MCP 2026-07-28 Goes Stateless, Eliminating Sticky Sessions on AWS

On July 28, 2026, MCP published its largest revision since launch, making the protocol core stateless. The initialize/initialized handshake is gone. The Mcp-Session-Id header that clients previously echoed on every subsequent request is gone. A client's first message can now be a direct tool call, and any server instance behind a load balancer can handle it. For teams running remote MCP servers on AWS, this eliminates two categories of compensating infrastructure the old design forced: sticky-session routing and externalized session state.

This is the kind of production architecture problem that kills deployments before the model ever becomes the bottleneck. The session-based protocol made horizontal scaling structurally awkward — a session was bound to the instance that issued it, so scaling out required either ALB stickiness rules pinning each client to one instance, or a shared session store in DynamoDB or ElastiCache absorbing all session reads and writes. The MCP 2026-07-28 specification removes both requirements at the protocol layer.

What the specification actually changes

AWS Architecture Blog authors Anand Komandooru, Steven DeVries, and Haleh Najafzadeh describe the shift as bringing remote MCP server deployments into alignment with the AWS Well-Architected Agentic AI Lens. The mechanical changes are precise.

Session initialization is replaced by an optional server/discover method. Clients that need to inspect supported protocol versions, capabilities, and server identity before making a tool call can call it; clients that don't can skip directly to the tool call. Servers must implement server/discover per the 2026-07-28 specification, but invoking it is the client's choice.

Two new headers — Mcp-Method and Mcp-Name — are available for gateway-layer routing and throttling decisions, replacing body-parsing at the gateway to identify the operation. Distributed tracing moves to W3C Trace Context carried in _meta. The proprietary protocol logging channel is deprecated in favour of stderr or OpenTelemetry. Tool list caching gains first-class support through ttlMs and cacheScope fields, which the session-based protocol offered no equivalent for.

Server-initiated mid-call requests — previously used for confirmations, sampling, and root queries over a held-open stream — are replaced by Multi Round-Trip Requests (MRTR), which use input_required responses and subsequent client-issued requests instead of requiring a persistent connection. Stream resumption via Last-Event-ID is also removed; clients are now expected to re-issue interrupted calls, placing idempotency on the tool implementation rather than the transport.

Deployment pattern changes on AWS

One thing AWS is explicit about: stateless describes the protocol, not the application. AWS describes it as a coat-check model — the server mints an identifier for stored state, the client receives it as a tool return value, and subsequent calls carry that identifier explicitly. The identifier sits in the model's context window rather than in a transport header, which AWS notes allows the model to reason about it and thread it across tool calls.

Migration path and backward compatibility

The 2026-07-28 specification preserves a backward-compatible lane for older clients, meaning ALB stickiness rules and session stores must remain operational until all pre-2026-07-28 client traffic has been eliminated. AWS recommends instrumenting the gateway to log protocol version per request, setting an explicit sunset date for the legacy lane, and decommissioning session infrastructure only after that traffic reaches zero.

InfoQ reports that Apify's MCP server project is already implementing stateless support alongside its existing sessionful server, with routing and conformance tests covering both protocol versions. The MCP project has also established a feature lifecycle policy providing a defined migration period for deprecated capabilities, though the specific duration is not given in the source material.

AI Mastery analysis

The removal of stream resumption deserves more attention than it typically gets. Idempotency was always a best practice for distributed tool calls, but the old protocol's Last-Event-ID mechanism provided a transport-level safety net for teams that hadn't enforced it. That safety net is now gone. Teams migrating to 2026-07-28 need to audit every tool that produces side effects — writes, external API calls, charge-triggering operations — and verify idempotency before cutting over, not after. MRTR introduces its own implementation surface: the input_required response pattern requires clients to handle mid-flight state transitions explicitly, adding logic that previously lived in the server's stream management.

The caching additions (ttlMs, cacheScope) are architecturally significant beyond their obvious utility. Per-session tool list fetches were a hidden overhead in the old model that most deployment telemetry never isolated as a latency contributor. Protocol-native caching makes that overhead visible and controllable — particularly for high-fanout agentic workloads where many short-lived agents each bootstrap against the same server. This connects to the broader pattern where infrastructure rewrites rather than model changes are driving meaningful capability gains in 2026.

The stateless MCP revision is a forcing function for deployment hygiene the protocol's original design deferred. Teams that built compensating infrastructure are now holding technical debt with a clear deadline: the legacy client sunset date they set themselves. MCP's trajectory is converging on standard web service patterns — stateless routing, explicit identifiers, header-based gateway control, OpenTelemetry — which lowers the barrier for infrastructure teams already operating REST or gRPC services to reason about MCP deployments without a separate mental model.

Sources

• Primary: MCP went stateless: Is your AWS MCP server deployment well-architected? | AWS Architecture Blog
• Reported by: InfoQ AI: Stateless MCP Removes Session Affinity Requirements for AWS Server Deployments