MCP 2026 Turns AI Agent Infrastructure Stateless and Serverless-Ready

The Model Context Protocol specification released on July 28, 2026 removes infrastructure rather than adding capability. The initialize handshake is gone. The Mcp-Session-Id header is gone. What remains is a stateless protocol core where every request carries everything a server needs to answer it — no prior connection required. Google and Hugging Face co-led the MCP Transports Working Group under the Agentic AI Foundation. The TypeScript and Python SDKs crossed 1 billion total downloads each before publication.

The problem is scale. Under the 2025-11-25 spec, clients pinned themselves to a single container holding session state. Three pods behind a load balancer meant the second request could land on the wrong machine, returning 400 Session Not Found. Workarounds were costly: sticky session rules that defeated autoscaling, Redis stores that added a read and write to every tool call, and gateway-level packet inspection to route by session. A pod crash wiped active sessions. Hugging Face measured the overhead as more than 100 MCP protocol messages per single tool call.

Google's motivation was scale at cost. Its MCP Toolbox for Databases logged over 20 million tool calls across 40-plus databases in a single month. Redis round-trips and sticky routing are line items on an infrastructure bill. Kurtis Van Gent, Google Cloud MCP core maintainer, wrote that teams needed MCP to scale across millions of concurrent queries on Google Cloud.

The fix removes the initialize/initialized handshake and Mcp-Session-Id header. Protocol version, client capabilities, and identity now travel in a _meta field on every request. Three new HTTP headers — Mcp-Protocol-Version, Mcp-Method, and Mcp-Name — let gateways route, authorize, and rate-limit without parsing the JSON-RPC body. List responses can include cache instructions. Result: any server instance answers any request, standard round-robin balancers work unchanged, and MCP servers run as serverless functions that spin to zero when idle. The GitHub MCP Server, powered by Google's Go SDK v1.7.0, already removed Redis session storage.

Stateless protocol does not mean stateless application. If a tool creates a browser session, shopping basket, or database transaction, it returns an identifier. The model passes it back as an ordinary argument on the next call. This is how HTTP APIs work. Explicit handles let the model reason about state, compose across tools, and hand it off between steps in ways opaque transport metadata never allowed.

The spec brings two concerns for teams on 2025-11-25. First, migration: stop relying on Mcp-Session-Id, move per-session state to explicit tool arguments, emit the new headers on Streamable HTTP requests, and target a Tier 1 SDK release that ships 2026-07-28 support. Second, deprecation: Roots, Sampling, and Logging are deprecated with 12-month removal window — earliest out July 2027. Security additions include RFC 9207 issuer verification and RFC 8707 resource indicators.

For teams building on MCP, the migration checklist is short. The SDK handles most transport work. The real risk: unmaintained third-party servers that nobody will upgrade before the deprecation window closes.