MCP spec 2026-07-28: the stateless revolution (Cloudflare)

What it claims

MCP 2026-07-28 makes the protocol fully stateless, and updated TypeScript, Python, Go and C# SDKs ship alongside it. Cloudflare reports production use: its Code Mode MCP server for the whole Cloudflare API ran on the earlier unofficial stateless mode and has scaled to "thousands of requests per second" and "billions of tool calls." Sentry says it went live on the release candidate before the spec was finalised "and it didn't break prod." These are vendor and customer statements, not benchmarks.

How it works

No session. Each request carries its own protocol version, client identity and client capabilities. server/discover is optional, for clients that want to inspect a server first.

Elicitation via MRTR. This is a breaking change. elicitation/create over an open stream is replaced by a server result of input_required. The client gathers the input and retries the original operation with it.

sequenceDiagram
  Client->>Server: tools/call
  alt needs input
    Server-->>Client: input_required (what it needs)
    Client->>Client: collect answer from user
    Client->>Server: retry tools/call + input
  end
  Server-->>Client: result

Routing headers. Mcp-Method and Mcp-Name are now required on Streamable HTTP requests, alongside MCP-Protocol-Version: 2026-07-28. With these, a WAF or rate limiter can act per tool without parsing the JSON body.

Caching. tools/list, prompts/list, resources/list and resources/read results carry ttlMs and cacheScope hints. Tool catalogs are deterministically ordered, so upstream prompt caches stay stable across reconnects.

Auth preference order:

1. Pre-registered clients.
2. CIMD.
3. DCR as a fallback.

There are two further auth requirements:

• The authorization server must advertise authorization_response_iss_parameter_supported: true and return iss.
• Clients send the canonical server URI as the RFC 8707 resource. Tokens must be accepted only by that audience.

How to use it

Minimal Worker server, using @modelcontextprotocol/server and createMcpHandler from agents/mcp/server:

export default {
  fetch(request, env, ctx) {
    return createMcpHandler(createServer)(request, env, ctx);
  },
}

Here createServer returns an McpServer with tools registered via server.registerTool(name, { description, inputSchema }, handler), using zod schemas. createMcpHandler is now in the official TS SDK. Cloudflare will keep a Worker-focused wrapper in the Agents SDK.

To get the new auth requirements, wrap the handler with OAuthProvider from @cloudflare/workers-oauth-provider. Set clientIdMetadataDocumentEnabled: true and supply resourceMetadata with resource, authorization_servers and scopes_supported. The page gives the full config.

Compatibility. The /mcp endpoint accepts both the new protocol and stateless requests from 2025 Streamable HTTP clients. Most clients reconnect without config changes. For Agents SDK clients, the stated step is to upgrade agents.

Migration from McpAgent. Servers relying on sessions, server-to-client requests or standalone streams should:

1. Run a strict stateless route beside the sessionful one.
2. Move features over to it.
3. Let active sessions drain.
4. Remove the legacy route within the deprecation window.

The page points to a "MCP SDK v2 migration guide" for this. Use Durable Objects only where the application itself needs state.

Limits

Deprecated in this release: Roots, Sampling, Logging, DCR, and the legacy HTTP+SSE transport.

• Deprecated features must stay available for at least 12 months.
• DCR is slated for removal after summer 2027.
• If your server or client uses any of these, you have a defined but finite window.

Moved to the extensions framework: MCP Apps, Enterprise-Managed Authorization and Tasks (long-running work) are now extensions, not core. Check that your client supports the extension before relying on them.

Caveats:

• The source is a Cloudflare post, so the deployment guidance is Workers-centric.
• The Python, Go and C# SDKs are mentioned but not described.
• No latency or cost figures are given for stateless versus Durable Object hosting.