Is Your MCP Server Actually Reachable — or Just Running?

The July 28, 2026 specification shipped something that's genuinely useful for everyone running an MCP server: a stateless protocol. No more session handshakes. No more sticky routing. No more shared session stores. Monthly downloads had already hit 500 million — and now you can finally run an MCP server behind a plain round-robin load balancer, the same way you'd run any API. So the real question is: why are so many of those 500 million client installs still pointing at manually configured endpoints?

To dig into this, we went through the July 28 specification release and release candidate posts in detail, pulled the current SEP proposal status from the MCP GitHub, and cross-referenced server registry counts across the major public indexes. The numbers tell a clear story about where MCP adoption is heading — and what's actually blocking autodiscovery from working.

How did MCP get to 500M downloads so fast?

When MCP launched in November 2024, the combined Python and TypeScript SDK downloads sat at roughly 100,000 per month. That's a respectable niche protocol number — not exactly breakout growth. Sixteen months later, that figure had reached 97 million monthly. By July 2026, when the stateless spec shipped, the major AI assistant clients had collectively pushed combined monthly downloads to approximately 500 million, with the TypeScript and Python SDKs each crossing 1 billion total cumulative installs.

For reference: React took about three years to hit 100 million monthly downloads. MCP got there in 16 months. What's driving the numbers is client-side demand — every major AI coding tool and AI assistant now ships native MCP support. They all need the SDK to connect to servers. The pull is coming from the client side, and there are a lot of potential client connections waiting for a server to point at.

What actually changed in the July 2026 spec?

The headline change is the removal of the initialize/initialized handshake and the Mcp-Session-Id header. If you've been running an MCP server on any version before July 28, 2026, your load balancer almost certainly had sticky session rules to keep each client pinned to the same server instance. That constraint is gone.

After July 28, every request carries its own protocol version and client identity inline — in a _meta field on the request itself. Any request can hit any server instance. You can deploy MCP behind a regular round-robin load balancer, serverless functions, or edge compute without any shared session state. The practical infrastructure overhead just dropped significantly.

There's also a less-discussed addition that matters for operators: ttlMs and cacheScope fields on list responses. When a client calls tools/list to see what your server can do, it can now cache that response for however long you specify. If your tool catalog rarely changes, you're about to stop serving the same list response on every client startup. That's a real reduction in cold-start overhead for clients that implement the new spec.

The spec also added a new server/discover method and Mcp-Method / Mcp-Name HTTP headers on every request, which means gateways can route and authorize based on headers without inspecting the request body. That's useful if you're fronting multiple MCP servers behind a single gateway layer.

So how many servers are out there right now?

At the start of 2025, the official MCP server registry listed roughly 1,200 servers. By April 2026, that number had grown to around 9,400 — a 7.8x increase in about 15 months. The community index at mcp.so lists over 20,000 servers across all categories, and the broader ecosystem is likely larger still.

The growth looks genuinely healthy. But here's the thing every one of those listings has in common: a human submitted it manually. Found the registry. Filled out a form. Created the listing. That's a directory, not discovery. And that distinction matters a lot when you're asking whether an AI client can find your server from scratch.

Why can't AI assistants just find your server from your domain?

This is the gap the broader "MCP is winning" narrative tends to gloss over.

A standardized discovery mechanism — where an AI client hits yourdomain.com/.well-known/mcp and gets back a JSON document describing your server's endpoints, capabilities, and authentication requirements — was proposed in December 2025 as SEP-1960 on the MCP GitHub. The proposal drew on established patterns from OAuth server metadata (RFC 8414) and WebFinger. The endpoint would return a structured JSON document with your server URL, available transports, capability declarations, rate limits, and auth configuration. Clients would know how to connect before making a single API call.

SEP-1960 is now closed. Not rejected — it was folded into SEP-2127, a pull request for "MCP Server Cards" that adds richer metadata: tool listings, versioned capability declarations, and a more complete server identity schema. As of the July 28 spec release, Server Cards are still an open pull request. They're in the development backlog, not in the shipped specification.

So what does that mean in practice? If you deploy an MCP server right now and don't submit to a registry or manually configure each client endpoint, you're effectively invisible to AI clients that haven't been explicitly told about you. There's no equivalent of a sitemap, a robots.txt, a security.txt, or an OpenAPI spec auto-discovery path that AI clients check automatically when visiting a new domain. The protocol's client base is enormous — 500 million monthly SDK downloads enormous — and the last mile of discoverability is still solved by a developer filling out a form.

What should you actually do about this?

First: deploy your MCP server if you haven't already. The stateless spec change makes this genuinely simpler than it was before July. No session affinity, no sticky routing, no persistent connection management required. Whatever infrastructure complexity was holding you back is largely gone.

Second: implement /.well-known/mcp today, even before it's an official standard. The SEP-2127 Server Cards format is stable enough to implement against. Clients that track early-stage SEPs will start finding you, and when the spec ships, you'll already be compliant. The JSON document you'd serve is not complicated — a few dozen lines covering your endpoint URL, supported transports, and capability list.

Third: submit to both the official MCP registry and mcp.so. Registry crawling is still how most AI assistant clients discover tools today. The manual submission friction isn't going away immediately, but being listed beats not being listed.

The stateless transition made deploying an MCP server dramatically easier. The discovery problem is still the hard one — and it's the one that determines whether all those client SDK installs ever actually connect to you.