MCP is a published spec, which is the only reason an agent built by one company can call a tool built by another. It gets versioned like any other protocol, and a new version landed on July 28. That version removes the initialize handshake and the Mcp-Session-Id header, the two pieces that told a server a conversation had started and which conversation it was. If you built governance around the session, you built it on something the protocol no longer has.
Here is what the old shape looked like. A client opened a connection, sent initialize, got capabilities back, and received a session ID it carried on every request after that. Anything sitting in the middle could latch onto that ID. You could pin a session to one server instance, resolve the user's identity once at handshake time, cache the policy decision against the ID, and count tool calls against it for the life of the connection. The protocol was stateful, and that state was quietly doing governance work for you.
Now every request is self-describing. Client identity travels in a _meta object in the JSON-RPC envelope under io.modelcontextprotocol/clientInfo, and the protocol version rides in an MCP-Protocol-Version header. Capability discovery became an ordinary RPC method, server/discover, called when a client wants it rather than at connect time. Any request can land on any instance behind a plain round-robin load balancer. The protocol is stateless now, and nothing carries from one call to the next.
What this breaks
Policy that was decided once per session now has to be decided per request. If you were resolving identity at handshake and caching it against the session ID, there is nothing left to key the cache on.
Rate limits, spend caps, and tool-call budgets that lived in connection state need somewhere else to live. The protocol got stateless. The requirements did not. That state moved into your infrastructure, and if you do not have infrastructure for it, it moved nowhere.
Sticky routing stops being load-bearing, which is the one item on this list that makes life easier.
What you get back
Two new headers: Mcp-Method carries the RPC method, Mcp-Name carries the tool or operation name. A proxy can route, meter, and make coarse allow and deny decisions off those without deserializing the body. On high-volume agent traffic that is a real saving.
It also has a sharp edge. Those headers are client-supplied hints, and nothing in the protocol forces them to agree with the body. A gateway that allows on Mcp-Name: read_file and forwards a body calling delete_file is a confused deputy with good logging. Use the headers for routing and metering. Parse the body before you authorize. We treat a header and body mismatch as a rejected request and a logged event, on the theory that it is either a broken client or someone measuring how carefully you look.
The authorization changes are the part we think is underrated. Authorization servers should now return the iss parameter per RFC 9207, and clients validate it before redeeming a code, which closes the authorization server mix-up hole. Client credentials are bound to the issuer that minted them, so a credential from one authorization server cannot be replayed against another. Dynamic Client Registration is on the way out in favor of explicit registration and Client ID Metadata Documents.
And Enterprise Managed Authorization is now a named extension, which means central IT can provision client access through the identity provider instead of every developer registering a client and hoping someone writes it down. That is the first piece of the spec that reads like it was written for the person who has to answer for what the agents did.
Where this leaves you
Roots, sampling, and protocol-level logging are deprecated, and the legacy HTTP+SSE transport gets a year-long offramp. The spec commits to keeping deprecated features working for at least twelve months, which is the new minimum window for breaking changes. Twelve months sounds generous until you remember that most MCP servers in production have no owner listed anywhere.
The short version: the unit of control used to be the connection, and now it is the request. If your audit trail, your identity resolution, and your policy checks were all hanging off a session ID, they are hanging off nothing. That work has to happen on every call now, which is more expensive and considerably harder to get wrong quietly.