What is MCP?

A server offers three primitives. Tools are actions the model can call, each with a JSON Schema for inputs and, optionally, outputs; since 2025-11-25 the default dialect is JSON Schema 2020-12. Resources are readable data behind URIs, such as a document or a table. Prompts are reusable templates a client can offer its users. On the client side, elicitation lets a server ask the user for input, including a URL mode for an OAuth or payment page handled outside the chat.

Over stdio the client starts the server as a subprocess and the two exchange newline-delimited JSON. Over Streamable HTTP each message is an HTTP POST to a single endpoint, and the reply comes back as JSON or as a server-sent event stream scoped to that one request; a single subscriptions/listen stream carries change notifications. The original HTTP+SSE transport of 2024 was replaced by Streamable HTTP in March 2025 and formally deprecated in July 2026. Copilot Studio, OpenAI’s Responses API and Anthropic’s connector still accept it for compatibility, while Gemini’s Interactions API takes Streamable HTTP only.

Versions are date strings marking the last backward-incompatible change, and a client or server may support several at once. A client built for 2026-07-28 falls back to the handshake-based protocol when it meets a server on 2025-11-25 or earlier. Optional features live in extensions negotiated through an extensions capability, each off by default and moving through experimental, beta and stable stages. MCP Apps (interactive HTML returned by a tool, launched 26 Jan 2026), Enterprise-Managed Authorization and OAuth Client Credentials are stable; Tasks, Skills over MCP and Server Cards are beta.

Each request now carries its protocol version, client capabilities and client identity in _meta, and a mandatory server/discover call advertises the versions and capabilities a server supports. A server that needs state across calls, a shopping cart for example, hands the model an explicit handle and gets it back as an ordinary argument on the next call. Because that handle passes through the client, the spec tells servers to sign or encrypt it, bind it to the user, and never treat possession of a handle as authentication.

Server-to-client requests over a held-open stream are gone. Instead of calling elicitation/create or sampling/createMessage back into the client, a server returns input_required and the client retries the original call with the input attached, which the spec calls a multi round-trip request. Every POST must carry Mcp-Method and Mcp-Name headers so gateways and web application firewalls can route and filter without parsing the body, and list results must include a cache lifetime and scope; tools should also come back in a deterministic order so model prompt caches hit more often.

Deprecated, with a 12-month minimum offramp under the new lifecycle policy: the HTTP+SSE transport, dynamic client registration (in favour of Client ID Metadata Documents), and the roots, sampling and logging features. Tasks, experimental in 2025-11-25, moved out of the core into the io.modelcontextprotocol/tasks extension, where a client polls tasks/get. SSE resumability through Last-Event-ID was removed, and the resource-not-found error code changed from -32002 to -32602. GitHub’s remote server removed its Redis session storage after the change, and Google’s team, which maintains the Go SDK, shipped v1.7.0 on release day.

Six requirements are normative in 2026-07-28: the server implements RFC 9728; the client supports both RFC 8414 metadata and OpenID Connect discovery; the client includes the resource parameter (RFC 8707) in authorization and token requests; the server validates the token audience; the server never accepts or forwards any other token, which the spec calls the token passthrough prohibition; and the client validates the iss parameter (RFC 9207) when it is present. A local stdio server takes credentials from its environment instead.

Client registration changed twice. Open dynamic client registration (RFC 7591) let any client register itself with an authorization server, which enterprises did not want. The 2025-11-25 revision introduced Client ID Metadata Documents: the client uses an HTTPS URL as its client_id and the authorization server fetches the client’s metadata from that URL. In 2026-07-28 dynamic registration is deprecated and kept only for authorization servers without CIMD support.

Two authorization extensions are stable. OAuth Client Credentials covers machine-to-machine use. Enterprise-Managed Authorization (stable since 18 Jun 2026) lets the client obtain an identity assertion grant from the corporate identity provider during single sign-on, so users reach a server with no per-app consent screen and IT sets policy centrally. Okta was the first identity provider; Claude, Claude Code, Cowork and VS Code (preview) the first clients; Asana, Atlassian, Canva, Figma, Granola, Linear and Supabase the first servers. The underlying ID-JAG grant was still an IETF draft on 2 Nov 2026. Minimal scopes are the spec’s recommendation: request the least scope first and let the server challenge for more through WWW-Authenticate.