MCP Protocol Goes Stateless, and Gateway Architecture Shifts

In July 28, the MCP spec moved to a stateless design: the initialize handshake and Mcp-Session-Id are gone, each request now carries its own protocol version, client info, and capabilities, and the Mcp-Method and Mcp-Name headers were added. On October 5, a DEV Community post looked at what this change means for gateways, using the fan-out design in Agent Router PR #2545 to show the adjustments needed on the gateway side. On October 6, another DEV Community post compared the security differences between MCP and custom REST tools, noting that MCP only standardizes communication—authentication, authorization, least privilege, input validation, and monitoring still have to be handled by the application and backend. The same post walked through the key changes in the finalized MCP spec of 2026-07-28, including the stateless protocol design, server/discover, Streamable HTTP, multi-round round-trip requests, and the Tasks extension, and noted that stdio is still common locally.

Generated by AI from reports · Updated 9 hours ago

1. Oct 6, 13:36 · 1 report
   MCP Architecture Evolution and AI Agent Security Best Practices
   DEV Community · MCP：MCP 与自定义 REST 工具的安全对比及最新 MCP 架构
2. Oct 5, 15:26 · 1 report
   How MCP Going Stateless Affects Gateway Architecture
   DEV Community · MCP：What the stateless MCP spec changes for gateways: the fan-out design in Agent Router PR #2545