MCP's 2026-07-28 spec goes stateless, dropping the initialize handshake and Mcp-Session-Id
The MCP 2026-07-28 specification removes the initialize handshake, the Mcp-Session-Id header, and protocol sessions from the core request path. A developer can now host an MCP server on a plain Cloudflare Worker with no sticky sessions or Durable Object, via createMcpHandler, which graduated into the official MCP TypeScript SDK. Required Mcp-Method and Mcp-Name headers also let gateways and firewalls route and rate-limit on HTTP mechanics instead of parsing JSON bodies, while elicitation becomes a retry-based Multi Round-Trip Request rather than an open stream.
Source: blog.cloudflare.com ↗
MCP is now a fully stateless protocol. The specification, interaction model and SDKs have all been rewritten to leverage this new protocol and simplify usage.
Why this matters
- → MCP servers now run on stateless Workers instead of Durable Objects, cutting operational overhead
- → Gateways can route and rate-limit via HTTP headers instead of parsing JSON bodies
- → Elicitation (e.g. approval workflows) uses retry-based requests instead of open streams