Move to remote HTTP safely
Understand stateless MCP
Learn what the final 2026-07-28 protocol removed from core HTTP and what per-request context replaces it.
8 minute lesson
The 2026-07-28 protocol starts a modern era. Instead of an initialize handshake and Mcp-Session-Id, each request carries a _meta envelope with the protocol context needed to process that request.
For HTTP, createMcpHandler() creates a fresh server instance per request. Any healthy deployment instance should be able to handle it.
This code is therefore wrong:
let selectedNoteId = ''If one call sets this variable and a later call expects it, a restart or another instance breaks the workflow. It can also mix data between callers.
Stateless protocol does not mean stateless application. Notes can live in a database. Caches can improve reads. Verified identity can select a tenant. The difference is that durable state lives in a system designed to share and protect it.
The modern protocol also changes how multi-step input works. State returned to a client and echoed back later is untrusted. If you add requestState, integrity-protect it, bind it to the caller and original operation, and give it an expiry.
Test the assumption. Start two local HTTP instances behind the same temporary dataset and alternate calls between them. search_notes and get_note should work without connection affinity.
Stdio has a different serving unit: serveStdio() pins one factory instance to one connection. Keep the capability logic independent of that lifetime so both transports stay equivalent.
Lesson completed