Track MCP 2026-07-28 spec + TypeScript SDK v2 migration

[sje397-automation]

Summary

The MCP 2026-07-28 specification (final July 28) is the largest protocol revision since launch, and the TypeScript SDK is splitting into separate packages (v2). MCPico needs to migrate from @modelcontextprotocol/sdk v1 to @modelcontextprotocol/server v2 post-July-28.

What changes (spec)

• Stateless protocol core: No more initialize/initialized handshake, no Mcp-Session-Id. MCP-Protocol-Version, Mcp-Method, Mcp-Name ride as HTTP headers on every request.
• Extensions framework: Extensions now first-class with reverse-DNS IDs, versioned independently.
• Tasks: Moves from experimental core to extension with new lifecycle (tasks/get, tasks/update, tasks/cancel).
• MCP Apps: Server-rendered sandboxed UIs (extension).
• Auth hardening: Issuer validation (RFC 9207), application_type in DCR, credential binding.
• Deprecations: Roots, Sampling, Logging (annotations only, 12-month window).
• JSON Schema 2020-12: Full support for tool schemas.
• Cache headers: ttlMs and cacheScope on list/read results.
• Multi Round-Trip Requests: InputRequiredResult replaces SSE streaming for elicitation.
• W3C Trace Context: Documented propagation via _meta.

What changes (SDK)

• Monolith @modelcontextprotocol/sdk v1 becomes split packages: @modelcontextprotocol/server, @modelcontextprotocol/client, @modelcontextprotocol/server/stdio
• ESM-only (Node 20+)
• McpServer.tool() becomes McpServer.registerTool() using Standard Schema (Zod v4 compatible)
• StreamableHTTPServerTransport becomes PerRequestHTTPServerTransport or createMcpHandler
• Codemod available: npx @modelcontextprotocol/codemod@beta v1-to-v2

MCPico impact

Most changes come for free via the SDK upgrade. Items worth active attention:

Post-migration enhancements

• ttlMs caching: Cache tools/list per server TTL instead of re-fetching on every help_<group> call
• Auth issuer validation: Patch oauth-provider.ts for SEP-2468
• JSON Schema 2020-12: Richer help output if upstream servers use composition/refs
• Mcp-Method/Mcp-Name routing: Smarter upstream routing without body inspection

Compatibility checks

• Verify resource/prompt passthrough under new spec
• Verify multi-server aggregation with stateless transport
• Verify OAuth client_credentials flow after auth hardening
• Test stdio transport compatibility

Timeline

• Now: v2 SDK at 2.0.0-beta.3 (npm @modelcontextprotocol/server@beta)
• July 28, 2026: MCP 2026-07-28 spec final
• ~August 2026: v2 SDK stable expected
• After v2 stable: Migration window. v1 SDK gets bug/security fixes for 6+ months, so no rush.

Resources

• Spec RC announcement
• SDK betas announcement
• Draft specification
• Spec changelog