Stateless, Not Traceless
The 2026-07-28 Model Context Protocol specification went final three days ago. It is the largest revision since the protocol launched, and within forty-eight hours the ecosystem produced an impressive volume of migration guides: what breaks, which SDK to pin, how to rewrite your transport layer.
Nobody wrote the threat model.
That gap matters more than usual here, because this is not a release that adds features. It is a release that removes a primitive — the session — and the session was load-bearing for something the spec authors were never obligated to care about: detection. Every behavioural rule, every SIEM correlation, every anomaly baseline built against MCP over the past eighteen months used Mcp-Session-Id as its grouping key. That key no longer exists, and the anchor that replaced it is supplied by the client rather than issued by the server — which means the party being observed now controls the observation key.
I wrote up the full threat model: what the lost correlation key costs detection, where the anchor actually moved, and the three further surfaces the stateless rework opened — server state round-tripped through an untrusted client, mandatory routing headers that no intermediary verifies against the body, and catalogue caching that gives tool poisoning a server-declared persistence window.