MCP Goes Stateless: What the 2026-07-28 Spec Means for Agent Builders

The core change: no more session state

MCP — the Model Context Protocol Anthropic introduced in November 2024 as a standard way to expose tools to LLM agents — just shipped its biggest spec revision yet. The formal name is the 2026-07-28 Model Context Protocol specification; developer Simon Willison, who tracks the protocol closely, is calling it MCP 2.0.

The old protocol was stateful: a client sent an initialize request to get a session, then made a second request carrying an Mcp-Session-Id header to actually call a tool. The new spec drops that entirely. Every request now carries its own protocol version, client identity, and capabilities, so it can be answered in a single round trip and routed to any server instance — no sticky sessions, no shared session store.

Two other pieces round out the HTTP layer. Multi Round-Trip Requests (MRTR) replace the old pattern of holding an open stream for server-initiated follow-ups: a server can now return resultType: "input_required", and the client just retries the same call with inputResponses attached. And list responses — tools, prompts, resources — now carry ttlMs and cacheScope, so clients can cache them intelligently instead of re-fetching on every call.

Why this matters if you're actually running MCP servers

For anyone shipping an MCP server rather than just calling one, statelessness is an operations win: no session affinity, no in-memory session store to lose on a restart, and requests that scale horizontally like any other stateless HTTP API. That matters more as MCP servers move from local dev tools into things sitting in front of real infrastructure and real data.

The spec also tightens auth for that world — RFC 9207 issuer validation before code redemption, dynamic client registration formally deprecated in favor of Client ID Metadata Documents, and credentials bound to a specific authorization server. It's a more enterprise-shaped auth posture, which tracks with MCP servers increasingly exposing things that aren't safe to leave loosely authenticated.

The tooling that's already showing up

Willison built two small projects to work through the new spec hands-on. mcp-explorer is a stateless CLI for probing any MCP server — list, inspect, and call commands to see what tools a server exposes and how to invoke them, without writing a client. datasette-mcp is a Datasette plugin that adds an /-/mcp endpoint exposing exactly three tools: list_databases(), get_database_schema(), and execute_sql() — all read-only. He's also got an alpha llm-mcp-client plugin wiring MCP into his llm CLI tool.

That datasette-mcp shape is the interesting part for builders: three narrow, read-only, schema-typed tools instead of a general-purpose SQL shell handed to an agent. It's a clean template for the question every team building agent tooling eventually has to answer — how do you give a model real access to data without giving it a blast radius.

The takeaway

MCP had cooled off through 2025 as Skills and other approaches got attention. A protocol revision this substantial — stateless-by-default, mid-call input requests, cacheable listings, hardened auth — is a real signal it's still where a lot of agent tooling is consolidating. If you're building or maintaining an MCP server, the migration is mostly additive rather than a rewrite: the stateless core is the headline, but the auth changes are the part worth reading closely before your next deploy.