MCP Just Went Stateless. Most Agent Stacks Just Broke.
Model Context Protocol just broke backward compatibility. 80% of clouds run MCP. Here's what actually shipped July 28th and what to do about it.
Model Context Protocol shipped its biggest revision two weeks ago — the 2026-07-28 specification — and the headline change is that MCP is no longer a stateful protocol. The initialize/initialized handshake is gone. The Mcp-Session-Id header is gone. Servers running the new spec may not talk to older clients at all[1].
Every LinkedIn take I've seen this week is celebrating it. "Enterprise-ready." "Cloud-native." "First-class HTTP workload."
They're not wrong. They're just skipping the part where your existing agent stack is now the older client.
If you've been quietly running an MCP server in production — for a customer service agent, a lead-scoring bot, an internal ops tool — the ground moved under you on July 28th. Here's what actually happened, and what I'd do about it if I ran a $5M business with a working agent in prod.
What MCP actually did
MCP is the protocol Anthropic released in late 2024 that lets an agent talk to tools — your database, your CRM, your Slack, your file system — through a single standardized interface. Think of it as USB-C for AI agents.
Adoption exploded. Wiz Research found MCP servers running in at least 80% of observed cloud environments in early 2026, and 5% of those environments had at least one internet-facing MCP server[2].
The old spec was stateful. You did a handshake, you got a session ID, the server remembered you between calls. Nice for building a local dev tool. Terrible for a production HTTP workload behind an enterprise gateway — because gateways, load balancers, and CDNs assume every request is independent.
The 2026-07-28 spec fixes that. MCP is now a request/response protocol. No handshake. No session ID. Every call carries whatever context it needs[3]. Tina Schuchman, Microsoft's Corporate VP for Engineering, called it "a first-class HTTP workload with no session management to work around"[3].
That's genuinely good. It's also genuinely painful for anyone who already shipped.
The migration everyone's underselling
The MCP team calls this "the most substantial changes we have made to the specification, probably since adding authorization"[1]. Their own words. Not marketing.
"A lot of things that made MCP are gone," is how Basil Parra, one of the protocol authors, put it[1].
Compatibility "requires both sides to share a supported protocol era, or for one side to implement deliberate fallback or translation"[1]. Translation: if your Cursor uses an older SDK than the server your agent hits, calls fail silently. Every SDK maintainer now has migration work. Every server you didn't write needs an upgrade window you don't control.
For a solo builder running one agent, this is a Saturday afternoon. For a business that wired MCP into three tools six months ago and hasn't touched it since, this is the moment you learn what "protocol era mismatch" means at 2 AM on a Tuesday.
The bigger problem no one is fixing
Here's the part I care about more, because the stateless migration will resolve itself in a quarter. The security story won't.
MCP has a fundamental design problem that the new spec does not touch: tools describe themselves to the agent in plain text, and the agent trusts the description.
That's called tool poisoning. Invariant Labs demonstrated it in April 2025 — they hid instructions inside a calculator tool's description and got the Cursor editor to read a user's private SSH key and send it to an attacker's server[4]. Later they showed the same trick working against a fake WhatsApp MCP server (exfiltrating message history) and a fake GitHub MCP server (leaking private repo contents)[5].
Microsoft's security team formally warned about the attack pattern in June 2026[4]. The NSA published a joint cybersecurity information sheet on MCP in May 2026, citing tool poisoning, rug-pulls, and shadowing attacks by name[6].
Then in April 2026, OX Security disclosed a systemic architectural flaw that exposes an estimated 200,000 vulnerable MCP instances across a supply chain of more than 150 million package downloads[7]. Not a coding error — a design-level issue with how MCP servers are packaged and discovered.
None of this is fixed by going stateless. The new spec adds enterprise-managed identity, which is real progress[3]. But the trust model — the LLM reads tool descriptions and does what they say — is the same as it was in November 2024.
What I'd actually do this month
If I were running a small business with a working agent in production, here's the ordered checklist. Not theoretical — the exact steps.
