Every MCP headline for the last two months has said the same thing: the protocol goes stateless on July 28. That story is real, and we've told it — what the stateless core breaks and why it's worth it. But it's also, at this point, the least useful thing to worry about. The spec was frozen at its release candidate on May 21, it's backward-compatible, and a single endpoint can serve new and old clients at once. Nothing in the prose is going to break your server the morning of the lock.

The thing that will break your build is the one nobody is covering: the SDK betas. All three tier-one SDKs shipped v2 pre-releases in the last eight days, and each carries a concrete gotcha that has nothing to do with the word "stateless." Here they are, in the order they'll bite you.

Python (v2.0.0b2, July 14): TLS moved out from under you#

The headline v2 features are nice — client-side subscriptions (subscriptions/listen) and real request cancellation that actually stops in-flight work over HTTP and stdio. The landmine is underneath them: the SDK swapped httpx for httpx2, and TLS verification now uses the operating-system trust store (via the truststore package) instead of certifi's bundled certificates. SSL_CERT_FILE and SSL_CERT_DIR are honored first.

Why it bites: if your server or client talks to anything behind a corporate proxy or a custom certificate authority that was only ever trusted through certifi's bundle, TLS can start failing the moment you upgrade. Nothing in your code changed; the trust root did.

What to do: pre-releases are opt-in, so a plain pip install mcp still resolves to stable 1.x — you only get this by asking for it. When you do, test the handshake against your real CA setup first.

pip install "mcp==2.0.0b2"     # explicit — the 1.x line stays put otherwise

TypeScript (v2.0.0-beta.4, July 13): one package became many#

v2 breaks the monolithic @modelcontextprotocol/sdk into separate packages — @modelcontextprotocol/server, /client, /core, a dedicated codemod, and framework adapters (node, express, fastify, hono, and a legacy server adapter). Schema and protocol constants moved into core and resolve as a single shared dependency, with schema construction now lazy instead of at import.

Why it bites: your installs and imports change. Code that did import { ... } from "@modelcontextprotocol/sdk" no longer resolves the same way, and you now install only the packages you actually use.

What to do: run the codemod, and lean on the legacy adapter so old clients keep working while you migrate one surface at a time — the whole point of the dual-serve design is that you don't rewrite everything at once.

npx @modelcontextprotocol/codemod    # automates the v1 → v2 rewrite

Go (v1.7.0-pre.3, July 17): cancellation you have to turn on#

The Go SDK added the fix that matters most to anyone watching a cloud bill — but made it opt-in. A new StreamableHTTPOptions.PropagateRequestCancellation flag makes an aborted POST cancel the handler context on stateless servers, so when a client disconnects, your long-running tool call actually stops. It also added OAuth session persistence (NewTokenSource / InitialTokenSource) so users don't re-auth on every deploy.

Why it bites: it's unchanged by default. Leave it off and a client that hangs up mid-call leaves your handler grinding — you pay compute for orphaned work you'll never return. On a stateless server sitting behind a plain load balancer, that's exactly the cost the stateless design was supposed to save you.

The spec froze in May. The breakage shipped this month — in a TLS bundle, a package boundary, and a flag you have to remember to flip.

The founder read#

Don't let the countdown clock rush you into a bad upgrade. The stateless spec is backward-compatible and the v2 lines are pre-releases you opt into on purpose, so pinned installs don't move on their own. Upgrade for the capabilities — subscriptions, real cancellation, OAuth persistence — not because it's July 28. And when you do, budget your migration time for the three things that actually break: your CA trust (Python), your package layout (TypeScript), and one flag that's off until you turn it on (Go). The full client-side walkthrough is in how to migrate your MCP client to the stateless spec; this is the SDK-side companion to it.