MCP GA is four days out: the final cutover checklist I run before July 28 goes live

Introduction

Four days is not enough time to invent handles. It is enough time to ship a messy cutover or a boring one. Boring wins. If you followed the July 28 migration checklist, the header security pass, and the week-three handle sprint, this post is the go-live runbook I tape next to the on-call laptop.

If you skipped those, do not start a greenfield redesign on Friday. Triage: sticky sessions still required? Handles missing on checkout? Gateway logging Authorization into Splunk? Fix those three before you worry about MCP Apps or Tasks extensions.

Day-by-day plan (Jul 24–28)

1. 01
   Day −4 (today): freeze and inventory again

   Pin client and server SDK versions that emit MCP-Protocol-Version, Mcp-Method, and Mcp-Name. Re-grep for Mcp-Session-Id and initialize handlers. List every multi-step tool without a documented handle. That list is your only allowed change set until Monday.
2. 02
   Day −3: staging round-robin proof

   Two or more server pods, no sticky affinity. Run each multi-step workflow ten times. Kill a pod mid-handle and confirm retry succeeds. Failures here are application-state bugs, not "MCP being hard."
3. 03
   Day −2: auth and cacheScope dual-identity test

   Hit tools/list as two OAuth subjects through the same gateway. Confirm cacheScope prevents cross-user bleed. Walk iss validation and EMA group mapping if you piloted Enterprise-Managed Authorization.
4. 04
   Day −1: delete sticky config in staging, keep prod sticky as rollback

   Cut sticky sessions in staging first. Keep a documented one-command rollback for production. Publish a client notice: Session-Id will be ignored or rejected after GA.
5. 05
   GA day: watch 4xx, latency, and handle mint failures

   Alert on spikes in Invalid Params, missing Mcp-Method, and step-2 empty responses. Pair handle_id with oauth_subject in the agent observability stack.

Cutover checklist (print this)

• SDK pins recorded in Helm/env with rollback tags.
• Gateway routes on Mcp-Method/Mcp-Name; body/header mismatch rejects.
• No secrets in MCP headers or proxy access logs (re-check the July 6 security pass).
• Every multi-step tool documents handle mint + ownership binding.
• Round-robin load test signed off by the owning squad.
• cacheScope verified with two identities.
• Client teams notified about Session-Id and initialize removal.
• Deprecation owners named for Roots, Sampling, and Logging (12-month window).
• On-call coverage through GA + 48 hours.

What not to do in the final four days

• Rewriting your tool registry "while we are in there." Wrong week for taste refactors.
• Enabling a second enterprise protocol stack because of July headlines. Stay portable per the portability playbook, but do not dual-cutover.
• Deleting Redis session stores before round-robin proof is green.
• Shipping unattended /doctor or broad Auto-review changes in the same window as MCP GA.

How I declare success on July 29

Success is not "we use the new version string." Success is: multi-step workflows complete under round-robin, no cross-tenant handle replay, no secret headers in CDN logs, and support tickets about Session-Id are a known backlog with a client upgrade path. If those hold, GA was boring. Boring is the goal.

Conclusion

Four days left. Freeze scope, prove round-robin, verify cache scope, staff the pager. The RC has been public since May 21. July 28 should be a publish date, not a discovery date.

Sources: MCP 2026-07-28 release candidate at MCP blog (final specification date July 28, 2026; RC locked May 21, 2026).