MCP's spec pushes auth checks to every request

MCP's spec pushes every request to carry its own authorization context, replacing a session trusted once at connect time and never checked again, per AAIF. That closes off a class of attack for anyone self-hosting an MCP server: session hijacking, where a stolen connection rides on trust nobody re-checks. It also closes off confused-deputy attacks, where a server acts on a request without confirming who actually authorized it.

The effect: a gateway sitting in front of an MCP server can check policy on every call, not just once at the door.

AAIF's post doesn't say how existing servers migrate, or when session-trust support actually goes away. It just states the direction: per-request checks, not session trust, going forward.

The spec change is the easy part. The harder problem is every self-hosted MCP server that already trusts a session past the handshake. That trust doesn't get safer just because the spec moved on. Building a new server around per-request checks from day one is far cheaper than ripping session trust out of a dozen live integrations later.