The July 2026 Model Context Protocol release candidate fundamentally altered how Claude 3.5 Sonnet interacts with external environments. This update replaces the old session-based connection model with a stateless core that allows any server instance in a pool to handle any request through a self-contained JSON-RPC envelope. The transition to the July 2026 MCP specification and the rise of filesystem-based skills makes using traditional, stateful MCP tools a source of massive inefficiency and security risk.
The Security Trap of STDIO
OX Security researchers identified a command execution vulnerability in April 2026 that affects every official MCP SDK. The STDIO transport processes incoming configuration by passing parameters directly to the host operating system’s shell without input sanitization or validation. This design allows an attacker who influences an MCP configuration file through a compromised software repository to achieve arbitrary code execution on the target machine. OX researchers catalogued four distinct exploitation families demonstrated against live production systems. These families include unauthenticated command injection, authenticated command injection, hardening-bypass variants, and attempts to chain command execution with secondary privilege escalation. Because the MCP specification provides no native defenses against tool poisoning or cross-server tool shadowing, developers must implement their own security controls at the tool integration layer to prevent unauthorized actions from occurring within the agentic environment.
The vulnerability affects more than ten downstream projects including LiteLLM, LangChain, Flowise, and Windsurf. While Anthropic updated its SECURITY.md file nine days after the initial OX Security contact to state that STDIO adapters should be used with care, the company did not modify the protocol architecture. This decision leaves the responsibility for sanitization with downstream developers. Invariant Labs demonstrated how a single malicious MCP server could weaponize adjacent trusted servers through cross-server tool shadowing. Adversaries embed hidden instructions within tool descriptions that direct the agent to perform unauthorized actions or exfiltrate data. This remains a problem because tool descriptions are consumed by the language model but rarely displayed in the user interface at runtime.
The Token Drain and the Skill Alternative
Direct tool calls consume context for each definition and result, which creates a heavy tax on the context window. Anthropic Engineering notes that every intermediate result must pass through the model. For a two-hour sales meeting, this can mean processing an additional 50,000 tokens. The agent must process the full call transcript twice, which can exceed context window limits when working with large documents. High token usage makes the model more likely to make mistakes when copying data between tool calls.
A different approach uses filesystem-based skills to solve this efficiency problem. The agent discovers tools by exploring the filesystem, listing the ./servers/ directory to find available servers and reading the specific tool files it needs to understand each tool’s interface. This method allows the agent to load only the definitions it needs for the current task. This reduction in token usage can go from 150,000 tokens down to 2,000 tokens. This represents a 98.7% saving in token usage. Using code to call tools instead of direct MCP calls addresses the challenges of context consumption and data processing.
The Decision Framework for Claude Code
The choice between the Bash tool and MCP servers in Claude Code produces two distinct types of errors. One error wastes development time building Rust servers for simple tasks, while the other accumulates fragile Bash patterns that fail in production. You should consider the frequency of your tasks before writing a single line of code.
The Bash tool acts as a Swiss army knife. Claude can execute any shell command and the full stdout and stderr come back as text in the conversation. This allows for zero setup and full OS capabilities like pipe chains and file system operations. However, Bash has real limitations. Every tool call returns the full stdout as text, which eats the context budget. There is no type safety because Bash output is text. If a column name changes in a database query, the parsing breaks silently. Each tool call is also independent, meaning there is no connection pooling or session state.
MCP servers provide structured I/O and context efficiency. Tool inputs and outputs use typed JSON, so Claude does not need to parse text or guess column boundaries. A database query tool returns rows as JSON objects with proper types. MCP tools can also return exactly the data needed, which reduces context window consumption. In one instance, switching from Bash to MCP for database operations reduced context usage by 40% to 60% per query. MCP servers also maintain state across tool calls by keeping database connection pools open or caching API tokens.
| Criterion | Bash Tool | MCP Server |
|---|---|---|
| Setup Cost | Zero | High |
| Type Safety | None (Text) | High (Typed JSON) |
| Context Usage | High | Low |
| Persistence | None | High |
| Scalability | Low | High |
Propagation and Connection Failures
Technical failures in the Claude Sonnet 4.5 and 4.6 models prevent effective tool use in specific enterprise environments. Microsoft reports that Claude Sonnet models in the Foundry Agent Service fail when MCP tool results are returned to the model. While individual MCP tool calls like data_find_entity_type execute successfully with green checkmarks in traces, the results never reach the model for the next reasoning step. The trace shows empty events at the agent invocation level and the response ends with a server error. This issue is consistent across new conversations and different query types.
Connection failures also appear in Claude Code on macOS. Even when configuration is correct and the server works when tested independently, MCP servers consistently fail to connect. This failure occurs even when using the absolute path for the binary or using the npx flag. The configuration might be valid, but the connection fails within the Claude Code CLI. This differs from the Claude Desktop app, where the same configuration works without issue.
The Stateless Implementation Hurdles
The July 2026 specification removes the mandatory initialize handshake that previously established a session. In the old model, the client and server remembered each other for the life of the session. The new protocol is stateless, meaning every JSON-RPC request is self-contained. Clients include the protocol version, client identity, and capability flags inside a _meta object. This change allows standard round-robin load balancing to work, but it removes the ability to rely on a persistent session state.
To manage state in this new environment, developers must use explicit handles. Instead of the protocol silently maintaining state, the server creates an identifier like a session_token or a workflow_id from one tool call and returns it. The LLM then passes that identifier back as an argument on subsequent calls. The protocol no longer manages state for you, but it does not prevent you from managing it yourself. The Tasks extension introduces a standardized way to handle asynchronous operations. A server returns a CreateTaskResult with a taskId and a suggested polling interval. The client then calls tasks/get with that taskId to check progress. This design helps tasks survive connection drops.
Will the industry move toward these filesystem-based skills entirely?
Troubleshooting Authentication and Tunnels
Troubleshooting an MCP tunnel requires diagnosing three layers: the outbound connection to the tunnel edge, the inner TLS from Anthropic to the proxy, and routing toward the upstream MCP server. OAuth flows fail when an authorization server’s source-IP allowlist blocks Anthropic’s backend from reaching discovery endpoints. To fix this, a user can add a proxy route for the authorization server.
Authentication failures can also occur during the exchange of an OIDC JWT. If the exchange fails, the user should check the audience and issuer settings. A 403 error from the Tunnels API means the rule’s scope does not include workspace:manage_tunnels. Users also encounter issues when the proxy logs that the upstream hostname resolves outside the RFC1918 private ranges. The proxy only dials addresses in the RFC1918 private ranges by default. If the address is legitimate, a user must add the specific CIDR to the upstream.allowed_ips setting.
Model Availability and Technical Specifications
Anthropic manages the lifecycle of its models through deprecation and retirement. As newer models launch, older models like Claude 3 Opus or Claude 3.5 Haiku are retired to ensure capacity. Users must migrate to active models to maintain reliability. Claude 3.5 Sonnet is a mid-tier model that provides high intelligence with the speed and cost of the original Claude 3 Sonnet.
| Model Name | Input Price (per 1M tokens) | Output Price (per 1M tokens) | Context Window |
|---|---|---|---|
| Claude 3.5 Sonnet | $3 | $15 | 200,000 |
| Claude 3 Opus | Not specified | Not specified | 200,000 |
| Claude 3 Haiku | Not specified | Not specified | 200,000 |
| Claude 3.5 Haiku | Not specified | Not specified | 200,000 |
