← Blog

Stateless, Not Traceless

  • #mcp
  • #protocol
  • #detection
  • #threat-model
  • #mst

The 2026-07-28 Model Context Protocol specification went final three days ago. It is the largest revision since the protocol launched, and within forty-eight hours the ecosystem produced an impressive volume of migration guides: what breaks, which SDK to pin, how to rewrite your transport layer.

Nobody wrote the threat model.

That gap matters more than usual here, because this is not a release that adds features. It is a release that removes a primitive — the session — and the session was load-bearing for something the spec authors were never obligated to care about: detection. Every behavioural rule, every SIEM correlation, every anomaly baseline built against MCP over the past eighteen months used Mcp-Session-Id as its grouping key. That key no longer exists, and the anchor that replaced it is supplied by the client rather than issued by the server — which means the party being observed now controls the observation key.

I wrote up the full threat model: what the lost correlation key costs detection, where the anchor actually moved, and the three further surfaces the stateless rework opened — server state round-tripped through an untrusted client, mandatory routing headers that no intermediary verifies against the body, and catalogue caching that gives tool poisoning a server-declared persistence window.

Stateless, Not Traceless — the full research