MCP's July 28 Spec Deletes Sessions and the Handshake

MCP's final revision deletes three load-bearing pieces of the protocol on July 28. Every team running an MCP server has six days to migrate, and the auth work the spec once handled for you becomes your job.

Mcp-Session-Id is deleted at the protocol level, per SEP-2567. The initialize and notifications/initialized handshake is gone too, per SEP-2575. Servers now read protocol version and capabilities from _meta on every request, plus a mandatory server/discover RPC. Tasks move out of core entirely into an extension, with polling via tasks/get replacing the old blocking tasks/result call, per SEP-2663. Stacktree has the full breakdown.

The fix is mechanical. Mint your own server-issued handles and pass them as ordinary tool arguments. Drop sticky routing from your load balancer, since there's no session left to be sticky about. Bind each handle to the user who created it. New ttlMs and cacheScope fields on list endpoints are the one addition worth adopting.

Killing protocol-level sessions kills protocol-level session hijacking, which is a real win. But it also moves whatever the spec handled implicitly around auth onto you, with no protocol fallback if you get it wrong.

Mercury, Pleo, and Spendesk all shipped MCP integrations in the same window Ramp shipped finance agents. Salesforce exposed its whole platform through MCP tools with Headless 360. Vercel's MCP server can now execute purchases, including Pro upgrades and paid add-ons, straight from an agent conversation.

Adversa AI ran static and taint analysis across more than 10,000 real MCP servers. They found credentials, API keys, and PII leaking through tool handlers at rates above 10 percent. Adversa's framing is that the leakage is protocol-induced, not sloppy code. The handler contract encourages passing raw environment and response data back through the tool boundary.

A protocol that's load-bearing for finance and CRM agents is leaking credentials at that rate in the wild. It's about to hand its auth boundary to whoever wrote your server code. Watch whether any vendor ships a standard consent or spend-limit primitive before more purchase-capable integrations like Vercel's show up.