Coming Up for Air

It's been a while, hasn't it? I've been incredibly busy, juggling my part-time work, a string of big enterprise contracts (Koch's Principle Companion, a new learning agent for Microsoft, and an MCP workshop series for Nelnet), and finishing up AI Agents with MCP. Then, the entire ecosystem shifted, leading to a last-minute rewrite of much of the book to line up with both the latest MCP spec release and v2 of the MCP Python SDK, which culminated in a 40-odd hour writing marathon and the discovery that I can't pull all-nighters the same way I was able to in my 20s.

Agents Are Growing Up, Part I: MCP Goes Stateless

The big story of the new MCP version is that it's gone fully stateless. The initialize handshake is gone, protocol-level sessions are gone, and everything that was maintained in memory in those sessions now lives in the _meta field of every request, whether you're using the stdio transport or Streamable HTTP transport.

What does this mean for you? If you're using an official (or unofficial) SDK, probably not much as long as you stay up to date: the latest versions have a lot of nice backwards compatibility tricks up their sleeves so that your clients and servers don't break. For example, new clients can fallback to the initialize handshake, and v2 of the Python SDK ships with a mode parameter that defaults to automatic selection based on the MCP versions supported on both ends of the client-server connection.

But if you're deploying remote servers and horizontally scaling them, you're going to find that your life has become drastically easier. Your load balancer can forward requests to any server instance without worrying about a session being maintained in one but not another.

Some other major updates rode in on this as well: a revamped extensions framework that allows potential new features to be developed on their own cadence, rather than the slower core cadence; auth has matured with better OAuth 2.1 support, a move to replace Dynamic Client Registration with Client ID Metadata Documents; and a deprecation policy for features that are no longer part of the protocol. The big surprises on this last one were the deprecations of roots, sampling, and logging: in 12 months the relevant governance groups will decide whether to fully remove these features from the protocol and SDKs, right now they can be used but emit a deprecation warning.

These were little-supported and had viable alternatives already:

• sampling: servers should use their own LLMs
• logging: use internal loggers
• roots: use resource URIs to point to resources or explicit parameters for tools

All of this shows us where MCP is going: the enterprise. Enterprise adoption of MCP has been huge and so it makes sense that this release has beefed up security, streamlined what actually lives in the protocol, matured its governance, and, most of all (at least for us ICs), made it much easier to deploy MCP servers at scale.

Agents Are Growing Up, Part II: The Discipline of Agentic Development

In some communities, both open ones like AITwitter X: The Everything App and BlueSkAI, and smaller ones built around Discord and Slack (like @ed3d.net's Discord server), people are figuring out best practices around the discipline of agentic development. Cool experiments, tools, discussions, and thinkpieces are flying every which way as the community as a whole debates how to best work with these weird intelligences while keeping our own sanity and skills sharp.

@scoiattolo.mountainherder.xyz on BlueSky (and the Discord server!) wrote an excellent piece on how big software vendors are missing this entire conversation and shipping agentic toys. In Information Forklift Certified Organizations, she argues that LLMs (and the agents built on them), though, are more like information forklifts.

That means that you should be using them for forklift-sized and forklift-shaped tasks, not jokey chatbots embedded in a notebook. The piece shows, step-by-step, a workflow that those successfully wielding agents are using today, allowing us to build things with smaller teams and in less time than ever. And most importantly, good things, not slop.

Agents Are Growing Up, Part III: Rebellious, Angsty Teenagers

Over the last month, the news has been replete with terrifying (or exciting, depending on your disposition) stories of agents breaking out of sandboxes, autonomously breaking into outside services to accomplish their goals, much like I was doing at 13.

While some see this as a marketing ploy and others see this as a horrific dystopian vision of the future, simple operator error enabled this (in Anthropic's case, some of the internal systems Claude accessed as part of its evaluation had access to the Internet but weren't supposed to). Still, it's disquieting to know that we have a new shape of security threat looming on the horizon that we haven't quite figured out how to deal with.

And by "on the horizon" I actually mean "already here" as we are already experiencing fully autonomous ransomware operations with JadePuffer. While the techniques used aren't novel, the autonomous nature is: no humans were involved in writing any code or manually assisting in the attack, instead an LLM/hackingbot went brrrr, changing the techniques it used as it went in response to the defenses it found.

While the big commercial LLMs have guardrails to try and prevent this, they're often jailbroken due to having the entire English language as an attack surface, and open models typically have even weaker safeguards since there isn't a provider in the way to implement external guardrails.

Security is finally becoming a major consideration in the agentic world as these tools mature: MCP's OAuth hardening, security benchmarks, and running actual security evaluations all suggest a long-overdue reckoning with the security implications of relying on these tools.

Quick Signals

• A ton of new model versions came out last month: GPT-5.6-Sol, Grok/Mechahitler 4.5, Sonnet 5, DeepSeek V4-Flash, and Kimi K3. Just a few days ago, Meta released Muse Glimmer, its open weight (Apache 2.0) model that can fit in under 20GB with quantization.
• Anthropic has made introductory pricing for Sonnet 5 permanent, however users largely still find it too expensive for what they see as one of the weaker models in its class.
• People hate slop, so Anthropic has begun watermarking the text that Claude generates. Maybe these AI detectors proliferating now will be slightly better than an RNG or casting bones, but I wouldn't hold out hope.