On July 28th, MCP is releasing its largest update ever, shifting from a stateful to a stateless protocol to simplify deployment and scalability, though this increases the burden on developers to manage state and security explicitly. Despite rapid adoption and strengthened authorization protocols, significant interoperability challenges and ecosystem fragmentation remain, with only one server currently ready for the update, making widespread alignment crucial for MCP’s long-term success.
On July 28th, MCP (a widely adopted protocol with 110 million SDK downloads per month) is releasing its biggest update since its launch 16 months ago. This update removes the handshake and session ID mechanisms, deprecates three original features, and fundamentally rewrites the protocol’s core to simplify deployment. The rewrite addresses a critical architectural flaw: the original MCP was stateful, requiring sticky sessions and persistent server memory, which made it difficult to deploy in modern, stateless infrastructure like serverless environments. This change shifts MCP to a stateless design where every request carries all necessary information, enabling easier scaling and load balancing.
The original stateful design forced complex infrastructure workarounds such as Redis clusters and complicated API gateway logic to maintain session state. The new stateless approach eliminates these burdens from the protocol itself, but it also transfers the responsibility of managing stateful interactions—like transactions or user sessions—to the server or application layer. This means developers building stateful servers must now explicitly handle state management, authorization, and security, increasing their workload and potential risks, especially since state handles can be manipulated by language models or other clients if not properly secured.
Authorization remains a major pain point despite the rewrite. MCP mandates OAuth 2.1, which is still an unfinished draft, and different major clients implement authorization in incompatible ways. This fragmentation causes interoperability issues, with servers potentially failing silently depending on the client used. While the July update strengthens authorization protocols, it does not unify or fully resolve these discrepancies, leaving developers to navigate a fragmented ecosystem with inconsistent security implementations.
Despite these challenges, MCP’s adoption continues to grow rapidly, outpacing technologies like React in SDK downloads within a much shorter timeframe. Much of MCP’s real-world usage happens behind corporate firewalls, integrated into enterprise systems like Salesforce, Jira, and Snowflake, rather than in public-facing social media hype. Some earlier complaints about protocol inefficiencies, such as context bloat, were actually due to client-side implementations rather than the protocol itself, highlighting the importance of understanding the full technology stack rather than blaming MCP alone.
Looking ahead, the critical question is whether the MCP ecosystem can catch up with the new protocol version. Currently, only one out of over 4,000 servers is ready for the update, signaling a significant gap. If clients converge on a unified implementation, MCP could solidify its position as a durable standard. However, if fragmentation persists, the rewrite may become a minor footnote in a fractured ecosystem. Ultimately, MCP’s deliberate simplification aims to ensure long-term survival, but its success depends on widespread adoption and ecosystem alignment in the coming months.