Field notes
Blog
What I learn running two MCP servers in production, and migrating other people's. No opinion pieces, only things you can check.
The 2026-07-28 spec, the seven changes in detailOAuth for MCP servers: the three changes in 2026-07-28
The MCP 2026-07-28 revision does not only touch the transport. It also hardens authorization, with three changes driven by a simple observation: in practice, an MCP client talks to many servers, often dozens. That is not the deployment shape OAuth was originally designed around. The three changes are small in code and…
Read the postWhat an MCP server costs in 2026: build, run and maintenance
The question always arrives at the same moment: someone decided an MCP server is needed, and nobody knows what that costs. Here are honest ranges, what moves them, and the running cost everyone forgets. Three build tiers A simple, read-only server. Five to ten tools, API key authentication, no state between calls. The…
Read the postSampling, roots and logging are deprecated: what replaces them
The 2026-07-28 revision moves three capabilities to deprecated: , and . In the SDKs they are marked obsolete, with pointers to their replacements. Before opening this work, one scheduling point that changes everything: the protocol now has a formal feature lifecycle. A deprecated feature stays functional for at least…
Read the postMcp-Method and Mcp-Name: routing MCP traffic without reading the body
This is the least dramatic change in the 2026-07-28 spec, and the highest return if you run the infrastructure. Two headers become mandatory on the Streamable HTTP transport: and . They mirror the JSON-RPC method and the name being called in the request body. A request calling the tool via now says so in its headers.…
Read the postThe initialize handshake is gone: what changes in your code
In every earlier revision of the Model Context Protocol, a connection began with a handshake. The client sent , the server answered with its capabilities, the client confirmed with , and from then on both sides knew who they were talking to. The 2026-07-28 revision removes that step. and are no longer required. There…
Read the postThe 12-point MCP migration audit checklist, before you touch any code
Most failed MCP migrations do not fail on the code. They fail because the team started writing before they knew what their server actually did. Here is the list I run before quoting a migration. It is designed to be executed in a day on a mid-sized server, without changing anything. A static audit does not prove…
Read the postStateless MCP: replacing Mcp-Session-Id with handles
The MCP 2026-07-28 spec removes sessions from the protocol layer. The header is gone from Streamable HTTP, and list endpoints no longer vary per connection. A server that needs to keep something between two calls now does it explicitly, with identifiers it mints itself that travel as ordinary tool arguments. The code…
Read the post-32002 becomes -32602: the change that breaks clients silently
This is the smallest change in the MCP 2026-07-28 spec, and the one that generates the most annoying tickets. MCP had introduced as a custom error code for a missing resource. JSON-RPC 2.0 already had for invalid params. The two overlapped. The new revision drops the duplicate and keeps the standard code. Why it hurts…
Read the postHow to migrate an MCP server to the 2026-07-28 spec
On 28 July 2026, the Model Context Protocol shipped its largest revision since launch. This is not a few new fields. The transport core was rewritten, three primitives are deprecated, authorization got stricter, and two extensions were promoted to first class. If you run an MCP server in production on 2025-11-25,…
Read the post
Got an MCP server to audit?
Five minutes to describe it. I reply within one business day with a first written diagnosis, free of charge.
Get my MCP server audited