Stateless MCP is Simpler, Identity is More Complex Than Ever

On July 28, 2026, the Model Context Protocol shipped its largest revision since launch. In the latest release, sessions and the initialization handshake are removed, and every request now stands alone on the credential it carries. That credential belongs to a non-human identity, which makes this an identity governance event, not just an infrastructure update. 

Most of the changes are technical housekeeping aimed at people who build and operate MCP servers. 

If you own identity or risk, it would be easy to file this one under "not my problem." But that would be a mistake. Buried in this update is a change that quietly shifts how you account for what your agents do. 

Once the connection no longer remembers anything, every request stands on its own, and the credential it carries, tied to a non-human identity, is all that answers for who is acting. This update turns out to have an identity question inside it.

‍

What changed in the July 28 release?

Most of the updates with this new spec are incremental and older versions get a full year of runway.

The primary change is that the protocol goes stateless. MCP used to open every connection with a setup handshake and pin that conversation to a single server that held its session state. This was problematic because requests for a given session had to keep landing on the same instance.

Dropping it means a request can hit any server instance behind a standard load balancer, so agents run on ordinary infrastructure, aren't stranded when an instance restarts, and scale to a whole workforce without sticky-session workarounds. 

The release also aligns the connection layer with the same OAuth and OpenID Connect standards enterprises already trust, so connections are better secured with less custom wiring.

The latest release also adds Enterprise-Managed Authorization, now backed by Okta, Microsoft, and Anthropic, which lets employees log in once and inherit access to approved servers while security teams set policy from one place. Together, these changes make agent access both safer and simpler to run.

Each of these updates focuses on how agents connect and how efficiently requests scale. Yet, none of them answer who the agent is once it is inside.

‍

What statelessness means for identity security

The MCP layer is going stateless by design. State still lives where it should, at the authentication layer and, when needed, the application layer, but the protocol itself no longer carries it. That's the point: MCP is being kept deliberately minimal, built to give agents the tools they need and little else.

That restraint splits security cleanly across two layers, and each secures something the other can't. The identity layer governs who the agent is and what it is authorized to do. The MCP layer governs what the protocol itself expresses, like which tool on which host (which is why the release even adds the tool name to the request headers, to make that kind of policy easier to enforce).

But covering both layers isn't the same as securing them. A good security solution has to coordinate the two, so identity decisions and MCP-layer policy are working from the same picture of what's happening, not telling two separate stories about the same request.

The identity layer is the more difficult challenge, and it's where the credential comes in. What's changing is what you could get away with. Previously, you could tie an MCP session to a task at your MCP security layer and lean on that association to carry ideas like: who's acting? and what is their purpose? 

Without a session to anchor to, that context now has to travel on the credential itself, which means reaching for the proper OpenID primitives: identity assertions for token exchange, actor claims, CIMD, and correctly re-minting the credential as it crosses trust domains. It's a hard transition for identity teams to make, and Oasis, alongside other leading vendors like Okta, is building the tooling that makes it workable.

This is also where most existing setups only cover half the problem. AI/MCP gateways secure the MCP layer. Advanced OpenID provider setups secure the identity context, and even then, most identity provider deployments in practice haven't caught up to the newer exchange primitives like ID-JAG.

The Oasis Platform works across both layers. Intent evaluation at the MCP layer lets it tailor and broker the identity a given agent mission actually needs, on top of giving you the tools to manage MCP-layer security itself. A tool call is allowed or blocked based on who the agent is and what it's trying to do, and at the resource level, based on the scopes actually granted, not just which tool it named.

‍

Govern the credential, not the connection

The practical implications follow from the same fact. If the credential and the identity behind it answer for every action, then governing them is the work.

• Agents and the servers they reach will multiply faster now that stateless servers are cheap to scale, so continuous discovery of these non-human identities matters more, not less.
• Standing, over-scoped agent credentials are your real exposure once the session is gone. Move toward least privilege and short-lived, revocable credentials.
• Every agent identity needs an explicit owner, so any action traces back to an accountable human and system.
• Revocation has to work fast and at fleet scale, because any instance can serve any request.
• Use what the agent is trying to do to decide the scope of the credential you mint, so the resource server enforces that scope without ever needing to interpret intent itself.

‍

Simpler protocol, bigger surface

MCP is now leaner by letting each request stand on its own, and the credential it stands on is a non-human identity. The efficiency is real, and so is the shift in where accountability lives. The risk was always there. Statelessness just removed what was quietly covering for it. Govern the identity that now carries all the weight, and you close the gap the protocol opened.

The Oasis Platform governs the non-human identities flowing through MCP, complementary to the connection layer rather than competing with it. If you want a structured way to evaluate what that governance should include, start with the agentic access management framework.

‍