MCP is going stateless. Is your team ready?

Stacklok is an official MCP maintainer. We can provide unique insight into the spec revision, including potential breaking changes. An assessment starts with a zero cost, zero obligation conversation. We are here to help!

Have your plan ready when the MCP spec update drops, and keep your MCP estate secure.

Schedule a zero-cost, zero obligation conversation with a Stacklok engineer

What’s included in the July 28 update?

  • Transport shifts from stateful to stateless; now any request can land on any server instance
  • Discovery becomes explicit, and modern servers must implement server/discover to advertise versions, capabilities and identity
  • OAuth / OIDC requirements are added and OTel compatible tracing is formalized
  • Warning: Modern-only clients will not automatically work with legacy-only servers and legacy-only clients do not automatically work with modern-only servers!

Frequently asked questions

We start with a zero cost, zero obligation conversation to get a clear picture of your current (and near-term planned) use of MCP. We will be direct with you … if your estate is unlikely to be impacted by the spec update, there’s no need for deeper engagement, and you can always reach our team via Discord as needed. Conversely, if you have internal servers that need to be modernized, we can run a rapid engagement (we have a proven six-step process) to ensure you have a migration plan in place.

The new specification defines “modern” implementations as 2026-07-28 and later, “legacy” implementations as 2025-11-25 and earlier, and “dual-era” implementations as those that support both. Modern-only clients do not automatically work with legacy-only servers, and legacy-only clients do not automatically work with modern-only servers. Compatibility requires both sides to share a supported protocol era, or for one side to implement deliberate fallback or translation.

Potentially, but only for well-defined patterns. A useful compatibility layer must do more than strip or add headers. It may need to detect protocol era, translate initialization and discovery behavior, preserve client identity and capabilities per request, map session state safely, transform method and result shapes, handle subscriptions and multi-round-trip interactions, and preserve authorization and audit semantics.