NewMCP Production is out: 57 lessons, 14 labsSee the course

Free sheet · Lesson 9.1 of MCP Production

What MCP 2026-07-28 breaks, and what's only deprecated.

The revision impact sheet from lesson 9.1: each assumption a 2025-11-25 server can hold, how the stateless revision behaves instead, and the deprecation clock.

By Runs Clean Sources checked 10 September 2026 Spec revision 2026-07-28 Free, no signup
Download the PDF

A4, prints in colour or greyscale. Same sheet the course hands out.

Where this goes next

Module 9 moves a 2025-11-25 server to 2026-07-28 with compatibility fixtures, explicit handles in place of sessions and a staged rollout plan, in lab 9.

See the course on Udemy The full curriculum

Checked 2026-09-10 against revision 2026-07-28 and the earlier 2025-11-25 lifecycle. No lab or previous lesson is needed for this diagnostic.

Existing assumptionTarget-revision behaviorFirst thing to inspect
Initialize once, retain capabilitiesVersion/capabilities on every request_meta construction for each call
Session ID carries application selectionProtocol sessions removedExplicit project/work handle and access checks
Server sends its own approval requestInput request returned in original resultRetry with inputResponses and opaque requestState
Every response finishes the operationRequired resultType distinguishes interim resultsBranch on complete/input_required
Any 400 means an earlier serverModern failures also use 400Error code and supported-version data
GET stream or Last-Event-ID recovers messagesThose mechanisms removed from target Streamable HTTPPOST response/subscription and operation recovery
All deprecated features disappearedDeprecated features remain during their windowPer-feature registry and normative notice

SSE itself has not disappeared: the target can return a request-scoped SSE response and subscriptions/listen has an SSE response stream. The older HTTP+SSE transport is a distinct compatibility path.

clientInfo is optional; version and clientCapabilities are required. An earlier server's result without resultType is treated as complete. Discovery is mandatory for target servers but optional for clients. Stateless protocol context does not remove the need to persist application work.

Deprecation is not immediate removal

Roots, Sampling, Logging and Dynamic Client Registration are Deprecated in this revision. Their registry row gives earliest eligibility as the first Current revision released on or after 2027-07-28. That is not an announced removal date. The historical HTTP+SSE transport has a different transition rule, tied to three months after SEP-2596 Final; do not assign it the same anniversary. includeContext thisServer/allServers follows Sampling. Recheck notices before setting deadlines.

The policy's normal twelve-month floor also has an approved expedited-removal exception with a minimum ninety-day interval under its stated active-risk conditions. SDK support can follow a different timeline from specification removal.

Practice and answer key

  1. A call gets HTTP 400 with error -32020. Must the client initialize? Answer: No. This identifies a modern header mismatch; inspect and repair the request instead of treating a status alone as an era detector.
  2. A server needs approval before adding a note. Does removing callbacks remove the approval requirement? Answer: No. Preserve the business boundary and deliver the input request through MRTR; a simulated answer is not human proof.
  3. A team schedules automatic feature shutdown on 2027-07-28. Does the registry mandate that? Answer: No. It names eligibility in a subsequent Current revision, not a scheduled removal. Use a dated feature-specific record.
  4. A service uses SSE responses today. Must all SSE code be deleted? Answer: No. Distinguish response streams still supported by the target from the removed GET/session/resume mechanisms and the older transport.

Primary sources

More free sheets#