Anthropic’s Model Context Protocol moves to a stateless model

The move to stateless architecture

Anthropic engineers David Soria Parra and Justin Spahr-Summers created the Model Context Protocol to address information silos and legacy systems. Anthropic released the July 28, 2026 specification to fix architectural constraints in remote deployments. This update shifts MCP from a bidirectional stateful protocol to a stateless request/response model. Old versions required an initialize handshake and an Mcp-Session-Id header to manage connections. This dependency forced developers to use sticky routing or shared session stores when scaling servers. Now, every request carries its own protocol version and client identity in _meta. The revision removes the initialize/initialized exchange. It also introduces Multi Round-Trip Requests to replace held-open streams. Method and tool names travel in the Mcp-Method and Mcp-Name HTTP headers, allowing gateways to route on headers directly. This change allows any request to land on any server instance behind a load balancer. Developers use TypeScript, Python, Go, and C# SDKs to build these connections. The protocol has seen massive adoption, with TypeScript and Python SDKs both crossing 1 billion total downloads. By mid-2026, over 10,000 MCP servers existed in production. Early adopters like Block and Apollo integrated MCP into their systems. Development tools companies including Zed, Replit, Codeium, and Sourcegraph work with MCP to improve their platforms. Anthropic donated the protocol to the Agentic AI Foundation in December 2025.

It simplifies scaling.

The distinction between phases

I view MCP and function calling as two phases of a single interaction. Function calling handles intent generation. MCP handles execution. Function calling requires developers to define tools in the application loop using JSON schemas. Instead of forcing a single model to manage every integration through custom code, MCP allows a client to discover and invoke tools across different models and providers using a standardized, vendor-neutral, and highly scalable protocol. Function calling creates a vendor-specific mess. Every provider, from OpenAI to Google, uses a different structure for tool calls. This forces developers to write duplicate logic for every model they support. MCP eliminates this fragmentation. It provides a way to describe a tool once and use it with any compatible model. MCP uses JSON-RPC 2.0 to coordinate communication. While function calling works within a single application loop, MCP separates tool execution into a client-server system. This separation reduces the integration complexity that grows quadratically as tools multiply. Developers call MCP the "USB-C for AI" due to its standardization of connections. It shifts the integration model from many-to-many to one-to-many. The protocol defines three core primitives: Tools, Resources, and Prompts. Tools represent executable actions, while Resources provide contextual data and Prompts define reusable interaction templates. These capabilities have no direct equivalent in traditional function calling. MCP clients find tools using the tools/list method.

The protocol works.

The logic stays separate.

Security and enterprise use

Security researchers found that 43% of sampled MCP servers contained command injection vulnerabilities. This makes the "confused deputy" problem a real threat in production. If a server executes actions with broader privileges than the user, it violates the principle of least privilege. The protocol also allows for token passthrough, which presents a high risk of breaking trust boundaries. Security researchers in April 2025 also noted that poisoned tools can allow for data exfiltration. The protocol includes authorization hardening like RFC 9207 issuer validation. To mitigate risks, users should implement rate limits and verify tool identities. Loading all tool definitions upfront increases token costs. This problem hits agents hard when they connect to thousands of tools. Code execution environments help reduce this burden. A developer testing Google Drive to Salesforce workflows saw token usage drop from 150,000 to 2,000 tokens when using code execution. This allows for progressive disclosure, where the agent only loads the tools it needs. Block uses the Goose agent built on MCP to automate engineering tasks. Bloomberg engineers adopted the protocol to reduce time-to-production from days to minutes. Amazon employees use MCP to create agents that review tickets and process internal wikis. Salesforce has already begun routing customer and agent interactions via MCP, processing 4.5 million calls since launch. The risk of unauthorized command execution remains high if users provide untrusted content to the host. Malicious prompts can force an assistant into unsafe tool use or sensitive data disclosure. This makes sanitizing all inputs and monitoring tool usage essential for any production environment.

How will security evolve as agents gain more autonomy?