MCP went stateless: Is your AWS MCP server deployment well-architected?

Summary

MCP 2026-07-28 removes the initialize handshake and Mcp-Session-Id, making the protocol core stateless and changing how remote servers scale on AWS. Requests carry protocol version and client context, while server/discover can expose versions, capabilities, and identity; continuity remains possible through server-minted identifiers passed in tool arguments and stored application state. It covers round-robin routing, header-based gateway signals, cache freshness fields, W3C Trace Context, idempotent tools, and Multi Round-Trip Requests for input-dependent calls. It recommends retaining sticky routing and session stores for 2025-era clients, then migrating after legacy traffic reaches zero and validating against the official conformance suite. The conclusion is that the revision aligns remote MCP deployments with AWS Well-Architected practices and permits removal of infrastructure required only by the old protocol.

Context

The session-based MCP protocol constrained horizontal scaling by binding sessions to individual instances, requiring sticky routing or shared session stores. The post examines how the 2026-07-28 stateless protocol changes those deployment requirements and maps the revision to the AWS Well-Architected Agentic AI Lens.

Approach / What changed

The post recommends migrating to MCP 2026-07-28, using round-robin routing, server-minted identifiers for application state, header-based gateway routing, built-in cache freshness fields, W3C Trace Context, idempotent tools, and Multi Round-Trip Requests. It advises maintaining the legacy lane for older clients, instrumenting protocol versions, and validating implementations with the official conformance suite before removing session infrastructure.

Takeaways

• Under MCP 2026-07-28, any server instance can handle a request without protocol-session affinity; ALB stickiness and session stores remain necessary while older clients are still served.
• Multi Round-Trip Requests replace server-initiated pushes: an input_required result carries inputRequests and requestState, after which the client resends the original call with inputResponses and the echoed token.
• Gateways and observability systems can use Mcp-Method and Mcp-Name headers, ttlMs and cacheScope, W3C Trace Context, and stderr or OpenTelemetry instead of body parsing and proprietary protocol logging.

Related reading