Stateless MCP Migration for Enterprise: The Session Debt Nobody Priced

On July 28 the Model Context Protocol shipped 2026-07-28, its largest revision since remote MCP launched. The headline is a stateless protocol core. The initialize/initialized handshake is retired, and so is the Mcp-Session-Id header. Right now almost every stateless MCP migration for enterprise teams is being scoped as a scalability upgrade, and it genuinely is one: any request can land on any server instance behind a plain round-robin load balancer, with no shared session storage.

That framing is incomplete. The incomplete half is the expensive half.

The session was never only a transport detail. In the agent stacks I work on with Fortune-level enterprise clients architecting and building agentic frameworks, the MCP session had quietly become the place four governance responsibilities lived: who is calling, what they are allowed to call, how much they may consume, and what happened. None of those were ever in the specification. All of them were leaning on it.

Delete the session and those four responsibilities do not vanish. They get evicted. They have to land somewhere, and for most organizations the only place left is an agent gateway that does not exist yet.

I call that gap session debt: the governance you were getting for free from a stateful protocol, and now have to pay for explicitly, on a twelve-month clock.

What actually changed in the 2026-07-28 specification?

The substance, straight off the release:

• Sessions are gone. The initialize/initialized exchange and the Mcp-Session-Id header are retired (SEP-2575, SEP-2567). Each request carries its own protocol version, client identity and capabilities in _meta. An optional server/discover RPC exists for clients that want capabilities up front.
• Routing moved into headers. Streamable HTTP requests must now carry Mcp-Method and Mcp-Name (SEP-2243), so a gateway, rate limiter or WAF can route and meter without parsing a JSON body.
• List results are cacheable. tools/list, prompts/list, resources/list and resources/read return ttlMs and cacheScope (SEP-2549), stabilizing upstream prompt caches across reconnects.
• Authorization hardened. Authorization servers should return iss per RFC 9207 and clients must validate it before redeeming a code (SEP-2468). Client credentials are bound to the issuer that minted them (SEP-2352). Dynamic Client Registration is formally deprecated in favor of Client ID Metadata Documents.
• Round trips replace held-open streams. Multi Round-Trip Requests (SEP-2322) let a server return resultType: "input_required" and have the client retry with inputResponses attached, so mid-call approvals survive a stateless transport.
• Deprecations run on a clock. Roots, Sampling, Logging and the legacy HTTP+SSE transport are deprecated under a new formal policy with a twelve-month minimum window (SEP-2577).

Tier 1 SDKs for TypeScript, Python, Go and C# speak the new version today, with Rust in beta. AWS, Google Cloud, Microsoft Foundry, Cloudflare and Figma all endorsed the release on day one.

The maintainers were explicit that statelessness is a transport property, not an application one. Their guidance: if a server must carry state across calls, mint an explicit handle from a tool and have the model pass it back as an argument, because a handle the model can see beats state hidden in the transport.

That is exactly right, and it is exactly the problem. An explicit handle is easy to design for task state. It is a much harder thing to design for authorization.

Why does a stateless protocol create a governance problem?

Because a session is a correlation key, and governance is correlation.

A stateful session gave you one identifier that tied a sequence of tool calls to an authenticated principal, a negotiated capability set, a consumption budget and an audit thread. Nobody wrote that down as an architecture decision. It was an accident of the transport that teams built on anyway, the way applications quietly came to depend on sticky sessions before load balancers made that a liability.

Remove the correlation key and four responsibilities go looking for a new home. That is the session debt ledger.

Eviction 1: Identity

The session used to answer who is calling. One authenticated handshake, then every subsequent call inherited that principal for free.

Now identity travels per request or not at all. That is strictly better for security, and it is more work: every call must carry a verifiable client identity, and the new issuer rules mean your tokens are bound to the authorization server that minted them. Credential reuse across issuers stops working. Teams that stood up Dynamic Client Registration in the last year are now on a deprecation path toward CIMD.

The migration question: can you name the principal behind a single arbitrary tools/call in production, without reference to a session?

Eviction 2: Scope

The session used to answer what may be called. Capabilities were negotiated once at initialization and held for the connection.

With per-request self-description, scope has to be enforced per request. The spec hands you the mechanism: Mcp-Method and Mcp-Name in headers mean a gateway can authorize a tool call by name before the body is ever parsed. That is a real gift. It is also a relocation notice, because the only component positioned to use it is a gateway sitting in front of your MCP servers.

