MCP Goes Stateless, and Developers Ask Whether That Just Makes It an API Again

MCP 2026-07-28 specification removes protocol sessions, which has been framed as a scaling win. However, the release adds two required HTTP headers that allow gateways to route, throttle and meter agent traffic without ever opening the request body. This change eliminates the handshake, session header, and protocol sessions from the core request path, allowing any request to land on any instance.

The protocol now uses JSON-RPC over HTTP, with information about a request previously contained only inside the JSON body now carried in the request headers. Two mandatory headers are introduced: Mcp-Method and Mcp-Name, enabling gateways to act on them per method or per tool. Tool arguments can also be copied into headers for custom routing.

Agent governance has moved to the transport layer, where infrastructure teams can read the metadata. Server-initiated requests now use Multi Round-Trip Requests, simplifying deployment but resulting in a wait for human approval sitting outside a single invocation. Authorization has tightened, with Dynamic Client Registration deprecated and RFC 8707 resource adopted for token acceptance.

Community reactions have been divided, with some arguing that the release confirms stateless protocols should be the norm, while others see the move as reducing MCP to a REST API endpoint. Adoption is already significant, with 400 million monthly SDK downloads, and the money is flowing to gateways, registries, and auth layers rather than to individual servers.