What Breaks in the New MCP Specification and How to Migrate | Du’An Lightfoot, Akamai | TFiR

Swapnil Bhartiya: When we started building on MCP, it was yet another exciting shiny new thing and a shiny new standard. People were doing whatever they wanted to do then it was open source. And as we have seen with every other open source project, as the adoption grows, the usage grows, new users come in and they try to bring their own problems and they wanted to solve. So it quickly became the backbone that connects all AI systems to your tools and data. Now with growth of usage, developers started to demand different things and they were starting to do different things. So the community, they released the latest specifications for MCP which changed the way we used to work. Whether it’s sessions, servers, security, everything has changed. And it’s good also because now you have stateful, no more stateless things. But it is a lot of changes. So today we have with us Du’An Lightfoot, senior developer advocate for AI engineering at Akamai, to not only unpack this, but to also talk about how it serves developers. And we will talk a lot about the whole MCP space as well. But before that, first of all, Du’An, it’s great to have you on the show.

Du’An Lightfoot: Hey Swapnil, thank you for having me today. I’m glad to be here. Hello everyone.

Swapnil Bhartiya: It’s my pleasure. So listen, start with, you know, I mean, of course it’s not even a question that who doesn’t know about MCP. But let’s just quickly talk about the role MCP. Since Anthropic announced it, then it was open source, but now it is playing, it is plugging into it has kind of, you know, become a backbone. So talk about the role of MCPs before we talk about specification and what has changed.

Du’An Lightfoot: Yeah, so when you think about AI applications, whether it’s a coding agent or you have some other agent that are performing tasks, what helps an agent be successful and actually play the role of an agent is the tools it has access to. And so those tools can come in the form of git, you know, with traditional connecting the traditional back end APIs to, let’s say get the weather, get some information from a database or they can just come from looking up information on some other backend storage where you have some data. Right. Well, in order to connect the tools, traditionally what you would have to do as a developer was you would have to write, let’s say Python functions and you would have to write them, connect it to your agent, and then scale that to every agent that you have. So there was a lot of manual work in order to give capabilities to agents and AI applications. What MCP did was it said, okay, let’s standardize a way to build tools and provide them to AI applications in this standardized way. Now, when it was first release, it was through standard in, standard out. So everybody was building MCP servers and running them on their laptop or desktop. Well, in enterprise, you know, since it’s standardized, it also needs to be centralized. So we needed HTTP, streamable HTTP. So now we could host this on a virtual machine or a Docker container and then other developers can connect to this MCP server, get the tools and capabilities. And it’s constantly been progressing to where we are today.

Swapnil Bhartiya: Now let’s talk about this latest specifications, what has changed and what kind of impact it will have on developers and the way they plug things to AI and LLMs.

Du’An Lightfoot: Yeah. So when you think when we were talking about the initial version of MCP, it had this client server relationship, one client connect to a single MCP server, right? So if you wanted to scale as a business to have an MCP server and scale it across multiple servers and multiple users, you would struggle with that because you couldn’t put it behind a load balancer and do something like round robin. What this new version allows you to do is remove the session in the handshake. That would happen with MCP, right. So now every request kind of stands alone, right? And any server you know can answer any request. So now you can actually do that round robin. When it comes to MCP behind a normal load balancer. This helps scale for an organization, you know, and it also increases reliability because not you’re not also maintaining that session state on your end. This is more on the client side when it comes to managing MCP. There’s also some tightening around securities improvements, there’s introductions around interactive apps, right? So now you can send forms or send additional information or request. Did you really want to make this change through the MCP server? Right. And then if you have long running tasks, you can create some type of ticketing to say, okay, this task is going to take maybe an hour, send it back to the agent. The agent now can check back to see how long it’s going to take. One last thing which is also important when it comes to MCP is that before when changes happen, there was no real way to mitigate when these changes happen within your application. Now you get a one year notice before anything is removed, right? So they kind of standardized to say, hey, we’re delivering MCP to the community since it’s open source and we’re going to make sure that it’s stable and available. For businesses to be able to use it within their enterprise applications.

