Stateless MCP shifts accountability to NHI credentials and policy

At a glance

What this is: MCP’s stateless revision makes each request stand alone on its credential, shifting accountability from session context to non-human identity governance.

Why it matters: IAM, IGA, PAM, and NHI teams now have to treat every agent request as an identity event, because stateless transport removes the session-based assumptions many controls relied on.

By the numbers:

• Only 18% of MCP server deployments implement any form of access scoping for tool permissions.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
• Only 5.7% of organisations have full visibility into their service accounts.

👉 Read Oasis Security's analysis of stateless MCP and NHI governance

Context

Model Context Protocol has become a practical identity problem, not just a transport-layer update, because stateless requests force every action to be evaluated on the credential attached to it. In primary NHI governance terms, that means accountability, authorisation, and traceability all move closer to the non-human identity carrying the request.

The governance gap is not whether MCP can scale. It is whether identity teams can govern agent credentials, token exchange, and revocation without relying on session memory to preserve context. For the broader non-human identity problem space, that makes this update a useful test of whether current IAM controls still match runtime reality.

Key questions

Q: How should security teams govern MCP requests without relying on session state?

A: Treat each MCP request as a standalone identity event. That means binding authorization to the credential, token scope, and actor claims rather than to conversation history. Teams should assume the connection may change, the server instance may change, and the identity decision must still be verifiable on every call.

Q: Why do MCP servers increase NHI governance risk?

A: MCP servers expose tools to AI clients, which turns each request into a machine identity decision. That creates risk when teams rely on broad client trust, persistent secrets, or prompt-based restrictions. The more dynamic the tool use, the more important it becomes to scope access at the server and not inside the model context.

Q: What breaks when teams assume MCP session context will preserve accountability?

A: Accountability breaks when the protocol no longer remembers the session, because attribution, purpose, and scope can no longer be inferred from connection history. Teams then need identity-native evidence such as token exchange records, ownership mapping, and request-level authorization logs.

Q: Who is responsible for revoking over-scoped MCP credentials?

A: The owning security and identity function must treat MCP credentials like any other governed NHI asset. That means explicit ownership, fast revocation, and lifecycle review. If revocation depends on a transport session ending, the control is already too weak for stateless requests.

Technical breakdown

Stateless MCP and request-level identity context

Stateless MCP removes the conversation memory that earlier implementations could use to infer continuity. Each request now stands alone, so the credential must carry the identity context needed for authorisation, audit, and policy evaluation. That makes OAuth and OpenID Connect primitives more important, because token exchange, actor claims, and re-minting become the mechanisms that preserve who is acting across trust boundaries. Without that, the protocol can route the request, but it cannot explain it.

Practical implication: identity teams need request-level policy and token handling that survive without session state.

Why non-human identity governance becomes the control plane

When the protocol no longer remembers a session, the non-human identity behind the request becomes the durable unit of governance. That identity needs ownership, scoping, revocation, and lifecycle control just like any other high-value NHI, but with a shorter operational window and more dynamic tool use. The risk is not only excess privilege; it is the loss of contextual guardrails that used to sit in the connection layer. Governance has to follow the credential, not the connection.

Practical implication: treat every agent credential as a governed identity with explicit ownership and scope.

Tool permissions, authorization boundaries, and policy enforcement

MCP’s stateless model separates protocol mechanics from security intent. The protocol can expose which tool is being called, but it should not be forced to infer business intent from the request itself. That is why policy has to align the identity layer with the tool layer, so authorization decisions reflect who the agent is, what it is allowed to do, and which resource scope was actually granted. In practice, this is a Zero Trust problem for non-human identity.

Practical implication: enforce least privilege at the resource layer, not just at the protocol layer.

Threat narrative

Attacker objective: The attacker aims to turn a single exposed or over-scoped NHI credential into repeated tool access, unauthorized actions, and scalable misuse across MCP servers.

1. Entry occurs when an agent is issued a credential that can be used against a stateless MCP server without session-based context to constrain it.
2. Escalation happens when over-scoped or standing NHI credentials are reused across requests, allowing broader tool access than the original task required.
3. Impact follows when the same credential can reach multiple servers and tools, turning one unmanaged identity into repeated unauthorized actions at scale.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• IOS app secrets leakage report — iOS apps leaking hardcoded secrets and credentials endangering user privacy.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Stateless protocol design creates an identity governance event, not just an MCP engineering update. The moment session memory disappears, every control that depended on connection continuity becomes weaker or irrelevant. That does not mean MCP is less secure by default. It means identity governance must now carry the burden that the protocol used to mask, and the practitioner conclusion is simple: govern the credential, not the connection.

