MCP Goes Stateless: What the 2026-07-28 Spec Update Actually Changes

What Changed in MCP's 2026-07-28 Spec Update?

On July 28, 2026, the Model Context Protocol published its most significant specification update since MCP launched: it eliminated the stateful handshake — the initialize/initialized exchange and the Mcp-Session-Id header that pinned a client to a specific server instance — and replaced it with a stateless, request/response model. Every MCP request now carries its own context (protocol version, client identity, capabilities) in a _meta field, meaning any request can land on any server instance behind a standard load balancer with no shared session storage required.

Why Did MCP Need to Go Stateless?

The original stateful design worked fine for a single long-running connection between one client and one server, but it fought against how production infrastructure actually scales. A stateful session pins a client to one server process — you can't just add more instances behind a load balancer, because the session lives in that one process's memory. According to the MCP team, this was the top piece of developer feedback: people building real MCP servers wanted better reliability and horizontal scalability, and the fix was to make MCP behave like the rest of the web — stateless, cacheable, routable.

How Do You Handle State Now?

If a tool call genuinely needs to remember something between requests, the pattern shifts from "the server remembers" to "the model remembers." A tool mints an explicit handle — an opaque reference — and the calling model passes that handle back as an argument on the next call. State becomes an application-level concern the model manages explicitly, rather than something the transport layer holds open for you. This is a real design shift, not just a header rename: it means state has to be designed into your tool schemas from day one instead of assumed for free by the connection.

What Are Multi Round-Trip Requests (MRTR)?

The stateless shift created one obvious problem: what happens when a tool call needs to ask the user something mid-call — a confirmation, a missing parameter — the kind of thing elicitation/create or sampling/createMessage used to handle over a held-open stream? MRTR solves it without reintroducing a persistent connection: the server responds with resultType: "input_required" and a description of what it needs, the client collects the answer, and retries the original call with the answer attached in inputResponses. The interaction becomes a short sequence of independent, stateless requests instead of one long-lived one.

What Else Changed?

• Header-based routing. Streamable HTTP requests must now carry Mcp-Method and Mcp-Name headers, so gateways, rate limiters, and WAFs can route and meter traffic without parsing the JSON body of every request.
• Cacheable list results. Tool, prompt, and resource list responses now carry ttlMs and cacheScope metadata, so clients can cache them intelligently instead of re-fetching the same tool list on every call.
• Authorization hardening. Authorization servers must return an iss parameter per RFC 9207, which clients validate before redeeming a code — closing a class of authorization-server mix-up vulnerabilities. Client credentials also now bind to the specific authorization server that issued them, preventing cross-server reuse.
• A formal extensions framework. Tasks graduate out of experimental status into a proper io.modelcontextprotocol/tasks extension with poll-based methods, and change notifications consolidate into a single subscriptions/listen stream.

Do I Need to Migrate Right Away?

Not urgently. Roots, Sampling, and Logging are deprecated with a minimum twelve-month offramp, and the legacy HTTP+SSE transport gets the same runway — the MCP team explicitly built a formal deprecation policy around a twelve-month minimum window specifically so teams can plan the migration instead of scrambling. All four Tier 1 SDKs (TypeScript, Python, Go, C#) already support 2026-07-28, with the Rust SDK in beta, so the tooling is ready whenever you are. The main migration cost falls on anyone whose server logic currently assumes a session identifier persists across calls — that assumption has to be replaced with an explicit handle pattern.

Vantaverse's Take: This Is the Update That Makes MCP Servers Actually Production-Grade

We've been building and running MCP servers as part of our agent harness practice since before this update, and the stateful session model was a real operational headache — you either ran a single server instance (a scaling ceiling and a single point of failure) or built your own sticky-session infrastructure to fake statelessness on top of a protocol that assumed you wouldn't need to. This update removes that entire category of problem at the protocol level instead of leaving every team to solve it themselves. It also validates something we've argued in our research on MCP as the tool-use standard: the protocol's long-term value depends on it behaving like normal web infrastructure, not like a special case that needs its own deployment playbook. If you're running MCP servers behind an agent harness and still assuming session affinity, this is the spec update worth planning a migration around before the twelve-month window gets uncomfortably short. We go deeper on what the stateless shift actually means for how you design tools and handle state in our follow-up research piece.