The Model Context Protocol shipped its fifth specification on Tuesday, and the headline feature is a deletion. The initialize/initialized handshake is gone. So is the Mcp-Session-Id header. MCP — the standard most AI agents now use to reach your tools and your data — has been rebuilt as a stateless request/response protocol, and the changes are deliberately backward-incompatible.
Every request is now self-describing. Method and tool names ride in Mcp-Method and Mcp-Name HTTP headers, so a gateway or rate limiter can route and meter without parsing a JSON body. List responses carry cache hints and a deterministic order. Any call can land on any server instance behind a plain round-robin load balancer — no sticky sessions, no shared session store, no reconnection logic.
The scale explains the urgency. Anthropic, which built MCP and gave it away, says the protocol recently passed 400 million monthly SDK downloads, a fourfold increase this year, and lists more than 950 MCP servers in its own connector directory. The spec now sits under the Agentic AI Foundation, a directed fund of the Linux Foundation.
Our take: This is the release where agent plumbing stopped being a demo and became ordinary web infrastructure. Statelessness is not the interesting part. The interesting part is that the maintainers chose to break things rather than paper over the gaps, and the entire cloud tier agreed on the same day — AWS, Google Cloud, Microsoft, Cloudflare, Netlify and Anthropic all shipped support for the same breaking change at once. When that happens the standards fight is over, and what is left is a migration bill. Somebody at one of your vendors is paying it right now. You will find out which ones when something quietly stops working.
What actually breaks
Five things are now formally deprecated: Roots, Sampling, Logging, Dynamic Client Registration and the legacy HTTP+SSE transport. All of them keep working. None of them belongs in new code. The spec also introduced its first formal deprecation policy — a twelve-month minimum window before anything can be removed — which puts the earliest removal date at July 28, 2027.
The subtler change is where state went. Dropping sessions does not make your application stateless; it moves the problem into the open. A server that needs continuity across calls now mints an explicit handle from one tool and lets the model pass it back as an ordinary argument on the next. The maintainers argue this beats hidden transport state because the model can actually see the handle and reason about it. True — and it is also a new failure mode. A model that garbles an identifier fails differently than a session that expires.
Authorization got the most attention, which tracks with where implementers said they were losing time. Clients must now validate the issuer per RFC 9207 before redeeming an authorization code, credentials are bound to the issuer that minted them, and Dynamic Client Registration is deprecated in favor of client metadata documents. Enterprise-managed authorization graduates to a proper extension, so an admin can provision connectors once through Entra or Okta and let users inherit access. That arrives in a year when agent security stopped being hypothetical — an autonomous agent swarm ran an end-to-end intrusion at Hugging Face in July — and enterprises started asking who exactly authorized any given tool call.
What to watch
- The migration bill, and who eats it. If you or a vendor built anything on session identifiers, that code changes. The Tier 1 SDKs — TypeScript, Python, Go and C# — all speak the new version as of Tuesday, with Rust in beta. Ask your tooling vendors which spec version they target before you assume it is handled.
- Extensions versioning separately from the core. MCP Apps, Tasks and enterprise-managed auth now ship under a formal extensions framework. That is how mature ecosystems evolve. It is also how compatibility matrices get born.
- Whether stateless changes the cost curve. Serverless and edge deployment was the point. If MCP servers get materially cheaper to run at scale, the number of tools an agent can reach goes up — and so does the number of things it can get wrong.
If you are building your own agent setup, the mechanics are in The $2 Test, and what happens when a dependency shifts under you is the whole subject of our resilience playbook. Both got more relevant on Tuesday.
A protocol that deletes its own handshake eighteen months in is not a protocol in trouble. It is one that expects to be load-bearing for a long time.