Building Scalable, Stateless MCP 2026 Servers (A Technical Deep Dive)
Operable walkthrough of Building Scalable, Stateless MCP 2026 Servers (A Technical Deep Dive): contracts, checks, and drop-in code slots for teams shipping this pattern.
This article is published in English.
Use this as an operator-facing rebuild of the ideas in “Stateless Model Context Protocol: Building Scalable MCP 2026 Specification Servers (Technical Deepdive)”: clear stages, ordered code slots, and recovery notes that survive a handoff. The Overview stage works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Record timings and token or query cost next to functional results. Cost visibility early prevents surprise bills when the path moves from demo to shared environments.
The Stateful Bottleneck: Why Pre-2026 MCP Struggled at Scale
For the The Stateful Bottleneck Why stage, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph. Prefer structured outputs with schema validation over free-form prose when the next step is code or a tool call.
+--------------------------------------------------------------------------+
| Pre-2026 Stateful Architecture |
| |
| +--------------+ WebSocket / SSE +-----------------------+ |
| | Client Agent | <=======================> | MCP Server Pod A | |
| +--------------+ (Session Pinned) | (In-Memory Session) | |
| +-----------------------+ |
| | |
| State Lookup |
| v |
| +-----------------------+ |
| | Central Redis Cache | |
| +-----------------------+ |
+--------------------------------------------------------------------------+
The Friction of Session Affinity
For the The Friction of Session stage, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Prefer structured outputs with schema validation over free-form prose when the next step is code or a tool call.
Under the Hood of MCP 2026–07–28: Header Routing and Self-Describing RPC
For the Under the Hood of stage, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Prefer structured outputs with schema validation over free-form prose when the next step is code or a tool call. For the Under the Hood of stage, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Record timings and token or query cost next to functional results. Cost visibility early prevents surprise bills when the path moves from demo to shared environments.
+--------------------------------------------------------------------------+
| MCP 2026-07-28 Stateless Architecture |
| |
| +--------------+ HTTP POST (Self-Describing) +---------------+ |
| | Client Agent | --------------------------------> | Round-Robin | |
| +--------------+ Headers: Mcp-Method, Mcp-Name | Load Balancer | |
| +---------------+ |
| | |
| Any Worker Pod | |
| +----------------------+--------+ |
| | | | |
| v v v |
| +--------+ +--------+ +---+|
| | Pod 1 | | Pod 2 | |...||
| +--------+ +--------+ +---+|
+--------------------------------------------------------------------------+
Self-Describing JSON-RPC 2.0 via _meta
When working through the Self-Describing JSON-RPC 2 0 stage, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph. Cache stable system instructions and tool schemas. Re-sending identical preamble is a common source of burn.
{
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"name": "query_database",
"arguments": {
"query": "SELECT count(*) FROM users WHERE status = 'active';"
}
},
"id": "req-98421",
"_meta": {
"protocolVersion": "2026-07-28",
"clientInfo": {
"name": "AutonomousAgentWorker",
"version": "4.1.0"
},
"progressToken": "tok_998122",
"traceContext": {
"traceparent": "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01"
}
}
}
Mandatory Layer-7 HTTP Routing Headers
When working through the Mandatory Layer-7 HTTP Routing stage, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Cache stable system instructions and tool schemas. Re-sending identical preamble is a common source of burn.
Server Discovery and Intelligent Caching
When working through the Server Discovery and Intelligent stage, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Cache stable system instructions and tool schemas. Re-sending identical preamble is a common source of burn. When working through the Server Discovery and Intelligent stage, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest. Record timings and token or query cost next to functional results. Cost visibility early prevents surprise bills when the path moves from demo to shared environments.