Swapnil Bhartiya: The interesting thing with standards is that there was a joke also. We love standards so much that we have made so many of those and that becomes a problem. While on paper MCP does look like standards, but when it comes to day to day also depends on the provider you’re using, tool you’re using. Everybody is doing their own things. There is a kind of fragmentation. Also how you talk to tools, they are. Everybody is doing their own implementation. How much fragmentation problem is there and will this because it is solving a lot of major problems that we face day to day. Will it push organizations towards more standardized standard or will that fragmentation remain?

Du’An Lightfoot: There will be fragmentation in the older version. The newer version was designed to operate more like traditional APIs through HTTP. So rather than you having that client server relationship, you kind of just build your MCP server and then you connect to it like a traditional API. So I believe that there will may be some challenges around the security and risk around MCP, but when it comes to being able to roll it out and use it and consume it, I believe the changes that they have made it more in line with how you would scale a API within your organization.

Swapnil Bhartiya: Now let’s talk about some of the biggest things which is going to impact almost everybody, which is statelessness. Talk a bit about what does removing protocol level sessions unlock for organizations running MCPs at a scale and how does that shift make changes to performance, reliability, repeatability and most importantly, security.

Du’An Lightfoot: The session ID has been removed from the new version of MCP. So there’s no more sticky routing, right? No more sessions stored by the server. Caching and tracing works like traditional APIs. But the one thing about that is that some of the risk has been removed, but it also didn’t vanish because you don’t have a session ID. There’s no stealing of the session or the state and being able to replay it. Right? The app memory now travels through the client. So anything that you want to remember and send back, that needs to happen via, okay, I want to have a connection to this MCP server. Well, the MCP server may provide you like a cookie, like in a traditional application. And so when that cookie comes back, the requester has to send that back to the server. And now the server needs to analyze this to ensure that the cookie or the state wasn’t altered. Right? It belongs to the person that’s asking and it hasn’t expired. Now, the protocol for the new MCP server does not tell us how to do that, but it says that this is something that you should do.

Swapnil Bhartiya: Beyond statelessness, the new spec also enables richer interactions from multi round trip request and long tasks to MCP apps and broader extensions model. Talk a bit about, because when we look at Akamai, you folks enable so many businesses real time. I mean the use cases are just beyond comprehension. So talk a bit about what new possibilities will these unlock that developers, users, organizations, business were not able to do. Now we have to also consider security risk, whether they will eliminate them or introduce new risks.

Du’An Lightfoot: So when it comes to this new version of MCP, tools can now pause and ask the user a question. So let’s say you request to remove a file or change a file on a database or some other storage location. The tool can pause and the server can request, hey, do you really want to do this? And you can reply back that, say yes, I do want to do this. And then when it comes to long running tasks, if a developer is working on an application and they have a tool call for MCP server, then that workload is going to take a longer time on the back end. Well, the server can actually send a ticket or some ID number back to the AI application and the AI application can now drop that request and on the next request check the status of that long running task. And to me that really changes how we use AI, right? Because now the work happens on the server rather than tying up the connection between something like cloud code or Codex, and it’s having that async communication or that synchronous communication that’s waiting, it now can be more asynchronous. We’ll say, hey, okay, this job is working, we can check back later and move on. Now one more thing that I’ll cover is that when it comes to apps, which is a new feature, interactive feature within MCP, is that it could actually send maybe a form or some type of data within the return from the server to the user. Which is interesting because now the back end can really send a request or some verification or some other type of app to the user through AI rather than the AI having to render that. This can happen from the server. But there are some risks, right? Those ticket IDs for those long running requests, they become targets, right? So when we think about that, well, how do you protect against that? Right? The same with the cookies in the state and verify, has it been altered? Does it really belong to the user that done the request? Has it expired? There needs to be some controls on the server to do that verification. Now another thing about those long running tasks is that now this is an attack surface because those long running tasks could be cheap to implement, cheap to start, but then they’re costly to run. But also an attacker now could do a denial of service because now they’re doing a bunch of requests in that application. So that’s something we got to think about as well. When it comes to the app, if you’re sending a form now, you got to worry about like prompt injection or phishing inside of that form when it comes back. So those are some of the things that we have to think about when we’re implementing or rolling out this new version of MCP and its features.

