Claude's largest-scale MCP upgrade sees its monthly downloads surge past 400 million

Just now, Anthropic dropped a game-changing update that shocked the entire industry —

MCP has received its largest-ever epic update since its launch: MCP 2026-07-28.

This update completely breaks the shackles that used to restrict developers' work.

From now on, the core architecture is fully stateless, extended features have been upgraded, and enterprise-level security has reached a brand new level.

Moreover, the monthly SDK download volume of MCP has exceeded the astonishing 400 million mark!

This marks that the absolute industry standard for interconnection between AI agents and the global application ecosystem has been established.

Now, this major MCP version update has excited countless developers.

Monthly downloads exceed 400 million! How does MCP become the HTTP of the AI era?

The following set of data is enough to go down in history.

According to the latest official disclosure, MCP's current monthly SDK download volume has officially exceeded 400 million, achieving a staggering 4x growth this year.

Even more surprisingly, the cumulative total downloads of the two Tier 1 SDKs, TypeScript and Python, have both crossed the historic threshold of 1 billion times!

This means that almost all top developers, mainstream SaaS platforms, and enterprise IT teams around the world are using MCP as the bridge connecting large language models and the external world.

The number of MCP servers in the Claude App Store has exceeded 950, with millions of users using them intensively every day.

If the HTTP protocol once connected computers all over the world to form the Internet, now the MCP protocol is connecting software, data and APIs all over the world into a new cyber network uniformly scheduled by the AI brain.

The core of MCP becomes "Stateless", completely liberating productivity

The most hardcore update of this MCP release is that the core of the protocol is completely transformed into "Stateless".

This change is also the most requested one by developers.

Experienced developers all know that running a remote MCP server in the past was a total nightmare.

Because the previous MCP was a bidirectional "Stateful" protocol, you needed to carefully manage complex Session State and handle connection Handshake.

This led to an extremely fatal limitation: it was very difficult for your MCP server to scale smoothly in modern cloud-native architectures.

But now everything has changed! MCP officially switches to a pure request/response mode.

This change brings subversive benefits.

First of all, we can fully embrace Serverless and edge computing.

Now you can deploy MCP servers on serverless and edge computing architectures such as AWS Lambda, Vercel, Cloudflare Workers without any scruples.

There is no need to rent expensive resident servers just for a few KB of session state.

Then, we can now achieve unlimited Horizontal Scaling.

Since the Mcp-Session-Id header and initialization handshake are discarded, every request now is "self-describing", and the identity and capabilities of the client are included in _meta.

This means you can directly hang MCP behind any ordinary polling Load Balancer! No matter which machine the request hits, it can be processed perfectly, and the scalability is maximized.

What if you really need to maintain state?

Anthropic has given a very elegant answer to this.

If your server must retain state across calls, do not hide it in the transport layer, but generate an explicit Handle through the tool, and let the Claude model pass it back as a parameter.

The model can see this Handle and connect different tools seamlessly, which not only makes the logic clearer, but also conforms to the thinking pattern of large language models.

Extensions are upgraded to "first-class citizens", the official puts an end to ecosystem chaos

In previous versions, many advanced features were pieced together by developers themselves.

In the new specification, Anthropic officially elevates "Extensions" to "first-class citizens", and lays out a set of official standardized frameworks.

Developers can add powerful capabilities to MCP without modifying the core protocol.

The following are the three official debut features.

MCP Apps: End the "screen switching era", UI is rendered directly in the dialog box!

In the past, AI conversations were very boring and could only return plain text. Now, through MCP Apps, your server can directly render server-side interactive UI in a secure sandbox iframe within Claude's chat interface.

You can ask Claude to check the company's revenue data for you. It will not only analyze it, but also render a fully interactive dynamic report directly in the dialog box.

When you ask it to help you operate the cloud server, it will pop up a control panel directly.

In this way, we no longer need to switch back and forth between the tabs of Claude and various SaaS applications, achieving true WYSIWYG.

