Field notes
Blog
What I learn running two MCP servers in production, and migrating other people's. No opinion pieces, only things you can check.
The 2026-07-28 spec, the seven changes in detailThe 12-point MCP migration audit checklist, before you touch any code
Most failed MCP migrations do not fail on the code. They fail because the team started writing before they knew what their server actually did. Here is the list I run before quoting a migration. It is designed to be executed in a day on a mid-sized server, without changing anything. A static audit does not prove…
Read the postStateless MCP: replacing Mcp-Session-Id with handles
The MCP 2026-07-28 spec removes sessions from the protocol layer. The header is gone from Streamable HTTP, and list endpoints no longer vary per connection. A server that needs to keep something between two calls now does it explicitly, with identifiers it mints itself that travel as ordinary tool arguments. The code…
Read the post-32002 becomes -32602: the change that breaks clients silently
This is the smallest change in the MCP 2026-07-28 spec, and the one that generates the most annoying tickets. MCP had introduced as a custom error code for a missing resource. JSON-RPC 2.0 already had for invalid params. The two overlapped. The new revision drops the duplicate and keeps the standard code. Why it hurts…
Read the postHow to migrate an MCP server to the 2026-07-28 spec
On 28 July 2026, the Model Context Protocol shipped its largest revision since launch. This is not a few new fields. The transport core was rewritten, three primitives are deprecated, authorization got stricter, and two extensions were promoted to first class. If you run an MCP server in production on 2025-11-25,…
Read the post
Got an MCP server to audit?
Five minutes to describe it. I reply within one business day with a first written diagnosis, free of charge.
Get my MCP server audited