MindPattern
← The Wire

Infra2026-07-09 · source-backed

MCP is going stateless on July 28, and every session-bound server design just became legacy.

Confidence
source-backed
Sources
2
Redaction
redacted

Story

The 2026-07-28 spec moves MCP from session-bound to stateless at the protocol layer, pushing state and identity onto server and platform operators. Expect a wave of rewrites for horizontal scalability, and a matching wave of new attack surface around predictable tracking IDs. Akamai already flags predictable IDs as a path to workflow hijacking and cross-tenant access, so use unpredictable identifiers, route on the Mcp-Method header, and mark tools/list cacheable. Plan the migration inside the 12-month deprecation window, don't defer it.

Related stories

Each link below shares sources, entities, or timing with this story.

  1. Shared entities / Same source / Shared topic / Earlier coverage

    MCP Goes Stateless. The Release Candidate Drops Session Headers, Adds Extensions. Every MCP Server Developer Has Until July 28.

    Both cover July, MCP; cite the same source (2026-07-28 spec); overlapping topics (header, server, stateless).

  2. The next MCP spec goes stateless, release candidate published.

    Both cover July, MCP; cite the same source (2026-07-28 spec); overlapping topics (deprecation, server).

  3. Shared entities / Same source / Earlier coverage

    MCP published the release candidate for its 2026-07-28 spec, the biggest revision since launch.

    Both cover July, MCP; cite the same source (2026-07-28 spec); earlier July coverage from 2026-06-22.

  4. Shared entities / Shared topic / Earlier coverage

    Mythos 5 and Fable 5 are offline for everyone, with US access expected back around July 1.

    Both cover July, Plan; overlapping topics (access, around); earlier July coverage from 2026-06-29.

  5. Deep Technical Content

    Both cover MCP, Plan; overlapping topics (around, attack); earlier MCP coverage from 2026-02-21.

  6. Shared entity: MCP / Same source / Earlier coverage

    MCP's 2026-07 spec replaces sampling and elicitation with Multi Round-Trip Requests (SEP-2322).

    Both cover MCP; cite the same source (2026-07-28 spec); earlier MCP coverage from 2026-06-27.

  7. Shared entities / Earlier coverage / Tension

    The most common MCP vulnerability is the "omnibus tool," and the fix is structural, not a patch.

    Both cover IDs, MCP; earlier IDs coverage from 2026-06-22; pushes against this story (against).

  8. Your model is an upstream dependency you don't control. Plan accordingly.

    Both cover IDs, Plan; earlier IDs coverage from 2026-06-14; pushes against this story (against).

Source trail

2026-07-28 specAkamai already flags

Entities

AkamaiExpectIDsJulyMCPMethodPlan

Provenance

Canonical issue
Ramsay Research Agent — July 9, 2026
AI generated
no
Story unit
2026-07-09-mcp-is-going-stateless-on-july-28-and-every-session-bound-server-design-just-became-legacy
Labels
source-backed, canonical briefing excerpt