Dev Radar: Agent plumbing settles - stateless MCP, A2A, Assistants API ends
Agent architectures have been built on interfaces that kept moving. Over the summer and into September, four changes made the base layer more predictable. Each also asks for work in existing systems.
MCP 2026-07-28: stateless, and breaking
The Model Context Protocol maintainers published the 2026-07-28 specification on 28 July. It retires the initialize/initialized handshake and the Mcp-Session-Id header: every request now carries its protocol version, client identity and capabilities in _meta. The release adds Multi Round-Trip Requests for mid-execution input, mandatory Mcp-Method and Mcp-Name HTTP headers for routing, cacheable list results and an extensions framework that now hosts Tasks.
Clients must now validate the RFC 9207 issuer (iss) parameter, and Dynamic Client Registration is formally deprecated in favour of Client ID Metadata Documents. Roots, Sampling and Logging are deprecated and keep working for at least twelve months; the legacy HTTP+SSE transport has a year-long offramp.
A stateless core lets MCP servers sit behind ordinary load balancers and gateways without shared session storage. The cost is compatibility: according to guidance cited by The Register, servers on 2026-07-28 may not work with older clients and vice versa, and, as The Register reports, a lead maintainer said in a pre-release livestream that custom implementations face "a lot of uplift".
A2A moves under neutral governance
On 17 August the Agentic AI Foundation, hosted by the Linux Foundation, announced that the Agent2Agent (A2A) protocol is joining it as a hosted project, alongside AGENTS.md, goose, MCP and agentgateway. The A2A v1.0 stable specification shipped in March 2026 with features including version negotiation, multi-tenancy and signed agent cards for cryptographic identity verification, and the foundation says more than 150 organisations back the protocol. Agent-to-tool (MCP) and agent-to-agent (A2A) standards now sit under one neutral body, which reduces the risk of betting on a vendor-controlled protocol.
OpenAI: Assistants API ends, Agents API in beta
The legacy Assistants API shut down on 26 August 2026. The Agents API has been in public beta since 10 September: a managed Codex harness in which OpenAI handles session orchestration, context compaction and recovery. At DevDay on 29 September it gained computer use in an OpenAI-hosted browser, with website access approvals and sign-in handled by the customer application. A hosted runtime speeds delivery and increases platform dependence. Two controls are worth adopting either way: project API keys with expiration dates, and mTLS together with X.509 workload identity federation. European buyers should note that the new Ultrafast tier for GPT-6 Astra runs with global processing and US data residency; EU regional inference residency is not supported.
Anthropic: computer use, Files API and Agent Skills leave beta
On 19 August Anthropic moved computer use out of beta on the Claude API as the computer_toolset_20260801 toolset, with batch actions and zoom enabled by default. It also launched a browser use tool (browser_toolset_20260801), a client toolset for a browser hosted by the customer application. The Files API and Agent Skills, including the Skills API, no longer require beta headers. The migration is not drop-in: the request shape changes, and Opus 5.5 and Sonnet 5.5 reject the earlier computer_20251124 tool on the Claude API and Google Cloud.
What to change in agent architectures now
Inventory every MCP server and client, including in-house ones, and plan the move to 2026-07-28 before the deprecation windows close.
Remove reliance on MCP session state and route on the new headers at the gateway.
Replace Dynamic Client Registration and add issuer validation in MCP clients.
Find any remaining Assistants API code. That interface no longer runs.
Decide deliberately where orchestration lives: in a vendor-hosted runtime or in your own code. Keeping tools on MCP and agent hand-offs on A2A makes that decision easier to revisit.
Move computer use integrations to the new toolsets and test them against the newer models.
Add key expiry and workload identity to the security baseline.