The Model Context Protocol, the open standard that connects AI models to external tools and data, just shipped its largest revision since launch. The 2026-07-28 specification, released on July 28, drops MCP's stateful session model in favor of a stateless request/response design. The practical result for anyone running a remote MCP server: it can now scale like an ordinary web service, behind a plain round-robin load balancer, with no sticky sessions and no shared session store. This is the change that moves MCP from a promising local-first standard into production infrastructure, and it starts a 12-month clock on the old way of doing things.
Background: why sessions held MCP back
Since its debut, MCP has been a stateful protocol. A client and server opened a connection with an initialize and initialized handshake, negotiated capabilities once, and then carried an Mcp-Session-Id header on every subsequent message so the server could tie requests back to that negotiated session. That design is simple to reason about on a laptop, where one client talks to one local server. It becomes expensive the moment you try to host a remote MCP server for real traffic.
Stateful sessions force sticky routing: every request in a session has to reach the same server instance that holds its state, which rules out ordinary load balancing and complicates autoscaling. Servers need held-open connections and often gateway-level inspection of the message body to route correctly. As The Register reported ahead of the release, this stateful past was exactly what the working group set out to break, because it made MCP servers fragile and costly to run at scale.
Deep analysis: what the stateless spec actually changes
The new request model
In the 2026-07-28 spec, every request is self-describing. Instead of relying on a negotiated session, each request carries its own protocol version, client identity, and capabilities in a _meta field, so any request can land on any instance without prior context. Capability discovery becomes optional through a new server/discover RPC that a client calls only when it needs it, rather than a mandatory handshake on every connection. The spec also adds header-based routing through Mcp-Method and Mcp-Name headers, letting gateways and load balancers route traffic without parsing the JSON body at all. For interactions that genuinely need a back-and-forth, such as a mid-call confirmation, the spec introduces Multi Round-Trip Requests so that pattern is handled explicitly rather than through a persistent session. The full changelog lists every breaking change.
How to migrate a stateful server to stateless
The migration is mechanical, and the official docs ship per-SDK notes to guide it. A clean path looks like this:
1. Update to the new SDK. Stateless support ships in the current TypeScript and Python SDKs, as well as the Go and C# SDKs. Pin the new version first so the type system flags the removed APIs for you.
2. Remove the handshake. Delete the initialize and initialized exchange and stop reading or writing the Mcp-Session-Id header. Any code that keyed behavior off a session id needs a new home.
3. Move per-client context into the request. Whatever the session used to hold, protocol version, client capabilities, auth scope, now travels in the _meta field of each request, or in an external store your handlers read on demand rather than an in-process session map.
4. Make list responses cacheable. Add the new ttlMs and cacheScope fields to tools/list and other list responses so clients and intermediaries can cache them instead of re-fetching on every connection.
5. Put it behind a normal load balancer. With no sticky sessions, a plain round-robin balancer works, and you can point Mcp-Method and Mcp-Name header rules at the right handlers. The official getting-started and migration notes cover the SDK-specific details.
The same discipline that goes into any move to deploy an MCP server for remote clients applies here, with the bonus that the stateless target is simpler to host than the stateful one it replaces.
What breaks and what gets cheaper
The revision is a genuine breaking change, not an additive one. It formally deprecates Roots, Sampling, and Logging with a 12-month support window, and it retires the legacy HTTP plus SSE transport. The table below summarizes the shift.
