{"slug": "what-changed-in-the-mcp-spec", "title": "What Changed in the MCP Spec", "summary": "The MCP team merged a stateless protocol update that removes the initialize handshake and server-side sessions entirely, replacing session-based interactions with Multi Round-Trip Requests (MRT) and formally defining cacheable list results via a cache-control header. Core request and response formats, JSON payload schemas, field names, HTTP status codes, and the rate-limit bucket algorithm remain unchanged, so single-request integrations that send the standard authentication header on every call see no breaking change. Integrations calling /session/create, waiting on a handshake token, or storing server-generated session IDs for long-running workflows must refactor, since those calls now return a method-not-allowed error.", "body_md": "When the MCP team merged the stateless protocol update, the headline caught most inboxes: initialize handshake gone, sessions removed. For engineers who have been sending requests to MCP for months, the question is immediate -- do I need to change my code, or can I keep shipping the same calls? The answer is not a simple yes or no. It depends on which parts of the spec you rely on, how you handle retries, and whether you already treat list results as cacheable. This post walks through the concrete differences, points out the areas that stay the same, and helps you decide what action, if any, is required for your integration.\n\n## What the stateless update actually changed\n\nThe spec revision introduced three major shifts. The initialize handshake that previously opened a session is no longer part of the flow -- clients now send a single request that contains all the context needed for that operation. Sessions have been removed entirely, so there is no longer a server-side object that tracks state across calls and each request is independent. Multi Round-Trip Requests (MRT) are now the recommended way to perform complex interactions that used to rely on a session: an MRT bundles a series of dependent calls into one logical unit while still being processed as separate HTTP exchanges. Finally, cacheable list results are now formally defined -- the spec marks list endpoints with a cache-control header that clients can honor to reduce redundant fetches.\n\nThese changes are not isolated. They affect how you structure authentication, error handling, and idempotency. The removal of the handshake means that any code that waited for a handshake-ok response before sending the first real payload will now see an unexpected error. The new MRT pattern replaces the old session-step-N sequence, but it does not force you to rewrite every call -- you can still issue single-request operations exactly as before.\n\n## What stayed compatible\n\nEven with the stateless shift, the core request and response formats remain unchanged. The JSON schema for payloads, the naming of fields, and the HTTP status codes are still defined exactly as they were before. If your integration sends a single request and expects a single response, uses the standard authentication header included in every call, and relies on the same error codes for validation failures, you will see no breaking change. The spec explicitly marks those endpoints as stateless-compatible, meaning the server will accept them without a prior handshake. In practice, many data pipelines that poll a list endpoint every few minutes already operate in a de-facto stateless mode, so the update is invisible to them.\n\nThe rate-limit model is another area of continuity. The spec keeps the same bucket algorithm, and the headers that convey remaining quota are unchanged. If you have monitoring built around those headers, you can keep using the same alerts without modification.\n\n## Which integrations need attention\n\nIf your codebase includes any of the following patterns, plan a short upgrade window.\n\n1. **Explicit session creation** -- any call to`/session/create` or a similar endpoint now returns a method-not-allowed error. Replace those calls with a direct request that includes the required context fields (project ID, user ID, and any optional flags) in the body.\n2. **Handshake-driven authentication** -- some clients wait for a handshake token before attaching the real auth token. The new flow expects the auth token on every request, so you can drop the extra step.\n3. **Long-running stateful workflows** -- if you built a loop that sent a request, stored a server-generated session ID, then used that ID in subsequent calls, you will need to refactor. Wrap the whole workflow in an MRT: the request includes an array of sub-requests, each with its own payload, and the server returns an array of responses in the same order.\n4. **Assumptions about list mutability** -- before the update, list endpoints were treated as always fresh. Now the spec marks many list calls as cacheable for a configurable TTL. If your pipeline re-fetches a list on every run without checking the cache header, you may be doing unnecessary work. Adjust your client to respect`Cache-Control: max-age=` and reuse the stored result when it is still valid.\n\nIf none of these patterns appear in your code, you can safely ignore the change. The spec's compatibility matrix lists each endpoint with a stateless-compatible flag -- a quick scan of the matrix confirms whether you need to adjust anything.\n\n## Practical steps to migrate\n\nA pragmatic migration can be done in three phases.\n\n**Phase 1 -- audit.** Search your source for any occurrence of `/session/` or `initialize`. Check your request-building library for a handshake step. Mark each occurrence as \"needs review.\"\n\n**Phase 2 -- refactor.** For each flagged spot, replace the handshake with a direct request that includes the required context fields. If you have a multi-step workflow, rewrite it as an MRT. Most client libraries now provide a helper method that builds the proper envelope and handles the array of responses.\n\n**Phase 3 -- test cache handling.** Enable logging of the `Cache-Control` header on list calls. Verify that your client respects the max-age value and that cached data is refreshed only when the TTL expires. This step can often be handled with a configuration toggle in your HTTP client rather than code changes.\n\nBecause the spec still accepts single-request calls, you can roll out these changes incrementally. Start with a low-traffic environment, monitor the response codes, and promote the updated client to production once you see no method-not-allowed or session-not-found errors.\n\n## When you can safely ignore this\n\nTeams that already treat MCP as a pure request-response service, without any session management, will find the new spec largely invisible. If your integration sends independent requests for each operation, uses the same authentication header on every call, and does not store or reuse a server-generated session identifier, you can continue operating as before. The only optional improvement is caching list results, which can reduce latency and cost on high-frequency pipelines. Even if you choose not to adopt caching right away, the spec guarantees that existing calls continue to work.\n\n## Bottom line\n\nThe stateless protocol update removes the handshake and sessions, introduces Multi Round-Trip Requests, and adds explicit cacheability for list endpoints. For most data engineers the impact is limited to code that explicitly creates or relies on sessions. If you fall into that category, a short refactor to MRT and per-request context will bring you back on track. If your integration already works in single-request mode, you can keep shipping the same calls and treat caching as a performance tweak when you have cycles for it.\n\nIf your team has MCP integrations that touch session management and you want a second set of eyes on the migration path, [get in touch](https://labyrinthanalyticsconsulting.com/contact). For broader context on how MCP fits into data architectures, the earlier posts in this series cover the fundamentals: [MCP Servers Explained](https://labyrinthanalyticsconsulting.com/blog/mcp-servers-explained-bridge-ai-data) and [MCP vs Function Calling vs Plugins](https://labyrinthanalyticsconsulting.com/blog/mcp-vs-function-calling-vs-plugins-2026-decision-tree).\n\n*Get posts like this delivered weekly -- [subscribe to Dispatches from the Labyrinth](https://labyrinthanalytics.substack.com/subscribe?utm_source=website&utm_medium=blog&utm_campaign=substack_subscribe).*", "url": "https://wpnews.pro/news/what-changed-in-the-mcp-spec", "canonical_source": "https://labyrinthanalyticsconsulting.com/blog/what-changed-mcp-spec-stateless-update", "published_at": "2026-10-05 00:00:00+00:00", "updated_at": "2026-10-05 20:49:02.538270+00:00", "lang": "en", "topics": ["agent-protocols", "developer-tools", "ai-agents"], "entities": ["MCP"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/what-changed-in-the-mcp-spec", "markdown": "https://wpnews.pro/news/what-changed-in-the-mcp-spec.md", "text": "https://wpnews.pro/news/what-changed-in-the-mcp-spec.txt", "jsonld": "https://wpnews.pro/news/what-changed-in-the-mcp-spec.jsonld"}}