MCP's Stateless Spec Turned It Into Boring Infrastructure (2026)

Last updated: September 9, 2026 · 6-minute read

The defining change in the Model Context Protocol's 2026-07-28 specification is a removal: state left the protocol core. A protocol built on bidirectional sessions became a stateless request/response one — the difference between a bespoke deployment and something that runs anywhere a plain web service runs.

An attribution note before the details, because this post leans on other people's counters. Everything below was verified in September 2026 against the specification page, the maintainers' announcement of July 28, and Cloudflare's follow-up analysis. Download and registry counts are labeled as whose numbers they are — and the enterprise-adoption percentages floating around this ecosystem failed verification, so none appear here.

The July 28 spec, plainly

The spec moved through three revisions: 2025-06-18, 2025-11-25, and the current 2026-07-28, which sat in release-candidate review from May 21 before shipping. The headline is the stateless protocol core — the maintainers call it one of the most highly-requested features the project has received. Servers no longer hold sessions; requests stand alone.

Four more changes round out the revision. Multi Round-Trip Requests (MRTR) keep server-to-client flows like sampling and elicitation working without the old session machinery. Header-based routing arrives via Mcp-Method and Mcp-Name headers, and list results become cacheable with deterministic ordering. Authorization hardens — RFC 9207 issuer validation lands, and the spec formally shifts away from Dynamic Client Registration toward client metadata documents (CIMD).

Two structural additions deserve note. A formal extensions framework recognizes Tasks, MCP Apps, and Enterprise Managed Authorization as first-class extensions rather than community forks. And the project adopted a formal deprecation policy with a 12-month minimum window — the first time the spec has promised anything about its own cadence.

Tier 1 SDKs moved with the spec: TypeScript, Python, Go, and C# all shipped updates with migration notes for the breaking parts.

What stateless actually buys

The stateless core is the change with the longest shadow. A request/response protocol deploys like any web service — behind a load balancer, at a CDN edge, inside an ephemeral container — with no session affinity to engineer around. The maintainers' own framing is that this was the most requested change; the market's framing showed up six weeks later.

Cloudflare's August 6, 2026 writeup put it bluntly: MCP is now a fully stateless protocol, and MCP servers can run in just a Worker. When a protocol that began as a Claude Desktop socket becomes something an edge platform treats as a workload category, the maturity argument makes itself.

The honest summary: MCP in September 2026 is boring, and boring is the compliment. Boring means the interesting decisions moved from "can this transport hold a session" to "is this server any good" — which is where a builder's attention actually pays.

Scale, with the attribution attached

The maintainers' July 28 post reports close to half a billion downloads per month across Tier 1 SDKs, and states that the TypeScript and Python SDKs have each crossed one billion total downloads. Those are maintainer-reported figures from the project's own blog — impressive, and quoted here with that label attached.

For growth shape, a third-party snapshot from March 2026 put monthly SDK downloads at 97 million — three months before the official half-billion figure. The two numbers come from different counters, so treat the comparison as directional color rather than a measured curve.

The registry is real infrastructure now. registry.modelcontextprotocol.io lists servers under reverse-DNS names like io.github., and its repository describes itself as something like an app store for MCP servers, with stable API commitments — its pages showed updates days before this post. On size, the defensible phrasing is this: roughly ten thousand registered servers, by third-party counts — with the caveat that listing is not curation, and breadth says nothing about whether any given server is good.

Adoption stopped being the question

The adoption timeline ended the argument about whether MCP was a vendor side quest. OpenAI announced MCP adoption in March 2025, with recaps naming Microsoft, AWS, and Google as adopters in the same season. On April 9, 2025, Google DeepMind's Demis Hassabis announced MCP support coming to Gemini models and SDKs.

Enterprise names now appear in the protocol's own ecosystem marketing. Cloudflare's August post names its MCP Demo Day customers: Asana, Atlassian, Block, Intercom, Linear, PayPal, Sentry, Stripe, and Webflow. Whether every one of those deployments is deep or decorative, only the customers know — but the direction of the names is the signal.

The opinion this site holds: the protocol debate is over, and implementation quality is the new battleground. That is a better problem for the ecosystem to have, and it is the one worth spending reading time on.

The honest catch list

The stateless rewrite is breaking for existing stateful server patterns — that is not a footnote, it is the migration cost of the headline feature. The official post ships detailed migration notes for exactly the breaking bits, and the Tier 1 SDKs carried those notes into their updates. Anyone maintaining a long-running MCP server has real work scheduled.

Three caveats keep the rest honest. The scale numbers are self-reported or secondary, so read them as orders of magnitude rather than audited metrics. Registry breadth is not quality — no listing implies endorsement. And the only cadence promise the project has made is the 12-month deprecation window, so any forecast beyond that is invention.

One housekeeping note for readers of this site: the MCP setups documented here were written against spec revisions older than 2026-07-28. Treat their instructions as pre-July until re-verified against the stateless core.

TL;DR

• The 2026-07-28 spec removed state from the protocol core — MCP servers are now stateless request/response services, deployable from a Worker to an enterprise gateway.
• Half a billion monthly SDK downloads and one-billion-plus totals per TypeScript and Python SDK are maintainer-reported figures; the registry lists roughly ten thousand servers by third-party counts.
• OpenAI, Google, Microsoft, and AWS adopted MCP in 2025; Cloudflare's August Demo Day names Stripe, PayPal, Linear, and other enterprise customers.
• The rewrite is breaking for stateful servers — the official migration notes are mandatory reading, and the only cadence promise is a 12-month deprecation window.

Keep reading

• The MCP servers I actually use with Claude Code
• Build a custom MCP server in Python in 50 lines
• Persistent memory for Claude Code via MCP
• AI Agents — the topic hub

---

Not affiliated with Anthropic, OpenAI, Google, Microsoft, or Cloudflare. Sources: the MCP specification, version 2026-07-28 and the maintainers' announcement of the same date, verified September 9, 2026.