The Model Context Protocol (MCP) released its 2026-07-28 specification, removing protocol sessions entirely and adding two mandatory HTTP headers, Mcp-Method and Mcp-Name. The change makes the protocol stateless, allowing gateways to route, throttle, and meter agent traffic without parsing the request body. The update has ignited a developer community debate over whether MCP has essentially become just another REST API.
Stateless by Design
The previous MCP protocol was stateful. Earlier transports opened with an initialize and initialized exchange that established a session, tracked through an Mcp-Session-Id header. Every subsequent request had to locate state tied to that session. This created real operational pain. Autoscaling infrastructure had to preserve sessions. Deployments had to drain or migrate sessions. Load balancing was impractical because a client was pinned to whichever instance held its session.
The new protocol removes the handshake, the session header, and protocol sessions from the core request path. Each request now carries the protocol version, client identity, and capabilities it needs. Any request can land on any instance. MCP messages remain JSON-RPC over HTTP, but the metadata now lives where infrastructure can see it.
Information about a request previously lived only inside the JSON body. A gateway had to parse the JSON body to learn whether a request listed tools, invoked one, or read a resource. That parsing is no longer necessary. A tool call arrives as Mcp-Method: tools/call and Mcp-Name: search, with the JSON-RPC payload behind it. Commenter evalstate noted that tool arguments can be copied into headers for custom routing.
Matt Carey, an employee at Cloudflare, spelled out the benefits. The new headers let gateways, rate limiters, and web application firewalls act on requests without opening the body. That is a meaningful shift for infrastructure teams.
The Headers That Matter
The session removal draws most of the attention, but the mandatory headers are the sleeper change. They put request metadata in the transport layer, where standard infrastructure already runs. Agent governance has been arriving from a separate control layer. Cloudflare has its own agent tracing product, and the AI Gateway tier of Azure API Management provides agent governance as a separate control layer. This release puts the metadata in the transport, where infrastructure teams already run can read it.
The practical effect is that a gateway can now decide how to handle a request based on headers alone. It can route a tools/call to one backend and a resources/read to another. It can throttle a specific agent by name. It can meter usage per client identity. None of this requires inspecting the JSON payload.
David Cramer, co-founder and Chief Product Officer at Sentry, praised the release. "The release cleans up auth and tools handling," he said. He added that "agents only get useful once the plumbing stops being the whole story."
Elicitation, Approval, and the Migration Path
The stateless redesign also changes how server-initiated requests work. Elicitation breaks under the old model. Server-initiated requests used to need an open stream. Now they use Multi Round-Trip Requests. The server returns input_required, the client collects the answer, and the call is retried.
Approval becomes two requests instead of one held connection. The wait for a human no longer sits inside a single invocation. This simplifies deployment but changes the nature of waiting for human approval. A human approval that once occupied a stream now spans multiple discrete requests.
Dynamic Client Registration is deprecated and slated for removal after summer 2027. The specification adopted RFC 9207 issuer identification. Clients now send the canonical server URI as the RFC 8707 resource so tokens are accepted only by that audience.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
For teams running MCP in production, the migration is real work. Servers depending on protocol sessions, server-to-client requests, or standalone streams can run a stateless route beside the existing sessionful one. The migration steps are straightforward. Move features across, drain active sessions, and remove the legacy path during the deprecation window.
The specification and updated TypeScript, Python, Go, and C# SDKs are available now.
The REST Debate
Community reactions are sharply divided, not on whether statelessness is an improvement, but on what the improvement reveals about MCP's fundamental nature. Commenter drdexebtjl said the release confirms the protocol should never have been stateful. They argued that MCP is now just another REST API endpoint, letting you use the same infrastructure you already have for REST APIs.
Commenter pjmlp referenced Sun RPC as a historical example of the same lesson. Stateless servers are always better, stateful only when unavoidable, they said. Commenter luciana1u observed that the industry invented a stateful protocol, discovered state is hard to scale, stripped it out, and arrived at "just send a POST request."
Commenter bloppe offered a more layered view. MCP is a REST-like API, plus a spec of the kind OpenAPI already provides, plus harness-level authorization. Only the third is genuinely new, they argued. Commenter lexicality noted that MCP is literally JSON-RPC, and what was invented was a convention models were already trained to use.
Commenter vidarh defended the protocol. The core advantage of MCP was a standard that, by virtue of being blessed by AI providers, people had strong incentives to actually implement. That blessing, not the technical novelty, drove adoption.
Commenter firasd pushed back on a different front. The CLI position assumes a developer, on a laptop, with a shell open inside a coding harness, which describes a small fraction of usage against a majority reached through phone apps, web chat, and embedded widgets.
Adoption Numbers and the Server Question
Adoption of MCP is not in dispute. Anthropic reported that MCP passed 400 million monthly SDK downloads, a fourfold increase this year. That is a staggering number. But whether that adoption reaches individual servers is another question.
A consultancy post on r/AI_Agents described auditing a client's server that recorded 61 tool calls in three months. Of those 61 tool calls, 58 were from the client's own engineers. The post author disclosed that MCP work is a significant share of their consulting revenue. They wrote that teams treat being reachable by an agent as though it meant being wanted by one. They also observed that the money is flowing to the gateways and registries and auth layers rather than to the servers themselves.
The release is framed as a scaling win, and for infrastructure teams, it is. The session removal eliminates a whole class of operational problems. The mandatory headers give gateways visibility without body parsing. The debate over whether MCP is now just REST may rage on, but the protocol itself has moved decisively toward the stateless model that REST has championed for decades.
The article was published on Aug 12, 2026, and takes about 4 minutes to read.