MCP Gets Its Biggest Update Since Launch: a Stateless Protocol Built for Production

For twenty months, every MCP server in production had to solve the same annoying problem: keeping stateful sessions made it nearly impossible to scale horizontally without sticky-session architectures. The new spec erases that problem at the root.

What Exactly Changes

The 2026-07-28 Model Context Protocol specification — officially published on July 28, 2026 and widely covered in tech press this week — is the biggest revision since Anthropic launched the protocol twenty months ago. The central change: MCP moves from a stateful core to a fully stateless one, eliminating sessions at the protocol level.

Alongside the stateless core, the spec brings Multi Round-Trip Requests, routing based on standard HTTP headers, cacheable listing results, and, for the first time, a formal deprecation policy with an Active → Deprecated → Removed lifecycle and a minimum 12-month transition window.

Why Session State Was a Real Problem

Security Hardening Included

The spec adds Issuer Verification (RFC 9207) to protect against session hijacking, and Resource Indicators (RFC 8707) to solve the "confused deputy" problem in delegation scenarios — where an MCP server with broad permissions could be tricked into acting on a different resource than the one the original user authorized.

Already Available in Production Runtimes

The new spec's stateless core is already available on Amazon Bedrock AgentCore, letting you deploy MCP servers on standard cloud infrastructure without managing sessions or persistent connections — the same "orchestrator + load-balanced workers" architecture we covered in our interactive AWS Bedrock agents guide.

What It Means for Teams That Already Built MCP Servers

If your current MCP server depends on in-memory session state, this update is the signal to plan a migration: the formal deprecation policy gives a 12-month window, but the horizontal-scaling benefits — no sticky sessions, no shared state store, standard load balancing — are big enough not to wait until the last minute. For teams evaluating building their first MCP server from scratch, the timing is ideal: starting directly on the stateless spec avoids having to migrate later.