Swapnil Bhartiya: We can put as many guardrails as we want, we can even put gates. But we all know there was a saying in Jurassic Park, life finds a way, AI finds a way, you know, to break those. So hallucination is there, making things up and then try to validate it or even try to remove the traces there. In these new specifications or from your perspective as AI is moving into production, the kind of disclaimer that, hey, AI can make mistakes, you know, double check is not going to work because damage can be done and damage can be much more severe, whether at standard level, protocol level, either the work is already underway or should be done to kind of prevent as much possible hallucination or such risky behavior where it can actually we have seen cases where agents interact with each other to compromise the secrets or to get access because they have to get something done. So they will behave just like humans behave, actually. So talk a bit about are these guardrails part of this specification? Or you feel that, no, that is something we must do, but that is for future.

Du’An Lightfoot: Yeah. So when you think about using AI, right? MCP is a server, right. How do you protect the server? Well, the network layer is the first place to start, right. What should actually connect to your MCP server? I would start there. Right. And then if you have like a load balancer, well, your load balancer can do protection at that layer 7, right. Checking the headers because now it acts like traditional HTTP. So these are things we got to think about. So between your network layer, which are firewalls, your access control list, and then your layer 7 load balancer or web application firewall, you can do some mitigation there. When it comes to guardrails. Now you’re thinking about the firewall around, let’s say the AI, whether it’s your AI agent or your LLMs, you could put guardrails to protect against those prompt injections. There’s some WAF applications that do that as well, that look inside of the payload. But there are mitigations that we’ve been doing traditionally with HTTP and now we can actually do that with MCP, since we don’t actually have to go in that JSON body. We actually just look at the headers now to really do some protections for our applications.

Swapnil Bhartiya: Excellent. Thank you for taking the question. Now, of course, everybody has already deployed MCP in production, MCP client servers. What should those setups, what should those teams who have this very crazy, very complicated, very complex, the whole MCP client server deployment, what should they do? What are the biggest migration or security things that they should be worried about?

Du’An Lightfoot: Yeah, so when it comes to the migration from traditional or the older version of MCP, one of the things you got to think about is that I mentioned that when MCP was first rolled out, you had a lot of standard in, standard out. So what did that mean? You had developers spinning up MCP servers on a laptop all across your organization. Right. You had teams spinning up MCP servers in different environments. So the question is, do you have, let’s say, a load balancer web application firewall to monitor the traffic to see what MCP servers are out there? Because you can look at the headers and identify that. So identify what MCP servers are out there. Right? Find out where they are, look at the logs, look at the versions and verify. Now, if you’re trying to migrate, there’s no real direct path from the older version. This is a new implementation, so you’ll have to focus on that. The second thing is that when you put the new version out, you know the old handshakes from the clients are going to break. Right? Because there’s no session ID, none of that exists. The new version also doesn’t have sampling, doesn’t have roots logging in the old client information. So those are some of the things that you have to think about. But I would start with just identifying what MCP servers you have that are out there now. What are the features? Right. This is an opportunity to really design your MCP servers more efficiently. Because one of the biggest challenges with MCP servers from a few months ago, less than six months ago, was token bloat. And now everyone’s talking about tokenomics. This is an opportunity to figure out what tools do you actually need in your MCP servers. How are they actually designed? What does the doc strings look like? Can you simplify this and make it more efficient in your organization?

