Audit Your MCP Servers Before the Session ID Disappears
The July 28 MCP spec deletes the session handshake and the Mcp-Session-Id header outright. Fifteen minutes tells you which of your servers quietly depends on them.
- Time
- 15 min
- Difficulty
- intermediate
- Potential value
- high value
Why today
The 2026-07-28 spec is a published release candidate, not a rumor, and it removes the session handshake outright rather than deprecating it. Three other features got a twelve month window. The handshake did not. A server that keeps state in memory works perfectly on one process and fails the moment there are two.
What you will do
Produce a written list of every MCP server you run and whether each one depends on the session behavior the new spec removes.
- 01 Open your MCP client configuration and write down every server you actually run. Most people have more than they remember, and the ones wired up months ago are the risky ones.
- 02 In each server's source, search for the header the spec deletes. Run: grep -ri "mcp-session-id" . If it appears anywhere, that server is written against the old contract.
- 03 Search the same source for the handshake. Run: grep -ri "initialized" . The spec removes the initialize and initialized exchange, so any logic gated on it needs a plan.
- 04 Look for state held between requests. A module level Map, dict, or object keyed by session or connection is the real failure: it works on one process and returns 400 Session Not Found the moment a second one exists.
- 05 Check whether the server sends the three headers the new spec requires: MCP-Protocol-Version, Mcp-Method, and Mcp-Name. A header that disagrees with the request body is rejected with code -32020.
- 06 Write one line per server: its name, whether it holds session state, and whether it sends those three headers. That list is the deliverable. Migrating is a separate decision you can now make with evidence.
How you will know it worked
You have a written line for every MCP server you run saying whether it holds session state, and you can name which one you would fix first.
How this was checked
An agent drafted this page. Each claim below was checked against the fetched document behind its sources, and a person reviewed the page before it published.
Claims checked
-
The 2026-07-28 MCP specification removes the initialize and initialized handshake and the Mcp-Session-Id header entirely.
-
The stateless specification requires the HTTP headers MCP-Protocol-Version, Mcp-Method and Mcp-Name, and a server rejects a header and body mismatch with code -32020.
-
Roots, Sampling and Logging enter deprecation with a minimum twelve month transition window.
-
Under the previous stateful model a second request from a client could hit another pod and return a 400 Session Not Found error.
-
Protocol version, client info and client capabilities now travel in a _meta field on every request instead of being exchanged once at connection setup.
Research run manual-2026-09-01-mcp-stateless. Verified Sep 1, 2026.