Better with Kent · draft

MCP dropped sessions

Here's what changes

Hook

No session required

to answer a tool call

Shipped on a live MCP server · 2026-08-05

The old pain

Sticky sessions · held-open streams

  • Local STDIO habits → remote sticky sessions
  • Handshake · open streams · message replay
  • Miserable behind a plain load balancer

Thesis

MCP grew up into HTTP

stateless · cacheable · routable

Spine

Five features · one migration

Stateless → MRTR → Headers → Cache → CIMD

Then: dual-lane + metrics — not a flip switch

Feature 1

Stateless core

2026-07-28

Gone

No handshake · no session id

  • initialize / initialized retired
  • Mcp-Session-Id retired
  • Every request carries _meta

What you unlock

Any instance · round-robin

  • Workers · edge · ordinary HTTP LBs
  • Optional server/discover — not required
  • Self-describing requests

Clarify

Stateless ≠ no app state

  • Mint an explicit handle · pass it as a tool arg
  • The model can see it
  • DO / DB when the app needs state — not the protocol

Hidden transport sessions are what died

Feature 2

MRTR

Multi Round-Trip Requests

Mid-call ask

Confirm without a stream

call → input_required → retry + answers

Elicitation without babysitting SSE

Features 3 + 4

Headers · cache hints

Routable

Mcp-Method · Mcp-Name

  • WAF · gateway · rate limiter
  • No JSON body parse required
  • Meter MCP like normal API traffic

Cacheable catalogs

ttlMs · cacheScope

  • tools/list (and prompts / resources)
  • Stop thrashing catalogs on reconnect
  • Keep upstream prompt caches stable

Feature 5

CIMD · auth hardening

  • Pre-registered → CIMD → DCR fallback
  • client_id can be an HTTPS URL
  • Issuer + audience binding (RFC 9207 / 8707)

DCR deprecated — removal after summer 2027

Also shipping

Extensions · deprecations

  • Tasks · MCP Apps · EMA — versioned opt-in
  • ≥12-month deprecation window
  • Roots · Sampling · Logging · legacy SSE

Receipt

Dual-lane on a live server

kentcdodds/kody#1237 · 2026-08-05

The bind

New spec · frozen session stack

  • Cloudflare feature-froze McpAgent
  • Most clients still speak 2025-era
  • Dropping legacy = break real traffic

CF Code Mode MCP already did thousands rps / billions of calls pre-GA

The move

One route · two lanes

Auth → classify → legacy DO / stateless

SDK isLegacyRequest · shared search + execute

Clarify

Lease ≠ session

  • Account write lease still wraps both lanes
  • That's deletion safety — every surface takes it
  • "Stateless" = no MCP session Durable Object

Retirement policy

Metrics decide · not a calendar

  • One Analytics Engine point per request
  • Lane · method · revision · client
  • Cut legacy when real traffic is gone

Homework

Can one tool call survive without affinity?

  • Check session stickiness on your /mcp
  • Sketch dual-lane — or modern-only behind a flag
  • Bonus: ship ttlMs on tools/list this week

Close

Make production boring

Better with Kent · durable skills for people who ship software