The migration question: if Mcp-Name: transfer_funds arrives from a valid client, what component decides that this client may call that specific tool, right now?

Eviction 3: Budget

The session used to be the natural unit for how much. Rate limits, concurrency caps and token metering all attached to a connection.

Stateless requests behind a round-robin load balancer have no connection to attach to. Per-instance counters are now meaningless, because the next call lands somewhere else. Metering has to move to a shared point of control, and header-based routing is what makes that cheap.

This is not theoretical cost. Agent spend is the failure mode enterprises report most consistently after reliability, and it is the reason the same week produced a wave of gateway products aimed squarely at capping it.

The migration question: what enforces a per-agent spend ceiling when no two consecutive calls share a process?

Eviction 4: Trail

The session used to be the audit thread. Mcp-Session-Id was, for a lot of teams, the de facto correlation ID that made a sequence of tool calls legible after the fact.

It is gone, and nothing in the spec replaces it. If you want to reconstruct what an agent did across fifteen calls that landed on eleven instances, you now have to mint and propagate that correlation yourself.

Auditability is drifting from a nice-to-have into a compliance precondition for agent deployment. Losing the accidental correlation key at the moment auditors start asking for it is poor timing.

The migration question: can you reconstruct one complete agent episode end to end, today, without a session ID?

Who is already building for the evictions?

The market answered before most architecture teams read the changelog, which is the strongest evidence that the read is right.

At Black Hat 2026 the same week, Snowflake launched Cortex AI Gateway, built on its acquisition of the Natoma MCP gateway. Read the feature list against the ledger above and it is a one-to-one match: fine-grained authorization across 100+ MCP servers (scope), agent identity and restricted session scope (identity), AI cost controls, budget guardrails and intelligent model routing (budget), real-time tracing and end-to-end agent action auditability (trail). It governs third-party agents such as Claude Code and Cursor, not just first-party ones.

Microsoft framed its own position in the MCP release itself, describing a unified MCP endpoint that brings tools together while centralizing governance, identity and observability. Same four responsibilities, same conclusion about where they belong.

VentureBeat's survey of the agent-trust startup landscape names the same three gaps from the buy side: agents cannot interoperate, cannot be trusted with permissions, and cannot be audited.

Four independent parties converging on identity, permissions, metering and audit in one week is not a coincidence. It is what an eviction looks like when the market notices before the architects do.

What I'd actually do

Treat this as a control-plane migration that happens to include a protocol upgrade, not the reverse. Concretely, in this order:

1. Audit the dependency before you migrate. Grep your MCP integration for Mcp-Session-Id and every place a session identifier is read outside the transport layer. Anything that touches it in an authorization, quota, logging or correlation path is session debt with a dollar figure attached. Do this first, because it sizes everything else.
2. Mint an explicit correlation ID now, on the old spec. This is the single highest-leverage move available today and it is backward compatible. Generate an episode ID at the agent boundary, propagate it through _meta, and log it on every tool call. You will need it after the migration regardless of which gateway you land on, and it makes the trail eviction a non-event.
3. Decide where scope is enforced before you enjoy the scalability. Mcp-Method and Mcp-Name only pay off if something authoritative sits in the request path. Choose that component deliberately, whether it is a vendor gateway or your own service mesh policy layer. Defaulting to per-server enforcement recreates the sprawl the stateless core was meant to remove.
4. Move DCR to CIMD on the twelve-month clock, not at month eleven. The deprecation window is a planning gift. Treat it as a dated milestone with an owner.
5. Do not let the load-balancer win drive the timeline. Horizontal scalability is real and it will make the migration look like an easy yes. The scalability lands in a week; the governance relocation takes a quarter. Sequence them so the second is not discovered after the first ships.

The protocol got better. It got better by handing your team a bill that a stateful transport had been quietly paying on your behalf. Read the ledger before the offramp closes.

Primary source: The 2026-07-28 Specification, Model Context Protocol Blog. Related reading on this blog: MCP integration architecture for enterprise and AI agent identity governance.

---

Get the next breakdown. I publish one enterprise agentic-AI teardown a week, built on primary sources and production experience. Subscribe on buildnextgen.ai.

Swipe the framework