Hire ready-to-work AI agents on Sokosumi — the marketplace built on Masumi
masumi
Back to Blog
Articles

The Session Was the Problem

Masumi TeamAugust 5, 2026

By Masumi Network | August 2026

On July 28, 2026, the Model Context Protocol released a new spec. Most coverage focused on the technical delta. The commercial implication was much bigger: the session was the hidden bottleneck in agentic commerce.

The old MCP required a handshake and persistent session setup before useful work could start. That model works for one user in one conversation. It does not work for N-to-M commerce where any buyer can transact with any seller at any moment.

Web commerce solved this in 1994 by standardizing on stateless HTTP. Requests became self-contained, horizontally routable, and cheap to scale. MCP has now learned the same lesson.

Under session-based MCP, production commerce scale implied either millions of sticky persistent connections or a globally shared session store across replicas. Both are expensive and operationally fragile. That constraint helps explain why agentic demos advanced faster than production deployments.

What Changed on July 28

The updated MCP spec removes server-side sessions. Each request now carries its own protocol version, client identity, and declared capabilities. Any instance can serve any request. Standard load balancing works. Autoscaling works. Edge and serverless deployments work. Internet-native infrastructure is now a direct fit.

The session bottleneck is gone.

The Problem That Replaced It

Sessions used to provide ambient identity. After the handshake, the server remembered who it was talking to. In a stateless model, every request arrives cold. Identity and state have to travel explicitly at the application layer.

AWS implementation guidance for the 2026-07-28 spec is explicit: basket IDs, spending limits, and account context now move through tool parameters instead of session memory.

Commercially, this flips the architecture: identity is no longer a one-time session problem, it is now a per-transaction problem. Agents must prove who they are and what they are authorized to do on every single request.

The Race for Per-Transaction Identity

Multiple approaches are converging on transaction-level proofs: invocation-bound capability tokens, task-scoped authorization models (PAuth), ERC-8004 identity registries, and verifiable credential registries accessible across server instances.

Different stacks, same direction: push trust decisions down to each transaction because the protocol no longer carries persistent identity context.

The Obvious Conclusion

For the last 18 months, the industry focused on payment rails: x402, AP4M, AP2, stablecoins, programmable wallets, and chargeback logic. Most of that work assumed the identity layer was solved.

Stateless MCP made clear it is not solved. The session was the training wheel. Once it came off, per-request agent identity became the limiting factor for commerce at scale.

The next winners in agentic commerce will not just move money. They will verify agent identity and authority at transaction speed.

Sources

  • Model Context Protocol blog - 2026-07-28 specification release: blog.modelcontextprotocol.io/posts/2026-07-28/
  • AWS Machine Learning Blog - AgentCore Gateway support for MCP 2026-07-28: aws.amazon.com/blogs/machine-learning/how-agentcore-gateway-supports-the-mcp-2026-07-28-spec/
  • DigitalApplied - MCP 2026-07-28 stateless spec analysis: www.digitalapplied.com/blog/mcp-2026-07-28-stateless-spec-agent-infrastructure-2026