Session-based accountability was designed for human-paced, stateful workflows, and that assumption fails here. A request can now arrive without a remembered conversation, a sticky server, or a preserved handshake trail. The implication is not merely more logging. It is that the accountability model itself must shift from connection history to continuously governed non-human identity behavior.

Ephemeral transport does not remove privilege risk, it concentrates it. Once requests are stateless, the standing credential becomes the durable control surface, and any over-scoping travels across every request the agent makes. The strongest framework fit here is OWASP-NHI combined with Zero Trust thinking, because the trust boundary has moved from the session to the token, and the practitioner takeaway is to treat token scope as the primary blast-radius control.

Tool-level policy is necessary, but it is not sufficient unless identity and authorization are aligned. The article’s strongest point is that protocol minimalism can coexist with stronger security only if the identity layer and MCP layer share the same policy picture. That aligns with NIST CSF and NIST SP 800-53 access control discipline, and the field should read this as a governance consolidation problem, not a routing optimisation.

Stateless MCP will accelerate AI and agent adoption faster than many identity programmes can absorb. By lowering infrastructure friction, it increases the number of agent credentials that must be inventoried, owned, scoped, and revoked. That makes NHI lifecycle discipline the deciding factor for whether MCP expansion is manageable or merely easier to deploy.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• Only 71% of NHIs are not rotated within recommended time frames, which leaves standing credentials exposed long after the task that created them has ended.
• For lifecycle depth, the Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs shows how provisioning, rotation, and offboarding need to work together.

What this signals

Stateless MCP will push identity teams toward request-level governance, but the real pressure will be on visibility. If only 5.7% of organisations can see their service accounts clearly, as our research shows, then most programmes will struggle to prove which agent identity was responsible for a given tool call. The practical signal is that MCP expansion will expose gaps in NHI discovery faster than it exposes protocol weaknesses.

Credential ownership becomes the new operational boundary for MCP governance. As requests become independent and portable across servers, teams will need a cleaner ownership model for agent credentials, including revocation authority and lifecycle review. The organisations that already run NHI Lifecycle Management Guide-style processes will adapt more quickly than teams still treating service accounts as infrastructure residue.

For practitioners

• Inventory every MCP-exposed non-human identity Build a complete register of agent credentials, service accounts, API keys, and tokens that can reach MCP servers, then assign an explicit human owner for each one. Prioritise credentials with no expiry or no clear business purpose, because stateless transport removes the session trail that once helped expose them.
• Rebase authorisation on token scope, not request history Review whether current policies still depend on session continuity, sticky routing, or conversation memory. Move enforcement to short-lived credentials, actor claims, and least-privilege scopes that are evaluated on every request.
• Enforce fast revocation at fleet scale Test revocation across all MCP-serving instances, not just a single gateway, because any node may handle the next request. Measure how quickly a compromised credential can be invalidated across the estate and close the gap where revocation is slower than request routing.
• Separate protocol handling from identity policy decisions Keep MCP routing logic from becoming the place where business intent is inferred. Put policy in the identity layer so the same authorization model governs access across all servers, tools, and trust domains.

Key takeaways

• Stateless MCP does not remove identity complexity, it concentrates it in the credential that now carries each request.
• The governance gap is visibility and lifecycle control for non-human identities, not just protocol hardening.
• Practitioners should shift from session-based trust assumptions to request-level ownership, scope, and revocation.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Request-level Authorization: Request-level authorization means access is decided for each request rather than once at login or network entry. It lets operators scope permissions by route, method, and identity, which is far more precise than broad network access and better suited to distributed systems and NHIs.

What's in the full article

Oasis Security's full blog covers the operational detail this post intentionally leaves for the source:

• The protocol changes behind stateless MCP, including the removal of session and handshake state.
• The identity primitives used for credential re-minting across trust domains, including actor claims and token exchange.
• The way Enterprise-Managed Authorization works across approved servers and policy administration.
• The operational detail behind the protocol and identity split that implementation teams will need before rollout.

👉 The full Oasis Security post covers the protocol changes, identity primitives, and authorization model in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building identity strategy or maturing governance across human and non-human identities, it is worth exploring.