The Model Context Protocol has moved to a fully stateless architecture with today’s final specification release. By removing the initialize/initialized handshake and the Mcp-Session-Id header, the maintainers have locked in a new paradigm for agent infrastructure. This transition, which was the subject of intense debate during the release candidate phase, establishes a permanent foundation for the protocol.
More than 10,000 active public MCP servers now run across the ecosystem, pulling in over 97 million monthly SDK downloads across Python and TypeScript. According to the Stacklok State of MCP in Software 2026 report, 41 percent of surveyed software organizations are already running MCP in limited or broad production. The protocol crossed from experiment to infrastructure some time ago; today’s release simply makes that status official.
For builders, the operational shift is immediate. Under the previous specification, a client and server would negotiate a session, creating a sticky connection that pinned a client to a specific server instance. That handshake is now gone. Any MCP request can be handled by any server instance. Microsoft published a reference implementation on Azure App Service that runs three instances behind a built-in load balancer with no session affinity and no shared session store. GitHub’s MCP Server stripped out Redis sessions and database-heavy initialization logic five days ahead of today’s release. FastMCP 4.0 ships multi-era serving, negotiating sessionless connections with newer clients while maintaining legacy support for older ones. The ecosystem was ready for this change. The 10-week release candidate window validated that.
This architectural shift introduces a significant security trade-off. By removing protocol-level sessions, the specification offloads security responsibilities to the developer. Akamai’s security research team flagged three concrete cross-tenant threats from predictable tracking identifiers: hijacking another user’s active workflow, accessing data belonging to a different agent, and triggering unauthorized cross-tenant actions. Backslash Security identified a new attack class they call handle hijacking: because portable handles are visible to the model and passed through conversations, anyone who obtains the string can replay it against the server. These attacks are invisible to traditional network-based security gateways because the malicious activity occurs within the LLM conversation itself.
Glama.ai published findings last week describing MCP hosts as an identity blind spot: authentication at the Identity Provider layer does not automatically translate to authorization at the tool layer. The net effect is that critical security boundaries now depend on developer implementation choices rather than the protocol itself. For a specification about to underpin enterprise agentic workflows, that is a material responsibility shift.
The formal deprecation policy (SEP-2577) provides some structural stability: a 12-month minimum between deprecation and earliest possible removal, with new capabilities required to ship as opt-in extensions first. Roots, Sampling, and Logging are deprecated in favor of tool parameters, direct LLM provider APIs, and OpenTelemetry, respectively. These methods will continue working for the next year, but the trajectory is clear. Tool schemas have been lifted to full JSON Schema 2020-12, allowing composition and $ref. OAuth 2.1 has been hardened with mandatory issuer validation to block token mix-up attacks. A new Extensions framework introduces first-class, reverse-DNS identifiers with independent versioning and their own lifecycle.
Governance now rests with the Agentic AI Foundation, the Linux Foundation body that took stewardship of MCP in December 2025 to ensure vendor neutrality. The AAIF is hosting a release party tonight in San Francisco at Arcade.dev, signaling the protocol’s transition from architectural friction to long-term stewardship. This governance layer matters as the ecosystem matures and competitive pressures mount, particularly as Google Cloud forces migrations toward its own Agent Registry ahead of the July 30 Cloud API Registry shutdown.
Security-by-implementation faces a scaling challenge that tracks directly with the protocol’s adoption. While the stateless architecture solves the bottleneck of sticky sessions and enables the horizontal scaling required for production agentic systems, it forces every MCP server deployment to rely entirely on the developer’s understanding of OAuth 2.1, handle scoping, and cross-tenant isolation. As the agent economy moves from pilot projects to production workflows, the gap between protocol capability and implementation maturity remains the primary point of risk.