What to Rip Out of Your MCP Stack Before the Deprecation Clock Hits

July 28, 2026 was not a soft update. Spec revision 2026-07-28 made MCP stateless at the core — self-describing requests, no required initialize handshake, no Mcp-Session-Id — and started a formal twelve-month deprecation clock on Roots, Sampling, Logging, Dynamic Client Registration, and legacy HTTP+SSE.

If your team treated the release candidate as “interesting reading,” this is the operator follow-up: what to stop relying on now, what still works temporarily, and what will break when clients and gateways stop being polite.

We already covered the headline in a short brief — sessions die, HTTP wins. This article is the rip-out checklist for builders and platform owners who ship remote servers into Cursor, Claude, ChatGPT, and enterprise connectors.

The mental model: hard cut vs twelve-month offramp

Not every change has the same urgency.

“It still works in our old client” is not a migration plan. The clock is for planning — not for hoping.

Rip out now: session-shaped infrastructure

1. Sticky sessions and shared session stores

If your MCP pods require the same instance for follow-up calls, you are fighting the new core. Round-robin and serverless are first-class again because every request carries protocol version, client identity, and capabilities in _meta.

Replace with: explicit handles returned from tools (job IDs, resource IDs, cursor tokens) that the model passes back as arguments. Application state can still exist — it just cannot hide in the transport.

2. Code that assumes initialize / initialized

Discovery is optional via server/discover. Clients may call tools/list or tools/call without a handshake. Servers that refuse traffic until a session is opened will look “down” to modern clients.

Replace with: validate protocol version and client info per request; treat discovery as a cacheable convenience, not a gate.

3. Anything that required a held-open bidirectional stream for mid-call input

Sampling and elicitation used to lean on server-initiated requests over a live stream. That model does not survive a stateless core. Multi Round-Trip Requests (MRTR) is the replacement: return input_required, let the client retry with inputResponses.

If your approval UX or “ask the human” flow still assumes an open SSE pipe, rewrite it against MRTR before you market “human-in-the-loop” to enterprise buyers.

Schedule for removal: the twelve-month list

These still work. New implementations should not adopt them. Existing stacks should have owners and dates.

• Roots — stop depending on client-exposed filesystem roots as a security boundary; scope tools yourself.
• Sampling — migrate interactive / model-callback patterns to MRTR-compatible flows or explicit client tools.
• Logging — send ops telemetry to stderr / OpenTelemetry; do not treat protocol logging as your observability plan.
• Legacy HTTP+SSE transport — Streamable HTTP with header routing is the production path. Plan cutover for every remote listing.
• Dynamic Client Registration (DCR) — formally deprecated in favor of Client ID Metadata Documents (CIMD). Keep DCR only as temporary compatibility.

Put each item on the same quarterly review as dependency upgrades. Assign an owner. Write the kill date.

Auth shortcuts that become liability

The 2026-07-28 auth hardening is easy to skim and expensive to ignore:

• Validate authorization-server iss (RFC 9207) before redeeming codes — mix-up attacks are not theoretical.
• Bind client credentials to the issuer that minted them; do not reuse across auth servers.
• Expect clients to set application_type correctly for localhost / CLI redirects.
• Plan the DCR → CIMD move before a major client drops DCR.

If you are still shipping “paste a PAT into mcp.json” as the happy path for team configs, pair this migration with the control model in AI agent tool access as an operating control and the builder guidance in OAuth and the over-permission trap.

Enterprise buyers will ask for IdP-provisioned connectors. Builders who ignore that path lose RFPs even if tools/list looks great — see enterprise-managed MCP auth.

Header routing is an ops win — and a security footgun

Streamable HTTP now expects Mcp-Method and Mcp-Name so gateways can route and meter without parsing JSON bodies. That is good for WAFs and rate limits.

It is also a new place teams accidentally put secrets. Do not map bearer tokens, PATs, or session cookies into custom MCP headers that proxies log by default. Treat headers as routing metadata, not a second auth channel, unless your gateway policy explicitly redacts them.

