Serverless Framework v4.41.0 introduces native MCP server deployment to AWS Lambda via four lines of YAML. This became possible after the MCP specification revision on July 28 removed stateful session requirements (initialization handshake and protocol-level sessions), making MCP plain request/response over HTTP. The framework handles HTTPS endpoints, response streaming, auth via Cognito or Lambda authorizers, OAuth discovery (RFC 9728), and stateless elicitation — where mid-call state is signed and passed through the client rather than stored server-side. Configuration keys include server, authorizer, oauthDiscovery, state, timeout, memorySize, and environment. The feature was validated with 664 unit tests, live integration suites, and end-to-end runs with Claude Code and MCP Inspector. Key limitations: interactive OAuth login requires a custom domain (not the default execute-api URL), and elicitation requires clients on the 2026-07-28 MCP revision.
Table of contents
MCP went statelessLambda is the natural homeYour code stays plainThe whole protocol worksThe whole configuration surfaceIt's just a functionTwo things before you shipWhere to go nextQuestions this post answers
Why can MCP servers now run on AWS Lambda instead of always-on servers?
The MCP specification revision of July 28 removed the initialization handshake and protocol-level sessions (SEP-2575 and SEP-2567). Every request now carries its own protocol version, client identity, and capabilities, so any request can land on any instance with no shared storage or sticky routing. MCP is now plain request/response over HTTP, making stateless compute like Lambda viable. Teams building MCP tooling on AWS track spec changes like this on daily.dev before they affect their architecture.
How does MCP elicitation work on a stateless serverless function with no session?
When a tool needs to pause and ask the user a question mid-call, the server seals all state needed to resume into a signed blob and returns it alongside the question. The client sends the blob back with the answer in a new HTTP request, which any instance can pick up and unseal to continue. The signing key is provisioned with `state: true` — no database required, since state never lands on the server. Developers shipping agent tools with mid-call user input find the tradeoffs around stateless elicitation worth following on daily.dev.
What are the limitations of deploying MCP servers with Serverless Framework v4 on AWS Lambda?
Two constraints apply. Interactive OAuth browser login requires a custom domain — on the default execute-api URL the OAuth discovery document sits under a stage prefix where MCP clients never look, so browser login cannot start. Cognito also lacks dynamic client registration, so it only fits pre-registered or machine-to-machine callers; full discover-then-register flows need Auth0, Okta, or Entra ID. Elicitation also requires clients on the 2026-07-28 MCP revision. Developers choosing between Cognito and third-party identity providers for MCP auth weigh these constraints on daily.dev.