{
"jsonrpc": "2.0",
"result": {
"protocolVersion": "2026-07-28",
"capabilities": {
"tools": { "listChanged": false }
},
"serverInfo": {
"name": "Scalable-Stateless-MCP-Server",
"version": "2.0.0"
},
"cacheControl": {
"ttlMs": 3600000,
"cacheScope": "public"
}
},
"id": "disc-001"
}
Building a Production Stateless Server: FastAPI, FastMCP 2.0, and OAuth 2.1
The Building a Production Stateless stage works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph. Budget tokens per turn and per session. Agentic tools expand context aggressively; hard caps keep demos from becoming surprise invoices.
+-----------------------------------------------------------------------------+
| Stateless Request Dispatching |
| |
| Client Request w/ Bearer JWT |
| + Header: Mcp-Method: tools/call |
| + Header: Mcp-Name: query_database |
| |
| │ |
| ▼ |
| +------------------------------------+ |
| | OAuth 2.1 Bearer Validation | ---> (401 Unauthorized if invalid)|
| | verify_token() | |
| +------------------------------------+ |
| │ |
| ▼ Decoded Claims (user_info) |
| +------------------------------------+ |
| | Header-Based Route Dispatcher | |
| | extract Mcp-Method / Mcp-Name | |
| +------------------------------------+ |
| │ |
| ├──────────────────────────────┐ |
| ▼ ▼ |
| [ tools/call ] [ server/discover ] |
| Execute tool handler Return cached capability |
| Scoped to user_info['sub'] manifest & protocol specs |
+-----------------------------------------------------------------------------+
from fastapi import FastAPI, Depends, HTTPException, Header, Security
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
from pydantic import BaseModel
from typing import Dict, Any, Optional
import jwt
app = FastAPI(title="Stateless MCP 2026 Server")
security = HTTPBearer()
JWT_SECRET = "production_secret_key"
JWT_ALGORITHM = "HS256"
def verify_token(credentials: HTTPAuthorizationCredentials = Security(security)) -> Dict[str, Any]:
"""
Validates incoming OAuth 2.1 Bearer JWT tokens.
Converts the MCP server into a standard OAuth Resource Server.
"""
try:
payload = jwt.decode(credentials.credentials, JWT_SECRET, algorithms=[JWT_ALGORITHM])
return payload
except Exception:
raise HTTPException(status_code=401, detail="Invalid Bearer token")
class JsonRpcRequest(BaseModel):
jsonrpc: str = "2.0"
method: str
params: Optional[Dict[str, Any]] = None
id: Any
_meta: Optional[Dict[str, Any]] = None
@app.post("/mcp")
async def handle_mcp_request(
request: JsonRpcRequest,
mcp_method: Optional[str] = Header(None, alias="Mcp-Method"),
mcp_name: Optional[str] = Header(None, alias="Mcp-Name"),
user_info: Dict[str, Any] = Depends(verify_token)
):
"""
Stateless MCP Request Handler conforming to the 2026-07-28 specification.
Prefers Mcp-Method and Mcp-Name headers for fast execution dispatch.
"""
effective_method = mcp_method or request.method
# Route: Tool Execution
if effective_method == "tools/call":
tool_name = mcp_name or (request.params.get("name") if request.params else None)
arguments = request.params.get("arguments", {}) if request.params else {}
if tool_name == "query_database":
query = arguments.get("query")
user_id = user_info.get("sub", "anonymous")
# Context is scoped directly to the authenticated token claims
return {
"jsonrpc": "2.0",
"result": {
"content": [
{
"type": "text",
"text": f"Executed query '{query}' for user {user_id}"
}
]
},
"id": request.id
}
# Standard JSON-RPC Method Not Found (-32601)
return {
"jsonrpc": "2.0",
"error": {
"code": -32601,
"message": f"Tool '{tool_name}' not found"
},
"id": request.id
}
# Route: Server Discovery
elif effective_method == "server/discover":
return {
"jsonrpc": "2.0",
"result": {
"protocolVersion": "2026-07-28",
"capabilities": {
"tools": {"listChanged": False}
},
"serverInfo": {
"name": "Scalable-Stateless-MCP-Server",
"version": "2.0.0"
}
},
"id": request.id
}
# Unsupported Protocol Method
return {
"jsonrpc": "2.0",
"error": {
"code": -32601,
"message": f"Method '{effective_method}' unsupported"
},
"id": request.id
}
Layer-7 Zero-Parsing Traffic Management: Envoy & Gateway Configuration
The Layer-7 Zero-Parsing Traffic Management stage works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Budget tokens per turn and per session. Agentic tools expand context aggressively; hard caps keep demos from becoming surprise invoices.
