The July 28, 2026 revision of the Model Context Protocol does more than the headlines suggest. Yes, it removes protocol sessions — a genuine scalability win. But the same release adds two required HTTP headers, Mcp-Method and Mcp-Name, that let gateways route, rate-limit and meter agent traffic without ever opening the request body. The Hacker News thread split sharply — not over whether statelessness is an improvement, but over what it reveals. "We invented a stateful protocol, found state hard to scale, stripped it out, and ended up with: send a POST request," wrote one commenter. "The REST crowd has been waiting 20 years for this moment."
How MCP worked before: sessions as a scaling tax
The early transport began with initialize and initialized exchanges, establishing a session tracked through the Mcp-Session-Id header. Every subsequent request had to find the state associated with that session. Auto-scaling infrastructure had to pin sessions, deployments had to drain or migrate them, and load balancing was impractical because a client was stuck to the instance holding its session.
The new protocol removes the handshake, the session header and the protocol session from the core request path. Every request carries the protocol version, client identity and capabilities it needs. Any request can land on any instance.
The quietly bigger change: metadata in the transport layer
Less attention went to what happened to the request itself. MCP messages are JSON-RPC over HTTP, and previously everything about a request lived in the JSON body — a gateway had to parse the body to know whether a request was listing tools, calling one, or reading a resource. Now Streamable HTTP requests must include two headers: Mcp-Method and Mcp-Name. A tool call arrives as Mcp-Method: tools/call and Mcp-Name: search, followed by the JSON-RPC payload. As Cloudflare's Matt Carey detailed, gateways, rate limiters and WAFs can read these headers and act per method or per tool, using the same mechanisms they already apply to every other API. The spec goes further — tool arguments can even be copied into headers for custom routing.
Governance is moving down the stack
Until now, agent governance approached from the other direction. Cloudflare's agent tracing and Azure API Management's AI Gateway layer sit above the protocol as separate control planes. This release puts metadata into the transport itself, so the systems infrastructure teams already run can read it. The same governance layer is where collisions between multiple agents sharing one codebase get resolved — a problem Anthropic's own multi-agent experiments showed is far from solved.
Elicitation got split apart. Server-initiated requests previously needed an open stream; they now use multi-round request/response — the server returns input_required, the client collects answers and retries the call. Approvals went from one keep-alive connection to two requests: simpler to deploy, but the wait for a human response no longer lives inside a single call.
Authorization tightened too: dynamic client registration is deprecated and scheduled for removal after summer 2027, issuer identification adopts RFC 9207, and clients send the canonical server URI as an RFC 8707 resource so tokens are only accepted by that audience.
The debate: is MCP just REST with extra steps?
The HN debate is the interesting part. One camp says stateful MCP was obviously a mistake in hindsight — it turned MCP into another REST API endpoint, letting teams reuse the load balancers, API gateways and progressive delivery they already built. pjmlp framed it as a lesson the industry keeps relearning, going back to Sun RPC: stateless servers are always better; only use state when unavoidable. luciana1u was blunter: "We invented a stateful protocol, found state hard to scale, stripped it out, and ended up with: send a POST request." bloppe went structural — MCP is a REST-like API, plus a spec OpenAPI could already provide, plus framework-level authorization; only the third is genuinely new.
Defenders don't deny the resemblance; they disagree with the conclusion. "MCP is really just JSON-RPC; what was actually invented is a convention models have been trained to use." vidarh put it most concisely: the core advantage of MCP is that it is a standard endorsed by AI providers, which gives people a strong incentive to actually implement it.
A parallel thread asked whether agents need a protocol at all — just give them shell access to ordinary CLI tools. The counter: the CLI position assumes a developer at a laptop with a shell open in a coding harness, which describes a small slice of usage. Most comes from mobile apps, web chat and embedded components.
Where the money is going: the real signal
Adoption is not in dispute — Anthropic reports MCP SDK downloads above 400 million per month, triple over the past year. Whether adoption benefits individual servers is another question. A consulting firm's audit of one client server found 61 tool calls in three months, 58 of them from the client's own engineers. Teams treated "agents can access" as "agents want to access." The post's conclusion echoes this release: money is flowing to gateways, registries and identity layers, not to servers themselves.
That is the structural change worth watching. As agent traffic becomes a real workload, value concentrates in the control plane — routing, metering, authentication — while the protocol itself converges back toward the ordinary HTTP tooling the industry has run for two decades. MCP's contribution was never the wire format; it was making agent tool access a standard that models and providers both commit to.
What to do if you run MCP in production
Migration is real work for teams relying on protocol sessions, server-to-client requests or streams. The spec and updated TypeScript, Python, Go and C# SDKs are out now. The recommended path: run a stateless route alongside the existing stateful session routing, migrate capabilities over, drain active sessions, and remove the old path within the deprecation window. Meanwhile, start treating Mcp-Method and Mcp-Name as first-class signals in your gateway and rate-limiter configs — that is where the industry is heading. And if you run agent infrastructure, audit actual tool usage before assuming your agents are being used; our breakdown of Anthropic's multi-agent experiment shows how fast aligned agents start fighting over the same codebase.
