MCP 2026-07-28 Specification: transport going stateless

The Java SDK is currently a Tier 2 SDK.. As a Tier 2 SDK they have up to 6 months to implement it. I know they are actively working towards support for the specification.

Best to join our community discord [1] and ask the maintainers !

[1] https://modelcontextprotocol.io/community/communication

Hallelujah.

Oh hey, it's modelcontextprotocol.io , your official source of protocol specifications and definitely not some attacker trying to get curious vibecoders to run their documentation with a prompt like "implement this", and getting it to install their payload via an npm package like '@modelcontextprotocol/server-filesystem' or the uv/pypi mcpcli package.

https://modelcontextprotocol.io/docs/2026-07-28/develop/conn...

But sure, you can expend more effort inspecting the source code and documentation than the developers actually spent writing it to verify that it's all safe and well architected.

Ok, end of rant. To be explicit, there's a lot of security issues here, that make it hard to distinguish a malicious actor from a legitimate one:

1- A TLD based in British Indian Ocean territory.

2- A domain name of the product itself, not the entity behind it. (Not how domains work)

3- low value to risk ratio. Some degree of risk is necessary, but if it is done for no benefit, then the acceptable risk becomes lower. It still isn't clear at all what the advantage of mcp is. Maybe when it came out that was my fault, but at this point you have to concede there's a communication or marketing issue, or lack of actual benefit.

4- It's presented as a protocol, but it actually comes with an extensive vibecoded reference implementation, and the code is distributed across multiple repositories, so it's not at all trivial to enumerate where all of the code is, which is a prerequisite to even start static code analysis, leaving one with the only option of runtime analysis, which is a good queue to drop it and not even bother to begin with.

5- The code is vibecoded and auditing would take more time than it takes to actually write it, which is one of the conditions for an amplified DoS attack (on developer attention), the best defense against such attacks is to ignore the packets, so the best path is to ignore content about Model Context Protocol.

Goodbye

I don't see the need for MCP for most use cases where it's currently used.

You can get better results with skills SKILL.md + linked .md files with curl commands inside... Just plain HTTP(S). I say this as someone who often prefers the stateful WebSocket protocol for data transport. HTTP stateless request-response model is a natural fit for LLMs.

HTTP is an excellent protocol for this and curl is an excellent, very popular command on which all major coding models are well trained. LLMs are insanely good with curl. Not to mention that it's pre-installed on all major operating systems. The curl command has become the protocol.

Then there is the fact that most tools require some documentation to go along with it anyway (to be used correctly). MCP mostly adds unnecessary work for a lot of cases.

It has its place in backend code environments I guess... But most of these use cases are thin applications trying to be a middleman between the user and the AI. I think ultimately, the AI will be at the front and tools at the back. Hence, curl.

Wedging a platform between the user and AI creates unnecessary constraints and reduces interoperability and integration opportunities.

[flagged]