The Protocol Underneath: How MCP’s Stateless Shift Exposes the Security Gaps AI Infrastructure Already Has
On July 28, 2026, the Model Context Protocol (MCP) underwent a fundamental architectural revision, removing protocol sessions and the Mcp-Session-Id header. This change renders the protocol layer stateless. While this simplifies the protocol, it effectively offloads the entire burden of state management and security enforcement onto individual implementations. The ecosystem, already struggling with basic security…