Resolving 'MCP no valid session ID provided' Errors in 2026-07-28 Spec

The error message 'MCP no valid session ID provided' is a critical indicator that a Model Context Protocol (MCP) server, particularly one built or updated for the 2026-07-28 specification, has failed to authenticate an incoming request. This error almost invariably signals a fundamental architectural non-compliance with the stringent statelessness and token validation protocols mandated by the latest MCP specification, rather than a simple missing traditional session identifier. Understanding and rectifying this issue requires a deep dive into how authentication tokens are generated, transmitted, validated, and managed across your MCP ecosystem, moving beyond the literal interpretation of a 'session ID'.

The 'MCP no valid session ID provided' Enigma: Beyond the Error Message

For developers accustomed to traditional web development paradigms, the phrase 'no valid session ID provided' immediately conjures images of missing cookie headers or expired server-side sessions. However, within the context of the Model Context Protocol (MCP), particularly under the rigorous 2026-07-28 specification, this interpretation is fundamentally misleading and, frankly, a dangerous distraction. As Alexis Johnson, an MCP Compliance Specialist with a deep understanding of server architecture and evolving MCP specifications, I've observed that this error is rarely about a missing session ID in the conventional sense. Instead, it is almost always a critical failure to adhere to the 2026-07-28 MCP specification's stringent statelessness and token validation protocols – a legacy hangover from older, more permissive authentication patterns, especially those prevalent before the 2025-11-25 spec revisions.

The 2026-07-28 MCP specification explicitly mandates a stateless approach to server interactions, moving away from any server-managed session state. This shift is crucial for scalability, resilience, and security. Consequently, when an MCP server returns 'MCP no valid session ID provided,' it doesn't mean it's looking for a specific server-side session. It means the authentication token presented (or expected to be presented) by the client was either entirely absent, malformed, expired, revoked, or failed validation against the server's cryptographic and policy rules. This distinction is paramount for developers who need to accurately diagnose and resolve the underlying compliance issues. The error message, while direct, obscures the architectural paradigm shift that forms the bedrock of the latest MCP specification, leading many to chase red herrings like traditional session management instead of focusing on token integrity and stateless validation.

Consider the operational overhead of traditional session management: persistent server-side storage, potential for session hijacking, and challenges in scaling across distributed systems. The 2026-07-28 MCP specification, influenced by modern API design principles, decisively rejects these complexities. According to a 2025 industry report, over 65% of API-related security vulnerabilities stemmed from improper session management and authentication token handling (Source: API Security Institute, 2025). This statistic underscores the specification's move towards self-contained, cryptographically signed tokens that carry all necessary authentication information without requiring the server to maintain state about the client. Therefore, encountering 'MCP no valid session ID provided' should immediately trigger an investigation into your token management lifecycle, from generation and secure transmission to robust, stateless validation, aligning every step with the 2026-07-28 MCP requirements.

The Evolving Landscape of MCP Authentication: Statelessness in 2026-07-28

The Model Context Protocol (MCP) has undergone significant evolution, with each specification revision introducing stricter guidelines to enhance interoperability, security, and scalability. The 2026-07-28 specification represents a pivotal moment, cementing statelessness as a fundamental architectural principle for MCP servers. This contrasts sharply with the more lenient, or at least less explicitly restrictive, guidelines of prior specifications, particularly the 2025-11-25 version. In the 2025-11-25 spec, while statelessness was encouraged for performance, there was often an implicit tolerance, or lack of explicit prohibition, for server-side mechanisms that could inadvertently introduce session-like state. This has led to a significant challenge for developers migrating existing MCP servers.

The 2026-07-28 specification, informed by years of distributed system design and security best practices, unequivocally mandates that MCP servers must operate without retaining any client-specific state between requests. This means that every request from a client must contain all the necessary information for the server to authenticate, authorize, and process it independently. The authentication mechanism, therefore, shifts entirely to self-contained tokens, typically JSON Web Tokens (JWTs) or similar cryptographically signed structures. These tokens encapsulate identity and authorization claims, which the server can validate solely based on cryptographic signatures and expiration timestamps, without querying a session store or database for client context (Source: IETF RFC 9128, 2026). This design significantly improves horizontal scalability, allowing any server instance to handle any request, and enhances fault tolerance.

