MCP Sticky Sessions Depend on the Client Protocol Version

Sticky sessions are not a universal MCP requirement anymore. A remote Model Context Protocol client speaking 2026-07-28 sends self-describing requests that may reach any compatible replica, while a 2025-era Streamable HTTP client can still depend on Mcp-Session-Id and server-local session state. Removing affinity before identifying which contract is on the wire can therefore fix scaling for one client and break another.

That version boundary matters more than the load-balancer brand. Operators should classify traffic first, keep legacy sessions inside a known compatibility lane, and let verified 2026 requests use ordinary round-robin routing. Existing teams starting from secure MCP server hosting can treat this page as the migration and fleet-design layer rather than another installation guide.

The protocol version became an infrastructure contract

On July 28, 2026, MCP moved from a bidirectional stateful core to a stateless request/response core. The official release announcement says the new revision retires the initialize/initialized exchange and Mcp-Session-Id; protocol version, client identity, and capabilities travel with each request instead. It also adds Mcp-Method and Mcp-Name headers so gateways can route and authorize without parsing every JSON body.

Stateless at the protocol layer does not mean memoryless tools. It means transport state is no longer the hidden place that connects calls. When a tool needs continuity, the server can mint an explicit, scoped handle and require later calls to return that handle as a tool argument. That state can live in a database, object store, or another durable owner selected for the application rather than inside whichever worker answered first.

Deployed clients and SDKs may still follow the earlier contract. Under the 2025-06-18 Streamable HTTP specification, a server may return a cryptographically secure session identifier with the initialization result. After receiving it, the client must include that identifier on later HTTP requests. A worker that never created or cannot resolve the session may legitimately reject the request.

Two simplified wire receipts show why one routing rule cannot safely describe both generations. The modern request follows the current Streamable HTTP specification, including its required transport headers and self-describing body metadata:

HTTP/1.1 200 OK
Mcp-Session-Id: 7ad1e4d0-legacy-session
Content-Type: application/json

POST /mcp HTTP/1.1
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: search
Authorization: Bearer <access-token>
Content-Type: application/json
Accept: application/json, text/event-stream

{
  "jsonrpc": "2.0",
  "id": 41,
  "method": "tools/call",
  "params": {
    "name": "search",
    "arguments": {"q": "capacity report"},
    "_meta": {
      "io.modelcontextprotocol/protocolVersion": "2026-07-28",
      "io.modelcontextprotocol/clientInfo": {
        "name": "ops-client",
        "version": "4.2"
      },
      "io.modelcontextprotocol/clientCapabilities": {}
    }
  }
}

Mcp-Session-Id creates routing history in the first receipt. The second request carries enough protocol context for any compatible replica to evaluate it. Do not infer either behavior from the endpoint name /mcp alone.

The routing headers are mirrors, not a second authority: the body remains the source of truth. A compliant server must reject a missing, malformed, or mismatched MCP-Protocol-Version, Mcp-Method, or applicable Mcp-Name with HTTP 400 and the JSON-RPC HeaderMismatch error (-32020). A gateway may use those headers for routing and observation, but it must not treat unvalidated mirrored values as independently trustworthy for authorization.

Inventory real clients before changing affinity

A safe migration begins with evidence from the edge and server, not an SDK package version copied from a deployment file. Record the normalized protocol version, presence of Mcp-Session-Id, method and tool-name headers, authenticated client identity, selected backend, status, and request ID. Never log bearer tokens or complete tool arguments.

Useful fields for one observation window are:

• MCP-Protocol-Version, including missing or unsupported values;
• whether Mcp-Session-Id arrived, without recording the raw identifier;
• whether Mcp-Method and Mcp-Name arrived where the 2026 contract requires them;
• backend replica and deployment revision;
• HTTP status, latency, and a trace/request correlation ID;
• client application name from verified metadata when available.

Treat a missing version as unknown, not modern. The edge should follow the server SDK’s documented negotiation and rejection behavior instead of silently assigning the newest contract. Unknown traffic belongs in a compatibility lane until a controlled probe proves otherwise.

Client-side operation matters too. AI agent VPS workspace design helps separate agent persistence, approvals, and tool access from the transport migration itself. Upgrading a server does not prove every desktop, gateway, automation, and embedded agent has upgraded its MCP client.

Route each deployment shape by its actual state owner

The correct balancing decision follows two questions: which protocol contract is the client using, and where does state needed by the next call live? The 2026 changelog removes protocol-level sessions, but it does not make an application database, job record, upload, or user workflow disappear.

