By: Gary W. Phipps, Head of Customer Success

The Model Context Protocol is finally maturing. On July 28, 2026, a stateless rewrite became the new standard, and it’s the biggest change MCP has seen since it launched. MCP is no longer a niche developer tool. It’s quickly becoming core infrastructure for how AI agents operate inside real companies, and infrastructure changes deserve a close look.

Good news first. This release closes real holes; long-lived sessions are gone, taking a whole category of hijacking with them. Servers can no longer push surprise prompts to clients out of nowhere. Authentication finally lines up with how modern OAuth actually gets deployed. These are the attack paths removed at the source.

The wrench. A stateless protocol still must remember where a workflow left off, and that memory now lives with the client, riding along in tracking IDs and state data that then get handed back to the server on every request. Anything the client holds is something an attacker can try to fake…essentially moving the security structure elsewhere.

The protocol is safer than it’s ever been, but the servers built on top of it now carry more of the load. Get the implementation wrong, and attackers can hijack sessions across users, escalate privileges through unverified data, or find their way into workflows that were never meant for them.

At Helmet, we spend a lot of time thinking about how AI coding agents handle MCP in practice, and this is exactly the trend we’d expect to keep seeing. Agents that act on a repository’s MCP setup before anyone has decided that repository is trustworthy. Just opening a project can be enough to trigger code execution or a connection to a server that an attacker controls. Risk doesn’t lessen overnight just because the protocol layer got a bit safer.

It’s the same story from two different perspectives. The new spec hands trust decisions to the people building MCP servers. On the client side, agents are often left making trust decisions of their own, without asking anyone first. A protocol can define where the boundaries sit, but it’s still up to the people and the software on either side to actually hold them.