Summary: MCP published its stateless 2026-07-28 specification on July 28, 2026, replacing the initialization handshake and session ID with one HTTP request carrying headers. The change removes server-side session routing, supports cacheable and globally scalable endpoints, and updates TypeScript, Python, Go, and C# SDKs. The article still treats prompt-injection controls as a server-side responsibility.
The Model Context Protocol (MCP) published a new version of its spec on July 28, 2026. The community nicknamed it MCP 2.0; Simon Willison called it “the biggest change to MCP since launch.” One thing changed, and every corner of the agent-tool ecosystem felt it: MCP is no longer stateful.
The Cost of the Old Design: A Two-Step Handshake
MCP’s older design kept state and spoke JSON-RPC: no tool could be invoked until a client sent an initialization request and received an Mcp-Session-Id, after which a second request carried that ID to make the call. Building services that scale out horizontally made this a real cost — as Willison puts it, you had to hold session state on the server and deal with “routing the same session to the same backend machine.”
The New Shape: One Request, Headers Carry the Details
Under the 2026-07-28 spec the flow collapses into one HTTP request: the protocol version, the method, and the tool name ride in the Mcp-Protocol-Version, Mcp-Method, and Mcp-Name headers, while client details sit in the _meta field of the params. Sessions and handshakes are gone — one request finishes the job.
Cloudflare’s verdict spells out the stakes: MCP infrastructure now behaves “like the rest of the web — stateless, cacheable, routable, and globally scalable,” and with the TypeScript, Python, Go, and C# SDKs updated at the same time, MCP is “fully production-ready.” One enterprise gap closed too: the Enterprise-Managed Authorization extension is now stable and brings centralized authentication.
Why This Matters to Independent Developers
Willison’s take rewards a slow read: he is both an MCP critic and someone who builds with it. The appeal: the single-request model “is so much cleaner from both a client- and server-side implementation perspective,” trimming implementation complexity; and MCP tools “are easier to audit and control, and simple enough that smaller models that run on a laptop” can operate them. Granting an agent shell and curl access “is fraught with risk,” whereas MCP makes it “much easier to reason about agent capabilities and what might go wrong.”
He does not skip the caveat either. The prompt-injection trouble of April 2025 still sits with him: “the pattern of having end users mix and match tools,” he argues, hands users the job of preventing exfiltration. That episode later hardened into his famous “Lethal Trifecta” argument.
Within one week he produced three working pieces: mcp-explorer, an inspection CLI needing no install; datasette-mcp, live against the Datasette mirror on his personal blog (three tools, execute_sql among them, SQL read-only for now); and llm-mcp-client, a plugin for his LLM tool. His verdict is plain: “I plan to lean into MCP a whole lot more when I’m building sensitive applications on top of LLMs.”
Three Moves for Tool Builders
First, a server still on the legacy stateful design erases the operational burden of session storage and sticky routing by moving to the 2026-07-28 spec. Second, stateless plus cacheable puts MCP endpoints in reach of CDNs and edge nodes — caching tool listings and schemas at the edge is the easy performance win now. Third, the spec update did not dissolve the responsibility boundary around prompt injection: the more freely tools get combined, the more output filtering and permission narrowing belong server-side.