News · Use it

MCP 2.0 — stateless

By NO FEEDEdition date 1 August 2026

The 2026-07-28 spec drops server-side sessions: one HTTP request instead of initialising, holding an Mcp-Session-Id, then calling. No sticky routing, no session store. Simon Willison shipped three clients and servers off it in a week.⁴

Relevant to: anyone who abandoned MCP for shell tools last year

What the verdict meansAvailable, works, worth your time today.

Deeper — what changed on the wire

legacy     POST /mcp → initialize → Mcp-Session-Id: 8f2c…
           POST /mcp + Mcp-Session-Id → tools/call

stateless  POST /mcp → tools/call

The server stops holding state, which means an MCP endpoint becomes an ordinary HTTP handler: no session store, no routing the second request back to the same machine, no reason it cannot run on a serverless function. Most of the MCP is a lot of work objection from last year was this handshake.

The second-order argument is the interesting one. An agent with a shell and curl can do more than any tool server, and is far harder to secure — every capability is implicit. An MCP tool surface is enumerable, auditable, and small enough that a laptop-sized model can drive it correctly.

Sources

simonwillison.net — stateless MCP, 31 Jul · read 1 August 2026

Originally part of the 1 August 2026 edition.

Sources

The useful part, in your inbox.