The latest Model Context Protocol update removes sessions from the core request path, and that change is prompting a familiar reaction: if MCP is now stateless, is it just an API again? The 2026-07-28 specification drops protocol sessions, adds required HTTP headers for Streamable HTTP requests, and shifts more routing, metering, and policy enforcement into infrastructure that gateways already understand.
MCP loses sessions and gains HTTP-friendly routing
Earlier MCP transports began with an initialize and initialized exchange that created a session, tracked through an Mcp-Session-Id header. That made each client effectively sticky to the instance holding its state, which complicated autoscaling, draining, migration, and load balancing.
The new specification removes that handshake, the session header, and protocol sessions from the request path. Instead, each request carries the protocol version, client identity, and capabilities it needs, so any request can be handled by any instance.
Why the change matters to infrastructure teams
Statelessness is the obvious scaling win, but the more immediate effect is operational. Without session affinity, MCP services can sit behind ordinary load balancers, scale more predictably, and avoid the special handling that stateful protocols often require. That brings MCP closer to the deployment patterns teams already use for conventional APIs.
At the same time, the protocol now exposes more of its intent at the transport layer. That means gateways and policy tools no longer need to inspect only the JSON body to understand what a request is trying to do.
Two new headers expose MCP intent before the body is parsed
MCP messages still use JSON-RPC over HTTP, but the specification now requires two headers on Streamable HTTP requests: Mcp-Method and Mcp-Name. A tool invocation, for example, arrives as Mcp-Method: tools/call and Mcp-Name: search, with the JSON-RPC payload following behind it.
According to Cloudflare’s Matt Carey, that lets a gateway, rate limiter, or WAF read the request type and respond per method or per tool using the same primitives it already applies to other APIs. The spec goes even further, with commenter evalstate noting that tool arguments can also be copied into headers for custom routing.
- Gateways can route requests by tool or method.
- Rate limits can be applied more precisely.
- WAF and policy layers can act without parsing the body first.
- Infrastructure teams can meter agent traffic using existing API controls.
That shift matters because agent governance has typically been added above the protocol, not inside it. Cloudflare’s agent tracing and Azure API Management’s AI Gateway tier both sit as separate control layers. This update moves part of the metadata into the transport itself, where infrastructure systems can see it earlier.
Human approval no longer holds a connection open
Another notable change affects elicitation, the server-initiated flow used when a human has to provide input. In the new model, those requests use Multi Round-Trip Requests instead of an open stream. The server returns input_required, the client gathers the answer, and the call is retried.
That makes deployment simpler, but it also changes the shape of waiting. Approval is now represented as two requests instead of one long-held connection, so the pause for a human no longer sits inside a single invocation.
Authorization is getting stricter too
The release also tightens the authorization story. Dynamic Client Registration is deprecated and scheduled for removal after summer 2027. The spec also adopts RFC 9207 issuer identification and has clients send the canonical server URI as the RFC 8707 resource so tokens are accepted only by the intended audience.
Those changes suggest MCP is being pushed toward clearer identity boundaries, not just easier scaling. For operators, that usually means less ambiguity about who is calling what, and fewer protocol-specific exceptions to manage in production.
Developers split over whether MCP was ever meant to be stateful
Community reaction on Hacker News has been divided, though not over whether statelessness is useful. The real disagreement is what the change says about the protocol’s original design.
One camp argues the update confirms MCP should never have relied on state. Commenter drdexebtjl said that in retrospect, stateful MCP was clearly wrong and that the new shape makes it look like “just another REST API endpoint,” while still letting teams use familiar infrastructure such as load balancers, API gateways, and progressive rollouts.
Commenter pjmlp framed it as a lesson the industry keeps relearning, while luciana1u was more blunt, saying the industry invented a stateful protocol, discovered state is hard to scale, stripped it out, and ended up at “just send a POST request.”
Others pushed back on the idea that resemblance to REST makes MCP pointless. Commenter lexicality noted that MCP is literally JSON-RPC, while vidarh argued that the protocol’s real value was never the transport mechanics but the fact that AI providers blessed a standard people had strong incentives to implement.
Practical value may be moving up the stack
That view lines up with comments from implementers. David Cramer, co-founder and chief product officer at Sentry, told Cloudflare the release improves auth and tools handling, and said, “Agents only get useful once the plumbing stops being the whole story.”
There is also a separate debate about whether agents need a protocol at all, or whether ordinary CLI tools are enough. But that position assumes a developer at a laptop with a shell open, and one commenter argued that describes only a small slice of real usage compared with phone apps, web chat, and embedded widgets.
Adoption is growing, but useful deployment remains the harder question
Anthropic says MCP has passed 400 million monthly SDK downloads, a fourfold increase this year. Even so, broad adoption does not mean every server is seeing meaningful external use.
One consultancy post referenced in the discussion described auditing a client’s server that recorded 61 tool calls in three months, 58 of them from the company’s own engineers. The author argued that many teams confuse being reachable by an agent with actually being wanted by one, and concluded that the money is flowing toward gateways, registries, and auth layers rather than the servers themselves.
What teams using MCP need to do now
For teams already running MCP in production, the migration is not just a specification update. Servers that depend on protocol sessions, server-to-client requests, or standalone streams can run the new stateless route alongside the old one, move features across gradually, drain active sessions, and then remove the legacy path during the deprecation window.
The specification and updated TypeScript, Python, Go, and C# SDKs are available now, so the technical path is clear. The bigger question is whether the protocol’s new shape will make MCP feel like a cleaner standard for agents, or simply a more carefully labeled API.
Source: Original report
Was this helpful?
Explore more: DevOps Services More Software Development Tech News
Last Modified: August 13, 2026 at 1:52 am
0 views
