Your agent calls create_booking through MCP, gets back a confirmation ID, hands that ID to add_extras. Then the user changes their mind. You want to undo the thing, and the first place you look is the protocol.
Here's how far that gets you after the July 2026 revision, which matters if your tools touch anything outside the process.
Before July, create_booking lived inside a protocol session: an initialization handshake, a server-assigned ID, calls grouped into a sequence. That grouping suggested a transactional container, something you could close or roll back, and no such thing was ever there. Sessions are gone now. The handshake was replaced by per-request metadata — every request carries its own version and capabilities in _meta. The reasons were operational and I don't argue with them. Sticky load balancers are miserable, and session state that evaporates when a server dies is worse. What went out with the sessions was the appearance of a container.
What replaced them:
"Explicit, server-minted handles passed as ordinary tool arguments."
Sevda Polat, tracing a shopping sequence through the same change, called it "Guidance, not machinery." The tools page says as much itself: the stateful-tools section is non-normative. On the wire, a handle is a string in a tool result and a string in the next call's arguments. Your booking_id moves forward because the tool description told the model to move it.
Now follow the booking. The server took your call, talked to a reservation system, and a room is held. Somebody's inventory went down by one. MCP standardized the shape of the call and the shape of the result. Whether the reservation can be reversed, when it commits, when it becomes final — the spec doesn't touch any of it.
The cancellation that does exist in the spec is narrow. notifications/cancelled with a request ID tells the server to stop processing, and the server may ignore you if processing already finished. The Tasks extension adds tasks/cancel for durable work, cooperative by design: the server decides whether and when to honor it. These mechanisms can stop a request still in flight. Search the July schema, the tools page, the cancellation page, and the Tasks spec for "rollback," "undo," or "compensation" — terms that would apply to a room already held — and you get nothing.
You might land on the annotations in the tool schema — readOnlyHint, destructiveHint, idempotentHint — and figure a client could reason about retries or confirmation prompts from those. The spec's own position is that hints may not faithfully describe behavior and must be treated as untrusted unless the server is trusted. There's no annotation for cancellability or reversibility. Idempotency is as close as the schema comes to describing what a repeat execution does, and idempotent isn't reversible.
So the protocol gives you invocation, result containers, in-flight cancellation, and hints it tells you not to trust. The July revision didn't open new holes in reversibility — it took away the abstraction that made the existing ones easy to walk past.
Which leaves a set of decisions sitting in your lap, explicitly now instead of implicitly. Whether cancel_booking exists at all. What it returns when the downstream system says no. What it does when the agent calls it forty minutes after the free-cancellation window closed and the real answer is a fee that somebody has to eat. The protocol will carry your handle from one call to the next. What happened at the far end of it was never its department.
- MCP server authentication gaps: A May 2026 measurement study found that 40% of live remote MCP servers exposed tools without authentication, and every OAuth-enabled server tested had at least one flaw — context that matters when the July revision's handle guidance distinguishes authenticated from unauthenticated servers.
- Tool metadata as attack surface: A peer-reviewed AAAI benchmark built from 45 live MCP servers and 353 real tools found widespread agent susceptibility to instructions hidden in tool descriptions, which complicates the already-thin trust model around tool annotations.
- Agent audit trail proposals: An individual Internet-Draft proposes structured pre-execution and post-execution records with hash-linked predecessors, but it has no IETF consensus and its stated EU AI Act timeline is already out of date with the final July 2026 amendment.
- W3C agentic commerce workshop: The September 8–9 W3C/GS1 workshop lists agent identity, delegation, authorization, and "last reversible moment" among its sessions, suggesting that the reversibility questions MCP leaves open are becoming explicit standards-body agenda items.