State of the art of the Model Context Protocol (MCP) after its 2026-07-28 revision, and what the revision means for peek-mcp.
Researched 2026-09-18 in session 4f0a68f9-1435-4150-bb9e-84567dc7db02 (harness-exploration-status). Source: the 2026-07-28 changelog.
The largest revision since launch.
| Change | Detail |
|---|---|
| Stateless core | No initialize handshake: protocol version, client capabilities and clientInfo ride per-request _meta keys. No sessions (Mcp-Session-Id); cross-call state is server-minted handles passed as ordinary tool arguments. |
| Multi Round-Trip Requests | Replace server-initiated requests (sampling, elicitation, roots). The server returns resultType: "input_required" plus inputRequests; the client retries with responses. Every result carries resultType ("complete" default). |
server/discover | Mandatory; doubles as the stdio backward-compat probe. |
| Cacheable lists | ttlMs + cacheScope on tools/list and the other lists. Deterministic tool order is recommended for prompt caching. |
| Extensions framework | Formalized: reverse-DNS IDs, independent versioning. Tasks moved out of core to io.modelcontextprotocol/tasks (polling tasks/get, no blocking result). MCP Apps and Enterprise Managed Authorization are extensions. |
| HTTP only | Header routing (Mcp-Method/Mcp-Name). subscriptions/listen replaces the GET stream and resource subscribe; SSE resumability is removed. OAuth 2.1/OIDC alignment; DCR is deprecated for Client ID Metadata Documents. |
| Deprecations | 12-month minimum, removable ≥ 2027-07-28: Roots, Sampling, Logging (→ stderr/OTel), the HTTP+SSE transport. |
| Governance | Linux Foundation / Agentic AI Foundation (AAIF, Dec 2025; ~190 member orgs), SEP process, working groups, a formal feature lifecycle. The official MCP registry is still preview. |
peek is the conservative subset (tools only, stdio-deployed, nothing server-initiated, no auth), so nearly every change is a no-op for it. No urgency: 2026-07-28 clients must interoperate with legacy servers, and the deprecation clocks run on features peek does not use.
| Area | Finding |
|---|---|
| Client identity | The one real coupling. AddAfterInitialize (cmd/start.go:193) and the session-based clientNameFromRequest → isClaude pagination switch (tools/forms.go:36-59) must rekey to per-request _meta clientInfo on the SDK bump. Alternative, more stateless in spirit: drop client sniffing for an explicit page-size tool argument. |
| SDK | mark3labs/mcp-go v0.52.0 negotiates up to 2025-11-25; v1.1.0 (2026-09-15) supports 2026-07-28. v0.52→v1.x is a breaking bump around exactly the touched surfaces (hooks, session-from-context, result construction); AddTool/ServeStdio/NewStreamableHTTPServer are likely intact. |
| Pagination | peek's cursor-token PageStore already matches the spec's blessed stateless-handle pattern; resultType comes free with the bumped types. |
| Nit | A resource capability is declared but no resources are registered (cmd/start.go:196-200). |
| Control port | The dashboard, SSE and OTLP ingest port is plain HTTP, not MCP: untouched by the revision. |