The next generation of MCP
15:00 · August 6, 2026 · Cloudflare AI Blog
The next version of MCP has a rewritten, stateless core that just works on Workers. We cover upgrades to the protocol, the new feature lifecycle and SDK migration path, and hear from early adopters already running it in production.
Summary
The Model Context Protocol has evolved from its origins in local STDIO transports into the dominant standard for connecting AI agents to external services. Earlier remote deployments carried forward a stateful design that required session identifiers, sticky routing, and persistent streams, forcing operators to maintain coordination layers even when most interactions needed none. The MCP 2026-07-28 release removes this requirement entirely, converting the protocol to a stateless model in which every request carries its own version, identity, and capability information.
Servers can now be deployed directly on request-scoped infrastructure such as Cloudflare Workers without Durable Objects or session affinity. The initialize handshake and Mcp-Session-Id header are gone from the core path; an optional server/discover call remains available for clients that need to inspect capabilities in advance. This change also introduces Multi Round-Trip Requests for elicitations, allowing a server to return an input_required response and resume once the client supplies the missing data, eliminating the need for long-lived streams.
Additional operational improvements include mandatory Mcp-Method and Mcp-Name headers that let gateways and rate limiters inspect requests without parsing JSON bodies, plus ttlMs and cacheScope hints that support stable client-side catalogs. Authorization has been tightened by preferring pre-registered clients, adopting Client ID Metadata Documents, and requiring RFC 9207 issuer identification to prevent confusion between authorization servers. Dynamic Client Registration is now deprecated and scheduled for removal after summer 2027.
A formal feature lifecycle classifies capabilities as Active, Deprecated, or Removed, guaranteeing at least twelve months of support before removal. Roots, Sampling, Logging, and the legacy HTTP+SSE transport fall under deprecation in this release. The specification also introduces an extensions framework so that features such as Tasks can evolve outside the core protocol.
Production users report concrete gains. Sentry’s David Cramer noted that the updated specification “cleans up a bunch of the nonsense around auth and tools,” enabling deployment before finalization without production breakage. Linear’s Tom Moor described the iteration as a clear improvement that strengthens the value of open standards for secure agent access to issue-tracking data. Migration paths allow existing endpoints to accept both the new stateless requests and prior Streamable HTTP clients during the transition period.
Why it matters
Security and privacy professionals in the Netherlands can apply the updated authorization and stateless design patterns to secure AI agent deployments, aligning with EU data protection expectations. The protocol changes reduce session management risks and improve auditability for Dutch enterprises adopting MCP.
