In depth
An MCP session is the unit of connection in the protocol. Sessions begin when a client calls `initialize`, negotiate capabilities, then run indefinitely until one side disconnects (stdio: process exit; HTTP: session close or timeout). Each session is independent — multiple sessions from the same client to the same server are valid and isolated.
For stdio transport, session = subprocess lifetime. For remote transports, sessions are identified by the `Mcp-Session-Id` header and can persist across many HTTP requests. Servers use the session ID to maintain state: active subscriptions, logged-in users, cached data.
Sessions are where authentication state lives. Once the client completes OAuth during initialize, the session holds the access token. Subsequent tool calls inherit this auth context without re-authenticating.
The session lifecycle is: `initialize` → `initialized` notification → normal operation (tools/call, resources/read, etc.) → `shutdown`. Errors during any phase terminate the session cleanly.