MCP spec 2026-07-28 drops the session handshake entirely, making servers stateless and serverless-deployable
Cloudflare detailed on August 6 how the new MCP revision removes the required initialize/initialized handshake and the Mcp-Session-Id header, so each request independently carries protocol version, client identity and capabilities — eliminating protocol sessions from the core request path. New Mcp-Method and Mcp-Name headers let gateways and WAFs route and inspect MCP traffic without parsing JSON bodies, deterministic tool/prompt/resource ordering plus ttlMs and cacheScope hints make responses cacheable, and server-initiated elicitation is replaced by Multi Round-Trip Requests where servers return an input_required result the client retries. Roots, Sampling, Logging, Dynamic Client Registration and the legacy HTTP+SSE transport are deprecated with a 12-month minimum removal window; authorization now requires RFC 8707 resource parameters and adopts RFC 9207 issuer identification.
↳ Follow the thread