MCP 2.0 Ditches Sessions for Serverless Scaling

MCP 2026-07-28 removes sessions, the initialize handshake, and the Mcp-Session-Id header entirely. Any request routes to any instance. This enables horizontal scaling behind round-robin load balancers, serverless deployment on Workers or Lambda, and per-tool traffic policy at the gateway. Anthropic reports nearly half-a-billion monthly SDK downloads, with TypeScript and Python SDKs each exceeding 1 billion cumulative downloads.

Sessions created the operational friction. Earlier Streamable HTTP transports required an initialize/initialized exchange, with servers assigning Mcp-Session-Id to each request. Autoscaling had to preserve sessions; deployments had to drain or migrate them; losing an instance forced reconnection. The new protocol eliminates all of that. Each request carries protocol version, client identity, and capabilities in _meta.

Two headers are now mandatory on every Streamable HTTP request: Mcp-Method and Mcp-Name. A tool call arrives as Mcp-Method: tools/call and Mcp-Name: search, with the JSON-RPC payload behind it. Headers let gateways, rate limiters, or WAFs act on method and tool identity using standard HTTP primitives—no body inspection required. Header-body parity is enforced; mismatches return 400 Bad Request and JSON-RPC error -32020. List results now carry ttlMs and cacheScope, letting clients cache tools/list responses across agent turns.

Server-initiated interaction no longer requires a held connection. Multi-Round-Trip Requests replace long-lived streams: the server returns resultType: input_required, the client collects the answer, and the original call retries with inputResponses attached. Frameworks modeling elicitation as synchronous callbacks will need to restructure.

On Hacker News, developer reaction split. One camp called it REST rediscovered. Commenter luciana1u: "We invented a stateful protocol, discovered state is hard to scale, stripped it out, and arrived at 'just send a POST request.'" The counterargument centered on standardization. Commenter vidarh: "The core advantage MCP gave you was a standard blessed by AI providers—people had strong incentives to implement it." David Cramer, co-founder and CPO at Sentry: "Agents only get useful once the plumbing stops being the whole story." For teams running production traffic, the debate is academic. Cloudflare's MCP infrastructure has served billions of tool calls at thousands of requests per second.

Adoption figures obscure a distribution problem. One consultancy audited a client's MCP server that logged 61 tool calls over three months. 58 came from the client's own engineers. Their conclusion: "The money is flowing to the gateways and registries and auth layers rather than to the servers themselves." Honeycomb.io is an outlier: roughly 20% of all monthly interactive queries on their platform now arrive from agents. Most MCP deployments land between these two data points.

Migration is non-trivial for servers relying on sessions. The recommended path runs a stateless route alongside the existing one, moves features incrementally, drains active sessions, and removes the legacy path. Roots, Sampling, Logging, and the HTTP+SSE transport are deprecated. The minimum removal runway is 12 months, with a deadline no earlier than July 2027. Dynamic Client Registration is also deprecated. For teams starting fresh, the operational model is now a plain HTTP workload.