The thread worth tracking this cycle is not a model release. It's the 2026-07-28 Model Context Protocol specification , which one community writeup characterized as "a stateless, extensible future." That framing is doing real work, and if you maintain connectors into an internal knowledge base, it changes your deployment shape.
Why statelessness is the load-bearing change
The original MCP session model assumed a long-lived connection between client and server. That's fine on a laptop talking to a local filesystem server. It's a problem the moment your MCP server is the front door to enterprise search — because a stateful session pins a request to a specific process, which means sticky sessions, which means you can't scale horizontally behind a plain load balancer, can't drain nodes cleanly, and can't run the thing on serverless compute without holding a connection open and paying for idle.
The infrastructure vendors clearly read it the same way. Google published on scaling AI agent infrastructure with the MCP stateless updates , and AWS shipped a post on how AgentCore Gateway supports the MCP 2026-07-28 spec . When both hyperscalers frame the same spec revision as a scaling story within days of each other, the signal is that statelessness was the blocker for hosted, multi-tenant MCP — not tool ergonomics.
Auth is the other half. WorkOS previewed the release specifically around what changes for AI agent authentication , which tracks: once you drop the persistent session, every call has to carry its own identity and authorization context. For retrieval systems that's actually clarifying. Per-request auth is what lets you do real document-level ACL enforcement instead of the common shortcut of indexing everything under a service account and filtering after the fact.
What to do about it
If you run an MCP server over your corpus, the migration work is mostly unglamorous: move session state into an external store or eliminate it, make tool calls idempotent, and stop caching retrieval context in process memory between calls. The cost is that you lose cheap in-session caching — a stateless server re-resolves identity and permissions on every request, and if your ACL check is a network hop, that's now in the hot path of every retrieval. Budget for it or cache authorization decisions with a short TTL.
The MCP project also published a new roadmap on August 23 , so the direction here isn't settled. But the architectural bet is legible now: MCP is being pushed toward looking like ordinary HTTP infrastructure. Build your connectors as if they'll be load-balanced, restarted mid-conversation, and asked to prove who's asking on every single call.