Serve MCP 2026-07-28 clients on the Cloudflare hosts

[RhysSullivan]

Final step of MCP spec 2026-07-28 serving: the Cloudflare hosts (executor-cloud and self-host-cloudflare) now speak the modern protocol. This is the endpoint modern clients hit in production.

Architecture — wire-stateless, DO-backed execution affinity:

• After bearer auth (unchanged, still before any DO addressing), the worker classifies the era. Legacy requests take the existing McpAgent path byte-for-byte; agents stays at 0.17.3 + patch.
• Modern non-tools/call methods are served by a resource-cached stateless v2 handler in the worker — no DO touch.
• Modern tools/call routes into a Durable Object for execution affinity: fresh executes get a newUniqueId() DO running a DO-local v2 handler over the existing execution engine; a pause registers executionId → modern:<doId> in the execution-owner directory before returning input_required with signed requestState.
• Continuation rounds and resume tool calls verify/extract the executionId in the worker, look up the owner directory, enforce the same cross-bearer ownership contract as legacy (403 -32003), and forward to the owning DO. Tampered or expired state degrades to a DO-less server whose codec rejects (-32602) or whose engine reports the existing execution_not_found shape — no new error surfaces.
• Modern DOs participate in the existing alarm/keepalive lifecycle; a DO eviction mid-pause yields the same execution_expired outcome legacy has today.
• CORS preflights echo requested headers (dynamic Mcp-Param-<name> support), telemetry records mcp.client.protocol_version from the modern envelope.

Deployment prerequisite (before merge): both workers need the shared continuation-signing secret, ≥32 bytes, visible to worker + session DOs:

wrangler secret put MCP_REQUEST_STATE_KEY

No generated fallback — the modern path fails loudly without it. Documented in both wrangler configs.

Tests: 74 hosts/cloudflare + 24 host-cloudflare + 244 cloud + 201 hosts/mcp. The 3 cloud failures in org-api-key-revoke.node.test.ts reproduce identically on the parent branch (pre-existing/environmental; CI arbitrates).

Stacked on #1602.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	3220892	Aug 16 2026, 12:36 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	3220892	Commit Preview URL Branch Preview URL	Aug 16 2026, 12:35 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1604

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1604

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1604

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1604

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1604

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1604

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1604

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1604

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1604

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1604

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1604

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1604

executor

npm i https://pkg.pr.new/executor@1604

commit: 3220892

[RhysSullivan]

Folded into #1611 (single consolidated PR per review preference).