The Model Context Protocol’s July 28, 2026 revision removes protocol-level sessions and makes requests more self-contained, simplifying scale-out deployments but changing where security controls need to live.
Applications can still maintain state, but they can no longer assume that possession of a session identifier is itself a trust boundary. MCP’s security guidance says portable state handles should be bound to verified users and re-authorized on each request rather than treated as credentials on their own.
The same principle applies to OAuth and client-rendered interfaces. Current guidance calls for protections such as PKCE, strict redirect validation, audience-bound tokens, sandboxing and careful handling of untrusted content.
The new specification is not evidence that MCP is inherently insecure. The risk is in implementations that adopt the scalable stateless architecture without moving the corresponding authorization checks to the endpoint.