**MCP 2026-07-28: From Stateful Streams to Stateless HTTP**
Over the last year and a half, the **Model Context Protocol (MCP)** has become the universal standard for how agents interact with external services. However, its original design relied on a stateful connection between client and server, inherited from its roots in local CLI/STDIO workflows. When MCP went remote, this stateful model became a burden—requiring sticky sessions, open streams, message replay, and significant infrastructure overhead.
That changes with the **MCP 2026-07-28 specification**, released alongside updated TypeScript, Python, Go, and C# SDKs. MCP is now fully stateless. The protocol, interaction model, and SDKs have been redesigned to leverage simple, request-scoped HTTP workloads—eliminating the need for persistent connections and stateful infrastructure.
—
## **What Changed in MCP 2026-07-28?**
### **1. MCP Is Now Stateless**
Previous MCP transports required an `initialize` handshake and a persistent `Mcp-Session-Id`. Every request depended on that session, forcing autoscaling systems to manage sticky sessions and complicating serverless deployments.
The new specification removes the mandatory handshake and `Mcp-Session-Id`. Each request is self-contained, carrying protocol version, client identity, and capabilities. Servers can process a request, invoke a tool or resource, and return a result—without storing any session state.
This shift:
– Simplifies deployment on serverless platforms like Cloudflare Workers.
– Enables autoscaling without coordination overhead.
– Reduces complexity and operational cost.
> **Note:** `McpAgent` is no longer required to run MCP servers. You can use the new `createMcpHandler` API (available in the updated SDKs) to build lightweight, stateless handlers.
### **2. Elicitations No Longer Require an Open Stream**
Earlier, server-initiated interactions like elicitations (e.g., approval prompts or user choices) depended on an open stream—adding cost and timeout risks.
The new protocol introduces **Multi Round-Trip Requests (MRTR)**. A server can return an `input_required` response describing what it needs. The client provides the input and retries the request, completing the interaction without persisting a transport session.
This makes elicitations easier to implement and more reliable in distributed environments.
### **3. HTTP Infrastructure Understands MCP**
MCP requests are JSON-RPC messages sent over HTTP. Previously, gateways had to parse the JSON body to determine the method being called. Now, the protocol requires `Mcp-Method` and `Mcp-Name` headers on Streamable HTTP requests.
Example:
“`
POST /mcp HTTP/1.1
MCP-Protocol-Version: 2026-07-28
Mcp-Method: tools/call
Mcp-Name: search
Content-Type: application/json
“`
This allows routers, rate limiters, and WAFs to make routing and policy decisions based on headers—without parsing JSON bodies. The spec also adds `ttlMs` and `cacheScope` hints for tools, prompts, resources, and resource reading, improving cacheability and performance.
### **4. Authorization Is More Flexible and Secure**
MCP now prefers pre-registered clients for known relationships, then uses **Client ID Metadata Documents (CIMD)** for dynamic registrations. **Dynamic Client Registration (DCR)** is deprecated and will be removed after summer 2027.
The protocol also adopts **RFC 9207** issuer identification, ensuring authorization responses can be validated against the expected issuer. Clients now send the canonical server URI as the `resource` in OAuth requests, and tokens are issued for and accepted only by that audience.
—
## **Developer Experience: Modern SDKs and Migration Path**
– **`createMcpHandler`** is now the standard way to build MCP servers in the TypeScript Agents SDK.
– The SDK has been refactored to align with web standards, improving interoperability with Bun, Deno, and Cloudflare Workers.
– You can run a minimal MCP server on Cloudflare Workers with just a few lines of code:
“`ts
import { createMcpHandler } from “agents/mcp/server”;
import { defineServer } from “@modelcontextprotocol/server”;
const server = defineServer({
name: “hello-server”,
version: “1.0.0”,
});
server.registerTool(“hello”, { description: “Return a greeting” }, async ({ name }) => ({
content: [{ type: “text”, text: `Hello, ${name ?? “World”}!` }],
}));
export default {
fetch(request, env, ctx) {
return createMcpHandler(server)(request, env, ctx);
},
};
“`
– Production users have already run stateless MCP at scale—handling thousands of requests per second and billions of tool calls.
—
## **FAQ**
**Q: Do I need to migrate my existing MCP server?**
A: If you’re using the legacy `McpAgent` or a stateful transport, you should migrate to `createMcpHandler` and the stateless protocol. The new SDKs support both legacy and new spec during a transition period, making upgrades smooth.
**Q: What happens to stateful use cases (e.g., server-to-server events)?**
A: For applications that truly need persistent state or server-initiated streaming, Cloudflare Durable Objects remain the recommended primitive. You can run stateful Durable Objects alongside stateless MCP handlers in the same service.
**Q: Is the old HTTP+SSE transport still supported?**
A: The legacy streamable HTTP transport is deprecated but still functional during the migration window. New implementations should use the stateless spec.
**Q: What about authorization changes?**
A: MCP now standardizes on pre-registered clients and CIMD-based dynamic registration. DCR is deprecated. The spec also enforces audience-bound tokens using the canonical server URI.
**Q: Will clients need to update?**
A: Clients using modern MCP SDKs will automatically handle the transition. The endpoint accepts both new stateless requests and legacy streamable HTTP messages, so reconnecting usually requires no configuration changes.
—
## **Conclusion**
The MCP 2026-07-28 specification marks a major milestone for the protocol—transforming MCP from a stateful, stream-based system into a lightweight, stateless, HTTP-native standard. With simplified deployment, stronger authorization, and broader interoperability, MCP is now easier than ever to run at the edge.
Whether you’re building a small internal tool or a large-scale agentic platform, MCP’s new stateless design reduces complexity, lowers costs, and future-proofs your infrastructure. The ecosystem—from Cloudflare Workers to leading enterprise adopters—is already running on the new spec.
**MCP is no longer tied to stateful infrastructure. It’s built for the modern web—and it’s ready for production.**
