MCP goes stateless: the 2026-07-28 spec kills the session

The Model Context Protocol just got a major overhaul. The 2026-07-28 specification makes MCP fully stateless, removing the session handshake and the Mcp-Session-Id header from the core request path. This is a breaking change, but it's one that simplifies deployment dramatically.

Previously, MCP servers required a stateful connection between client and server, inherited from the original STDIO transport designed for local applications. When servers went remote, that statefulness translated into sticky sessions, open streams, and message replay — overhead that most interactions never needed. Now, each request carries the protocol version, client identity, and capabilities it needs. A client can optionally call server/discover to inspect a server, but it's not required.

For Cloudflare, this means MCP servers can run in a plain Worker, no Durable Object required. The McpAgent primitive is no longer needed for protocol compliance, though Durable Objects remain useful when the application itself needs state. Cloudflare's Agents SDK has supported the new spec since day one, and the migration path from McpAgent to the new createMcpHandler has been tested in production.

Elicitation without open streams

Server-initiated requests like elicitation/create previously depended on an open stream. The new protocol replaces this with Multi Round-Trip Requests (MRTR). A server can return an input_required result describing what it needs; the client collects the answer and retries the operation. No transport session is preserved between requests. This is a breaking change, but it's operationally much simpler.

HTTP infrastructure can now understand MCP

The spec adds Mcp-Method and Mcp-Name headers to Streamable HTTP requests, so gateways, rate limiters, and WAFs can make decisions without parsing JSON bodies. Tool catalogs are deterministically ordered, and ttlMs and cacheScope hints on list results help keep caches stable across reconnects.

Authorization tightens

MCP now prefers pre-registered clients, then Client ID Metadata Documents (CIMD) for dynamic registrations, with Dynamic Client Registration (DCR) as a deprecated fallback, slated for removal after summer 2027. The spec also adopts RFC 9207 issuer identification to prevent authorization response confusion.

A lifecycle for a maturing standard

Features are now classified as Active, Deprecated, or Removed, with a minimum 12-month deprecation window. Roots, Sampling, Logging, DCR, and the legacy HTTP+SSE transport are deprecated in this release, giving teams time to plan upgrades.