(We will expand this in a dedicated brief; for now: if your access log prints every header, assume those values are compromised.)

Hosting checklist for remote servers

If Chapter 4 of MCP Builders got you from stdio to HTTP, re-run the hosting pass against the new core:

1. Load balancer: remove sticky sessions; confirm any replica can answer tools/call.
2. SDK: upgrade to Tier 1 SDKs that speak 2026-07-28 (TypeScript, Python, Go, C#). Python 2.x / FastMCP renames are part of the same week — budget migration, not a drive-by bump.
3. List caching: return ttlMs / cacheScope on list responses so clients keep prompt caches stable.
4. Tasks: if you used experimental Tasks, move to the official tasks extension APIs (tasks/get, tasks/update, subscriptions/listen).
5. Secrets: still never in the prompt; still never in committed configs — see stdio, HTTP hosting, and secrets.

Local stdio is not “dead.” It remains the right lane for air-gapped repos and laptop-bound secrets. Remote HTTPS is the lane for Claude / ChatGPT connectors and shared team agents. Stop governing them as one market — our brief on remote vs local still holds.

A 30-day rip-out plan you can run this sprint

1. Days 1–3: Inventory every MCP server your org runs or depends on (Cursor project configs, Claude connectors, ChatGPT custom connectors, Slack Claude Tag). Mark transport + whether session affinity is assumed.
2. Days 4–10: For each remote you own: remove sticky sessions, upgrade SDK, verify a cold instance can serve tools/list and one real tools/call with no prior handshake.
3. Days 11–17: Find Roots / Sampling / Logging / DCR / HTTP+SSE usages. File tickets with owners and kill dates inside the twelve-month window.
4. Days 18–24: Rewrite mid-call human confirmation onto MRTR. Delete “keep the SSE open” hacks.
5. Days 25–30: Re-audit tool surface and scopes with the seven-question MCP audit. Publish an internal allowlist that only includes servers known to speak the new core — or have an explicit exception.

How to pick replacement servers while you migrate

While you rip out fragile remotes, do not fill the hole with demoware. Prefer servers with indexed tools, clear transport labels, and setup docs you can paste into team policy.

Browse the Influzer directory (~5,900 listings, daily validation on live HTTP endpoints). From inside the agent, connect Influzer MCP Discovery and search by capability — “postgres”, “scrape to markdown”, “create_issue” — instead of hoping the old session-bound server still answers after the next client update.

Quick answers

Is session state forbidden forever?

No. Forbidden is transport-hidden session state. Explicit tool-returned handles that the model threads between calls are the supported pattern.

Do we have to migrate local Cursor stdio servers this month?

Priority is lower than public remotes, but SDK and client updates will still surface. Do not start new stdio servers on deprecated APIs.

What breaks first in production?

Usually: sticky-session fleets behind round-robin, handshake-gated gateways, and elicitation flows that required an open bidirectional stream.

Where is the official source of truth?

The MCP 2026-07-28 announcement and Tier 1 SDK migration notes. Treat vendor blog posts as secondary.

How does this relate to enterprise auth?

Stateless HTTP makes IdP-managed connectors and standard gateways practical. Auth hardening (issuer validation, CIMD) is the other half of “enterprise-ready.” Do both.

Related reading

• Brief: MCP 2026-07-28 — sessions die, HTTP wins
• MCP Builders Ch. 4: stdio, HTTP hosting, and secrets
• MCP Builders Ch. 2: OAuth and the over-permission trap
• The seven-question MCP server audit
• AI agent tool access as an operating control
• What is the Model Context Protocol?

Final thought

Deprecation windows feel long in August and short in April.

The teams that treat 2026-07-28 as a rip-out project — sticky sessions gone, MRTR in place, DCR on a kill calendar, allowlists refreshed — will keep shipping agents while everyone else is still debugging why the load balancer “randomly” drops tool calls.

Stop relying on session affinity. Stop adopting deprecated surfaces. Put owners on the twelve-month list.

Then validate your remotes the boring way: cold instance, no handshake, one real tool call. If that fails, the deprecation clock is already ringing for you.