The next generation of MCP (opens in new tab)

MCP’s latest specification makes the protocol fully stateless, removing the session management and persistent connections that complicated remote deployments. Requests now carry the information they need, enabling MCP servers to run on simpler request-scoped infrastructure such as serverless Workers. The update also redesigns elicitation, improves HTTP observability, and strengthens authorization practices.

MCP Becomes Stateless

• Earlier MCP implementations required an initialize/initialized handshake and an Mcp-Session-Id for subsequent requests.
• Stateful sessions created operational challenges:
  • Sticky-session routing
  • Open-stream management
  • Session migration during deployments
  • Reconnection problems when instances disappeared
• The new protocol removes:
  • The mandatory handshake
  • Mcp-Session-Id
  • Protocol sessions from the core request path
• Each request includes its protocol version, client identity, and capabilities.
• server/discover is available for optional server inspection.
• MCP servers can now execute a request and return its result without storing protocol state.
• Cloudflare’s McpAgent is no longer required for MCP itself; developers can use createMcpHandler and deploy on Workers.
• Durable Objects remain useful when the application—not MCP—requires state, persistence, or real-time coordination.

Elicitation Uses Multi Round-Trip Requests

• Elicitation allows servers to request additional information or approval, such as confirming a deployment or refund.
• Previously, elicitation/create depended on an open stream, adding timeout, scaling, and infrastructure complexity.
• The new Multi Round-Trip Request model works as follows:
  • The server returns an input_required result.
  • The client gathers the user’s response.
  • The client retries the operation with the requested input.
• This is a breaking change from the previous approach but removes the need to preserve a transport session.

HTTP Infrastructure Can Inspect MCP Requests

• Streamable HTTP requests now include Mcp-Method and Mcp-Name headers.
• Gateways, rate limiters, and web application firewalls can identify operations such as tools/call without parsing JSON-RPC bodies.
• Operators can apply method-specific policies and collect tool-level metrics using standard HTTP infrastructure.
• Results from tools/list, prompts/list, resources/list, and resources/read can include:
  • ttlMs hints
  • cacheScope hints
• Deterministically ordered tool catalogs help clients reuse results and maintain stable prompt caches.

Authorization Continues to Evolve

• The specification prioritizes authorization approaches in this order:
  • Pre-registered clients when an established relationship exists
  • Client ID Metadata Documents (CIMD) for dynamic registration
  • Dynamic Client Registration (DCR) as a fallback
• DCR is deprecated for new implementations, although the provided text ends before describing the full authorization changes.

The new MCP specification significantly reduces deployment complexity by making the protocol request-oriented rather than session-oriented. Developers should migrate from McpAgent to createMcpHandler where application state is unnecessary, adopt MRTR for elicitation, and update HTTP and authorization integrations to use the new headers and registration guidance.