MCP went stateless: the control point moved

What the paper argues

The card’s argument turns on one sentence: headers are written by the client from the body, so they are asserted, not independently observed. The 2026-07-28 specification lets a gateway route, rate-limit and audit agent traffic without opening the request body, which makes it a better home for a control. It does not make the gateway a record. What the edge sees is what the client declared. It cannot see the query, path, diff or message body, any parameter the server did not annotate, or what the call actually did downstream.

The gap the card names is between traffic telemetry and accountability. Traffic logs answer what was called. Accountability answers who authorised it, against which policy, and what resulted, and the second set does not appear because you enabled the first. A gateway that logs tool names and call counts has no authorising party, no policy and no outcome.

Key points

• Client identity is not guaranteed at the edge, because clientInfo is a SHOULD. The card advises minting your own correlation identifier and carrying it end to end, using the OpenTelemetry trace context conventions the spec documents in _meta: traceparent, tracestate and baggage.
• Where correlation relied on the server-minted session ID, that spine is withdrawn. Anything reconstructable by accident before is now deliberate or absent.
• The core protocol defines no idempotency key, and a broken stream now loses the in-flight request. Anything that moves money, provisions infrastructure, sends a message or deletes something needs a key held by the tool.
• Policy that lives inside the agent runtime or the MCP server sits inside the thing it governs. It holds only while that thing cooperates.
• Header requirements for notification POSTs are undefined in this revision, so the audit should be built around requests, where every compliant POST carries MCP-Protocol-Version. If nothing in the estate can say which revision it is on, that is the first finding.
• Controls that depend on protocol features inherit the protocol’s release cadence. A twelve-month deprecation window is policy now, but it is still a clock.