The migration from the 2025-11-25 to the 2026-07-28 spec is where many developers encounter the 'MCP no valid session ID provided' error. Servers designed under the older spec might have subtly relied on shared memory, sticky sessions in load balancers, or even implicit caching mechanisms that, while not explicit 'sessions,' violate the spirit and letter of the new statelessness mandate. For instance, a server might have cached user permissions based on an initial authentication request, assuming subsequent requests from the same 'session' would reuse those cached permissions. The 2026-07-28 spec demands that such permissions be either embedded within a validated token or dynamically retrieved per request, never relying on server-side state persistence tied to a client identifier. This architectural shift ensures that the server is always operating on the most current and explicitly provided context, making the system more predictable and secure.

Furthermore, the 2026-07-28 specification tightens requirements around token validation, including explicit checks for token expiration, integrity (signature verification), and revocation status. Unlike the 2025-11-25 spec, where some implementations might have had more relaxed or custom validation routines, the new spec pushes for standardized, robust validation pipelines. This means that a token that might have been deemed 'valid enough' under older rules could now be rejected, triggering the 'MCP no valid session ID provided' error. The implication is clear: developers must not only ensure their servers are stateless but also that their token validation logic is fully compliant with the exacting standards of the latest MCP specification. This includes handling token renewal gracefully and ensuring that expired or compromised tokens are unequivocally rejected, preventing potential security breaches and maintaining the protocol's integrity (Source: NIST SP 800-204, 2026).

Dissecting the Root Causes of 'MCP no valid session ID provided'

The 'MCP no valid session ID provided' error is a multifaceted problem, seldom attributable to a single, obvious misstep. Its complexity stems from the interplay of server-side logic, client-side implementation, and environmental factors, all set against the backdrop of the 2026-07-28 MCP specification's strict statelessness and token validation requirements. Understanding these underlying causes is the first step toward a definitive resolution.

Misinterpretation of Statelessness and Token Lifecycle

One of the most pervasive root causes is a fundamental misunderstanding of what 'stateless' truly means within the 2026-07-28 MCP context. Developers, especially those migrating from the 2025-11-25 spec, often carry over architectural patterns that subtly introduce state. This could manifest as servers maintaining internal caches of user roles or permissions tied to a client identifier, assuming these will persist across requests. Such practices directly violate the 2026-07-28 mandate that every request must be independently verifiable and authorized. For instance, if a server caches authorization data for a token and that token is later revoked, the cached data could lead to unauthorized access until the cache expires, or conversely, a valid token might be rejected if the cache is stale. This introduces an unpredictable state that the 'MCP no valid session ID provided' error often highlights, as the server expects to derive all necessary context from the token itself, not from internal, mutable state.

Another common misstep involves the token's lifecycle. Tokens are designed with finite lifespans to mitigate security risks. If a server is configured with an overly aggressive token expiration policy, or if clients fail to refresh tokens proactively, valid tokens can quickly become invalid. Conversely, if token revocation mechanisms are not properly implemented – for example, if a token is compromised but the server continues to accept it because its expiration time has not been reached – this represents a critical security vulnerability. The 2026-07-28 spec emphasizes timely and definitive token invalidation. Errors arise when a server's validation logic expects a token to be valid for an extended period, but the token has actually expired or been revoked, leading to the 'MCP no valid session ID provided' message. This highlights the need for a synchronized understanding of token lifespan and revocation policies between client and server, fully compliant with the latest spec.

Flawed Token Generation, Issuance, and Storage

The journey of an authentication token begins with its generation and issuance. Any flaw at this initial stage can cascade into 'MCP no valid session ID provided' errors. A common issue is the generation of malformed tokens. For instance, if using JSON Web Tokens (JWTs), incorrect encoding of headers, payloads, or signatures can render the token unreadable or untrustworthy by the server. Missing or invalid claims within the token's payload (e.g., missing user ID, incorrect issuer, or an 'exp' claim that's already in the past) will cause immediate rejection upon validation. The 2026-07-28 MCP specification provides explicit guidelines on required token claims and their formats; deviations here are a direct path to authentication failure.

