A number of years in the past, I helped transfer an software off sticky classes so we may scale behind an extraordinary round-robin load-balancer. On paper it was an infrastructure change. Each service was alleged to be stateless, so eradicating session affinity ought to have modified nothing.
Nothing crashed. CPU seemed regular. Each well being examine stayed inexperienced. However customers began reporting workflows that will randomly leap backwards. One request would choose up precisely the place the earlier one left off. The subsequent would behave as if it belonged to a wholly totally different dialog.
The bug wasn’t in our enterprise logic. It was in an assumption we’d inherited about the place correlation lived. We’d quietly relied on the platform to recollect which requests belonged collectively. As soon as that duty disappeared, our software didn’t fail loudly. It simply grew to become inconsistent in ways in which have been very arduous to breed.
We fastened it the plain means. We stopped counting on the platform and began passing an specific identifier on each request. It labored, and it stored working, as a result of the factor carrying that identifier did precisely what we advised it to do.
That’s the incident I stored fascinated by whereas I learn the brand new Mannequin Context Protocol specification.
When MCP shipped its stateless core on July 28, I did what everybody else did. I opened the changelog, discovered the SDK migration notes and scoped the work. The code diff was smaller than I anticipated. I took that as excellent news for about 4 hours.
I’d been studying it as a transport change. Periods gone, requests self-contained, no sticky routing. All true, and all coated elsewhere. What I missed was what the maintainers had performed with correlation.
They didn’t delete it.
They handed it to the mannequin.
What the spec truly moved
Buried within the launch publish is steering for servers that also want state throughout calls: mint an specific deal with from a instrument, akin to a basket ID or a browser ID, then have the mannequin go it again as an extraordinary argument on later calls. The maintainers are clear about why. The mannequin can see the deal with and thread it between instruments, as a substitute of state hiding in a connection you possibly can’t examine.
From an engineering standpoint, I feel they’re proper. It scales, it survives a load-balancer and it matches how HTTP APIs have labored for many years.
However learn it once more as an operator. The identifier your server makes use of to determine which basket, which doc or which tenant is now carried by a language mannequin, held in its context window and re-emitted on a later flip.
We simply made an LLM a part of the request path. That’s not a sentence I anticipated to jot down a few transport specification.
It means your server’s correctness now relies upon, partially, on the mannequin faithfully carrying an identifier from one flip to the following.
There’s an objection I hear each time. MCP was at all times stateless in the best way that issues, individuals say. It by no means held your purchasing cart. It by no means saved your pull request. Join a calendar and the mannequin received’t know concerning the assembly you added ten minutes in the past till one thing fetches it. All right, and all true since launch.
However MCP at all times had two sorts of state. The primary is your software’s information, which lives in your software, in GitHub or in Outlook. MCP by no means owned that and nonetheless doesn’t.
The second is protocol session state: the handshake, the negotiated capabilities and the session identifier that advised the server two requests belonged to the identical dialog. MCP did personal that one, and that’s the one which’s gone.
The confusion runs in a handy route. Should you imagine MCP was at all times stateless, this launch seems to be like a scaling optimization with no architectural penalties.
It isn’t.
The protocol didn’t take away your software’s state. It relocated correlation, out of a protocol-managed session and into an argument the mannequin carried from one flip to the following.
We have now measurement on this
What turns this from an statement into one thing groups get harm by is that threading an identifier throughout turns isn’t novel. It has a reputation within the analysis literature. Cross-turn data fusion is among the many most studied failure modes in multi-turn mannequin habits.
“LLMs Get Misplaced in Multi-Flip Dialog,” an excellent paper at ICLR 2026, ran greater than 200,000 simulated conversations throughout fifteen main open and closed-weight fashions. It discovered a 39% common efficiency drop in multi-turn settings in opposition to single-turn settings with similar data. Perform calling was one of many six duties examined.
First, how the degradation decomposes. Aptitude falls about 16%. Unreliability rises 112%. The fashions keep succesful and change into dramatically much less constant. Should you’ve shipped something agentic you understand what that appears like from the surface: a system that works in each demo, passes each take a look at you wrote, then produces one inexplicable end result per week that no one can reproduce.
Second, not all the pieces degraded. Translation, which might be performed sentence by sentence with no dependency between turns, confirmed no degradation in any respect. What fell aside have been the duties that required data to be carried throughout turns and fused.
That’s precisely what a deal with is.
So, the protocol relocated session state into the one place we’ve the strongest proof fashions wrestle: carrying data reliably throughout turns. It did so for good causes.
It is a failure mode I’ve hit repeatedly on agentic techniques, and it’s why I’ve change into unbearable about observability. When a mannequin passes the improper deal with, your server doesn’t get an error. It will get a well-formed request with a valid-looking argument. If the deal with factors at an actual object, the decision succeeds.
No log line says the mannequin misplaced the thread. No metric turns pink. A session that quietly break up into two half-populated baskets seems to be precisely like a person who modified their thoughts.
Purple Hat revealed an incident writeup just lately that exhibits the form of it, with no MCP concerned. An agent wanted to cost Account A. The identifier was proper there in its immediate. The mannequin chosen Account B. The billing API accepted the decision, and 4 thousand {dollars} went to the improper buyer. It had handed each take a look at in staging.
In extraordinary software program, a misrouted name is contained by two issues: credential scoping limits what a workload can attain, and the downstream API enforces which parameters are legitimate for that caller. No one would ship an online software the place one set of credentials may write to each buyer’s billing document. We ship brokers like that on a regular basis.
Now take that failure and make the identifier one thing the mannequin carries throughout turns as a substitute of one thing handed to it in a single immediate.
There’s a second-order consequence I haven’t seen raised. Comply with the chain. Your server’s habits depends upon the deal with. The deal with is carried by the mannequin. The mannequin is chosen by the consumer, not by you.
So, the reliability of your MCP server now relies upon, partially, on whichever mannequin the consumer occurs to be utilizing. That varies throughout distributors, throughout mannequin upgrades and throughout the identical consumer over time. The ICLR paper discovered significant unfold throughout the fifteen fashions examined. Your integration suite runs in opposition to one among them.
What I’m doing about it
Nothing unique. The controls are extraordinary. Solely the reason being new.
I authorize each deal with in opposition to the authenticated caller on each request, with no exemption for inside instruments. I give them actual entropy and quick lifetimes. I exploit idempotency keys so a retry after a misplaced deal with doesn’t quietly create a second object. And I take a look at at flip depth thirty quite than flip one, as a result of flip one is the place all these techniques look advantageous.
The adversarial studying of this isn’t mine. Akamai’s menace analysis crew received there first, and SecurityWeek coated it forward of the ultimate specification: as soon as protocol classes are gone, the handles that exchange them change into the assault floor, opening paths to workflow hijacking, studying one other agent’s information and cross-tenant actions.
I’d add one wrinkle.
A session identifier lived in a protocol header the mannequin by no means noticed. A deal with lives within the context window, proper subsequent to regardless of the final instrument name returned. If any of your instruments ingest untrusted content material, whether or not an online web page, a ticket physique or a buyer e-mail, your state identifier and an attacker’s textual content now sit in the identical context, interpreted by the identical mannequin.
I’d quite have specific handles I can audit than session state hidden in a connection. That’s the higher structure and I’d have voted for it.
However there’s a distinction between state you possibly can see and state you possibly can belief.
This launch solved the primary downside by introducing the second.
Which leaves the query I can’t cease fascinated by.
If the identifier is now carried by the mannequin, what precisely is the boundary that decides whether or not it ought to have been trusted within the first place?
That’s not a transport query.
It’s an id query, and the reply isn’t on this specification.
