Every MCP server I run starts its life the same way: an initialize handshake, an Mcp-Session-Id that pins every later call to one process, state held server side. The 2026-07-28 revision of the Model Context Protocol deletes all three. I read the changelog twice. The first pass felt like relief. My servers can finally sit behind a plain round-robin load balancer with no sticky sessions and no shared session store. The second pass is the one this post is about: the thing that used to tie a request to a conversation is now a string the model carries in its context window, and strings in a context window can be read, copied, and planted by anyone who can inject text the model trusts.
VentureBeat put the sharp version in a headline on September 5: MCP's new spec turns a planted prompt into a stolen credential. This post walks the same ground from a server author's seat, which is the seat I actually sit in: I maintain a small static analyzer for MCP servers, and the new spec quietly broke one of my assumptions about where credentials live. What changed on the wire, the three ways a handle gets stolen, and the per-request checks I now treat as mandatory.
Here is roughly how a client talks to a server now. No handshake line, no session header, one self-contained request:
