MCP Went Stateless: The AWS Well-Architected Audit Your MCP Server Needs Now

On July 28, 2026, MCP published its largest protocol revision since launch: the initialize handshake is gone, the Mcp-Session-Id header is gone, and with them went the architectural reason most AWS MCP deployments needed sticky routing and dedicated session stores. If your MCP server is still running the infrastructure that was necessary six weeks ago, it’s carrying unnecessary cost and complexity.

The Framework

AWS maps the MCP 2026-07-28 specification against the six pillars of the Well-Architected Framework, and the stateless change touches every one of them. The audit below follows that structure — for each pillar, what the old deployment required, what the stateless protocol enables, and what action to take.

Operational Excellence

The previous protocol required teams to instrument custom session lifecycle tracking to maintain observability across an inherently stateful connection. The stateless spec builds W3C Trace Context into the _meta field on every request, enabling end-to-end distributed tracing through existing OpenTelemetry pipelines without custom instrumentation. Standard stderr or OpenTelemetry replaces the proprietary logging channels that had become a maintenance burden. Action: remove custom session logging middleware; route _meta trace context into your existing OTel collector.

Security

Stateful MCP exposed servers to session hijacking if Mcp-Session-Id tokens were predictable or logged. The stateless revision enforces ownership validation on server-minted identifiers passed as tool arguments. Multi Round-Trip Requests (MRTR) define protocol-bounded human interaction points — agents cannot initiate uncontrolled interaction loops. JSON Schema 2020-12 validation is now required at the protocol layer. Action: ensure input validation uses the protocol-mandated schema; verify identifier handling follows the minting pattern, not the old session ID approach.

Reliability

Session affinity requirements meant a single failed instance could drop active sessions — the most common cause of MCP server reliability failures in multi-node deployments. Stateless transport eliminates that failure mode: any instance handles any request. Continuation tokens enable incremental recovery from interrupted operations. Action: replace ALB sticky-session routing with plain round-robin; remove session state replication logic.

Performance Efficiency

Per-session tool list fetching — the handshake step that front-loaded latency on every new session — is replaced by protocol-declared caching with ttlMs and cacheScope. Deterministic tool list ordering enables LLM prompt-cache hits on repeated queries. Action: declare cache TTLs in your tool list; validate that your tool list ordering is stable across deployments to maximize cache efficiency.

Cost Optimization

The session store was the clearest cost target. A two-node Amazon ElastiCache (cache.t4g.micro) running purely for session persistence costs approximately $23/month — now deletable. AWS Lambda becomes a natural first-class deployment target without the workarounds that stateful MCP required (Lambda’s ephemeral execution model was incompatible with held-open sessions). Action: delete ElastiCache instances serving only MCP session state; evaluate whether Lambda now meets your latency targets.

Sustainability

Session capacity over-provisioning was a predictable inefficiency: teams sized instances to handle peak session counts, leaving headroom idle during off-peak hours. Stateless transport allows right-sizing against actual request throughput rather than concurrent session counts. Action: re-evaluate instance sizing after session stores are removed.

Where It Doesn’t Apply

Do not delete session infrastructure until you have established a firm sunset date for pre-2026-07-28 clients. Legacy MCP clients that still send Mcp-Session-Id headers need your gateway to handle the old protocol gracefully. Instrument your gateway to log the protocol version per request — this data tells you when the legacy traffic has drained to zero and removal is safe.

Source: AWS Architecture Blog

Content created with AI assistance and reviewed for accuracy.