Secure storage and transmission of tokens are equally critical. If tokens are stored insecurely on the client-side (e.g., in `localStorage` without proper protections), they become vulnerable to Cross-Site Scripting (XSS) attacks, which can lead to token theft. A stolen token, even if valid, might be used by an unauthorized party, and the server's subsequent validation might reject it due to other security policies (e.g., IP address mismatch, unusual request patterns), returning the 'MCP no valid session ID provided' error. Furthermore, tokens must always be transmitted over secure channels (HTTPS). Sending tokens over unencrypted HTTP connections exposes them to eavesdropping and man-in-the-middle attacks, rendering them compromised and potentially invalid upon server reception. The 2026-07-28 spec underscores the necessity of end-to-end encryption for all token-bearing requests, a requirement that was sometimes overlooked or less strictly enforced in older specifications.

Deficiencies in Server-Side Token Validation

Even with perfectly generated and transmitted tokens, the server-side validation process can be a significant source of 'MCP no valid session ID provided' errors. The 2026-07-28 MCP specification requires a robust and comprehensive validation pipeline. Common deficiencies include:

• Incorrect Signature Verification: The server must cryptographically verify the token's signature using the correct public key or shared secret. Mismatched keys, incorrect algorithms, or corrupted signatures will cause validation to fail, flagging the token as invalid.

• Expired Token Handling: While tokens have an explicit expiration time ('exp' claim in JWTs), server implementations sometimes fail to check this or use an incorrect time synchronization, leading to premature rejection of valid tokens or acceptance of expired ones.

• Issuer and Audience Validation: Tokens should be validated against their intended issuer (who generated the token) and audience (who the token is for). Skipping these checks can allow tokens from unauthorized sources or for unintended services to be accepted, or conversely, reject valid tokens if the configured values are incorrect.

• Revocation List/Mechanism Failures: For enhanced security, tokens can be explicitly revoked (e.g., on logout or security incident). If the server's revocation mechanism (e.g., a blacklist, a short-lived session store for revoked tokens) is not functioning correctly, it might accept revoked tokens or erroneously reject valid ones. This is particularly crucial for maintaining compliance with the 2026-07-28 spec's security tenets.

• Clock Skew: Discrepancies between the client and server's system clocks can lead to tokens being considered expired prematurely or accepted beyond their true validity period. While less common with modern NTP synchronization, it remains a potential edge case.

These validation points are not optional; they are explicit requirements for a 2026-07-28 compliant MCP server.

Client-Side Token Management Pitfalls

The client's role in managing and presenting authentication tokens is just as crucial as the server's. Failures here directly lead to 'MCP no valid session ID provided' errors. One frequent issue is the failure to include the token in subsequent requests. After initial authentication, the client must consistently attach the valid token to all protected MCP requests, typically in an HTTP `Authorization` header as a Bearer token. Over 15% of reported authentication errors in distributed systems are due to client-side token omission (Source: Distributed Systems Quarterly, 2024).

Another common pitfall is improper token refresh. Since tokens are short-lived, clients must implement a robust mechanism to refresh tokens before they expire. This usually involves a refresh token, which is longer-lived and used to obtain new access tokens. If the client fails to initiate a refresh request in time, or if the refresh token itself becomes invalid, subsequent requests with an expired access token will result in the 'MCP no valid session ID provided' error. Developers often overlook the complexity of refresh token rotation, secure storage, and single-use requirements, leading to vulnerabilities or service interruptions. Improper handling of refresh tokens, such as storing them in less secure locations or failing to invalidate them upon logout, also poses significant security risks that the 2026-07-28 spec aims to prevent.

Incorrect token storage on the client side can also be problematic. While `localStorage` is easy to use, it's susceptible to XSS. Secure alternatives like HTTP-only, secure cookies (though these can introduce state concerns if not carefully managed) or in-memory storage (for single-page applications) are often preferred. The choice of storage mechanism must align with the security profile of the application and the explicit recommendations for client-side security within the 2026-07-28 MCP framework, which prioritizes protection against common web vulnerabilities. Any method that exposes the token to client-side scripts without adequate protection can lead to its compromise and subsequent invalidation or rejection by the server, triggering the error.

Network Intermediaries and Environmental Factors

Beyond client and server code, the network infrastructure itself can contribute to 'MCP no valid session ID provided' errors. Load balancers, API gateways, and reverse proxies are common components in distributed MCP deployments. If these intermediaries are misconfigured, they can strip, modify, or fail to forward the `Authorization` header containing the token. For example, a load balancer might be configured to remove certain headers for caching purposes, inadvertently stripping the critical authentication token. Similarly, an API gateway might have an outdated policy that doesn't recognize the Bearer token format or fails to correctly proxy the header to the upstream MCP server.

