Stateless MCP 2.0 revives the protocol — simpler servers, safer agents

The July 28, 2026 Model Context Protocol spec — informally MCP 2.0 — drops the two-request handshake that legacy MCP required, where a client first initialized a session to obtain an Mcp-Session-Id before it could call a tool. Tool calls now happen in a single stateless HTTP request, with routing metadata carried in headers. That collapses a lot of implementation complexity on both ends and removes the need to persist session state or pin a session to a specific backend, making MCP servers far easier to scale as ordinary web applications.

Simon Willison, whose interest in MCP had cooled as Anthropic’s Skills and shell-plus-curl agent setups seemed to cover the same ground more flexibly, says the statelessness pulled him back in. He shipped three tools on the new spec: mcp-explorer, a zero-install Python CLI (runnable via uvx) for listing, inspecting, and calling tools on any MCP server; datasette-mcp, a plugin that exposes a /-/mcp endpoint on a Datasette instance with list_databases, get_database_schema, and read-only execute_sql tools; and llm-mcp-client, an alpha plugin wiring MCP into his LLM tool, which he may fold into LLM core.

The larger argument is a security one. Willison, who earlier flagged MCP’s prompt-injection and data-exfiltration exposure and coined the “lethal trifecta,” now contends that constrained, auditable MCP tools are meaningfully safer than handing an agent an open shell with internet access — a setup that demands a strong model and is much harder to reason about. Narrow tool surfaces are also tractable for smaller, laptop-class models, and he plans to favor MCP when building sensitive LLM applications.