Tasks: Elegantly handle long-running asynchronous operations

AI agents are getting smarter and taking on more heavy workloads. For example, operations like "analyzing a 100GB log file" or "rendering a 3D video" may take several hours.

Previous protocols could hardly handle such ultra-long running tasks, and in the new extension io.modelcontextprotocol/tasks, Tasks are now officially available.

It provides a polling-based tasks/get and a brand new tasks/update mechanism.

Even better, change notifications are unified from the old HTTP GET endpoints to a single subscriptions/listen data stream, allowing clients to subscribe precisely by notification type.

From now on, asynchronous task management is extremely stable.

Enterprise Managed Auth (EMA): A boon for IT administrators

This is the most anticipated feature for enterprise customers! Through Enterprise Managed Auth (EMA), enterprises can now centrally control access permissions to MCP servers directly via identity providers such as Microsoft Entra and Okta.

Administrators only need to grant authorization once, and users will inherit access permissions through existing IdP groups and automatically connect when logging in for the first time.

This process enables zero-touch secure login throughout the whole process, which not only meets the extremely strict security compliance requirements of enterprises, but also provides end users with a smooth and seamless access experience.

• Geek Moment: In-depth breakdown of the underlying protocol

If you are a hardcore developer, the underlying protocol optimization of MCP 2026-07-28 will definitely make you full of excitement.

Over the past 18 months, Anthropic has drawn lessons from massive production environments and carried out drastic refactoring of the protocol:

MRTR (Multi Round-Trip Requests) replaces long-lived connections

In the past, if the server needed to actively request data from the client (such as sampling or asking the user to confirm missing parameters), it had to keep a bidirectional stream open.

Now, they have introduced Multi Round-Trip Requests (MRTR) technology.

If the tool needs user input halfway through execution, the server only needs to return resultType: "input_required" with the question. After the client answers, it re-initiates the call with inputResponses.

This design perfectly fits the stateless protocol and completely eliminates redundant long-lived connections.

Header-based Routing

There is another good news: streamable HTTP requests must now include the Mcp-Method and Mcp-Name headers.

Therefore, our API Gateway, Rate Limiter or WAF firewall no longer need to painstakingly parse the JSON body. They can perform routing and billing directly based on the Header, and the performance is greatly improved instantly.

Full cache support for list results

In the AI era, Prompt Cache is money!

Now, responses from interfaces such as tools/list and prompts/list will come with ttlMs (time to live) and cacheScope (cache scope) prompts, and guarantee deterministic sorting.

This allows clients to formulate the optimal caching strategy, greatly reducing unnecessary repeated pulls and saving real money for developers.

Ultimate hardening of Auth

According to official disclosure, in the past year, the most time-consuming part for developers integrating MCP was authorization and authentication.

This new version has undergone a military-level reinforcement.

1. Fully aligned with production-grade OAuth 2.0 and OIDC deployments.

2. Mandatory compliance with RFC 9207 issuer verification, completely closing the vulnerability of authorization server confusion.

3. Deprecate DCR and embrace CIMD: Dynamic Client Registration (DCR) is officially marked as deprecated, and fully transitions to Client Metadata Documents (CIMD). If you used to encounter annoying redirect_uri errors when developing CLI clients (because OAuth refused localhost redirection), this update completely eliminates this problem.

Claude native ecosystem support: the unprecedented peak of developer experience

In order to allow developers to make better use of this strongest specification in history, Claude not only released the protocol, but also provides a full set of powerful infrastructure support.

First of all, they provide an exclusive data dashboard for developers.

How does your MCP server perform on Claude? Are there any bugs? Is the latency high? In the past, these issues were all black boxes.

Now, as long as your server is listed on the Claude App Store, you can unlock the official developer dashboard!

You can monitor the adoption rate of your product in real time, diagnose errors and latency, and even break down the usage data of different product interfaces to drive iteration