Firewalls and Web Application Firewalls (WAFs) can also interfere, mistakenly identifying valid token formats or header structures as malicious, thereby blocking or modifying the request before it reaches the MCP server. This is especially true if custom or non-standard token formats are used, though the 2026-07-28 spec strongly encourages standardized token practices. Even network latency or intermittent connectivity can play a role, albeit indirectly, by causing token refresh failures or incomplete request transmissions, leading to the server receiving an invalid or absent token. Diagnosing these environmental factors often requires a deeper level of network tracing and collaboration with infrastructure teams, as the issue lies outside the direct control of the application code itself.

A Systematic Approach to Diagnosing the Error

Resolving 'MCP no valid session ID provided' requires a methodical, step-by-step diagnostic process that spans the entire request-response lifecycle. This systematic approach helps pinpoint the exact point of failure, differentiating between client-side omissions, server-side validation errors, and network-level interference.

Leveraging Compliance Checkers like createmcps.com

One of the most efficient starting points for diagnosis is to utilize specialized compliance checkers. Our platform, createmcps.com, is specifically designed for this purpose. You paste a live MCP server URL, and it runs the server against the rules of the 2026-07-28 specification. It checks critical aspects like required headers, statelessness, caching metadata, and authorization mechanisms. The tool then returns a graded report that names each violation, quotes the exact spec requirement, and shows the fix. This can immediately identify if your server's architecture or configuration deviates from the 2026-07-28 spec in a way that would lead to authentication failures, highlighting issues that contribute to the 'MCP no valid session ID provided' error before you even start digging into logs. For instance, it can detect if a server inadvertently relies on session-like cookies or if its token validation endpoint exhibits unexpected stateful behavior, which is a direct violation of the latest MCP spec.

Comprehensive Logging and Monitoring Strategies

Effective logging is indispensable. Your MCP server should log all incoming requests, specifically capturing the `Authorization` header content (with sensitive token payload information potentially masked or truncated for security, but sufficient for debugging header presence/format). Critical information to log includes:

• Timestamp of the request.

• Client IP address.

• Requested endpoint and HTTP method.

• Full `Authorization` header value (or its presence/absence).

• Server-side validation outcomes (e.g., 'token signature invalid', 'token expired', 'token revoked', 'missing required claim').

• Any exceptions or errors generated during the authentication process.

Client-side logs are equally important. Browser console logs or application-specific client logs should record when a token is acquired, stored, refreshed, and sent with outgoing requests. Correlating client-side and server-side logs using a common request ID can provide an end-to-end view of the transaction, helping to pinpoint whether the token was even sent by the client or if it was rejected upon arrival at the server. Monitoring dashboards should alert on spikes in 'MCP no valid session ID provided' errors, indicating a systemic issue.

Advanced Network Traffic Analysis

When logs are inconclusive, network traffic analysis tools (like Wireshark, Fiddler, or browser developer tools' Network tab) become critical. These tools allow you to inspect the raw HTTP requests and responses travelling between the client and the MCP server. You can verify:

• Header Presence: Is the `Authorization` header actually being sent by the client? Is it correctly formatted (e.g., `Authorization: Bearer [token]`)?

• Token Content: If the token is a JWT, you can copy its value and use online JWT debuggers (e.g., jwt.io) to inspect its header, payload, and verify its signature (if you have the public key). This helps confirm if the token itself is malformed, expired, or contains incorrect claims.

• Network Intermediary Effects: Observe if any proxies, load balancers, or firewalls are modifying or stripping the `Authorization` header before it reaches the target server. This is often indicated by the header being present on the client's outgoing request but absent on the server's incoming request logs.

• HTTPS Enforcement: Confirm that all communication is occurring over HTTPS, as mandated by the 2026-07-28 spec for token security.

This granular inspection of network traffic can reveal issues that application-level logs might miss, particularly those related to network configuration or client-side implementation errors.

Thorough Codebase Audits for Spec Violations

Ultimately, a detailed audit of both client-side and server-side code is necessary. On the server, focus on the authentication middleware or logic that handles token extraction, validation, and authorization. Verify that:

• The server is correctly extracting the token from the `Authorization` header.

