The Model Context Protocol shipped its most consequential architectural change since launch on July 28: sessions are gone. The 2026-07-28 specification eliminates the initialize
handshake and Mcp-Session-Id
header entirely. If your MCP server carries any session-scoped state — and most do — it will break against spec-compliant clients. This is not a deprecation with a 12-month grace period. It is a hard cut. Here is what changed, what needs fixing this week, and what you actually gain.
The Old Architecture Is Dead #
The previous spec required a multi-step ceremony: client connects, sends initialize
, receives initialized
plus an Mcp-Session-Id
header that pinned the client to a specific server instance. Every subsequent request carried that session ID. Servers stored state keyed to it. Horizontal scaling required sticky routing, shared session stores, and deep packet inspection at the gateway — none of which is fun to operate at any scale.
The 2026-07-28 spec replaces all of that with self-contained requests. Protocol version, client identity, and capabilities now travel in a _meta
field on every call. Any request can land on any server instance. No handshake. No session ID. No shared state required.
Cloudflare put it plainly: “agent infrastructure now works like the rest of the web: stateless, cacheable, routable, and globally scalable.” That quote lands because it’s accurate. MCP was always fighting its stateful design when deployed on real infrastructure. This release stops fighting.
What Breaks in Your Server #
Five things break immediately when a spec-compliant client connects to an unpatched server:
Session-scoped caches— Any pattern likecache[sessionId].userConfig
fails. There are no session IDs to key on.The initialize handshake— Code expecting theinitialize
/initialized
flow receives nothing. Removed entirely.Session ID routing logic— If your gateway routes onMcp-Session-Id
, that logic now routes on nothing.Server-initiated sampling and elicitation— Thesampling/createMessage
andelicitation/create
patterns required held-open bidirectional streams. Stateless transport kills them. Replaced by Multi Round-Trip Requests (MRTR).— Removed completely. Without sessions, “all tasks for this session” has no defined scope.tasks/list
Two smaller breaks worth catching: the missing resource error code shifts from -32002
to -32602
(Invalid Params), and remote servers now require OAuth 2.1 alignment — unauthenticated remote endpoints are no longer acceptable under spec.
The Migration Checklist #
The SDK teams shipped v2 releases alongside the spec. The TypeScript SDK includes a codemod that automates most of the v1-to-v2 changes. Run it first, then handle what’s left manually.
Step 1: Update your SDK.
- Python:
`pip install "mcp[cli]==2.0.0b1"`
- TypeScript:
npm install @modelcontextprotocol/server@beta
then runnpx @modelcontextprotocol/codemod@beta v1-to-v2 .
-
Go:
go get github.com/modelcontextprotocol/go-sdk@v1.7.0-pre.1 -
C#:
dotnet add package ModelContextProtocol --prerelease
Step 2: Strip session dependencies. Audit your codebase for anything keyed to a session ID. Replace server-side session stores with explicit handles returned from tools. The pattern: your tool returns a handle (a basket ID, a workflow token), and the model passes it back as an argument on subsequent calls. State becomes visible in the request, not hidden in server memory.
Step 3: Emit the required routing headers. Every HTTP request now needs Mcp-Method
(e.g., tools/call
) and Mcp-Name
(the specific tool or resource). These let load balancers route and meter traffic without parsing JSON bodies. Do not embed API keys or tokens in these headers — they’re visible to your entire gateway stack.
Step 4: Rewrite any server-initiated input flows to MRTR. If a tool needs user confirmation before running (deleting data, provisioning paid resources), return resultType: "input_required"
with an inputRequests
array. The client re-calls with answers in inputResponses
. Cleaner than held-open streams, and it survives connection drops.
Step 5: Harden auth. If you run a remote MCP server, validate the iss
parameter on every authorization response per RFC 9207. Start planning your migration from Dynamic Client Registration to Client ID Metadata Documents (CIMD). DCR is deprecated with a 12-month runway — no emergency, but plan it.
What You Gain #
The infrastructure wins are real. Round-robin load balancers just work now — no sticky sessions, no shared stores. Serverless and edge deployments are viable without contortion. The spec adds ttlMs
and cacheScope
fields to list and read responses, modeled after HTTP Cache-Control
, which cuts redundant fetches and keeps upstream prompt caches stable across reconnects. W3C distributed tracing (traceparent
, tracestate
) is now formally specified in metadata — observability tooling that already understands trace context works without custom instrumentation.
AWS’s take: “stateless protocol core enables standard, scalable infrastructure without managing sessions.” Per AWS AgentCore’s official guidance, this means MCP servers now deploy like any other HTTP service — no special infrastructure required.
Safe to Defer #
Three features are deprecated but remain functional for at least 12 months: Roots (replace with tool parameters or resource URIs), Sampling (replace with direct LLM API calls from the server), and Logging (replace with stderr or OpenTelemetry). The legacy HTTP+SSE transport also has a 12-month window. Handle these in your next planned migration cycle — no rush.
New Capabilities Worth Knowing #
Two extensions ship with this release. MCP Apps lets servers provide interactive HTML interfaces rendered in sandboxed iframes within chat applications — tools can now surface real UIs, not just text responses. Tasks moves from experimental core to a stable extension, giving you standardized async operations with polling that survive connection drops. Both are opt-in additions, not migration requirements.
The 2026-07-28 spec is the release that makes MCP a realistic choice for production infrastructure at scale. The stateful design was always a friction point for teams who knew how to scale services — now that friction is gone. Check the official announcement and the SDK release notes for the full changelog. And if you’re tracking MCP security separately, our coverage of the DeepJack MCP backdoor is worth reading alongside this migration.