Simon Willison makes a strong case for “stateless MCP” — Model Context Protocol servers that keep zero session state. Here’s why it matters, the trade-offs, and how to build it right.
Source: Stateless MCP by Simon Willison, and the official Model Context Protocol docs.
What is “stateless MCP”?
MCP defines a standard way for AI clients to talk to tools and data. A stateless MCP server does not store per-user or per-session context. Instead, the client sends all needed context on every request.
- Think: pure, request-in/response-out behavior with no hidden server memory.
- Benefits: easier scaling, simpler security boundaries, and serverless-friendly deployments.
Why teams adopt stateless MCP
- Horizontal scale: add instances without sticky sessions or shared caches.
- Serverless-ready: deploy on Cloudflare Workers, AWS Lambda, or container autoscaling with low cold-start risk.
- Resilience: restarts are cheap; no in-memory state to lose.
- Determinism & auditability: behavior depends on inputs you can log and replay.
- Simpler compliance: fewer places where personal or regulated data can linger.
Key trade-offs and risks
- Auth on every call: require signed requests, scoped tokens, and short TTLs.
- Context size and cost: large prompts or resources can bloat bandwidth and tokens—favor references over blobs.
- Side effects: if tools write to databases or APIs, ensure idempotency and clear rollback plans.
- Privacy: avoid echoing sensitive inputs into logs; tokenize or redact at ingress.
- Rate limiting: enforce per-tenant and per-tool quotas to prevent abuse.
Design patterns for stateless MCP servers
- Include all state in the request: user, tenant, permissions, and tool parameters should be explicit, not implicit.
- Use resource references: pass signed URLs or resource handles instead of raw data blobs; fetch only what you need.
- Idempotency keys: attach a unique key for write operations so safe retries don’t duplicate work.
- Fine-grained, expiring tokens: capability-style tokens that grant least privilege and expire quickly.
- Version pinning: pin tool, model, and dataset versions for reproducibility; include checksums in metadata.
- Streaming & pagination: stream long responses and paginate listings to keep requests small.
- Structured errors: return machine-readable codes to guide automated recovery in the client.
- Observability at the edge: log request metadata (not secrets) and sample payload sizes to watch cost/latency regressions.
When you still need state
- Long-running jobs: track progress in a job store, not in server memory.
- Real-time updates: use event streams or webhooks; let the client subscribe.
- Per-user caches: externalize to a shared cache (e.g., Redis) with explicit keys and TTLs.
Quick implementation checklist
- Every request authenticates, authorizes, and includes all needed context.
- No server memory of prior calls; rely on external stores for jobs and caches.
- All writes are idempotent and audited.
- Inputs and outputs are size-bounded; large artifacts are referenced, not inlined.
- Secrets never appear in logs; PII is redacted or tokenized.
Takeaway
Stateless MCP makes your AI tooling easier to scale, reason about, and secure. Push context to the client, keep servers pure, and externalize anything that must persist.
Want more practical AI build patterns? Subscribe to our newsletter: theainuggets.com/newsletter
