MCP Protocol Goes Stateless, and Gateway Architecture Shifts

In July 28, the MCP spec moved to a stateless design: the initialize handshake and Mcp-Session-Id are gone, each request now carries its own protocol version, client info, and capabilities, and the Mcp-Method and Mcp-Name headers were added. On October 5, a DEV Community post looked at what this change means for gateways, using the fan-out design in Agent Router PR #2545 to show the adjustments needed on the gateway side. On October 6, another DEV Community post compared the security differences between MCP and custom REST tools, noting that MCP only standardizes communication—authentication, authorization, least privilege, input validation, and monitoring still have to be handled by the application and backend. The same post walked through the key changes in the finalized MCP spec of 2026-07-28, including the stateless protocol design, server/discover, Streamable HTTP, multi-round round-trip requests, and the Tasks extension, and noted that stdio is still common locally.

Generated by AI from reports · Updated 16 hours ago