Quick answer
Stateless MCP and session-based MCP are materially different wire contracts. The 2026-07-28 revision removes initialization and Mcp-Session-Id, places version and capabilities on every request, and adds server/discover. Do not point an untested older client at a new-only server and assume negotiation will repair the mismatch.
Compatibility comparison
| Concern | Session-based protocol | Stateless 2026-07-28 protocol |
|---|---|---|
| Connection setup | Initialization handshake | Independent requests |
| Routing | May require session affinity | Any compatible instance can handle a request |
| State | Often coupled to session | Explicit handle and application storage |
| Failure recovery | Session loss can interrupt work | Retry can reach a healthy instance, subject to idempotency |
| Capability exchange | Startup negotiation | Per-request metadata and optional preflight discovery |
| List behavior | May vary by connection | List endpoints no longer vary per connection |
Stateless routing improves infrastructure flexibility, but a retried mutation can still duplicate work unless the application enforces idempotency.
Mixed-version rollout
- Record every client and server protocol version.
- Use
server/discoverwhere supported and preserve a documented older probe path only where required. - Route old and new traffic to explicit compatibility surfaces.
- Test list results, tool calls, resources, prompts, notifications, errors, auth, retries, and long-running tasks.
- Compare semantic results, not only successful HTTP status.
- Remove the older path only after observed traffic and rollback criteria are satisfied.
Use the migration guide for the implementation sequence and the HTTP governance guide for gateways.
Frequently asked questions
Is it automatically backward compatible?
No. Removed handshake and session fields require explicit detection and tested compatibility behavior.
Is all state gone?
No. Only protocol-level session state is removed. Application state remains explicit.
Why is load balancing easier?
Self-describing independent requests do not require an in-memory protocol session on one pinned instance.
Official sources
Source check: August 6, 2026. Verify final spec and SDK compatibility before changing production routing.