MCP goes stateless on July 28: the four-week migration checklist I run before deleting sticky sessions

Introduction

If you run remote MCP behind a load balancer, July 28 is the day your sticky sessions die. That is good news. Most of the session infrastructure I see exists only because MCP 1.0 forced it. The bad news is teams treat "stateless protocol" as "stateless application" and ship broken shopping carts, browser sessions, and multi-step forms on day one.

I covered the RC changes in MCP goes stateless in the 2026 release candidate. This post is the countdown checklist for the four weeks before GA, assuming you already run MCP in production or have a July deploy planned.

What changes on July 28 (and what does not)

• Protocol layer drops initialize handshake and Mcp-Session-Id.
• Any request can hit any instance behind round-robin load balancing.
• Mcp-Method and Mcp-Name headers are required for gateway routing without body parsing.
• Application state stays in your DB keyed by explicit handles passed as tool arguments.
• OAuth hardening from the RC (iss validation, OIDC application_type, scope accumulation) remains required.
• Roots, Sampling, and Logging deprecated with a one-year runway (plan, do not panic).

Week-by-week checklist (four weeks to GA)

1. 01
   Week 4 (now): inventory stateful assumptions

   Grep for Mcp-Session-Id, initialize handlers, and in-memory maps keyed by session. List tools that assume the same instance serves consecutive calls. That list is your migration scope.
2. 02
   Week 3: mint explicit handles in tool contracts

   Replace implicit session with basket_id, browser_id, or workflow_id returned from the first call and required on follow-ups. Document handles in JSON Schema so the model sees them.
3. 03
   Week 2: upgrade SDKs and gate headers

   Move to stateless-capable SDK versions. Configure the gateway to require and route on Mcp-Method and Mcp-Name. Test round-robin under load; kill an instance mid-handle and confirm retry lands correctly.
4. 04
   Week 1: auth hardening and EMA pilot

   Walk the six OAuth proposals from the RC. If connector OAuth fatigue blocked rollout, pilot Enterprise-Managed Authorization on one team before GA traffic hits.
5. 05
   GA week: delete sticky config and watch cacheable reads

   Remove sticky sessions and MCP-only Redis. Enable cache headers where tools/list and static resources allow. Alert on 4xx spikes from clients still sending Session-Id.

Example: session handle in a tool schema

{
  "name": "checkout_submit",
  "description": "Submit cart for payment. Requires basket_id from create_basket.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "basket_id": { "type": "string", "description": "Handle from create_basket" }
    },
    "required": ["basket_id"]
  }
}

Gateway and observability gotchas

Stateless plus header routing means MCP traffic behaves like normal HTTP at the edge. That is the win. The gotcha is observability: you must log Mcp-Method, handle IDs, and instance_id together or post-incident traces become guesswork. Wire the agent observability stack before you delete the session store, not after.

If you run MCP through Databricks Unity AI Gateway patterns, confirm the gateway forwards the new headers and does not strip _meta fields your clients rely on.

Common mistakes before July 28

• Deleting Redis before tools return explicit handles.
• Assuming stateless protocol means tools cannot carry multi-step state.
• Running EMA rollout and stateless cutover in the same maintenance window.
• Ignoring deprecated Roots/Sampling/Logging without a one-year plan.
• Clients that still call initialize after GA (hard failures, not soft warnings).

Conclusion

July 28 is an infrastructure simplification day if you do the handle migration first. Delete sticky sessions, route on headers, keep application state in your database where it belonged all along. Skip the checklist and production learns from 502s. Run it and MCP scaling gets boring, which is the goal.

Sources: MCP 2026 release candidate (locked May 21, 2026); final specification date July 28, 2026 per MCP project timeline; details in /blog/mcp-stateless-spec-release-candidate.