One. Find every MCP server your stack talks to. Look at your mcp.json (or equivalent config) on every dev machine, every server, every CI runner. Wiz says the average cloud has MCP running whether you knew it or not[2] — you probably have more than you think.
Two. For each server, note who publishes it and what version of the spec it targets. If it's community-maintained and hasn't shipped an update since June 2026, assume it will break within 90 days. Pin a version.
Three. Kill any MCP server whose tool descriptions you haven't personally read. Sounds paranoid until you remember that a poisoned description in a tool you installed six months ago will still be running the next time your agent calls it[8]. The exploit doesn't need code changes. It just needs the description text.
Four. Move to servers that support the 2026-07-28 spec and route them through a gateway with audit logging. The WorkOS analysis of the 2026 roadmap flagged this exact gap: no standardized audit trails, no auth tied to corporate identity, undefined gateway behavior[9]. Fix it before your legal team asks.
Five. For anything internet-facing, assume you'll be tested. That 5% of cloud environments running internet-facing MCP servers is the attack surface everyone's building blog posts around right now[2]. If you're in that 5%, you're the demo.
The take everyone's missing
MCP going stateless is not the story. The story is that a protocol most business owners have never heard of is now running quietly inside 80% of the cloud environments Wiz surveyed[2], the spec just broke backward compatibility in ways your average vendor hasn't announced[1], and the underlying security model still trusts text that any tool author can rewrite[8].
If you have an agent in production and you don't know what MCP version it speaks, you're not being cautious. You're being lucky.
I'd rather be prepared. So would you.
Want a real audit of the agent stack running in your business? Book a free 30-minute audit and I'll tell you exactly which MCP servers you're running, which ones are about to break, and which ones can already read files you don't want read. No pitch, no funnel.
-
Model Context Protocol prepares to break with its stateful past↩
MCP's 2026-07-28 spec brings the most substantial breaking changes since adding authorization.
-
Understanding Model Context Protocol Security (MCP) in 2026↩
MCP servers are running in 80% of observed cloud environments in early 2026.
-
The 2026-07-28 Specification↩
Official announcement of MCP's move to a stateless protocol core with enterprise-managed identity.
-
Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data↩
Microsoft security formally warned about MCP tool poisoning; Invariant Labs demonstrated the attack against Cursor.
-
MCP Security Notification: Tool Poisoning Attacks↩
Invariant Labs' primary disclosure demonstrating tool poisoning against WhatsApp and GitHub MCP servers.
-
NSA releases security design considerations for AI-driven automation↩
Coverage of the NSA AISC Cybersecurity Information Sheet on MCP, published May 20, 2026.
-
MCP Security Crisis: Systemic Design Flaws in AI Agent Infrastructure↩
OX Security disclosed a systemic MCP flaw exposing an estimated 200,000 instances across 150M+ package downloads.
-
MCP Tool Poisoning: How It Works & How To Fight It↩
Poisoned tool descriptions can trigger data exfiltration on subsequent agent calls without code changes.
-
MCP's 2026 roadmap makes enterprise readiness a top priority↩
MCP 2026 roadmap flags no standardized audit trails, no corporate-identity auth, and undefined gateway behavior.
Ready to build your own AI system?
Book a Free Audit Call →Keep Reading
Half The Fortune 500 Just Killed Their AI Agents. Do Not Copy Them.
KPMG says 49% of enterprises cut back AI agent rollouts because costs outran value. The tech isn't the problem — the buying model is. What smaller operators should do instead.
An AI Agent Just Attacked A Booking System. It Was Trying To Help.
An AI assistant hit a bug in a gym's booking system to help its own user grab a class. Australia calls it their first autonomous AI cyberattack.
The AI Safety Regulator Just Got Breached By The Agents It Was Testing
The UK AI Security Institute's own test agents attacked real GitHub maintainers for four days before anyone noticed. Here's what it means for your agent stack.