← All articles

Upgrading MCP connections before the stateless cutover: a plan for small teams

The Guildwise HQ team · 19 October 2026 · 4 min read

• How-to
• AI agents

If your agents reach repositories, ticket queues or internal scripts through Model Context Protocol (MCP) servers, one change from this year affects you directly. The MCP 2026-07-28 specification changes how a client and a server keep track of each other, and that changes what your tool connections must store.

This article covers what changed, the parts small teams most often get wrong, and a plan you can run without a platform team.

What changed in the protocol core

The specification is dated July 28, 2026. Its main change is a stateless protocol core. The maintainers describe the move as going from a stateful protocol to a request and response protocol, and they note that the change will require some migration work for existing servers and clients.

In practice, the connection setup that opened each session no longer carries state for the protocol. Each request carries the information it needs. A server instance behind a plain load balancer can answer it, so a shared session store is no longer a protocol requirement.

Treat this as planned work, not a routine version bump. The cost falls mainly on code that relied on session identifiers.

Three things that break quietly

Most small-team failures will not come from the new specification itself. They come from assumptions that were true under the old one.

The first is session state. A server that stored a user's draft or a multi-step workflow in memory, keyed by the connection, will lose that data when the next request lands on another instance. The state has to move into your own storage and be passed back explicitly.

The second is deprecated features. Some features from earlier revisions have been deprecated in favor of other mechanisms. Search your code for them and plan a replacement before you remove the old path.

The third is authorization. The revised rules tighten how clients describe their authorization metadata. Hand-written token handling needs a review, and every token your server accepts should have been issued for that server.

The SDK version trap

SDK packages are where many teams will trip. The Python SDK release notes describe a 2.x line that supports the new revision. An unpinned install can move your code across a major version without anyone deciding to, and major versions are breaking changes for code you own.

Pin the version in your lock file before you upgrade anything else. Then upgrade one server at a time, on its own branch, with its own rollback path.

A five-step upgrade plan

The following plan assumes a team of two to ten people running a handful of MCP servers.

1. Inventory. List every MCP server you run or depend on, its owner, and whether it keeps any state between calls. Include servers hosted by vendors, because you will need their upgrade dates.
2. Pin. Pin SDK versions in your lock files. Upgrade one server at a time.
3. Test idle and capacity limits. Check how your SDK version handles sessions that sit idle, and what happens when a server reaches its session limit. Confirm that your clients recover cleanly, for example by initializing again after a not-found response. Read the release notes for the exact limits rather than assuming them.
4. Review deprecations and authorization. Search your code for deprecated features and check token issuers and client authorization metadata against the specification.
5. Change the routing last. Remove sticky-session rules from the load balancer only after tests pass in staging. Keeping the rule longer costs little. Removing it too early can break clients that still depend on it.

A worked example

Consider an illustrative team of four people with three MCP servers: a repository reader, a ticket writer and a script runner. The ticket writer kept each user's unsent draft in server memory, keyed by the connection. Under the old model, that worked because each user stayed on one instance.

After the upgrade, the draft disappears when the next request lands on another instance. The fix is to store drafts in the team's database and return a draft identifier from a create-draft tool. Each later call passes that identifier as an argument. The team also sets an expiry on drafts, because nothing in the protocol manages their lifetime.

The lesson is general. Anything that used to live in a session now needs an owner, a lifetime and a permission check that you design yourself.

Where agent-to-agent protocols fit

MCP connects one agent to tools and data. A separate family of protocols connects agents to each other. The Agent2Agent (A2A) protocol, which the Linux Foundation now governs, is the most visible example. The Linux Foundation reported more than 150 supporting organizations for A2A in its first year.

A small team with one or two agents does not need that layer yet. Add it when two agents must hand work to each other and you can name the failure you are trying to prevent.

Policy context

In February 2026 the US National Institute of Standards and Technology announced its AI Agent Standards Initiative, with the stated aim of an interoperable and secure agent ecosystem. For a small team, the practical signal is that identity, authorization and interoperability for agents are becoming formal standards topics. Expect procurement questions about them, even if no regulation applies to your business today.

Key takeaways

• The 2026-07-28 MCP specification moves the protocol core to stateless requests, so any state your servers keep must be stored and passed explicitly.
• An unpinned SDK install can move your code across a major version. Pin first, then upgrade one server at a time.
• Check idle and capacity limits in your SDK release notes, and review deprecated features and token issuers before you change load balancer rules.
• Add agent-to-agent protocols only when two agents must hand work to each other and you can name the failure you want to prevent.

This article was written with AI assistance and researched from the sources listed.

Sources

1. MCP 2026-07-28 specification release
2. MCP 2026-07-28 spec general availability announcement
3. Python SDK releases
4. Linux Foundation: A2A protocol surpasses 150 organizations
5. NIST announces AI Agent Standards Initiative for interoperable and secure AI

This article was written by an AI agent for Guildwise HQ (Guildwise blog writer, claude-haiku-5-5) and is reviewed against its sources.