Model Context Protocol Prepares to Break With Its Stateful Past

Source: The Register — 2026-07-23

Summary

MCP's biggest spec revision since launch finalizes on 2026-07-28, ripping out the initialize/initialized handshake and the Mcp-Session-Id header that made every connection stateful. Requests become self-contained, so a remote MCP server that previously needed sticky sessions, a shared session store, and deep packet inspection at the gateway can now run behind a plain round-robin load balancer. The same release ships two official extensions — MCP Apps (sandboxed HTML UIs) and a redesigned Tasks extension — plus OAuth/OIDC-aligned authorization fixes and a formal deprecation policy.

Key Takeaways

• The initialize handshake (SEP-2575) and the protocol-level session / Mcp-Session-Id header (SEP-2567) are removed entirely — each MCP request is now independent and self-contained.
• Servers that still need to carry state across calls do it the way ordinary HTTP APIs always have: mint an explicit handle (e.g., a basket_id) from a tool call and have the model pass it back as a plain argument on later calls, making state visible to the model instead of hidden in transport metadata.
• This solves a real infrastructure pain point directly: stateful MCP required sticky routing and shared session stores for horizontal scaling; the new stateless design lets any request land on any server instance behind a plain round-robin load balancer.
• Persistent SSE streams for server-to-client communication are replaced with multi-round-trip request/response patterns (e.g., InputRequiredResult), so any server instance can pick up a continuation.
• Two extensions graduate to official status with reverse-DNS identifiers and independent versioning: MCP Apps (SEP-1865), letting servers ship sandboxed HTML interfaces rendered inside MCP hosts, and Tasks (SEP-2663), redesigned around the stateless model with server-directed task handles (tasks/get, tasks/update, tasks/cancel).
• Roots, Sampling, and Logging are formally deprecated with a mandatory 12-month compatibility window, and tool schemas now support full JSON Schema 2020-12 with composition and conditionals.

Reel Script

Hook Every MCP server built so far had to remember who you were between requests, which meant sticky sessions, shared state stores, and infrastructure headaches at scale. As of today, that requirement is gone.

Core Concept MCP, the Model Context Protocol that lets AI models call tools and servers, originally worked like a phone call: you dial in with an initialize handshake, get a session ID, and every message after that has to route back to the same server that answered, because that server is the only one holding your session in memory. That's "stateful," and it's exactly what makes horizontal scaling hard — you need sticky routing so requests keep hitting the same machine, plus a shared session store so machines can hand off state if one goes down. MCP's new spec, finalized 2026-07-28, deletes that entire handshake and the session ID header. Now every request carries everything it needs on its own, like sending a full postcard each time instead of relying on a running phone call.

Hands-On Picture two architecture diagrams. Before: client sends initialize, server allocates a session, replies with Mcp-Session-Id, and every request afterward must route to that same server instance — a load balancer needs sticky routing or deep packet inspection to keep the thread intact. After: client sends a self-contained request with method info in headers like Mcp-Method, and any server instance in the pool can answer it, because there's no session to look up. If a server-side tool genuinely needs to remember something, like a shopping basket or an in-progress task, it now returns an explicit handle, a basket ID, and the model just passes that ID back as a normal argument on the next call. State still exists; it's just visible data now, not protocol magic. That's why a server that used to need sticky sessions and a shared session store can now sit behind a plain round-robin load balancer. The same release also ships MCP Apps for sandboxed HTML UIs inside MCP hosts, and a rebuilt Tasks extension using the same handle pattern.

Takeaway This is a maturity signal, not a cosmetic tweak — MCP is shedding the assumptions that made it awkward to run at real production scale, and any team self-hosting MCP servers behind load balancers should treat this as the moment it gets meaningfully easier. If you maintain an MCP server, start planning your migration off initialize and session IDs now — the deprecated features get a 12-month window, not forever.

Discussion

(No questions yet — ask follow-ups via a Claude Code chat session on this repo; answers get appended here.)