MCP drops sessions to make agent servers scale like ordinary HTTP

Why it matters

MCP is becoming basic agent infrastructure. Stateless requests reduce deployment complexity, while the breaking migration shows the cost of standardizing technology that spread before its production model settled.

Led by maintainers David Soria Parra and Den Delimarsky, the Model Context Protocol project published its final 2026-07-28 specification on July 28, replacing the agent integration standard's handshake and transport-level sessions with self-contained HTTP requests.

The change brings MCP closer to the infrastructure Soria Parra originally wanted developers to be able to extend for themselves. He recounted in a 2025 interview that the idea grew from his frustration copying material between Claude Desktop and his code editor after joining Anthropic. Soria Parra took the concept to Justin Spahr-Summers, and the pair prototyped clients and servers before Anthropic released MCP in November 2024.

The protocol spread far beyond that local desktop use case. Remote servers introduced requirements that its early stateful design handled awkwardly: sticky routing, shared session storage and persistent connections. In MCP's 2026 roadmap, maintainers identified those constraints as a barrier to horizontal scaling.

The final 2026-07-28 specification is their answer. It removes the initialize and initialized exchange and retires the Mcp-Session-Id header. Every request instead carries its protocol version, client identity and capabilities. Clients can call the optional server/discover method when they need to inspect a server before invoking it.

A protocol redesigned around load balancers

The operational consequence is straightforward: an MCP request can land on any available server instance behind a round-robin load balancer. Operators no longer need the protocol layer to remember which instance handled a client's previous request or maintain a shared session store across the cluster.

That distinction matters as MCP moves from developer experiments into managed agent infrastructure. Stateful connections complicate autoscaling, recovery and traffic distribution. A failed server can take its session state with it, while a stateless request can be retried against another instance if the surrounding application is designed to permit it.

MCP has not eliminated application state. Servers that need continuity can issue an explicit handle, such as a basket or browser identifier, and require the model to pass it into subsequent tool calls. The state becomes an argument the model can inspect and reuse instead of hidden transport metadata.

That design follows Soria Parra's broader approach to MCP: keep the specification narrow and make the useful behavior composable above it. In the 2025 interview, he described MCP as a deliberately "boring specification" intended to support something resembling the API economy for interactions involving language models.

The hard part moves up the stack

Removing persistent sessions required the maintainers to redesign flows that previously depended on an open bidirectional stream. Multi Round-Trip Requests, shortened to MRTR, now handle cases where a server needs more input during a tool call. A server can return an input_required result, and the client retries the original request with the requested answers attached.

That mechanism covers user confirmations and missing parameters without allowing a server to initiate an unrelated request at any time.

The revision also requires Mcp-Method and Mcp-Name HTTP headers. Gateways, rate limiters and web application firewalls can use those fields to route, authorize or meter traffic without parsing each JSON body. List responses for tools, prompts and resources now include cache scope and time-to-live hints, reducing repeated catalog requests and helping clients preserve stable prompt inputs.

These choices make MCP easier to fit into infrastructure that companies already operate. They also increase the importance of honest method naming, correct authorization policy and careful handling of identifiers passed between tools. Stateless transport removes one class of operational dependency; it does not remove the trust decisions created when an agent can call external systems.

Security work follows adoption

In the July release post, MCP's maintainers say its Tier 1 SDKs are approaching 500 million downloads a month, while both the TypeScript and Python SDKs have passed 1 billion cumulative downloads. Those are package retrieval counts rather than unique developers, active servers or production customers, but they show how frequently MCP components now move through development and deployment systems.

The security exposure has grown with that distribution. The National Security Agency has warned that MCP deployments introduce risks involving trust boundaries, serialization, context sharing and agent misuse, particularly when agents reach sensitive data or execute tools.

Delimarsky joined Anthropic in January 2026 after working on MCP's steering group and serving as a core maintainer focused on authorization and security. In his account of the move, he described the job as a bet on making interoperability between agents and external services safer and easier to scale.

The July specification adds issuer validation under RFC 9207, binds client credentials to the authorization server that issued them and formally deprecates Dynamic Client Registration in favor of Client ID Metadata Documents. The changes address concrete OAuth deployment problems. They do not settle broader questions about whether a tool should be trusted, which data an agent should see or how operators should contain a compromised integration.

Breaking once to break less often

The maintainers are pairing the transport rewrite with rules intended to reduce future migration shocks. Roots, Sampling and Logging are deprecated, as is the legacy HTTP and server-sent events transport, but the project promises at least 12 months between deprecation and removal.

Tasks have moved from the experimental core into an extension with polling and update methods. The extensions framework gives features such as Tasks, MCP Apps and enterprise-managed authorization room to evolve without forcing every implementation to absorb them into the base protocol.

TypeScript, Python, Go and C# SDKs support the new specification. Developers that relied on session identifiers still face migration work, and broad compatibility will depend on clients and servers negotiating versions while maintainers update their implementations.

MCP's governance has also moved beyond Anthropic's direct ownership. Anthropic donated the project to the Agentic AI Foundation under the Linux Foundation in December 2025. The project's governance page lists Soria Parra and Delimarsky as lead maintainers, with Spahr-Summers as lead maintainer emeritus.

That structure gives the protocol a neutral home while leaving individuals with final technical authority. The stateless rewrite is the clearest test of that arrangement so far: a community-led standard accepting near-term breakage to fit the production systems that have grown around it.