# Stateless MCP Collapses the Session Handshake Into One Call

> The 2026-07-28 MCP spec collapses the initialize plus call handshake into a single stateless HTTP request, removing server-side session state.

Published: 2026-08-06
URL: https://daniliants.com/insights/stateless-mcp-collapses-the-session-handshake-into-one-call/
Tags: mcp, ai-agents, security, cli-tools

---

## Summary

The Model Context Protocol shipped a new "stateless" spec (2026-07-28) that collapses the old two-request session flow (initialize plus call) into a single HTTP request. Simon Willison, who had drifted away from MCP toward shell-based agents, says this revival plus renewed security concerns about giving agents raw shell and curl access pulled him back into building MCP tooling. He shipped three projects in a week: a CLI explorer, a Datasette MCP plugin, and an MCP client for his `llm` tool.

## Key Insight

- **Protocol simplification is real, not cosmetic.** Legacy MCP required `initialize` (get `Mcp-Session-Id`) then a second `tools/call` request carrying that header, meaning servers had to hold session state and route repeat calls to the same backend. Stateless MCP puts everything (protocol version, method, tool name, client info) into one request via headers (`Mcp-Method`, `Mcp-Name`) plus the JSON-RPC body, so there is no server-side session state and horizontal scaling gets easier.
- **Why this matters for agent security, not just DX**: the piece argues MCP's tool-scoped, auditable interface is a materially safer default than an agent with a raw shell plus `curl` (referencing the "Lethal Trifecta" concept for data-exfiltration risk via prompt injection). Smaller and local models can drive a well-defined MCP tool list reliably; they struggle to safely drive an open shell.
- **Concrete tools that came out of this shift:**

  - `mcp-explorer`, a stateless Python CLI, runnable via `uvx mcp-explorer list <url>` / `inspect <tool>` / `call <url> <tool> -a key value` with no install step. Useful as a generic MCP server probe and debugger.
  - `datasette-mcp`, a Datasette plugin exposing `/-/mcp` with exactly 3 tools: `list_databases()`, `get_database_schema()`, `execute_sql()` (currently read-only). Wireable directly into ChatGPT or Claude to let them run SQL against a hosted dataset.
  - `llm-mcp-client`, an alpha plugin for the `llm` CLI tool: `llm -T 'MCP("https://.../mcp")' 'count the notes'` lets any LLM call an MCP server ad hoc from the command line.

- **Design lesson embedded in the example**: a minimal, read-only, narrowly-scoped tool surface (3 tools on datasette-mcp) is deliberately preferred over a general SQL or shell interface. Smaller attack surface, easier to reason about what an agent given this tool could do wrong.