diff --git a/apps/mcp/src/server/auth/index.test.ts b/apps/mcp/src/server/auth/index.test.ts
index 7adb52c4..55b5a197 100644
--- a/apps/mcp/src/server/auth/index.test.ts
+++ b/apps/mcp/src/server/auth/index.test.ts
@@ -177,7 +177,7 @@ describe("MCP authentication", () => {
 			scopes: [],
 		})
 		expect(fetchSpy).toHaveBeenCalledWith(
-			`${API_URL}/v3/session`,
+			`${API_URL}/session`,
 			expect.objectContaining({
 				headers: { Authorization: `Bearer ${key}` },
 			}),
@@ -197,14 +197,16 @@ describe("MCP authentication", () => {
 	it("rejects an API key the session endpoint refuses", async () => {
 		const warn = vi.spyOn(console, "warn").mockImplementation(() => {})
 		const error = vi.spyOn(console, "error").mockImplementation(() => {})
-		vi.stubGlobal(
-			"fetch",
-			vi.fn().mockResolvedValue(new Response(null, { status: 401 })),
-		)
+		const fetchSpy = vi
+			.fn()
+			.mockResolvedValue(new Response(null, { status: 401 }))
+		vi.stubGlobal("fetch", fetchSpy)
 
 		await expect(
 			validateApiKey("sm_revoked_key_0123456789abcdef", API_URL),
 		).resolves.toBeNull()
+		expect(fetchSpy).toHaveBeenCalledTimes(1)
+		expect(fetchSpy.mock.calls[0]?.[0]).toBe(`${API_URL}/session`)
 		expect(warn).toHaveBeenCalledTimes(1)
 		expect(warn).toHaveBeenCalledWith(
 			"API key rejected: Session request failed with status 401",
diff --git a/apps/mcp/src/server/auth/index.ts b/apps/mcp/src/server/auth/index.ts
index b1e56bf9..006cf66d 100644
--- a/apps/mcp/src/server/auth/index.ts
+++ b/apps/mcp/src/server/auth/index.ts
@@ -31,7 +31,7 @@ export async function fetchSession(
 	bearerToken: string,
 	apiUrl: string,
 ): Promise<SessionInfo> {
-	const response = await fetch(`${apiUrl.replace(/\/+$/, "")}/v3/session`, {
+	const response = await fetch(`${apiUrl.replace(/\/+$/, "")}/session`, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${bearerToken}` },
 		signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
diff --git a/apps/mcp/src/shared/types.ts b/apps/mcp/src/shared/types.ts
index ad59a02b..a1834f72 100644
--- a/apps/mcp/src/shared/types.ts
+++ b/apps/mcp/src/shared/types.ts
@@ -11,7 +11,7 @@ export const namespaceAccessSchema = z.object({
 
 export type NamespaceAccess = z.infer<typeof namespaceAccessSchema>
 
-// /v3/session has no v5 replacement and still sends container-tag field names.
+// /session still sends container-tag field names.
 const sessionNamespaceAccessSchema = z
 	.object({ containerTag: z.string(), permission: z.enum(["read", "write"]) })
 	.transform(({ containerTag, permission }) => ({