What changed upstream
MCP shipped a 2026-07-28 specification that moves the protocol from stateful to stateless and adds required headers on the Streamable HTTP transport.
MCP-Protocol-Version is required, and must match the value in the body's _metaMcp-Method is required on every request, for example Mcp-Method: tools/callMcp-Name is required for tools/call, resources/read and prompts/get, for example Mcp-Name: search- Servers reject requests where the headers and the body disagree
- A server may annotate a tool parameter with
x-mcp-header, and a conforming client then mirrors that argument's value into an Mcp-Param-{Name} header
The stated purpose is that a gateway can route without parsing the body. Cloudflare One already detects MCP traffic using exactly these headers.
What it means here
Nothing in this repository knows about protocolVersion. parse_initialize_result captures serverInfo.version and capabilities.tools.listChanged and stops there. #111 proposed keying baselines partly on protocolVersion without anything capturing it.
The stateless change undercuts an assumption in the proxy. mcp_audit_proxy correlates with a per-process session id:
_SESSION_ID = uuid.uuid4().hex # ties every tool call in this MCP connection together
That is correct for stdio, where one process is one connection. It is not obviously correct for a stateless HTTP transport where requests are independent and routable. Correlation is the whole product, so this needs an answer before #112 lands rather than after.
Consequences for open issues
New surface worth its own thought
x-mcp-header lets a server cause a client to copy an argument value into an HTTP header. Two things follow:
- Argument values that this project deliberately hashes at the hook boundary may travel in cleartext headers on the wire, outside the hashing.
- A server choosing which arguments get mirrored into headers is a server influencing where data goes. That is a data-movement decision made by the least trusted party in the exchange.
Neither is a detection today. The second looks like the same family as the rug pull: a legitimate protocol feature that becomes an exfil channel when the server is hostile.
Not urgent, but not ignorable
Nothing breaks today. The proxy is stdio-only and the stdio transport is unaffected by the header rules. This matters at the moment #112 is picked up, and it should be read before that design is written rather than discovered during it.
Source
TL;DR sec #343, 2026-08-27, reporting Cloudflare One's MCP detection. Spec details verified against the MCP 2026-07-28 specification rather than taken from the newsletter.
What changed upstream
MCP shipped a 2026-07-28 specification that moves the protocol from stateful to stateless and adds required headers on the Streamable HTTP transport.
MCP-Protocol-Versionis required, and must match the value in the body's_metaMcp-Methodis required on every request, for exampleMcp-Method: tools/callMcp-Nameis required fortools/call,resources/readandprompts/get, for exampleMcp-Name: searchx-mcp-header, and a conforming client then mirrors that argument's value into anMcp-Param-{Name}headerThe stated purpose is that a gateway can route without parsing the body. Cloudflare One already detects MCP traffic using exactly these headers.
What it means here
Nothing in this repository knows about
protocolVersion.parse_initialize_resultcapturesserverInfo.versionandcapabilities.tools.listChangedand stops there. #111 proposed keying baselines partly onprotocolVersionwithout anything capturing it.The stateless change undercuts an assumption in the proxy.
mcp_audit_proxycorrelates with a per-process session id:That is correct for stdio, where one process is one connection. It is not obviously correct for a stateless HTTP transport where requests are independent and routable. Correlation is the whole product, so this needs an answer before #112 lands rather than after.
Consequences for open issues
Mcp-MethodandMcp-Namemean a proxy can identify the method and the tool without parsing a body, which is cheaper and more robust than what stdio requires. But session correlation has to be redesigned rather than carried over.protocolVersionto capture. Note it is negotiated rather than authenticated, so the objection that killedclientInfoas a key applies here too: it discriminates, it does not authenticate._meta. That fix deliberately hashes only the_metaon a tool definition insidetools/list. Those are different objects and the fix was written to that distinction, which the spec has now made consequential rather than academic.New surface worth its own thought
x-mcp-headerlets a server cause a client to copy an argument value into an HTTP header. Two things follow:Neither is a detection today. The second looks like the same family as the rug pull: a legitimate protocol feature that becomes an exfil channel when the server is hostile.
Not urgent, but not ignorable
Nothing breaks today. The proxy is stdio-only and the stdio transport is unaffected by the header rules. This matters at the moment #112 is picked up, and it should be read before that design is written rather than discovered during it.
Source
TL;DR sec #343, 2026-08-27, reporting Cloudflare One's MCP detection. Spec details verified against the MCP 2026-07-28 specification rather than taken from the newsletter.