The MCP Spec Dropped Session State — Migration Checklist for Your Server

TL;DR: The July 2026 MCP spec removed session state — no Mcp-Session-Id, no handshake — and your server becomes a plain stateless HTTP service with working load balancing and caching.

The MCP 2026-07-28 specification shipped a protocol-level change that affects every MCP server in production: session state is gone. The initialize/initialized handshake is removed. Mcp-Session-Id is gone. Every request now carries protocol version, client info, and capabilities in a _meta field, making each one self-describing and independent.

Why this matters. Stateful MCP servers required sticky sessions — a request from client A had to reach the same server instance that handled its initialization. That made round-robin load balancing, autoscaling, and CDN caching impossible. Stateless servers let any instance handle any request: horizontal scaling works without infrastructure workarounds.

Migration checklist:

1. Audit session state. Search your codebase for Mcp-Session-Id, initialize event handlers, and per-session in-memory stores. Replace them with explicit handles or request-scoped state.
2. Pass _meta through. Ensure your handler forwards the incoming _meta object on every response — it carries the client's declared capabilities and protocol version.
3. Wire up header-based routing. The new Mcp-Method and Mcp-Name headers let your gateway or rate limiter route and meter without parsing JSON bodies. Add them to your load balancer config.
4. Add cache hints to list responses. tools/list, resources/list, and prompts/list responses now support ttlMs and cacheScope fields — fill them in so clients know how long to reuse a listing without re-fetching.
5. Check your SDK version. Cloudflare's Agents SDK has supported the spec since the day it shipped; createMcpHandler returns a standard fetch handler that runs as a Worker with no session Durable Object overhead. If you're on another framework, confirm its MCP SDK version is ≥ 2.0.

Limit to know. Legacy MCP clients that haven't updated their client library may still send Mcp-Session-Id or expect the handshake. The Cloudflare handler serves both spec versions until clients migrate — but verify your client versions before switching production traffic. The experimental Tasks API has a separate, not-yet-final migration path; hold off on that piece until the spec stabilizes.

Sources: MCP 2026-07-28 Specification — MCP Blog · The next generation of MCP — Cloudflare Blog · What changed — DEV Community · Build and deploy on the new spec — DEV Community · Cloudflare Agents SDK changelog