The MCP stateless protocol update released this week changes the core of the Model Context Protocol, an open source standard for connecting AI systems to external tools and data. Lead maintainers David Soria Parra and Den Delimarsky, both Anthropic employees, said the new specification moves MCP away from a bidirectional, stateful design and toward a stateless request-and-response model.
That shift matters because MCP requests no longer need to depend on a session pinned to a particular server instance. According to the maintainers, developers had repeatedly asked for this because they wanted more reliable and scalable MCP servers. The change is meant to remove one of the obvious headaches for companies trying to run MCP across more than a local developer setup.
What changed in the new MCP specification?
The biggest change is the stateless protocol core. In the earlier model, MCP’s behavior depended more heavily on ongoing server-linked sessions. Under the new specification, individual requests can be handled without that same per-server session dependency, which the maintainers describe as a better fit for large deployments.
Soria Parra wrote that this is MCP’s most significant update since remote MCP launched more than a year ago. The specification also adds multi round-trip requests, header-based routing, cacheable list results, authorization hardening, a formal extensions framework, and updated Tier 1 software development kits, according to the protocol documentation.
MCP began as a way to connect models running on a local machine with local applications. That origin is part of why the new version is more than routine polish: it reworks assumptions baked into a protocol that is now being pushed into more complicated company environments. For readers tracking the model side of that equation, our explainer on how LLMs answer prompts covers the AI systems MCP is often built around.
Why does stateless MCP matter for enterprise use?
Enterprise deployments tend to care about scale, uptime, upgrade paths, and authorization rules. The maintainers say the stateless design is intended to improve reliability and scalability, while the new authorization changes and extensions framework give organizations firmer protocol-level machinery to work with.
The update also introduces a deprecation policy aimed at more predictable operations. Once a feature is formally deprecated, the policy requires at least 12 months before it can be removed, except for a narrow class of critical security updates. That kind of runway is dull in the best possible way: large software shops dislike surprise breakage more than they dislike reading changelogs.
MCP is overseen by the Agentic AI Foundation, which operates under the Linux Foundation. Anthropic introduced MCP just under two years ago and still has notable influence over the project, although the protocol now has contributors from OpenAI, Google, Microsoft, and Amazon, according to the project’s public materials.
The governance picture is slightly messier than a vendor press release would prefer. Formal responsibility sits with individual maintainers rather than the companies that employ them. Several principal maintainers, including Soria Parra and Delimarsky, currently work at Anthropic. That does not make MCP an Anthropic-only project, but it does mean Anthropic’s fingerprints remain visible on a standard that other major AI and cloud companies are now helping shape.
This story draws on original reporting from Ars Technica.
