MCP 2026-07-28 in plain language

2026-07-28 is the current revision of the Model Context Protocol. The previous one was 2025-11-25. This page walks through what the specification contains, in the order you meet it when building a server. It is a guide, not a replacement: when you need the exact rule, follow the link to the original section.

Words the spec uses

MUST, SHOULD and MAY have their RFC 2119 meanings: required, recommended, optional. Deprecated means still in the spec but scheduled for removal; removed means gone.

Every message

All messages are JSON-RPC 2.0: requests with an id, responses with the same id, and notifications without one. Since 2026-07-28 each request also carries _meta with the protocol version and client capabilities, and each result carries resultType. → Base protocol

Error codes:

Code	Meaning
-32700, -32600 to -32603	Standard JSON-RPC: parse error, invalid request, method not found, invalid params, internal error
-32602	Also used for “resource not found” (was -32002 before)
-32020	Header mismatch: HTTP headers do not match the body
-32021	Missing required client capability
-32022	Unsupported protocol version
-32000 to -32019	Left to implementations. SDKs use them for their own errors, so the meaning depends on the SDK

The range -32020 to -32099 is reserved for the specification. If you define your own error codes, pick numbers outside -32768 to -32000.

Methods a client calls

Method	What it does	Section
server/discover	Supported versions, capabilities, server info. Servers must implement it	Discovery
tools/list	List tools with their input and output schemas	Tools
tools/call	Run a tool	Tools
resources/list	List fixed resources	Resources
resources/templates/list	List URI templates such as notes://{id}	Resources
resources/read	Read one resource by URI	Resources
prompts/list	List prompt templates and their arguments	Prompts
prompts/get	Fill in a prompt template	Prompts
completion/complete	Suggest values for a prompt argument or URI template variable	Completion
subscriptions/listen	Open a stream of the change notifications the client opts in to	Subscriptions

There are no methods a server calls on the client any more. When a server needs input during tools/call, prompts/get or resources/read, it returns resultType: "input_required" and the client retries with the answers. → Multi Round-Trip Requests. Explained on How 2026-07-28 works.

Notifications a server sends

Notification	When	Delivered on
notifications/progress	Progress of a long request	That request’s response
notifications/message	A log line, only if the request set a log level	That request’s response
notifications/subscriptions/acknowledged	First message of a subscription: which types it will send	The subscriptions/listen stream
notifications/tools/list_changed, …/prompts/list_changed, …/resources/list_changed	A list changed	The subscriptions/listen stream
notifications/resources/updated	A subscribed resource changed	The subscriptions/listen stream
notifications/cancelled	The server ends a subscription stream	The subscriptions/listen stream

Cancelling a request depends on the transport: over Streamable HTTP the client closes the response stream; over stdio it sends notifications/cancelled with the request id. → Cancellation

Input the server can ask for

These are the request types a server can embed in an input_required result. The client must declare the matching capability.

Request	Purpose	Status
elicitation/create	Ask the user for structured input (form mode) or send them to a URL (URL mode)	Active → Elicitation
sampling/createMessage	Ask the client’s LLM for a completion	Deprecated → Sampling
roots/list	Ask which directories the user shared	Deprecated → Roots

Transports

• stdio: the client starts the server; one JSON message per line; logs on stderr. → stdio
• Streamable HTTP: one POST per message to a single endpoint; MCP-Protocol-Version, Mcp-Method and Mcp-Name headers; no GET, no sessions. → Streamable HTTP
• HTTP+SSE (from 2024-11-05): deprecated. → Migration guide

Details and tested examples: Transports.

Server utilities

• Caching: list results and resources/read carry ttlMs and cacheScope. → Caching
• Pagination: list methods take a cursor and return nextCursor. → Pagination
• Logging: deprecated. The log level is set per request in _meta; logging/setLevel was removed. → Logging

Authorization

HTTP servers that need authentication use OAuth 2.1, with the MCP server acting as a protected resource. In 2026-07-28, Client ID Metadata Documents are the preferred way for clients to register, and Dynamic Client Registration is deprecated. → Authorization

Extensions

Optional features live outside the core protocol and are announced in the extensions field of the capabilities. Two you will meet: io.modelcontextprotocol/tasks for long-running work, which moved out of the core in this revision, and MCP Apps (io.modelcontextprotocol/ui) for interactive interfaces.

Deprecated in this revision

Feature	Use instead	Earliest removal
Roots	Tool parameters, resource URIs or server configuration	First revision on or after 2027-07-28
Sampling	Call an LLM provider API directly	First revision on or after 2027-07-28
Logging	stderr for stdio; OpenTelemetry	First revision on or after 2027-07-28
Dynamic Client Registration	Client ID Metadata Documents	First revision on or after 2027-07-28
HTTP+SSE transport	Streamable HTTP	Three months after SEP-2596 reached Final

Source: the deprecated features registry.

Next

• Spec diff: 2025-11-25 → 2026-07-28
• Migrate from 2025-11-25 to 2026-07-28