The server currently speaks 2025-11-25, via @modelcontextprotocol/[email protected] (LATEST_PROTOCOL_VERSION = "2025-11-25"). That is fully compliant with the revision it implements, and clients negotiate down, so nothing is broken today. This is currency rather than a defect — filed so it does not become one quietly.
What 2026-07-28 changes
Mostly by removal, which is why the upgrade is smaller than it sounds:
- Sessions removed. No
Mcp-Session-Id, no minting or echoing. Already stateless here — a fresh server and transport per request — so this costs nothing.
- GET stream endpoint removed.
GET/DELETE should answer 405. Already the behaviour, and correct on both revisions.
Last-Event-ID resumability removed. Not implemented here.
The genuinely new work is header validation:
- Every POST MUST carry
MCP-Protocol-Version, and it must match _meta.io.modelcontextprotocol/protocolVersion in the body.
Mcp-Method is REQUIRED on all requests; Mcp-Name on tools/call, resources/read, prompts/get.- Mismatched or missing headers MUST be rejected with
400 and JSON-RPC error -32020 (HeaderMismatch), after Base64-decoding any =?base64?…?= sentinel values.
- An unimplemented method MUST return HTTP
404 with -32601, which distinguishes it from a legacy HTTP+SSE server.
- Optional:
x-mcp-header annotations to mirror tool parameters into Mcp-Param-* headers. Servers MAY use it; clients MUST support it.
Blocked on
The SDK shipping 2026-07-28 support. Most of the above lives in the transport layer, so the bulk should arrive with a version bump rather than hand-written code. Worth re-reading the spec at that point rather than trusting this summary.
When to do it
Not urgent, but it is a dated liability: as clients adopt the revision, a server two behind gets negotiated down or refused. Revisit when the SDK releases support.
References
Found during the client-compatibility research that also produced the Origin validation fix (d93d425).
The server currently speaks
2025-11-25, via@modelcontextprotocol/[email protected](LATEST_PROTOCOL_VERSION = "2025-11-25"). That is fully compliant with the revision it implements, and clients negotiate down, so nothing is broken today. This is currency rather than a defect — filed so it does not become one quietly.What
2026-07-28changesMostly by removal, which is why the upgrade is smaller than it sounds:
Mcp-Session-Id, no minting or echoing. Already stateless here — a fresh server and transport per request — so this costs nothing.GET/DELETEshould answer405. Already the behaviour, and correct on both revisions.Last-Event-IDresumability removed. Not implemented here.The genuinely new work is header validation:
MCP-Protocol-Version, and it must match_meta.io.modelcontextprotocol/protocolVersionin the body.Mcp-Methodis REQUIRED on all requests;Mcp-Nameontools/call,resources/read,prompts/get.400and JSON-RPC error-32020(HeaderMismatch), after Base64-decoding any=?base64?…?=sentinel values.404with-32601, which distinguishes it from a legacy HTTP+SSE server.x-mcp-headerannotations to mirror tool parameters intoMcp-Param-*headers. Servers MAY use it; clients MUST support it.Blocked on
The SDK shipping
2026-07-28support. Most of the above lives in the transport layer, so the bulk should arrive with a version bump rather than hand-written code. Worth re-reading the spec at that point rather than trusting this summary.When to do it
Not urgent, but it is a dated liability: as clients adopt the revision, a server two behind gets negotiated down or refused. Revisit when the SDK releases support.
References
Found during the client-compatibility research that also produced the
Originvalidation fix (d93d425).