The 28-year-old broke clear with 32 kilometres left on the Canadian street circuit and held off a disorganised chase to win by 13 seconds ahead of Australian Michael Matthews, with former winner Mathieu van der Poel in third.
"Honestly, I don't know. Really, this is, I don't know," said McNulty.
"I'm really at a loss. Until the last 100 metres, I really didn't even believe it. I was so tired."
The last American man to wear the coveted rainbow jersey was Lance Armstrong in 1993, six years before he began his tainted reign at the Tour de France.
"I mean we talked about it, I made some jokes to my wife," said McNulty about whether or not he had ever thought he could challenge for the victory.
"I knew something could happen, but it would take a miracle, and I guess miracles happened."
McNulty succeeds his UAE Emirates-XRG teammate Tadej Pogacar after launching an opportunistic move just after a four-man breakaway, which included Van der Poel, was caught following an acceleration by one of the pre-race favourites, Isaac Del Toro.
A succession of chase groups ebbed and flowed behind him, with Briton Tom Pidcock, who finished seventh, and Irishman Ben Healy particularly aggressive, but each time the riders failed to fully cooperate.
McNulty quickly built up a lead of more than a minute at one point, but with nine kilometres left, Pidcock brought a group including Del Toro and Paul Seixas, another of the pre-race favourites, to within 10 seconds of the lone leader.
But again they all sat up looking at each other, and McNulty put his head down and went for it, eventually triumphing after 273.4km and six hours, 17 minutes in the saddle.
And this win more than made up for McNulty's near miss a week ago in the time trial, where he finished fourth behind Remco Evenepoel, Filippo Ganna and Seixas.
McNulty takes chance for glory
Van der Poel and Wout van Aert ignited the fireworks with 85km to ride as they sparked a break that saw a dangerously strong six-man group go clear.
Van der Poel seemed to have itchy feet and 10km later he dropped Van Aert from the group with another vicious acceleration.
With about 50km to ride, he had only Primoz Roglic and Quinn Simmons for company.
Behind them, Del Toro was working hard to keep the gap to within around 40 seconds, but Evenepoel was repeatedly caught out with poor positioning when other riders accelerated.
Van Aert worked hard to bring Evenepoel back to the chase group, and with 40km to ride, they were only 30 seconds behind the leading trio.
They were caught with 35km left when Del Toro accelerated on the Camillien-Houde climb and again dropped Evenepoel, who would dig in and eventually finish 12th at 25 seconds.
It was soon after that McNulty took his chance and, with 25km to go, he had a lead of more than a minute on 11 chasers.
His daring break looked in danger with nine kilometres to go, but the chasers hesitated while McNulty ploughed on.
His teammate Simmons just missed out on a medal in fourth, with Del Toro fifth.
Seixas, who only turned 20 during the week, suffered from cramps in the final few kilometres and finished 15th at just over two minutes and 30 seconds.