Model Context Protocol (MCP) in its 2026-07-28 release has become a fully stateless protocol after its core, interaction model, and related SDK packages were rewritten. Cloudflare says this change enables MCP servers to run inside a regular Worker without dedicated infrastructure to maintain protocol sessions, while reducing operational complexity and the cost resulting from additional components.
The new specification was launched last week alongside updated SDK packages for TypeScript, Python, Go, and C#. According to Cloudflare, servers can now receive a request, execute a tool, prompt, or resource operation, and then return the result without storing a protocol session between requests.
Eliminating Mandatory Sessions
Previous releases began with an initialize and initialized exchange to create a session, with the option to assign an identifier through the Mcp-Session-Id header. Every subsequent request had to access the state associated with that session, creating challenges for environments that rely on autoscaling and requiring deployments to drain or transfer active sessions. Losing an active server instance could cause the client to reconnect or the session to fail.
The new release removes the mandatory handshake, the Mcp-Session-Id header, and sessions from the core request path. Each request carries the protocol version, client identity, and required capabilities. Calling server/discover to inspect the server before carrying out another request is now optional.
This does not mean stateful applications are no longer necessary; Cloudflare notes that Durable Objects remain suitable when the application itself needs coordinated state. However, MCP no longer requires Durable Objects to communicate using the protocol, and servers that need request-scoped processing can scale on Workers.
Multi-Round Interactions Instead of Open-Ended Streaming
The release redesigned the elicitation mechanism, which is used when a server needs additional information before completing a request, such as approval to deploy a release to production or confirmation of a refund amount. Requests initiated by the server previously relied on open-ended streaming.
With the Multi Round-Trip Requests mechanism, the server can return a result named input_required that explains the required data. The client collects the response and retries the operation with that data, without either party retaining a transport session between the two requests. Cloudflare describes this change as breaking compatibility with the previous approach, but simpler operationally.
Making MCP Requests Understandable to HTTP Infrastructure
The new specification requires the Mcp-Method and Mcp-Name headers in Streamable HTTP requests. This allows a gateway, rate limiter, or web application firewall to determine whether a request invokes a tool or reads a resource without fully parsing the JSON-RPC payload.
The specification also added the ttlMs and cacheScope hints to the results of tools/list, prompts/list, resources/list, and resources/read, along with deterministic ordering for tool indexes, allowing them to be reused and keeping prompt-cache stability upon reconnection.
Authorization and Feature Lifecycle Changes
The new specification favors pre-registered clients when an existing relationship exists between the client and server, then uses Client Information Metadata Documents, CIMD, for dynamic registration, while Dynamic Client Registration, or DCR, becomes a fallback option. DCR has been deprecated for new applications, with plans to remove it after summer 2027.
The specification also adopts the RFC 9207 mechanism for identifying the issuer, and requires the server's canonical URL to be used as a resource according to RFC 8707 in authorization and token requests. Cloudflare says Workers OAuth Provider implements these requirements for MCP servers on Workers.
The specification now has an official lifecycle that classifies features as active, deprecated, or removed. A deprecated feature must remain available for at least 12 months before removal. Features announced as deprecated in this release include Roots, Sampling, Logging, DCR, and the old HTTP+SSE transport. MCP Apps and Enterprise-Managed Authorization have become extensions, while Tasks has been moved to the extensions framework to provide a path for long-running and reliable work.
Migration Path and Availability
The createMcpHandler interface is moving out of experimental status into the official MCP TypeScript SDK package, while Cloudflare continues to provide a Workers-oriented interface within the Agents SDK. The company also helped move the TypeScript SDK from Node.js to Web Standards to improve compatibility with Bun, Deno, and Cloudflare Workers.
Clients can migrate while maintaining compatibility with older specifications. The /mcp endpoint accepts the new protocol and stateless requests from Streamable HTTP clients using the 2025 version, allowing most clients to reconnect without configuration changes. Servers that rely on legacy sessions, server-to-client requests, or independent streams require a more careful migration path, such as running a stateless path alongside the legacy path until active sessions are drained.
Cloudflare says the new specification is available to clients and servers on its platform, and a stateless MCP server can be run on a Worker and secured through Workers OAuth Provider. According to the company, its Code Mode MCP Server for the Cloudflare API used this approach and reached thousands of requests per second and billions of tool calls.