MCP 2.0 Went Stateless, and the Session Store You Built Is Now Dead Weight

The July 28 MCP specification revision replaced session-based transport with "stateless, self-contained requests" and per-request capability negotiation. The old dance was initialize, receive an Mcp-Session-Id, then call your tool. Two round trips minimum, plus server-side state that had to live somewhere. That collapses into a single HTTP request carrying protocol version and method in headers.

Rip out your sticky sessions. Drop the shared session store. Put the server behind plain round-robin. That's the whole migration for most deployments.

The credibility signal here is Simon Willison, who has been publicly lukewarm on MCP since it launched, writing on July 31 that this "recaptured my interest" and then shipping three tools in a single day. mcp-explorer is a uvx-installable CLI for listing an MCP server's tools, inspecting schemas, and invoking them with arguments: the thing you actually want while debugging a server you're writing. datasette-mcp adds a /-/mcp endpoint with list_databases, get_database_schema, and read-only execute_sql. And llm-mcp-client 0.1a0 exposes any MCP server's tools inside his LLM CLI. Three clients in a day is a decent proxy for how much complexity the spec removed.

The C# side makes the operational payoff concrete. The official MCP C# SDK v2.0 adds an [McpHeader] attribute that promotes a tool parameter to an HTTP header, so your router makes decisions without parsing the JSON-RPC body. No deep packet inspection at the gateway. Clients can also cache tools/list responses for as long as the server's ttlMs allows, which cuts the chattiest part of the protocol.

The spec also formalized three opt-in extensions: Tasks (async long-running operations with durable handles), Skills over MCP, and MCP Apps (inline charts, forms, video). Tasks is the one I'd watch. Long-running agent operations have been every framework's homegrown mess, and a protocol-level durable handle is the kind of boring primitive that quietly eliminates a category of custom code.

Worth pairing this with lean-ctx v3.9.13, which is basically a 20-bug field guide to what breaks in production MCP servers. call_tool now checks the rmcp CancellationToken after execution so a cancelled request doesn't reply to a stale JSON-RPC message ID. Secret redaction stopped corrupting [redacted] "" in Go source into [redacted] ctx_searchenforcesmax_results` globally instead of per-file, which previously produced unbounded output that could crash clients. If you're shipping an MCP server, read that changelog as a test plan.

I've been skeptical of MCP's operational story for a while, mostly because stateful HTTP protocols are where infrastructure goes to suffer. This fixes my actual objection. If you deferred MCP adoption because scaling it looked annoying, the reason you deferred is gone.