Model Context Protocol Update Eliminates Sticky Sessions

The Model Context Protocol (MCP) has transitioned to a stateless architecture with the release of specification 2026-07-28. This update completely removes the initial handshake and the Mcp-Session-Id header, allowing a single HTTP POST request to carry the protocol version, client capabilities, method, and name. Because any server replica can now answer incoming requests, developers no longer need to implement sticky sessions to route subsequent tool calls to the same instance.

Previously, under older specifications like 2025-11-25, tool calling required two HTTP requests. An initial handshake opened the path and returned a session ID, which acted as a ticket for subsequent calls. According to a Google Cloud post from August 5th, round-robin routing to the wrong pod would trigger a 400 Session Not Found error, forcing operators to pin clients to specific instances. The new stateless design allows seamless scaling on spin-to-zero platforms like Google Cloud Run and Cloud Functions. GitHub has already adapted to this change, with its July 23rd MCP Server changelog showing the removal of Redis writes on initialization and Redis reads on every call.

For developers building custom clients or servers, this shift requires a new approach to handling network interruptions. Testing with TypeScript SDK 2.0.0 on August 14th demonstrated that if a local place_order call hung up, the server still executed the write after 2.5 seconds even though the client aborted at roughly 400 milliseconds. A naive retry using a new JSON-RPC request ID resulted in a duplicate order. To prevent duplicate writes or charges, developers must design tools to be idempotent. For example, passing a specific order_id like ord-42 allowed the server to recognize the duplicate, return wrote: false, and keep the database clean.

When migrating away from the older 2025-11-25 specification, developers must ensure their requests are fully formed. Sending the client name alone is insufficient; the SDK will return an HTTP 400 error and a JSON-RPC -32602 error code if the per-request envelope is missing. Server and custom-client authors should treat any dropped connection as a trigger for a full retry, making robust idempotency keys essential for safe operations.