MCP Behind a Load Balancer

The 2026 protocol explicitly enables simple round-robin routing. Sticky sessions are not required for modern core requests.

Header-aware policy

Streamable HTTP carries Mcp-Method and, for tool calls, Mcp-Name. Gateways can use these for routing, metrics, or coarse policy, though server-side authorization remains mandatory.

Configure infrastructure limits

Set connect/request/idle timeouts, body-size limits, maximum concurrent requests, and health checks appropriate to your tools.

Do not trust headers from arbitrary external callers

Your application should still validate the actual protocol request; headers are useful routing signals, not independent proof of intent or authorization.