Model Context Protocol shifts to stateless architecture for better scalability

The Model Context Protocol (MCP) is transitioning toward a stateless architecture, a move that enhances scalability by removing the need for persistent sessions. Under the updated specification, the protocol removes handshakes and session headers, instead requiring each request to carry its own protocol version, client identity, and capabilities. This change allows infrastructure like load balancers and API gateways to handle requests more efficiently without being tied to specific server instances.

To support this, new HTTP headers such as ‘Mcp-Method’ and ‘Mcp-Name’ have been introduced. These allow gateways to route, rate-limit, and meter AI agent traffic by inspecting headers rather than parsing the entire JSON-RPC request body. This shift effectively brings MCP closer to standard REST API patterns, enabling the use of existing web infrastructure for AI tool calls and resource management.

Cloudflare has implemented these changes within its Gateway service, adding MCP detection and Portal-only enforcement. The updated Gateway can now identify MCP requests via protocol-specific headers and payload characteristics, even when using ordinary URLs. This allows administrators to block direct connections to unapproved servers and isolate requests through managed MCP Portals. Cloudflare also introduced an AI Security Report dashboard to track MCP requests, unique users, and server activity, helping to identify ‘shadow’ MCP servers that bypass organizational controls.