MCPP-TRN09: Session ID minted on a stateless revision¶


Family	Transport
Default severity	`info`
Confidence	`high`
Mode	passive (default scan)
Spec revisions	2026-07-28

Why it matters¶

Revision 2026-07-28 removed protocol sessions: servers should not mint or echo Mcp-Session-Id. A leftover session layer is unused attack surface.

Remediation¶

Drop session handling when serving 2026-07-28 clients; keep per-request authorization.

References¶

MCP 2026-07-28 Streamable HTTP

Suppressing¶

# .mcp-posture-ignore
[[ignore]]
check = "MCPP-TRN09"
target = "https://mcp.example.com/*"
justification = "Why this is acceptable here"
expires = 2026-12-31