MCP Goes Stateless: No More Sessions, No More Handshakes

No Sessions. No Handshakes. No Sticky Connections.

On July 28, 2026, the MCP team released spec version 2026-07-28. The main event: the entire session mechanism — the initialize/initialized handshake, the Mcp-Session-Id header — is gone. MCP is now a pure request/response protocol.

The numbers make this change significant: nearly 500 million SDK downloads per month, with both TypeScript and Python SDKs crossing 1 billion total downloads. Claude Code, Cursor, Windsurf, and a growing list of agent platforms use MCP as their tool connectivity layer. Any change here ripples across the entire ecosystem.

Why Now?

MCP launched in 2024 with a stateful design — each client opened a long-lived connection to a server, maintaining a session throughout the interaction. That design was fine for an MVP. It became a bottleneck as the ecosystem grew.

Three trends converged to make stateless urgent:

• Scale: at half a billion requests per month, sticky sessions aren't practical. Every deploy, restart, or scale event breaks sessions, forcing clients to reconnect and reinitialize.
• Serverless: more MCP servers now run on Lambda, Cloud Run, and Cloudflare Workers — platforms where functions live in milliseconds, not sessions.
• Multi-provider: when an agent calls tools across multiple MCP servers, maintaining separate sessions for each provider creates unnecessary connection matrices.

How Stateless Works

Every request is now a standalone, self-describing unit:

POST /mcp HTTP/1.1
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: search

{"jsonrpc":"2.0","id":1,"method":"tools/call",
 "params":{"name":"search","arguments":{"q":"otters"},
 "_meta":{"io.modelcontextprotocol/clientInfo":{"name":"my-app","version":"1.0"}}}}

No pre-flight needed. The server reads _meta from the first request. Clients can optionally call server/discover to fetch capabilities upfront, but it's not required.

The upshot: an MCP server sits behind the simplest round-robin load balancer. No sticky sessions. No shared Redis for session sync. Deploy on serverless without thinking about connection draining.

MRTR: When the Server Needs to Ask the Client

Dropping sessions means dropping bidirectional streams — the only channel for the server to send requests back to the client (e.g., "are you sure you want to delete this?"). This was the hardest technical problem to solve.

The answer is Multi Round-Trip Requests (MRTR) (SEP-2322):

1. Server returns resultType: "input_required" with a list of questions
2. Client retries the original call with inputResponses filled in

Instead of one open two-way connection, MRTR creates a chain of independent request/response pairs. The model manages handles between tool calls. This approach uses the natural LLM behavior: tool call → result → next tool call.

Route by Header, Not by Body

Requests now carry Mcp-Method and Mcp-Name in HTTP headers (SEP-2243). It sounds small, but it changes operations fundamentally:

Before	After
Gateway must parse JSON body to identify method	Read headers — no JSON parsing needed
Rate limiting requires application-layer inspection	Rate-limit at the edge, based on headers
Debugging requires body inspection	Log headers + trace ID for troubleshooting

Combined with cache hints (ttlMs, cacheScope) on list responses (SEP-2549), clients can cache tool catalogs and prompt lists — cutting 30-40% of unnecessary round-trips for repeated calls.

Auth: Fixing the Biggest Integration Pain Points

Authorization has been the most time-consuming part of MCP integration. Three key changes:

• RFC 9207 issuer validation (SEP-2468): servers must return iss; clients must validate. Closes the authorization-server mix-up hole — a vulnerability where redirect URLs could be hijacked.
• CIMD replaces DCR: Dynamic Client Registration is deprecated. Client ID Metadata Documents are the new standard. Why? DCR breaks with CLI and desktop apps due to localhost redirect_uri issues.
• Issuer-bound credentials (SEP-2352): no more reusing credentials across authorization servers.

What's In, What's Out

• Tasks graduates to the official io.modelcontextprotocol/tasks extension (SEP-2663), with poll-based tasks/get and tasks/update.
• Roots, Sampling, Logging are deprecated (SEP-2577).
• HTTP+SSE transport is also deprecated.

Everything has a 12-month offramp. This is MCP's first formal deprecation policy — a signal that the protocol has matured and takes backward compatibility seriously.

What Developers Should Do

All four Tier 1 SDKs (TypeScript, Python, Go, C#) have migration guides. If you run an MCP server:

• Audit session dependencies: grep for Mcp-Session-Id and initialize in your codebase
• MRTR for elicitation: if your server calls elicitation/create or sampling/createMessage, redesign for MRTR
• Auth migration: DCR → CIMD, add iss validation
• Enable cache hints: use ttlMs to cut round-trips
• Timeline: Roots, Sampling, Logging, and HTTP+SSE have 12 months — don't panic, but don't forget

The Trade-Off

Stateless isn't free. Servers lose the ability to push notifications proactively. Use cases that need real-time interaction — streaming tool output, long-running task progress — will need polling or out-of-band mechanisms.

But the trade-off is worth it. MCP is no longer a demo protocol. It's becoming production infrastructure. When a protocol chooses to sacrifice features for scalability, it's preparing for something much bigger than what came before.

---

Content assisted by AI (Amy 🌸). Reviewed by the author.