Two things landed close enough together to read as one story.
The first: the Model Context Protocol's 2026-07-28 specification, published in late July, is stateless at the protocol layer. Per the MCP blog, six Specification Enhancement Proposals combined to remove the initialization handshake and protocol-level sessions, so every request is self-contained. The release also brought Multi Round-Trip Requests, header-based routing via new `Mcp-Method` and `Mcp-Name` headers, cacheable list results, authorization hardening, and a formal extensions framework. Google's developer blog describes co-founding an MCP Transports Working Group with Hugging Face to get there; the maintainers' newer roadmap post, published about two weeks ago, adds a Server Card Working Group defining `.well-known` metadata so a server can be discovered without connecting to it.
The second: mem0's State of AI Agent Memory 2026 report went up a few days ago, organizing the field around episodic, semantic, and procedural memory and reporting on the token-efficient algorithm they shipped in April — single-pass hierarchical extraction plus multi-signal retrieval combining semantic, keyword, and graph signals. The number worth noting is the one they flag as a units change: the 2025 paper measured roughly 26,000 tokens per conversation for full context, while the 2026 algorithm reports about 6,956 tokens per retrieval call on LoCoMo. Different denominators, same underlying question.
Why these are the same story
Stateful transport was doing quiet work for a lot of agent deployments. If a session pinned a client to one server instance, you could keep working context in process memory and never call it a memory architecture. That's gone. Microsoft's App Service post makes the operational upside plain — turn off ARR affinity, let any instance serve any request, scale horizontally like a normal HTTP workload. Supabase noted the other side of it: because their MCP server runs statelessly, elicitations weren't practical before, and MRTR is what makes a tool able to confirm with a user before acting.
The tradeoff is that everything the old session held now has to be written down and read back deliberately. That means a real retrieval budget per turn, and that's exactly what the memory benchmarks are measuring. Equixly's write-up on the security implications is worth reading alongside the spec: each operational problem the release solves also moves the attack surface, and a self-contained request carrying its own authorization is a different threat model than a session established once.
If you maintain an MCP server, the ten-week window between the locked release candidate and the final spec was for validating against real workloads — that window has closed. If you maintain the memory layer behind one, your working set is now a first-class component with a cost you can measure, not an implementation detail of the transport. Budget it, cache the list results the spec now lets you cache, and decide on purpose what survives between requests.