Stateless MCP Collapses the Session Handshake Into One Call

2 min read
mcpai-agentssecuritycli-tools
View as Markdown
Originally from simonwillison.net
View source

My notes

Summary

The Model Context Protocol shipped a new “stateless” spec (2026-07-28) that collapses the old two-request session flow (initialize plus call) into a single HTTP request. Simon Willison, who had drifted away from MCP toward shell-based agents, says this revival plus renewed security concerns about giving agents raw shell and curl access pulled him back into building MCP tooling. He shipped three projects in a week: a CLI explorer, a Datasette MCP plugin, and an MCP client for his llm tool.

Key Insight

  • Protocol simplification is real, not cosmetic. Legacy MCP required initialize (get Mcp-Session-Id) then a second tools/call request carrying that header, meaning servers had to hold session state and route repeat calls to the same backend. Stateless MCP puts everything (protocol version, method, tool name, client info) into one request via headers (Mcp-Method, Mcp-Name) plus the JSON-RPC body, so there is no server-side session state and horizontal scaling gets easier.

  • Why this matters for agent security, not just DX: the piece argues MCP’s tool-scoped, auditable interface is a materially safer default than an agent with a raw shell plus curl (referencing the “Lethal Trifecta” concept for data-exfiltration risk via prompt injection). Smaller and local models can drive a well-defined MCP tool list reliably; they struggle to safely drive an open shell.

  • Concrete tools that came out of this shift:

    • mcp-explorer, a stateless Python CLI, runnable via uvx mcp-explorer list <url> / inspect <tool> / call <url> <tool> -a key value with no install step. Useful as a generic MCP server probe and debugger.
    • datasette-mcp, a Datasette plugin exposing /-/mcp with exactly 3 tools: list_databases(), get_database_schema(), execute_sql() (currently read-only). Wireable directly into ChatGPT or Claude to let them run SQL against a hosted dataset.
    • llm-mcp-client, an alpha plugin for the llm CLI tool: llm -T 'MCP("https://.../mcp")' 'count the notes' lets any LLM call an MCP server ad hoc from the command line.

  • Design lesson embedded in the example: a minimal, read-only, narrowly-scoped tool surface (3 tools on datasette-mcp) is deliberately preferred over a general SQL or shell interface. Smaller attack surface, easier to reason about what an agent given this tool could do wrong.