FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

SEP-2567: Sessionless MCP via Explicit State Handles by pja-ant · Pull Request #2567 · modelcontextprotocol/modelcontextprotocol · GitHub

  1. modelcontextprotocol
  2. modelcontextprotocol

Repository navigation

SEP-2567: Sessionless MCP via Explicit State Handles - #2567

Merged
pja-ant merged 10 commits into
mainfrom
sep/sessionless-mcp
May 7, 2026
ConversationCommits (10)ChecksFiles changed
Merged

SEP-2567: Sessionless MCP via Explicit State Handles#2567
pja-ant merged 10 commits into
mainfrom
sep/sessionless-mcp

Conversation

pja-ant commented Apr 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Draft SEP proposing the removal of protocol-level sessions from MCP, replacing implicit session-scoped state with explicit, server-minted state handles. Builds on SEP-1442 (stateless-by-default) but argues the opt-in stateful path should not exist at all.

Core claims:

  • Application state is better served by explicit identifiers
  • The mere possibility of session-scoped tools/list forces O(subagents × servers) re-fetches on everyone, even when ~zero servers actually use it
  • Session cardinality of exactly-one prevents mixed shared/isolated state (e.g., subagents sharing a cart but isolating browser state)
  • Explicit handles are strictly more expressive and make list endpoints cacheable at (deployment, auth) granularity

What changes:

  • No session/create, session/destroy, or Mcp-Session-Id header
  • tools/list / resources/list / prompts/list MUST NOT depend on per-connection or prior-tool-call state
  • Stateful workflows use create_*() -> handle + threaded parameters (guidance, not a protocol construct)

Imported from modelcontextprotocol/transports-wg#25.

pja-ant requested review from a team as code owners April 14, 2026 12:43
pja-ant changed the title SEP-XXXX: Sessionless MCP via Explicit State Handles SEP-2567: Sessionless MCP via Explicit State Handles Apr 14, 2026
pja-ant added SEP draft SEP proposal with a sponsor. labels Apr 14, 2026
kurtisvg self-assigned this Apr 14, 2026
kurtisvg mentioned this pull request Apr 14, 2026
Merged
kurtisvg added the transport Related to MCP transports label Apr 14, 2026
dsp-ant added the roadmap/transport Roadmap: Transport Evolution & Scalability (incl. Server Cards) label Apr 15, 2026

kurtisvg commented Apr 15, 2026

Copy link
Copy Markdown
Contributor

tools/list / resources/list / prompts/list MUST NOT depend on per-connection or prior-tool-call state

Should this be "prior request call state"? I don't think we want other requests to effect the outcome as well right?

kurtisvg reviewed Apr 15, 2026
View reviewed changes
Comment thread docs/seps/2567-sessionless-mcp.mdx Outdated
Comment thread docs/seps/2567-sessionless-mcp.mdx Outdated
Comment thread docs/seps/2567-sessionless-mcp.mdx Outdated
Comment thread docs/seps/2567-sessionless-mcp.mdx Outdated
Comment thread docs/seps/2567-sessionless-mcp.mdx

**Clients.** Clients become simpler: they no longer track or resend session identifiers, or need to determine whether a given server is stateful. List-endpoint caching becomes safe.

Rollout is a clean break: sessions are removed in the next spec version, with no deprecation window. Servers that currently rely on session-scoped state stay on the current protocol version until they have migrated to explicit handles. Protocol version negotiation already handles mixed-version deployments — a client that supports both versions speaks the old protocol to an unmigrated server and the new one to everyone else. This avoids shipping a version where clients support both modes simultaneously, which would prevent the caching benefit (a client cannot cache list endpoints if any connected server might be session-scoped).

kurtisvg Apr 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Rollout is a clean break: sessions are removed in the next spec version, with no deprecation window. Servers that currently rely on session-scoped state stay on the current protocol version until they have migrated to explicit handles.

Somewhere in this SEP we should provide an example of how SDKs should handle this. I think we are essentially saying that the session functionality become a no-op.