routes:
- match:
prefix: "/mcp"
headers:
- name: "Mcp-Method"
exact_match: "tools/call"
- name: "Mcp-Name"
exact_match: "query_database"
route:
cluster: mcp_database_tools_cluster
- match:
prefix: "/mcp"
route:
cluster: mcp_general_cluster
Managing State Without Sessions: Multi-Round-Trip Requests and Trade-Offs
The Managing State Without Sessions stage works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Budget tokens per turn and per session. Agentic tools expand context aggressively; hard caps keep demos from becoming surprise invoices. The Managing State Without Sessions stage works best when treated as a measurable surface. Capture one golden transcript, one failure case, and the rollback note before expanding scope. Record timings and token or query cost next to functional results. Cost visibility early prevents surprise bills when the path moves from demo to shared environments.
Multi Round-Trip Request (MRTR) Interactive Loop
For the Multi Round-Trip Request MRTR stage, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Keep configuration outside application code. Environment files, secret stores, and feature flags belong in one place operators can audit without reading the whole graph. Prefer structured outputs with schema validation over free-form prose when the next step is code or a tool call.
Architectural Trade-Off Analysis
For the Architectural Trade-Off Analysis stage, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish. Prefer structured outputs with schema validation over free-form prose when the next step is code or a tool call.
Cloud-Native Deployment: Scaling MCP on Kubernetes & Serverless
For the Cloud-Native Deployment Scaling MCP stage, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Prefer small, testable units over sprawling scripts. When a step fails, the failure should point at a single responsibility rather than a tangled pipeline. Prefer structured outputs with schema validation over free-form prose when the next step is code or a tool call.
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: mcp-tool-server-hpa
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: mcp-tool-server
minReplicas: 3
maxReplicas: 50
metrics:
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: 70
- type: External
external:
metric:
name: nginx_ingress_controller_requests
target:
type: Value
averageValue: 1000m
Conclusion & Next Steps
For the Conclusion Next Steps stage, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion. Prefer structured outputs with schema validation over free-form prose when the next step is code or a tool call.
Resources for more information
For the Resources for more information stage, define the inputs, the owner of the step, and the exit criteria before changing code. Operators should be able to re-run the step from a known checkpoint without guessing hidden state. Record timings and token or query cost next to functional results. Cost visibility early prevents surprise bills when the path moves from demo to shared environments. Prefer structured outputs with schema validation over free-form prose when the next step is code or a tool call.
Operational checklist
When working through the Operational checklist stage, write down the contract first: required inputs, success signal, and what happens on partial failure. That checklist keeps later code changes honest.
Treat this stage as a contract between inputs and validated outputs. Name the artifacts, define success checks, and refuse silent partial completion.
Cache stable system instructions and tool schemas. Re-sending identical preamble is a common source of burn.
Expose tools with narrow schemas and explicit side-effect labels. Hosts need to know which calls mutate state before they auto-approve.
Add a smoke test that exercises the critical path in CI with fixtures, not live paid APIs, whenever budgets allow.
Document the happy path and the recovery path together. Retries, human gates, and dead-letter handling are part of the product, not later polish.
Before promoting the stack, freeze versions, capture a golden transcript for the critical path, and confirm rollback steps. Shared environments need rate limits, tenancy checks, and a clear owner for secret rotation. Prefer boring reliability over clever one-off demos.
Batch note for ecba7bb3b9c6: keep provider keys out of the repo, set a per-session token ceiling, and store transcripts next to the eval fixtures so later model swaps stay comparable.