Your Agent's Tool Calls Are Not Transactions — And MCP Just Made That Official

MCP just went stateless. That's a good protocol decision. And it makes a much bigger systems problem impossible to ignore.

Your business workflows are not stateless.

Last week, SEP-2575 removed MCP's initialization handshake. Combined with SEP-2567 and SEP-2322, MCP goes fully stateless on 2026-06-30. Every tools/call is an independent request — no protocol-level notion that "these calls belong to one workflow."

REST has been stateless for decades. MCP has... the agent.

We solved the coordination problem with:

• two-phase commit
• sagas
• compensating transactions
• eventual consistency

I instrumented a 4-step workflow across Notion, HubSpot, and Slack.

Step 1: Update a Notion page with meeting notes. Success. Step 2: Create a deal in HubSpot. Success. Step 3: Send a Slack message: "Deal created, notes attached." Success. Step 4: Log the action to the audit trail. Failed. Rate limited.

The task failed. Three side effects already happened.

The Slack message was sent. The HubSpot deal exists. The Notion page was updated.

There is no rollback. The compliance officer cannot prove the deal was authorized.

This is the problem nobody is naming:

Semantic Irrevocability

Some tool calls have real-world effects that cannot be compensated — even when the API offers an "undo."

• slack.send_message — recipients already read it. delete_message doesn't unread.
• hubspot.create_deal — webhooks fired. Downstream systems already reacted.
• notion.update_page — downstream readers already saw the change.
• audit.log_action — when it fails, prior actions exist without a record.

It's a property of the action, not the API. No agent framework knows which is which.

MCP no longer has a coordination point.

Each request carries its own version, capabilities, and state handles. Nothing coordinates side effects across servers.

The durable execution stack lives at the wrong layer.

Temporal, DBOS, Restate, Inngest solve durable workflow execution — used by OpenAI Codex and Replit Agent.

But they sit at the agent framework layer. Adoption is opt-in. They can be bypassed by direct MCP calls. And they don't classify Semantic Irrevocability — they replay everything.

The agent is the transaction coordinator.

The LLM tracks which calls succeeded, which handles are active, what to compensate. LLMs are non-deterministic and hallucination-prone — the worst possible transaction coordinators.

Agent crash = orphaned operations.

Steps 1-3 are committed. Nothing knows the workflow existed.

REST went through this evolution. We didn't trust callers to track side effects — we built coordination infrastructure.

MCP needs it too. Not in the agent. Not in the framework. In the gateway — the one layer agents cannot bypass.

1970s databases learned this lesson. 2000s microservices learned it again.

Agent infrastructure is about to learn it the expensive way.