Legacy affinity needs more than hashing an incoming session header. The initialization request does not yet carry the identifier that the server will return. A correct implementation must learn the response-to-worker association, encode a trusted routing hint, or use shared state. If the edge cannot do that safely, one bounded legacy replica is more honest than a nominally redundant pool that loses sessions.

Capacity planning should preserve two separate pools during the overlap. Match compute capacity for MCP replicas to measured request concurrency, streaming duration, CPU and memory per replica, then reserve enough headroom for one pool to absorb a rollback. Stateless routing improves distribution; it does not erase tool execution cost.

Move useful state into explicit, scoped handles

Hidden transport sessions made cross-call state convenient but coupled application behavior to one connection or worker. The 2026 model asks the application to name that state. A tool might return analysis_handle, upload_id, or approval_request_id, and later calls present it explicitly.

An operationally useful handle should be:

• opaque and unguessable rather than a sequential database key;
• bound to the authenticated subject, tenant, and allowed operation;
• short-lived when the workflow is temporary;
• revocable and auditable;
• safe under retries and duplicate delivery;
• resolved through a store every healthy replica can reach;
• excluded from ordinary logs when it grants access or reveals sensitive workflow state.

Explicit does not mean client-trusted. A server must re-authorize the handle on every use and reject cross-tenant or expired references. The handle represents continuity; it is not proof that the caller may act.

Gateway design should keep model-provider credentials, MCP access tokens, and downstream API credentials in separate trust boundaries. AI gateway key separation provides a useful parallel: centralizing one credential class must not turn the gateway into a pass-through for every downstream secret.

Authorization remains a per-request decision

Round robin is safe only when every replica applies the same authorization policy. The current MCP authorization specification requires bearer authorization on every protected HTTP request, audience validation for the intended MCP resource, and rejection of invalid or expired tokens. A connection that authenticated earlier is not a substitute for validating the current request.

The 2026 revision also hardens authorization discovery and issuer handling. During migration, keep policy, keys, clocks, resource identifiers, and supported scopes synchronized across the modern pool. Otherwise, load balancing exposes disagreement as alternating 200, 401, or 403 responses even though routing itself works.

For observability, aggregate only decision-safe dimensions: issuer identifier, audience result, scope decision, protocol version, method/tool, replica, and status. Bearer tokens, authorization codes, refresh tokens, complete tool arguments, and explicit state handles should remain out of routine logs.

Roll out the modern pool as a compatibility migration

Changing every backend at once hides whether a failure belongs to protocol support, state ownership, authorization, or routing. Use a staged release with one rollback boundary at each step.

1. Freeze an evidence window. Record current protocol-version shares, session-header use, backend distribution, latency, and errors.
2. Create a modern pool. Deploy replicas that explicitly support 2026-07-28, share necessary application state, and enforce identical authorization policy.
3. Keep legacy traffic isolated. Preserve the existing 2025 endpoint or affinity path until named clients have passed compatibility tests.
4. Send controlled modern probes. Exercise discovery when used, representative read tools, one bounded write tool, explicit-handle continuation, retry behavior, and an authorization denial.
5. Increase modern traffic by known client. Do not route anonymous percentages of an unclassified mixed fleet merely because aggregate error rate is low.
6. Restart or remove one modern replica. A following request using the same explicit handle must succeed on another healthy replica.
7. Retire legacy routing only after coverage is proven. Keep a dated inventory of remaining client owners and a tested restoration path.

Edge changes deserve the same discipline as application releases. Practices from reload-safe reverse-proxy changes apply here: validate configuration before reload, preserve established connections where the proxy supports it, and prove the intended route after the change rather than treating a successful reload as acceptance.

Rollback is a routing decision, not a data rewind. Sending known modern clients back to a compatible legacy lane may restore service, but explicit state created only in the new design must remain resolvable. Test that boundary before production traffic creates irreplaceable work.

Close on one request reaching any healthy replica

The strongest acceptance test is not a balanced connection chart. Send a verified 2026 tool call, retain its explicit application handle, remove or restart the replica that answered, and continue the workflow through another healthy replica. Then repeat an unauthorized request and confirm every replica rejects it consistently.

Keep legacy proof separate: a 2025 client should retain its session through the declared compatibility path until that client’s owner upgrades. When both receipts pass, operators can remove affinity deliberately instead of guessing that a new SDK made the old contract disappear. Browse Voxfor AI hosting research for adjacent agent, model, and infrastructure decisions after the routing boundary is stable.