Stateless MCP: 2026-07-28 spec drops sessions for one HTTP call
Builders are moving now: Simon Willison ships mcp-explorer and datasette-mcp, all four Tier-1 SDKs support it, and gateways can route on headers alone.
Copy markdown
One self-contained request, no handshake
The 2026-07-28 spec kills the initialize/initialized handshake and the Mcp-Session-Id header. Every call now carries its own protocol version and capabilities, so any server instance behind a load balancer can answer it — round-robin scaling, no sticky sessions or shared state store.
Build this weekend: hit any MCP server from your terminal
Simon Willison's new mcp-explorer (uvx mcp-explorer) lists tools, inspects schemas, and calls endpoints interactively. His datasette-mcp plugin adds a /-/mcp endpoint exposing list_databases(), get_database_schema(), and execute_sql() — so an agent can SQL-query any hosted Datasette instance.
Gateways route on headers now
Mcp-Method and Mcp-Name ride in HTTP headers, so gateways and rate-limiters can authorize and route without parsing JSON-RPC bodies. tools/list, prompts/list, and resources/list also return ttlMs and cacheScope, letting clients cache tool listings instead of re-fetching them.
The catch: auth on every call
Statelessness moves authorization from implicit connection state to explicit per-request checks — RFC 9207 issuer validation, plus Client ID Metadata Documents replacing Dynamic Client Registration. You now validate the caller on each request, not once per session, so budget for tighter auth code.
Nothing breaks yet
This isn't a cutover. Old clients and servers keep working, and SDKs auto-negotiate, falling back to the 2025-11-25 version. Tier-1 SDKs — TypeScript, Python, Go, and C# — shipped support on day one, with Rust in beta, across a combined ~500M monthly downloads.