What changed in the 2026-07-28 MCP spec?
The initialize handshake is gone, and with it protocol-level session tracking. Version, client identity and capabilities travel in a metadata parameter on each request, and new headers let a gateway route on the method being called without reading the body. Server-initiated requests were replaced by a pattern where the server returns an input-required result and the client retries with the answer attached. It is the largest change to MCP since authorization was added, and it was aimed squarely at production deployments.
What replaces server-initiated requests?
A turn-taking pattern. Earlier revisions let a server push a request at the client mid-operation, which only works while both ends share a live session. The stateless revision inverts it: when a server needs an answer, it returns an input-required result, and the client retries the original call with that answer attached. Every retry is a complete, self-contained request, so any replica can pick it up. A long exchange now costs several round trips; in exchange, no server has to remember a conversation. Since clients retry by design, an idempotent tool call contract matters more, not less.
Why does statelessness matter for agent infrastructure?
Because the fleet is the hard part, not the protocol. A remote server that once needed sticky sessions and deep packet inspection now runs behind round-robin load balancing, which is how everything else in a web stack already works. Stateless MCP makes tool servers boring to operate, which lowers the cost of exposing internal systems as tools and plays well with an LLM gateway in front. State did not disappear, it moved up a layer: what the user is doing lives in the application’s own agent session, where it belonged all along.
How do you migrate an existing MCP server?
Start by deleting assumptions, not code. Everything your server learned during initialize, protocol version, client capabilities, now arrives in each request’s metadata, so read it there and treat every call as the first. Per-user state your tools need moves into your own store, keyed by user or agent identity rather than by a protocol session. Flows where the server initiated requests get reworked around input-required results and retries. Then test the revision’s own claim: run two replicas behind a load balancer with no affinity and confirm nothing breaks. There is no forced cutover: requests are dated to a spec revision, and older clients keep working while you switch.