The 2026-07-28 spec drops server-side sessions: one HTTP request instead of initialising, holding an Mcp-Session-Id, then calling. No sticky routing, no session store. Simon Willison shipped three clients and servers off it in a week.4
legacy POST /mcp → initialize → Mcp-Session-Id: 8f2c…
POST /mcp + Mcp-Session-Id → tools/call
stateless POST /mcp → tools/callThe server stops holding state, which means an MCP endpoint becomes an ordinary HTTP handler: no session store, no routing the second request back to the same machine, no reason it cannot run on a serverless function. Most of the MCP is a lot of work objection from last year was this handshake.
The second-order argument is the interesting one. An agent with a shell and curl can do more than any tool server, and is far harder to secure — every capability is implicit. An MCP tool surface is enumerable, auditable, and small enough that a laptop-sized model can drive it correctly.
| Use it | GPT-5.6 price cut · Fast mode |
| Wait | Cline 4.1.0 → 4.1.2 |
| Wait | qm — multiplayer agent harness |
| Use it | Gemini CLI 0.53.1 |
One issue every weekday. The whole thing, not a teaser.