The MCP protocol team shipped a new version on July 28 2026 that drops the protocol-level session and forces every request to be stateless. If you run MCP clients, servers or agents, you must rewrite code that assumes a persistent session ID—or you’ll face broken routing, cache misses and runaway background work.

Why the shift matters

MCP used to require a handshake that produced a session identifier. Downstream services relied on that ID to assume a series of requests would hit the same process, to let load balancers use sticky routing, and to store per-session data in memory. The July release swaps that model for a pure request-response flow. A server can now be added or removed without worrying about lost sessions. The protocol no longer preserves context; the application must.

Teams that keep old session-centric code will watch requests bounce to the wrong instance, caches miss, and background jobs pile up. Teams that adopt the stateless pattern can run MCP behind non-sticky load balancers and gain tighter observability across the whole request chain.

What’s really different

  • Protocol lifecycle – The handshake and session ID disappear. Every request must carry all the information the server needs; there is no guarantee a follow-up request lands on the same process.
  • HTTP routing – Gateways now read two new headers, Mcp-Method and Mcp-Name, to decide where to forward a request. Session-cookie routing no longer works.
  • Caching – The spec adds ttlMs (time-to-live in milliseconds) and cacheScope fields for reads. You decide whether stale data is acceptable and configure the cache accordingly.
  • Observability – A _meta block now expects a W3C Trace Context payload, letting tracing systems stitch together edge gateways, tooling and backend work into a single end-to-end trace.
  • Composition – Extensions are formalised; new capabilities can be added without touching the core spec, encouraging a plug-in style architecture.
  • Long-running work – Simple request/response no longer suffices for tasks that run minutes or hours. The protocol now defines a Task object for asynchronous work, complete with lifecycle controls.

Risks hidden in legacy code

A quick audit often uncovers patterns that assume statefulness:

  • In-memory maps keyed by session IDs.
  • Load balancers configured for sticky sessions.
  • Startup routines that preload per-session data into local memory.
  • Cleanup logic that deletes business data when a session ends.

If any of these survive the migration, the system will lose data or leak resources under load.

A concrete migration checklist

1. Inventory current assumptions

Map every place your code touches a session ID, a sticky-routing rule, or a process-local cache. Document which components rely on each.

2. Make identity explicit

Add tenant IDs, run IDs and user IDs to every request payload or header. Treat these identifiers as the source of truth for authorization and data partitioning.

3. Update routing configuration

Replace session-based routing with rules that read Mcp-Method and Mcp-Name. Test the new gateway logic with a minimal two-instance deployment behind a non-sticky load balancer.

4. Refactor caching logic

Switch to the new ttlMs and cacheScope fields. Run performance tests to see how different TTL values affect hit rates and freshness requirements.

Enable end-to-end tracing: Populate the _meta block with a W3C Trace Context header. Verify that traces now flow from the edge gateway through your backend services without gaps.

Adopt the Task model for async work: Define who may create a task, set maximum runtimes, and enforce queue limits. Add explicit cancellation and retry policies, and restrict what an agent can do while a task is pending.

Review SDK and client library release notes before July 28.

Run regression suites that target failure paths: Beyond happy-path tests, inject missing headers, expired tasks, and malformed cache directives. Confirm the system degrades gracefully.

What to watch next

Teams that migrate safely will test the boundaries, not just the happy path. Any production deployment that still expects a session ID after July 28 may fail to interoperate with the new MCP servers.