MCP 2026-07-28: The Stateless Core That Made MCP Serverless

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

The Model Context Protocol became the connective tissue of the agent ecosystem the way HTTP became the connective tissue of the web — and like HTTP, it had to shed its ceremony to scale. On July 28, 2026, the Agentic AI Initiative under the Linux Foundation released MCP spec 2026-07-28, the fifth spec release, built around a stateless request/response core. The handshake is gone, the session ID is gone, and in their place is a protocol that any instance can serve any request for, with caching, task management, and hardened auth built in. The numbers say the bet is working: MCP now logs roughly 400M+ monthly SDK downloads, about a 4x increase this year, near 250M per week.

The stateless core

The headline change is philosophical and practical at once. The previous spec required a client to establish a session — an initialize/initialized handshake followed by a Mcp-Session-Id that the server tracked. That model fits a chat app with one long-lived connection; it is terrible for a fleet of agents hitting a service from anywhere. The 2026-07-28 spec makes every request self-contained:

• No initialize/initialized handshake — the first request is a real request; there is no setup round trip.
• No Mcp-Session-Id — the server holds no client session state.
• Mcp-Method and Mcp-Name HTTP headers — method routing lives in the headers instead of the body.
• Per-request _meta — metadata travels with the request that needs it, not with a session.

That single change makes MCP servers horizontally scalable in the way the web always was: any instance can serve any request, because there is nothing to remember between requests.

Old versus new: the transport comparison

Look at the last row twice, because it is the entire ROI in one line. A stateful protocol forces session affinity — sticky routing, session stores, eviction policies — which is exactly the infrastructure complexity that makes MCP servers expensive to operate at scale. Statelessness deletes that category of infrastructure outright.

Caching: ttlMs and cacheScope

A stateless protocol needs a caching story or it trades simplicity for latency. The 2026-07-28 spec adds one: servers can declare how long a response may be reused with ttlMs, and how broadly the cache applies with cacheScope. Agents get predictable response reuse, and servers avoid recomputing results that are still valid. In agent loops that poll the same state repeatedly — watch a task, check a queue, read a config — the difference between cache-hit and recompute is often the difference between snappy and unusable, and it is directly a cost line: fewer model calls, fewer tool round trips.

MRTR and the Tasks extension

The release also matured the protocol's long-horizon story. MRTR (SEP-2322) lays out the request routing model, and the Tasks extension (SEP-2663) adds tasks/get, tasks/update, and subscriptions/listen. That is the vocabulary durable agent work needs: launch a task, query its state, update it, and subscribe to its progress instead of holding a connection open. Combined with the stateless core, an agent can fire a task at a server, disconnect, and come back later to collect the result — which is the serverless agent pattern, not just the serverless transport.

Auth hardening and the deprecation policy

Security hardened in step with the protocol change. The spec adds RFC 9207 iss validation and RFC 8707 resource indicators — the first closes the identity-confusion class of attacks by validating the issuer, the second scopes authorization to the specific resource an agent is asking for. The schema layer moved to JSON Schema 2020-12, giving tool calls a proper, versioned validation base.

And it made an honest cut: roots, sampling, and logging were built on session semantics and no longer fit the stateless model, so they are deprecated with a 12-month window. That window is the ecosystem's migration runway, and the removed features are designed to be re-expressed through _meta, caching, and Tasks rather than simply lost.

Migration ROI

The clearest proof came from the reference implementation itself: GitHub MCP Server removed its Redis session storage. The migration ledger for a typical server:

For most teams, removing the session store is a standalone win that pays for the migration, and the caching and Tasks work is where the new value lives. The 12-month deprecation window means the migration can be sequenced rather than rushed.

What this means for production agent fleets

For operators the practical upshot is simple: MCP servers can now be deployed exactly like ordinary HTTP services. A stateless server behind a load balancer needs no affinity, no sticky sessions, and no shared session cache, so autoscaling to zero and back becomes routine rather than risky. Security teams gain header-based routing they can meter and audit at the gateway without parsing request bodies, and agents gain durable tasks that survive disconnects. That is the difference between a protocol you can prototype with and a protocol you can build a business on — and the 2026-07-28 release is squarely aimed at the second category.

Frequently Asked Questions

What exactly changed in the stateless core?

The initialize/initialized handshake and Mcp-Session-Id are gone — the first request is a real request. Method routing moved to Mcp-Method and Mcp-Name headers, per-request metadata to _meta, and server-side session storage became unnecessary.

What are ttlMs and cacheScope caching?

Servers declare how long a response may be reused (ttlMs) and how broadly it applies (cacheScope). Agents get predictable reuse and servers skip recomputing valid results, cutting both latency and cost.

What does the Tasks extension add?

SEP-2663 adds tasks/get, tasks/update, and subscriptions/listen, so clients can query task state, update it, and subscribe to progress instead of holding a connection — the piece that makes durable, asynchronous agent work possible.

Why deprecate roots, sampling, and logging?

They were built on session semantics that no longer fit the stateless model. The 12-month window gives time to migrate, and the capabilities are re-expressed through _meta, caching, and Tasks rather than abandoned.

What does migration actually cost?

Mostly removing infrastructure: the GitHub reference server dropped its Redis session store entirely. Clients lose the handshake round trip and any instance can serve any request, so the migration typically pays for itself in reduced infrastructure and latency.

Closing thoughts

MCP 2026-07-28 is the release where the protocol stopped being a chat-protocol adaptation and became a real web-native standard. Statelessness, caching, tasks, and hardened auth are the features an infrastructure protocol needs when it crosses 400M monthly downloads and starts powering production agent fleets. The deprecation of session-era features with a 12-month window is the mature move: standardize what works, migrate what does not, and keep the ecosystem moving together. For anyone operating MCP servers, the plan is short — drop the session store, adopt the headers, and then pick up Tasks and caching where the new value is. Explore what the ecosystem is building on this protocol in the MCP directory, and track the spec's evolution in the latest AI news.