MCP 2.0's stateless rewrite makes AI agent tools simpler to build and harder to weaponize

There are two ways to give an AI agent tools, and the developer community has spent the last year arguing about which one is reckless. One camp hands the model a shell and lets it run commands. The other constrains it to a curated set of auditable tools. For most of 2025, the shell camp had the stronger pitch: it was faster, more flexible, and closer to how developers already work. Then MCP 2.0 landed, and the cost of the constrained path fell sharply.

The Model Context Protocol, originally introduced by Anthropic in November 2024 as an open standard for wiring external tools into AI agents, shipped its biggest rewrite on July 28 1. The headline change drops MCP's stateful session handshake. Where the old protocol required two HTTP requests to call a single tool (one to initialize a session and obtain a session ID, one to actually invoke the tool), the new specification collapses that into a single self-contained request 1.

The practical payoff: MCP servers no longer need to track session state or pin a user to a specific backend. Any request can land on any server behind a plain load balancer 2. The maintainers describe it as the most substantial set of changes since MCP added authorization 3. David Soria Parra, an Anthropic technical staff member and lead MCP maintainer, was blunt about the scope: "A lot of things that made MCP are gone" 3. Deprecated features include sampling, roots, and logging, all of which still function for at least twelve months 2.

But the engineering details are not the story. The story is who this rewrite helps, and why the answer exposes a real fault line.

Simon Willison is the useful bellwether. He covered MCP extensively when it launched and then drifted away from it during 2025, as general-purpose agents with shell and network access proved they could do most of what MCP did, more flexibly 1. If you could give a frontier model a terminal and let it curl APIs and run scripts, why bother with a structured protocol?

Willison's reversal is worth examining because his reasons are not ideological. He now argues that giving an agent shell access with internet connectivity carries serious risk and demands a strong model capable of safely navigating that environment 1. MCP tools, by contrast, are scoped to specific functions and easier to audit. And critically, they are simple enough that smaller models running on a laptop can operate them effectively 1.

That last point is where the argument pivots from principle to pragmatics. The shell-versus-tools debate has been framed as a values question: flexibility versus control. But if a small model running locally cannot reliably drive a terminal yet can call a well-defined MCP tool, then the constrained path is not just safer. It is the only path that works for the majority of models developers will actually deploy.

MCP 2.0 makes that path dramatically cheaper to adopt. Building an MCP server used to mean implementing session management, handling the initialization handshake, and dealing with the operational complexity of sticky sessions 3. Now it is a single HTTP endpoint. Willison built three MCP projects in the week the spec dropped 1.

The adoption curve backs the bet. Across its four Tier 1 SDKs for TypeScript, Python, Go, and C#, MCP sees close to half a billion downloads a month, according to the maintainers 2. Anthropic donated MCP to the AAIF, a Linux Foundation fund co-founded by Anthropic, Block, and OpenAI 3. It is no longer an Anthropic product. It is infrastructure.

The shell maximalists are not wrong. A frontier model with terminal access is genuinely powerful, and for experienced developers running local agents, the risk is manageable. But that is a narrow audience. The deployments that will scale are the ones where a constrained model calls a constrained tool, and a security team can inspect the call graph.

Craig McLuckie, CEO of Stacklok and co-creator of Kubernetes, frames it in operational terms. Stateless MCP, he told The Register, gives security teams "a unified control point to apply agent aware policy" 3. The stateful protocol was a by-product of MCP's origin as a local developer tool. The broader community needs it to intermediate access to production systems 3.

The agent safety debate has spent two years arguing about whether models should be trusted with shells. MCP 2.0 does not settle that question. But it removes the excuse that the constrained alternative is too expensive to build. When the safer path is also the easier one, the argument stops being about values and starts being about effort.