LucaButBoring mentioned this pull request Apr 15, 2026
Closed
8 of 9 tasks

CaitieM20 commented Apr 16, 2026

Copy link
Copy Markdown
Contributor

This looks good to me. Supportive of this!

CaitieM20 added this to the 2026-06-30-RC milestone Apr 17, 2026

pja-ant commented Apr 20, 2026

Copy link
Copy Markdown
Contributor Author

This was reviewed by Core Maintainers: 6 Accepted, 2 Accept with Changes.

pja-ant added accepted SEP accepted by core maintainers, but still requires final wording and reference implementation. and removed draft SEP proposal with a sponsor. labels Apr 20, 2026
mcp-commander Bot removed the accepted SEP accepted by core maintainers, but still requires final wording and reference implementation. label Apr 20, 2026

mcp-commander Bot commented Apr 20, 2026

Copy link
Copy Markdown

New commits were pushed — removed the accepted label. Re-approve with /lgtm.

panyam mentioned this pull request Apr 21, 2026
Closed
pja-ant force-pushed the sep/sessionless-mcp branch from d95feda to dada908 Compare April 22, 2026 23:32
maciej-kisiel mentioned this pull request Apr 24, 2026
Closed

briankrug commented Apr 27, 2026 •
edited
Loading

Copy link
Copy Markdown

tools/list / resources/list / prompts/list MUST NOT depend on per-connection or prior-tool-call state

This means that MCP Servers cannot filter tools, resources, or prompts based on authorization. Seems like a step backwards. Why list an entity the client / user can't use?

Actually, I guess you could do an auth to entity permission look-up on every call. It just means greater burden on the server

scotwells mentioned this pull request Apr 28, 2026
Closed
4 tasks

dawid-nowak commented Apr 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Continuing from #2575 (comment)

After:

create_counter() // returns counter_id
increase_counter(counter_id)
get_counter(counter_id)

  1. It looks like the server logic needs to tweaked to suit MCP Protocol. And MCP server needs to introduce their own sessions handling if necessary.
  2. Is there a mechanism to pass information about the principal of a user who made these calls. For example from the security/audit perspective if create_counter is created by user A and that counter id is leaked then any other user can call increase_counter and thus hijack the session.

Even if all transport calls are authenticated/authorized, there is a danger that the user with lower permissions could potentially hijack the session of a super user by using their handle id.

maciej-kisiel mentioned this pull request Apr 28, 2026
Closed

pja-ant commented Apr 28, 2026

Copy link
Copy Markdown
Contributor Author

This means that MCP Servers cannot filter tools, resources, or prompts based on authorization. Seems like a step backwards. Why list an entity the client / user can't use?

You can still filter based on auth. I should clarify that sentence as I can see why it looks like it implies the opposite. "Per-connection state" means relying on information sent in previous messages on the connection. The auth headers are on every request, so it is stateless.

This was referenced Sep 13, 2026
Closed
Open
Merged
Closed
Open
Open
coderabbitai Bot mentioned this pull request Sep 17, 2026
Merged
6 of 12 tasks
This was referenced Sep 17, 2026
Closed
Merged
This was referenced Sep 18, 2026
Closed
Closed
This was referenced Sep 19, 2026
Closed
Closed
Closed
Open
Merged
Merged
Closed
Open
This was referenced Sep 27, 2026
Closed
Closed
Open
Closed
Closed
Closed
Open
Closed
Open
This was referenced Oct 7, 2026
Open
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

clareliguori clareliguori left review comments
CaitieM20 CaitieM20 approved these changes
kurtisvg kurtisvg approved these changes
+1 more reviewer
yarolegovich yarolegovich left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

pja-ant

Labels

final SEP finalized. roadmap/transport Roadmap: Transport Evolution & Scalability (incl. Server Cards) SEP transport Related to MCP transports

Projects

2026-07-28 Spec Implementation
Status: Done
SEP Review Pipeline
Status: No status

Milestone

2026-07-28-RC

Development

Successfully merging this pull request may close these issues.

Back | FazBrowse Home | New Git URL