| Dimension | Stateful MCP (before 2026-07-28) | Stateless MCP (2026-07-28) |
|---|---|---|
| Session setup | Mandatory initialize/initialized handshake | None; each request is self-describing |
| Client context | Held server-side, keyed by Mcp-Session-Id | Carried per request in a _meta field |
| Routing | Sticky; requests must hit the same instance | Any request can hit any instance |
| Load balancing | Session affinity required | Plain round-robin, header-based routing |
| Capability discovery | Negotiated on every connection | Optional server/discover RPC |
| List responses | Re-fetched per connection | Cacheable via ttlMs and cacheScope |
| Deprecated | Roots, Sampling, Logging active | Deprecated, 12-month window; legacy HTTP+SSE retired |
The serverless cost equation
The economic story is the point of the whole revision. Stateful sessions meant held-open connections, session-store infrastructure, and gateway inspection, all of which cost money and add failure modes. Stateless requests remove every one of those. Because any request can land on any instance, MCP servers now fit the serverless execution model, functions that spin up per request and bill per invocation, on platforms like AWS Lambda, Google Cloud Run, and Cloudflare Workers. As InfoWorld noted, the change lets standard cloud infrastructure handle MCP traffic without special session handling, which is what turns a fixed always-on server bill into a pay-per-request one for integrations that see bursty, uneven load.
Impact on creators and tool builders
If you build creative tooling on MCP, this lowers the cost and complexity of shipping it to other people. The MCP servers behind AI-operated video editors and similar integrations no longer need always-on hosting to serve remote clients; they can run serverless and scale to zero between jobs. That matters most for independent builders and small teams, where a fixed monthly server bill is the difference between shipping a hosted integration and keeping it local-only. Approaches that cloud-deploy MCP servers for Claude and ChatGPT get simpler too, because the deployment target is now a stock web service rather than a session-aware one. The tradeoff is real migration work for anyone whose server leans on session identifiers or the deprecated transport, so the sooner you audit, the more of the 12-month window you keep.
Key takeaways
- The 2026-07-28 MCP spec replaces stateful sessions with a stateless request/response model, so any request can hit any server instance.
- The
initialize/initializedhandshake and theMcp-Session-Idheader are gone; per-client context moves into a_metafield per request. - Header-based routing, an optional
server/discoverRPC, Multi Round-Trip Requests, and cacheable list responses replace the session machinery. - Roots, Sampling, and Logging are deprecated on a 12-month window, and the legacy HTTP plus SSE transport is retired.
- The payoff is serverless-friendly hosting: MCP servers can now run behind ordinary load balancers and bill per request.
What to watch
The near-term signal is SDK adoption. With stateless support already in the TypeScript, Python, Go, and C# SDKs, watch how quickly framework and gateway vendors add native Mcp-Method and Mcp-Name header routing, since that is what makes the serverless deployment story turnkey rather than manual. The 12-month deprecation clock on Roots, Sampling, Logging, and the legacy transport is the other thing to track: servers that ignore it will break when the window closes. The open question is how well a purely stateless model serves long-running agent sessions that genuinely want continuity, and whether Multi Round-Trip Requests plus external state cover those cases cleanly or leave builders reaching for their own session layer on top. The answer will shape whether MCP's stateless bet holds for the most demanding agent workloads or only for the request-shaped ones.
Frequently asked questions
Is the old stateful MCP still supported?
Partly. The deprecated features, Roots, Sampling, and Logging, along with the legacy HTTP plus SSE transport, carry a 12-month support window, so existing servers keep working during that period. After the window closes, servers that depend on them will need to have migrated.
Do I have to rewrite my MCP server?
Not from scratch. The migration is mechanical: update the SDK, remove the handshake and session header, move per-client context into the request, add caching fields to list responses, and drop the server behind a normal load balancer. Servers that never leaned on session state will change very little.
Can MCP servers now run on serverless platforms?
Yes. Because each request is self-describing and any request can land on any instance, MCP servers fit the per-request execution model of platforms like AWS Lambda, Google Cloud Run, and Cloudflare Workers, which was impractical under the old sticky-session design.
What replaces the Mcp-Session-Id header?
Per-request self-description. Protocol version, client identity, and capabilities travel in a _meta field on each request, and gateways route using the new Mcp-Method and Mcp-Name headers instead of a session id.
Which SDKs support the stateless spec?
The TypeScript, Python, Go, and C# SDKs all ship stateless support with per-SDK migration notes. Pinning the new SDK version first is the recommended starting point, because the updated types surface the removed APIs for you.
