing debugger and profiler support, and sort out how packagers distribute the JIT.

The PEP is still a draft, and the Council hasn’t ruled. But turning a governance ultimatum into a concrete public roadmap inside a month is a decent showing, and the discussion thread is worth reading if you want to see the process working as intended.

The Election Dates Get Concrete

Last month we noted that the PSF had set its 2026 election dates, and that the first-ever Packaging Council vote would run alongside the board election. The details are now out, and if you’re thinking of standing, then the window is narrow: nominations for both open on July 28 and close on August 11.

The Packaging Council election has five seats, split into two two-year terms and three one-year terms. The PSF Board election has four.

If you’d rather vote than run, then you need to be a PSF voting member in good standing and affirm your intent by August 25. It takes two minutes, and a surprising number of eligible people forget.

Astral Ships Two Breaking Minors

uv 0.12.0 arrived on July 28, the first minor bump since 0.11.0 in March, with Ruff 0.16.0 five days ahead of it. Both are flagged as breaking, though Astral’s line on uv is that it expects “most users to be able to upgrade without making changes.”

The visible change in uv is that uv init builds a packaged project again. New projects get a src/ layout, a [build-system] using uv_build, and a [project.scripts] entry, so the project can be imported from your tests instead of only run as a loose script. Pass uv init --no-package for the old flat layout. Existing projects are untouched.

The more interesting half of the release got less attention. uv used to warn about a --require-hashes directive inside a requirements.txt and then install without checking hashes at all. That’s now fixed. Hash-checking mode also rejects MD5-only digests, and uv now refuses wheels that could overwrite your interpreter. That includes variants like Python.exe, which slipped past the old check on case-insensitive file systems.

Source distributions must be .tar.gz now, per PEP 625, so a .tar.bz2 or .tar.xz sitting in an existing lockfile will start failing. If you’ve been trying pylock.toml, then uv validates it far more strictly: a missing packages array used to read as an empty lockfile, which meant uv pip sync could quietly uninstall your environment instead of rejecting the file.

Ruff 0.16.0 is the one more likely to fill your terminal. The default rule set jumps from 59 rules to 413, so ruff check will flag far more on an existing project than it did before. Ruff also formats Python code blocks inside your Markdown files by default now.