MCP Goes Stateless on July 28. If You Run MCP Servers, Here's Your Migration Checklist.

The biggest change to the Model Context Protocol since it launched ships on July 28: the protocol core goes stateless. The release candidate locked on May 21, the SDK betas are out, and if you operate MCP servers in production — I've shipped eight of them for a single education platform, so this one is personal — you have a migration to plan.

What actually changed

The 2026-07-28 spec removes the protocol-level session entirely. The Mcp-Session-Id header is gone (SEP-2567). Every MCP request is now self-contained: any request can land on any server instance.

What that kills, in the best way:

• -Sticky routing — no longer needed. A plain round-robin load balancer works.
• -Shared session stores — the Redis instance you ran just to share MCP sessions across replicas? Delete it.
• -Deep packet inspection at the gateway — gateways can now route on a simple Mcp-Method header instead of parsing JSON-RPC bodies.
• -Cold-start session rebuilds — clients cache tools/list responses for as long as the server's ttlMs allows, so a redeploy doesn't force every client to re-handshake.

If you've ever deployed an MCP server behind a horizontal autoscaler, you know exactly how much accidental complexity this deletes. MCP servers now scale like any boring HTTP service — and boring is the highest compliment in infrastructure.

What else ships in the spec

• -MCP Apps — servers can ship interactive HTML interfaces that hosts render in sandboxed iframes, talking back over the same JSON-RPC protocol. Tools declare UI templates ahead of time so hosts can prefetch and security-review them.
• -Tasks extension — long-running work moves to an extension: a server answers tools/call with a task handle, and the client drives it with tasks/get, tasks/update, and tasks/cancel. Tasks started life inside the core spec in late 2025; production reality pushed it out to an extension where it can evolve faster.
• -Authorization hardening — auth aligns more closely with standard OAuth and OpenID Connect deployments, which matters enormously for enterprise adoption.
• -A formal deprecation policy — every feature now has an Active → Deprecated → Removed lifecycle with at least twelve months between deprecation and removal. You can finally build on MCP without fearing the rug.

The migration checklist

Here's what I'm doing across my own MCP fleet, in order:

• -Grep for session assumptions. Search your server code for Mcp-Session-Id and any logic keyed on session identity. Every hit is a migration item.

• -Move state out of the protocol layer. If your server kept per-session state (user context, conversation memory, partial results), re-key it on something durable — the authenticated principal from OAuth, or an explicit resource ID passed as a tool argument. The protocol will no longer carry identity for you.

• -Simplify your infrastructure. Once stateless, remove sticky-session config from your load balancer and retire session-sharing stores. This is the payoff step — don't skip it, because running the old infra against the new protocol means paying for complexity you no longer need.

• -Set ttlMs deliberately. Your tools/list response is now cacheable. Stable tool catalog? Set a generous TTL and cut handshake traffic. Tools that appear and disappear dynamically? Short TTL, and rethink whether they should.

• -Adopt the Tasks extension for anything slow. If any tool call takes more than a few seconds, return a task handle instead of holding the connection. The lifecycle is cleaner and it composes with statelessness.

• -Track your SDK's beta. Tier 1 SDKs are expected to ship support within the ten-week validation window. Pin your current version, test against the beta in a branch, and don't upgrade blind on July 28.

The bigger picture

Since Anthropic donated MCP to the Agentic AI Foundation, the protocol has been growing up fast — governance, deprecation policy, extensions framework. The stateless core is the clearest signal yet: MCP is being engineered for the phase where AI agents are normal infrastructure, not demos.

Protocols win when they get boring. HTTP won because any server could answer any request. MCP just made the same bet — and if you run agent infrastructure, July 28 is the day it starts paying out.