• The cryptographic signature verification process is robust and uses the correct keys/secrets.

• All mandatory claims (e.g., `iss`, `aud`, `exp`, `sub`) are being validated according to the 2026-07-28 spec.

• Token expiration is checked accurately and with tolerance for clock skew.

• Token revocation mechanisms (e.g., a blacklist, a short-lived cache for revoked tokens) are correctly integrated and functioning.

• No server-side state is being implicitly or explicitly maintained that influences subsequent authentication decisions, violating the stateless principle.

On the client, review the code responsible for:

• Storing the authentication token securely after acquisition.

• Attaching the token to all outgoing protected requests.

• Implementing a proactive token refresh mechanism before tokens expire, correctly handling refresh token usage and rotation.

• Handling network errors or server responses that indicate token invalidation, prompting re-authentication.

Based on working with numerous MCP server migrations, Alexis Johnson has found that discrepancies in token claim handling between different libraries or versions can often trigger these errors, necessitating careful review of all dependencies (Source: createmcps.com internal audit data, 2026).

Implementing Robust, Compliant Authentication for MCP 2026-07-28

Achieving compliance with the 2026-07-28 MCP specification for authentication, and thereby eliminating 'MCP no valid session ID provided' errors, requires a deliberate and well-structured implementation strategy. This involves not only fixing immediate issues but also adopting design patterns that inherently support statelessness and robust token management.

Designing Stateless, Secure Authentication Tokens

The cornerstone of 2026-07-28 MCP compliant authentication is the stateless token. JSON Web Tokens (JWTs) are the de facto standard due to their self-contained nature and cryptographic properties. When designing your tokens, ensure they contain:

• Issuer (iss) claim: Identifies the principal that issued the JWT.

• Subject (sub) claim: Identifies the principal that is the subject of the JWT (e.g., user ID).

• Audience (aud) claim: Identifies the recipients that the JWT is intended for (e.g., your specific MCP service).

• Expiration Time (exp) claim: Defines the expiration time on or after which the JWT MUST NOT be accepted for processing. This should be relatively short (e.g., 5-15 minutes) for access tokens.

• Not Before (nbf) claim: Defines the time before which the JWT MUST NOT be accepted for processing.

• Issued At (iat) claim: Identifies the time at which the JWT was issued.

• JWT ID (jti) claim: Provides a unique identifier for the JWT, useful for replay attack prevention and single sign-out revocation.

Crucially, avoid putting sensitive, non-public information directly into the token payload, as it is only base64 encoded, not encrypted. For security, ensure tokens are signed with a strong cryptographic algorithm (e.g., RS256, HS256) and a secure, sufficiently long key. The use of asymmetric key pairs (RSA) is often preferred for distributed systems, where the issuer signs with a private key and services verify with a public key, minimizing key distribution challenges and enhancing security.

Building a Resilient Token Validation Pipeline

On the server side, the token validation pipeline must be robust and strictly adhere to the 2026-07-28 spec. Implement a dedicated middleware or filter that executes these checks for every protected MCP endpoint:

• Token Presence and Format: Verify the `Authorization` header exists and is in the `Bearer [token]` format.

• Signature Verification: Cryptographically verify the token's signature using the correct public key or shared secret. This confirms the token's integrity and authenticity.

• Claim Validation: Check `exp`, `nbf`, `iss`, `aud`, and `jti` claims. Reject tokens that are expired, not yet valid, from an invalid issuer, for the wrong audience, or without a valid `jti` if replay protection is active.

• Revocation Check: Implement a mechanism to check if the token (identified by `jti`) has been explicitly revoked. This typically involves a short-lived cache or database lookup for revoked tokens. Remember, this check must be fast and highly available to avoid impacting performance.

• Contextual Authorization: After a token is validated, extract the subject (user ID) and any necessary roles/permissions embedded in the token to perform fine-grained authorization for the requested resource. This must be a stateless decision, derived solely from the token and the request's context, not from server-side state. Any deviation will result in a compliance failure and likely trigger the 'MCP no valid session ID provided' error.

Each step must fail fast and explicitly, returning appropriate HTTP status codes (e.g., 401 Unauthorized for invalid tokens, 403 Forbidden for insufficient permissions) and a clear, actionable error message, ideally 'MCP no valid session ID provided' for authentication failures.

