MCP's sessionless transport removes connection affinity, not continuity. A new AAIF reference implementation shows where multi-step state, retry safety, ownership, and runtime evidence still have to live.
Stateless Requests, Explicit Handles
On September 2, 2026, the Agentic AI Foundation published a serverless MCP 2026-07-28 reference architecture with companion code.
The current MCP specification uses stateless, self-contained requests. The example keeps workflow continuity explicit: tools return opaque handles, clients send those handles on later calls, and expired or mismatched records fail without revealing whether another caller owns them.
Retry Safety Is Application State
The implementation stores owner-bound handles and replay records in DynamoDB. A replay key is derived from the verified client, tool, and caller's idempotency key; the input is fingerprinted separately. Identical retries return the recorded response, while the same key with changed input returns an idempotency conflict.
Handle creation, state transition, and response recording use conditional transactions. That matters when a network timeout occurs after a write may have committed: the server can return the original outcome instead of repeating the side effect or minting a second handle.
Three Separate Evidence Layers
- Local tests exercise protocol, ownership, replay, conflict, and concurrency paths.
- CI inspects synthesized infrastructure, IAM scope, tracing, and static-analysis gates.
- Credentialed checks after an approved deployment verify gateway rejection, runtime replay, and cross-service trace correlation.
The repository does not treat template checks as proof of deployed behavior. It also keeps secrets and argument values out of its application audit event while retaining identifiers needed to correlate a tool attempt.
Scope And Limits
The supplied deployment provisions one machine client. It does not implement dynamic client registration, interactive authorization, prompt-injection defenses, generalized workflow orchestration, multi-region cursor concurrency, or production approval policy. Its AWS deployment has also not been independently verified here.
The reusable principle is provider-neutral: bind durable state to a verified principal, define deterministic retry behavior, expire it in application logic, and reserve live claims for attributable post-deployment evidence.
Related: Read our field notes on agent identity and short-lived authority and managed agent runtime boundaries.