Swapnil Bhartiya: If you just look at from purely developer’s point of view, how is it going to solve some of their problems, some of their struggles, some of their frustration when their day to day life has changed. They got access to the things they want, they got things the way they want and also security wise because it is actually, you know, every time you plug into, you have to think about so many things and sometimes you cannot think about that. So talk about the impact on developers day to day life, who is totally hooked into MCP?

Du’An Lightfoot: Yeah, from a developer’s perspective, a lot of developers are using MCP servers. They’ve built their own MCP servers, depending on how deep they are in AI. When it comes to this migration, it’s a question of, okay, does this MCP server solve my needs? Right. If you have one in your organization and it connects to your application, well, now you’re more. If you’re building AI agents that request information, you can do a lot more. Right. Long running tasks, forms, apps within MCP. This is an opportunity to figure out, okay, I’ve been wanting to build these specific workflows, but the problem that I was having was that I had this hangup with MCP. It was adding latency to my application. Well, now what you could actually do is rather than waiting on this job to finish, you could actually move on within your application, maybe decrease some latency, increase user experience. There’s a lot of different things that you can do from a developer perspective, but I think because it’s so new, it’s going to take some experimenting and finding out what works, what doesn’t work, and how to actually apply it at scale within your organization.

Swapnil Bhartiya: As organizations make this transition, how can Akamai help them migrate to the new MCP architecture more securely?

Du’An Lightfoot: I mentioned, when you have a web application firewall and you have a load balancer and you have these different network tools and resources within your organization, often those that are watching this and they’ve heard of Akamai and they’re familiar with Akamai, they’re probably running it in their organization. So that means we’re already protecting their API traffic. So since we’re protecting your API traffic, this new version of MCP is in line with that, right? Because it’s using HTTP. So now since we’re already in front of that, we can put the web application firewall and our tools in front of your MCP servers and then we can monitor those traffic, check the headers, right. Help you with that mitigation or that migration from the old version to the new version, identify that traffic and also protect you at that edge when it comes to malicious attacks or that rate limiting and everything that you’re used to when you use Akamai.

Swapnil Bhartiya: And while Akamai is there to help for those teams who are just starting to plan their migration, what are the things that they should do at their end? What kind of homework, how they should prepare their infrastructure, their tools, their server for this migration?

Du’An Lightfoot: Yeah, I mentioned this before, but when it comes to preparing your servers, identify what your workloads are, right? Identify the tools, identify the workloads, identify the rate limiting that you may need, identify you know, how many tokens that are being sent from your MCP server. These are things that you can do to identify. But when it comes to your application, what’s actually connected to it, what’s being served, you know, how are you going to handle the different types of flows that come through MCP, right? If you’re doing a long running task, well, now you need to figure out how do you identify and verify that task when it comes back, right? That request and that check. So these are some of the things that you have to think about when you’re moving to the new version of MCP.

Swapnil Bhartiya: What are other things that you wish should have made into this specification or that is on your own wish list for the next iteration of specifications?

Du’An Lightfoot: When it comes to wishlist, I see MCP as being the future of maybe app integration, right? Since we have tools like Hermes, Agent, openclaw and they’re using skills. But if I am an app developer and I want to integrate with these agents, skills are one way to do that. But why are we downloading a file when you can just connect to this MCP server, right? So I would like to see in the future if it’s possible, if it happens, if there is maybe like a central repository of MCP servers, like an app store, right? Where everybody that has, which I believe they will, an agent on their phone can go to the app store, download whatever MCP server, connect to that MCP server, get the data, get the tools that they need so we can all build new things and be more efficient, not just in the enterprise, but in life.

Swapnil Bhartiya: Du’An, thank you so much for walking us through these changes and helping our viewers make sense of what all of that means from the perspective of performance, productivity, but also security. So thank you for that. And of course those who are watching, please head over and check akamai.com, their blog post, a lot more about these changes. The whole MCP evolution. Du’An, thank you so much for your time today, and I look forward to chatting with you again. Thank you.

Du’An Lightfoot: Thank you for having me.