The new Model Context Protocol specification published on July 28, 2026 — nicknamed MCP 2.0, and called by Simon Willison “the biggest change to MCP since launch” — changes exactly one thing, with consequences across the entire agent-tool ecosystem: MCP went stateless.
The Old Pain: A Two-Step Handshake
Legacy MCP was a stateful, JSON-RPC-based design: before calling any tool, the client sent an initialization request to obtain an Mcp-Session-Id, then made a second request carrying that ID to invoke the tool. For horizontally scalable services this was a concrete burden — Willison notes you had to maintain server-side session state and worry about “routing the same session to the same backend machine.”
The New Design: One Request, Details in Headers
The 2026-07-28 spec compresses the whole flow into a single HTTP request: protocol version, method, and tool name move into the Mcp-Protocol-Version, Mcp-Method, and Mcp-Name headers, with client information tucked into the _meta field of the params. No session, no handshake — one request, done.
Cloudflare’s assessment captures the meaning most completely: MCP infrastructure now works “like the rest of the web — stateless, cacheable, routable, and globally scalable,” and with the simultaneously updated TypeScript, Python, Go, and C# SDKs, MCP is “fully production-ready.” The enterprise gap got its patch too: the Enterprise-Managed Authorization extension reached stable status, adding centralized authentication.
Why Independent Developers Should Care
Willison’s take is worth a close read, because he is simultaneously an MCP critic and an implementer. What he likes: the single-request approach “is so much cleaner from both a client- and server-side implementation perspective,” greatly decreasing implementation complexity; MCP tools “are easier to audit and control, and simple enough that smaller models that run on a laptop” can drive them — compared with giving an agent shell and curl access, which “is fraught with risk,” MCP makes it “much easier to reason about agent capabilities and what might go wrong.”
He doesn’t skip the caution: the prompt-injection issues of April 2025 still stick in his memory — “the pattern of having end users mix and match tools” pushed responsibility for preventing exfiltration onto users. That history later grew into his well-known “Lethal Trifecta” argument.
In practice, he shipped three implementations in a week: the zero-install mcp-explorer inspection CLI, datasette-mcp running live on his blog’s Datasette mirror (three tools including execute_sql, read-only for now), and the llm-mcp-client plugin for his LLM tool. His conclusion is direct: “I plan to lean into MCP a whole lot more when I’m building sensitive applications on top of LLMs.”
Three Actions for Tool Builders
First, if your MCP server still runs a legacy stateful implementation, migrating to the 2026-07-28 spec eliminates the operational cost of session storage and sticky routing outright. Second, stateless plus cacheable means CDNs and edge nodes can serve MCP endpoints directly — caching tool listings and schemas at the edge is the new low-hanging performance fruit. Third, the responsibility boundary for prompt injection did not vanish with the spec update: the more tools get mixed and matched, the more output filtering and permission narrowing must happen server-side.
Sources
- MCP 2026-07-28 specification announcement — Model Context Protocol blog
- The Next Generation of MCP — Cloudflare Blog
- Stateless MCP has recaptured my interest — Simon Willison
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.