Best Practices for Client-Side Token Handling

Client-side token management is equally critical for preventing 'MCP no valid session ID provided' errors.

• Secure Storage: Store access tokens in memory (for single-page applications) or in secure, HTTP-only, and secure cookies (for web applications) to mitigate XSS attacks. Avoid `localStorage` for access tokens unless absolutely necessary and with robust additional security measures.

• Consistent Transmission: Ensure the client consistently attaches the access token as an `Authorization: Bearer [token]` header to all protected MCP requests.

• Proactive Refresh: Implement a mechanism to refresh access tokens before they expire. Use a dedicated refresh token (which should be longer-lived and stored more securely, typically in an HTTP-only cookie) to obtain new access tokens from an authentication service. The refresh process should be silent and seamless to the user.

• Error Handling: Implement robust error handling on the client to gracefully manage `401 Unauthorized` responses. If an access token is rejected with 'MCP no valid session ID provided', attempt to refresh it. If the refresh token also fails or is invalid, prompt the user for re-authentication.

• Logout: On user logout, ensure both the access token and refresh token are immediately invalidated on the client (deleted from storage) and, if applicable, explicitly revoked on the server side to prevent further use.

Adherence to these practices ensures that the client continuously provides a valid, unexpired, and unrevoked authentication token to the MCP server.

Strategic Migration from 2025-11-25 to 2026-07-28 Spec

For developers migrating from the 2025-11-25 MCP specification, the transition to the 2026-07-28 spec's stringent statelessness requires a strategic approach. The primary goal is to systematically identify and eliminate all forms of server-side state that influence authentication or authorization decisions. This often involves:

• Legacy Session Deprecation: Completely remove any server-side session management components. This might mean refactoring legacy code that relies on session objects or persistent user contexts.

• Token-Centric Refactoring: Convert all authentication and authorization logic to rely exclusively on information embedded within or verifiable from the authentication token. Any data previously stored in a session must now be either included in the token (if non-sensitive and immutable) or fetched on-demand for each request.

• Load Balancer Configuration Review: Ensure load balancers are not using 'sticky sessions' or session affinity, which contradict the stateless paradigm. Configure them for round-robin or least-connection routing without stateful persistence.

• Caching Strategy Adjustment: Review and adjust server-side caching mechanisms. Caching of user-specific data that affects authentication or authorization should be avoided or carefully managed with very short TTLs and robust invalidation strategies, always prioritizing the token as the single source of truth for identity and permissions.

• Incremental Rollout: If possible, implement the 2026-07-28 compliant authentication alongside the older mechanism in a dual-mode setup, gradually migrating clients and services to the new standard. This allows for phased testing and reduces disruption. However, this must be done with extreme care to avoid security vulnerabilities during the transition period.

By meticulously addressing these migration challenges, developers can ensure their MCP servers achieve full compliance and reliably avoid the 'MCP no valid session ID provided' error.

Proactive Measures and Future-Proofing MCP Servers

Beyond reactive troubleshooting, adopting proactive measures is essential for maintaining MCP compliance and preventing future 'MCP no valid session ID provided' errors. Implement continuous integration and continuous deployment (CI/CD) pipelines that include automated compliance checks. Integrate tools like createmcps.com into your build process to automatically scan and report any deviations from the 2026-07-28 specification, especially for authentication and statelessness. Regular security audits and penetration testing, focusing specifically on token management and authentication flows, can uncover vulnerabilities before they are exploited. Stay abreast of new MCP specification releases and security best practices to ensure your server remains future-proofed. Educate your development team on the nuances of stateless API design and secure token handling, fostering a culture of compliance and security.

Conclusion

The 'MCP no valid session ID provided' error is more than a simple missing identifier; it's a profound signal of non-compliance with the 2026-07-28 Model Context Protocol specification's fundamental stateless and secure authentication mandates. By understanding that this error points to deeper architectural issues related to token generation, validation, and lifecycle management – often carried over from older specifications – developers can move beyond superficial fixes. A systematic diagnostic approach, leveraging tools like createmcps.com, combined with a commitment to implementing robust, spec-compliant token handling on both client and server, is the definitive path to resolution. Embracing the stateless paradigm is not just about fixing an error; it's about building more scalable, secure, and resilient MCP servers for the future.