megachangelog
Feature2026-07-28

MCP server portals support MCP 2026-07-28 specification

MCP server portals now support the stateless MCP 2026-07-28 specification for client and upstream server connections, with automatic backward compatibility for earlier 2025 clients and independent protocol selection between clients and servers.

MCP server portals support the stateless MCP 2026-07-28 specification for client and upstream server connections.

The portal's /mcp endpoint automatically accepts stateless MCP 2026-07-28 requests and earlier 2025 Streamable HTTP clients. When the portal connects to an upstream Streamable HTTP server, it checks for MCP 2026-07-28 support and falls back to the 2025 handshake when needed. Client and upstream protocol selection are independent, so clients and servers can upgrade separately without portal configuration changes.

SSE connections continue to use the legacy protocol. For details, refer to MCP server portal transport and protocol compatibility.

mcpaccessprotocolcompatibilityapi

Source: original entry ↗

More from Cloudflare

Follow Cloudflare to get its new changes in your feed and email digest.

Feature

DNS - Configure Advanced Custom Nameservers with nameserver sets

Nameserver sets are now available in beta for Enterprise accounts, allowing you to group custom nameserver names with Cloudflare-assigned IP addresses and assign them to multiple zones. This new approach replaces legacy custom_ns sets with reusable, immutable objects that support up to 3 IPv4 and 3 IPv6 addresses per nameserver and can leverage Advanced anycast network groups for improved resiliency.

dnsnameserversenterpriseapibeta
Security2026-10-14

Emergency WAF managed rule for active RCE vulnerability

Cloudflare released an emergency WAF update with a new managed rule to block exploitation of a critical remote code execution vulnerability in popular web frameworks. The Generic Rules - Remote Code Execution detection prevents attackers from executing arbitrary system commands via malicious input with invalid path sequences.

wafsecurityrcemanaged-rulesemergency
Feature

Cloudflare API MCP server sends Workers Issues as MCP Events

The Cloudflare API MCP server now exposes Workers Issues as MCP Events through webhook subscriptions, allowing agents to receive real-time notifications when production failures are detected without polling. Clients can subscribe to cloudflare.alert.workers_observability_real_time_issue scoped to an account or individual Worker.

workersmcpmonitoringapiobservability
See all Cloudflare changes →