MCP's Stateless Rewrite Moves Scale From Sessions to Explicit State

The Model Context Protocol has replaced its connection-bound core with a stateless request-and-response design. The rewrite removes protocol sessions, changes how clients and servers introduce their capabilities, and makes applications carry any state they still need in explicit forms.

The specification dated July 28, 2026, is MCP's largest revision since the standard began connecting AI systems to external tools and data sources. Its central promise is operational: a request no longer depends on reaching the same server instance that handled an earlier exchange. That removes one protocol-level reason for sticky routing, though it does not make distributed deployment automatic.

MCP began as an Anthropic project and is now managed by the Agentic AI Foundation under the Linux Foundation. Anthropic remains influential, while OpenAI, Google, Microsoft and Amazon also contribute. The new release therefore affects a protocol used across competing model and developer-tool ecosystems rather than a feature controlled by one product.

Requests No Longer Inherit a Server Session

In Streamable HTTP, the revision ends session tracking at the protocol layer. Clients no longer attach the Mcp-Session-Id field. The revision also removes the initialization handshake that previously established a connection's version and capabilities. In the new flow, each request carries its own protocol context, including the version and client capabilities in _meta.

Servers must expose a server/discover method that advertises their supported versions, capabilities and identity. A client may call it before doing other work, allowing version selection to happen without first building a durable session. If the two sides cannot agree on a version, the protocol defines an unsupported-version error rather than relying on a connection's earlier setup.

This design gives load balancers more freedom because protocol correctness is no longer tied to per-instance session memory. A fleet can evaluate a self-describing request without recovering an initialization record from one particular node. Operators still need shared data stores, consistent configuration and idempotent application behavior where their tools require them; the specification removes a transport dependency, not every source of distributed state.

Cross-Call Work Moves Into Handles and Retries

Applications sometimes need continuity across calls, and the specification provides an explicit path for it. A server can mint a handle and return it to the client, which then supplies that handle as an ordinary tool argument on later requests. The state can remain server-side, but the relationship is visible in the application contract instead of being implied by the network session.

Multi Round-Trip Requests handle cases in which a server needs more information before finishing. The server returns an input_required result describing the missing input. The client obtains that information and retries the original request with responses attached. Ordinary results are labeled complete, while clients treat results from older servers that lack the new label as complete. This replaces server-initiated requests with a client-controlled retry sequence that can be logged and routed like other requests.

Long-lived updates use a separate mechanism. Clients that want tool, prompt or resource change notices open subscriptions/listen, a POST response stream limited to the update types they selected. Progress and logging messages tied to one request stay on that request's response stream. The release also removes SSE message redelivery: if a response stream breaks, the client issues a new request with a new identifier. Stateless ordinary calls and stateful streaming therefore coexist, but their roles are separated.

Caching and Authorization Become Deployment Contracts

Tool, prompt and resource list results now include a freshness interval and a cache scope. The interval tells clients how long a result may be treated as fresh, while the scope distinguishes content suitable for shared caching from content that must remain private. Servers are also encouraged to return tools in a stable order, which can improve both ordinary caches and model-prompt cache reuse.

These fields do not require every intermediary to store every response. They provide enough information for a client or gateway to make a consistent caching decision. Combined with header-based routing and standard request headers, the change turns several deployment assumptions into data that infrastructure can inspect rather than behavior hidden inside a session. The specification also documents propagation of OpenTelemetry trace context, giving distributed requests a standard observability path.

Authorization rules receive a similar tightening. Clients must validate an authorization issuer when it is supplied, keep stored credentials bound to the server that issued them and register again when the issuer changes. Those requirements are designed to prevent credentials from being silently reused across authorization servers. Experimental task handling also leaves the core and becomes an official extension, narrowing what every implementation must support. The extension uses polling for status and adds a route for clients to provide later input.

Stateless MCP Makes State Visible Instead of Eliminating It

A new feature lifecycle gives implementations a minimum one-year runway after formal deprecation before routine removal. Roots, Sampling and Logging enter that process, while the older HTTP-plus-SSE transport is formally deprecated. The window gives implementers planning time, but it does not preserve obsolete features indefinitely or remove the need to negotiate protocol versions.

The architectural shift is best understood as a relocation of responsibility. Version and capability information move into every request; cross-call continuity moves into explicit handles; missing input moves into retries; update streams require a subscription; and cache behavior gains declared limits. Servers may still store durable records, and clients may still maintain workflows, but neither side can assume that an invisible connection session carries the necessary context.

That is the enterprise value of the rewrite. Statelessness makes horizontal distribution easier to reason about because the protocol identifies where continuity lives. The practical migration test is whether SDKs and gateways expose those new contracts clearly enough that operators can scale a service without rebuilding the hidden session behavior the specification just removed.