MCP is stateless now. Any instance can answer a tool call. Kent walks the 2026-07-28 release: sticky sessions vs a normal load balancer, CIMD vs DCR, multi-round-trip elicitations, and how to run both lanes until the metrics say you can drop the old one.
- (00:00) - They fixed MCP
- (01:13) - Better with Kent
- (01:37) - Cloudflare + the dual-lane upgrade
- (03:13) - MCP is now a stateless protocol
- (03:25) - Sticky sessions vs any instance
- (06:20) - Self-describing requests and headers
- (07:17) - What else shipped
- (08:24) - Formal deprecation policy
- (10:05) - Roots, sampling, logging, SSE
- (11:58) - Client ID metadata documents
- (12:38) - How DCR used to work
- (14:15) - Unbounded client registrations
- (15:59) - The client ID is a URL
- (18:33) - Multi-round-trip requests
- (22:17) - Dual-lane until the metrics say so
- (23:54) - Homework: instrument old cruft
Better with Kent - durable skills for people who ship software.
They fixed MCP. The people who called it a bad protocol have less of an excuse now. The 2026-07-28 spec is the biggest change since the beginning, and the headline is that MCP is a stateless protocol.
Kent walks the before-and-after. The old world needed a sticky session on one instance behind the load balancer. If that instance fell over, the client was stuck. The new world is ordinary HTTP: any instance can serve the request. App state can still live in a database. The transport session is what died.
That unlocks the rest of the release. Requests are self-describing. Method and tool names travel in Mcp-Method and Mcp-Name headers, so a gateway can route without reading the body. Multi-round-trip requests replace held-open SSE for elicitations: the server returns the input it needs, the connection closes, and the client can come back days later on any instance. List responses are cacheable. Extensions are formal now (MCP Apps, Tasks). DCR is deprecated in favor of Client ID Metadata Documents: the client_id is an HTTPS URL, trust is ownership of the domain, and you stop minting an unbounded registration record per reconnect. Kent's own early Kody numbers: about 125 DCR registrations per user.
There is a formal 12-month deprecation window. Roots, sampling, logging, and HTTP+SSE are on the way out. Kent is glad Roots is gone, a little sad about sampling, and fine with streaming replacing SSE.
The receipt is a dual-lane /mcp: Cloudflare's Agents SDK classifies isLegacyRequest, the new spec already shows up from Claude Code, and weekly agents watch the metrics. Homework is the durable move: instrument your old cruft so data, not a calendar, tells you when it is safe to remove.
Links
