Pattern: Agent State Is Moving Out of the Server and Into the Conversation
The stateless MCP spec formalizes a shift that had been happening informally: instead of a server holding a session keyed by an opaque token, tools return handles that the model carries in context and passes back on the next call. The upside is horizontal scalability — any instance can serve any request — and, less obviously, the model's multi-step reasoning becomes inspectable because the state is right there in the transcript. The cost is that anything the model can read, a malicious tool response can also write, which is exactly why handle hijacking replaced session hijacking as the threat. Expect the same tradeoff wherever agent frameworks move state into context: transparency and scale bought with a new injection surface.
↳ Follow the thread