MCP Shipped the Stateless Spec. Here's the Scorecard on What I Said Would Break.

In June I read a draft that proposed deleting sessions from MCP and wrote up what it would break in my production server. The conclusion was that it would cost me a weekend and be worth it. The specification went final on 28 July 2026, so this is the honest scorecard: what shipped, what I called correctly, and the one thing I got wrong badly enough that it changed my migration plan.

What actually landed

The headline held. The initialize/initialized handshake and the Mcp-Session-Id header are gone. Every request now carries its own protocol version, client identity, and capabilities. The spec's own framing is the part worth quoting: any request can now land on any server instance behind a plain round-robin load balancer without needing shared storage.

Four other changes matter more than the release notes make them sound:

Multi Round-Trip Requests (MRTR). This is the replacement for server-initiated requests that used to need an open stream. A tool that needs a confirmation or a missing parameter mid-call returns resultType: "input_required", and the client retries with answers in inputResponses. Elicitation stops being a streaming problem and becomes a retry problem, which is a category of problem every HTTP engineer already knows how to debug.

Header-based routing. Requests must carry Mcp-Method and Mcp-Name headers. Your gateway can now rate-limit and route without parsing a JSON body — which means nginx can do it, and on a one-box setup that's the difference between a rate limiter and no rate limiter.

Cacheable list results. Tool, prompt, and resource listings now return ttlMs and cacheScope. Unglamorous, and probably the single biggest token-cost lever in the release.

Authorization hardening. RFC 9207 issuer validation is required, client credentials are bound to the authorization server that issued them, and the ecosystem is moving from Dynamic Client Registration to Client ID Metadata Documents. Tasks, MCP Apps, and Enterprise-Managed Authorization all moved out of the core into a formal extensions framework.

The scorecard

What I got right: the session ID was load-bearing in ways nobody had documented, and ripping it out mostly hurt code that was quietly using it as a cache key. That was true, and it was true in my server — the TypeScript one I wired into Next.js had exactly that sin in two places.

What I got wrong: I budgeted a panicked weekend. I didn't expect the spec to ship a formal deprecation policy with a twelve-month minimum window. Roots, Sampling, Logging, and the HTTP+SSE transport are all deprecated but keep working for at least a year. That turns a fire drill into a planned upgrade, and it's the most grown-up thing in the release. A protocol that publishes its deprecation clock is a protocol you can put in a roadmap.

All four Tier 1 SDKs — TypeScript, Python, Go, C# — supported the spec on release day. Rust is in beta. If you're on a Tier 1 SDK, most of this is a dependency bump plus deleting the session plumbing you wrote to work around the old design.

The part that isn't in the changelog

When I wrote that MCP was declared dead in January and the numbers said otherwise, the counter-argument was that a single vendor's protocol can't be infrastructure. That argument is now closed on paper: MCP is governed by the Agentic AI Foundation under the Linux Foundation, alongside goose and AGENTS.md, with AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI as Platinum members. The Tier 1 SDKs are pulling close to half a billion downloads a month, and third-party registries count somewhere around 101,000 servers across the ecosystem.

I'd treat the server counts the way I treat every ecosystem number — registries double-count, and a registry entry is not a maintained server. But the SDK download figures come from package managers, and those are hard to inflate.

One security note before you migrate

Stateless makes servers easier to run and does nothing about the client side. This month's symlink RCE across six coding agents lands its payload by overwriting .mcp.json so the agent loads an attacker's server on restart. Your MCP config file is now a privileged asset. If you're touching MCP plumbing this month anyway, that's a cheap thing to lock down at the same time.

The verdict

I said in June I was glad they were deleting sessions, and I'll take the win: this is the release where MCP stopped being a clever protocol and started being boring infrastructure. Stateless behind a load balancer, cacheable listings, headers a proxy can read, a deprecation policy with a date on it. None of it is exciting. All of it is what you want under something you're going to run for three years.

My migration plan, if it helps: bump the SDK, delete the session cache keys, add ttlMs to the list endpoints because it's free money, and leave the deprecated transports alone until the twelve months are closer to up. If you run MCP servers inside a team, the Enterprise-Managed Authorization extension going stable is the line item to bring to your platform people this quarter.

Sources

The spec announcement, with the stateless rationale, MRTR shape, and the deprecation policy: The 2026-07-28 Specification on the Model Context Protocol blog, and the release candidate post that preceded it. Governance and membership details are in the Linux Foundation's Agentic AI Foundation announcement and Anthropic's note on donating MCP. Registry counts are third-party aggregates and should be read as an order of magnitude, not a census.