The Model Context Protocol (MCP) — the standard that lets AI assistants call out to external tools and data sources — just got a major simplification. MCP 2.0, released July 28, 2026, eliminates session management entirely, cutting each tool call from two HTTP requests down to one. Simon Willison built three new tools to explore the change and came away arguing the redesign makes MCP a meaningfully safer foundation for AI agents than giving them raw shell access.
This article covers what "stateless" actually means for a protocol like this, why removing session management is a security improvement and not just a performance one, and what the new tooling built around MCP 2.0 signals about where agent architecture is heading.
What "stateless" removes
In the original MCP design, a client had to first establish a session with a server — creating a session ID, then using that ID across a sequence of requests — before it could actually call a tool. That's a stateful interaction: the server has to remember who you are and what you've already asked across multiple round trips. MCP 2.0 removes that requirement. A tool call becomes a single, self-contained HTTP request with no session setup step and no server-side memory of prior state.
The practical effect is that MCP servers get dramatically simpler to write and to run. A stateless server doesn't need session storage, doesn't need to handle expired or hijacked sessions, and doesn't need to reconcile what happens if two requests using the same session arrive out of order. An entire category of implementation bugs disappears because there's no state to get out of sync in the first place.
Why fewer moving parts means better security
Removing a feature can be a security improvement — session management is exactly the kind of stateful complexity that creates room for hijacking, replay, and desync bugs, and MCP 2.0 just deleted it.
Willison's argument for MCP over unrestricted shell access is really an argument about the shape of the capability surface. A shell gives an AI agent an unbounded set of possible actions — anything a command line can do — which makes it extremely hard to audit or restrict after the fact. MCP, especially in its stateless form, exposes a fixed, explicit set of tools with defined inputs and outputs. That's a much smaller surface to reason about, log, and control, and a stateless design shrinks it further by removing an entire class of session-based attack vectors (stolen session IDs, session fixation, replay across a hijacked session).
This matters specifically for LLM applications because the thing you're granting access to — a language model acting somewhat autonomously — is exactly the kind of actor you want to constrain to a narrow, auditable set of capabilities rather than trust with broad, stateful access.
Tooling built to prove it out
Willison didn't just analyze the spec — he built three tools against it: mcp-explorer, a command-line tool for interrogating MCP servers directly; datasette-mcp, a plugin that exposes database queries from Datasette (his data exploration tool) through MCP endpoints; and llm-mcp-client, which connects his LLM command-line tool to MCP servers so models can access external tools and data through the standard.
Building working tools against a spec within days of its release is itself a signal — MCP 2.0's stateless design is simple enough that a single developer could implement client and server tooling for it almost immediately, which bodes well for how quickly the broader ecosystem can adopt it.
What this means for builders
If you're building or evaluating AI agent architectures that need external tool access, MCP 2.0's stateless model is worth treating as the new baseline rather than the old session-based version. Fewer moving parts on the server side means fewer places for state-related bugs and vulnerabilities to hide, and a fixed, auditable tool surface is a genuinely better security posture than handing an agent shell access and hoping prompt-level guardrails hold.
Teams currently running MCP servers built against the earlier stateful spec should evaluate a migration path — the reduction from two requests to one isn't just a latency win, it removes a category of state-management bugs your current implementation may already be carrying without knowing it.
Conclusion
MCP 2.0 is a reminder that the safest way to constrain what an AI agent can do is often to shrink the interface it operates through, not to add more guardrails on top of a broad one. A stateless protocol with a fixed set of tools is easier to audit than a shell, and it's easier to implement correctly than a stateful one — which is exactly the combination that makes it more likely to actually get adopted rather than just admired in a blog post.