Field notes
Blog
What I learn running two MCP servers in production, and migrating other people's. No opinion pieces, only things you can check.
The 2026-07-28 spec, the seven changes in detailMCP Apps: a real interface in the chat, without an iframe
The MCP 2026-07-28 revision promotes MCP Apps to first class. The principle: a server can render an interface that appears inside the client, in the conversation, without an iframe and without the user leaving their chat. For a SaaS, this is the most interesting change in the revision, because it touches the product…
Read the postSetting up MCP compliance monitoring without a protocol team
Until 2026, keeping up with MCP was a sport. Revisions landed, features changed, and the only way not to be caught out was reading SEPs as they came. The 2026-07-28 revision changes that. It brings three governance pieces that make monitoring feasible without dedicating a role to it: a formal feature lifecycle, an…
Read the postDynamic Client Registration is deprecated: moving to Client ID Metadata Documents
OAuth 2.0 Dynamic Client Registration is formally deprecated by the MCP 2026-07-28 spec, in favour of Client ID Metadata Documents. It keeps working for backwards compatibility, but it has a date. If you operate an MCP server with OAuth, this is not urgent. It is still worth understanding now, because it solves a…
Read the postGetting accepted into the Claude connectors directory: the full submission
An MCP server listed nowhere is a server nobody installs. This is the part technical teams underestimate most: distribution work is separate from build work, and it has its own requirements. The Claude connectors directory is the most visible channel, and the most demanding. Here is what a submission that passes…
Read the postPrompt injection through MCP tools: the threat model your API never had
Your API had a simple threat model: an authenticated caller sends parameters, your code validates them, it responds. The caller was a program, doing what its developer wrote. An MCP server breaks that assumption. The caller is a model, and that model decides what to call based on a context containing text you do not…
Read the postThe 8 flaws found in almost every production MCP server
Auditing MCP servers turns up more or less the same holes every time. These are not exotic vulnerabilities. They are the predictable consequence of a server written like an API, and called by an agent. Here are the eight, in the order I run into them. One token that opens every tool The most widespread default. The…
Read the postOAuth for MCP servers: the three changes in 2026-07-28
The MCP 2026-07-28 revision does not only touch the transport. It also hardens authorization, with three changes driven by a simple observation: in practice, an MCP client talks to many servers, often dozens. That is not the deployment shape OAuth was originally designed around. The three changes are small in code and…
Read the postWhat an MCP server costs in 2026: build, run and maintenance
The question always arrives at the same moment: someone decided an MCP server is needed, and nobody knows what that costs. Here are honest ranges, what moves them, and the running cost everyone forgets. Three build tiers A simple, read-only server. Five to ten tools, API key authentication, no state between calls. The…
Read the postSampling, roots and logging are deprecated: what replaces them
The 2026-07-28 revision moves three capabilities to deprecated: , and . In the SDKs they are marked obsolete, with pointers to their replacements. Before opening this work, one scheduling point that changes everything: the protocol now has a formal feature lifecycle. A deprecated feature stays functional for at least…
Read the postMcp-Method and Mcp-Name: routing MCP traffic without reading the body
This is the least dramatic change in the 2026-07-28 spec, and the highest return if you run the infrastructure. Two headers become mandatory on the Streamable HTTP transport: and . They mirror the JSON-RPC method and the name being called in the request body. A request calling the tool via now says so in its headers.…
Read the postThe initialize handshake is gone: what changes in your code
In every earlier revision of the Model Context Protocol, a connection began with a handshake. The client sent , the server answered with its capabilities, the client confirmed with , and from then on both sides knew who they were talking to. The 2026-07-28 revision removes that step. and are no longer required. There…
Read the postThe 12-point MCP migration audit checklist, before you touch any code
Most failed MCP migrations do not fail on the code. They fail because the team started writing before they knew what their server actually did. Here is the list I run before quoting a migration. It is designed to be executed in a day on a mid-sized server, without changing anything. A static audit does not prove…
Read the postStateless MCP: replacing Mcp-Session-Id with handles
The MCP 2026-07-28 spec removes sessions from the protocol layer. The header is gone from Streamable HTTP, and list endpoints no longer vary per connection. A server that needs to keep something between two calls now does it explicitly, with identifiers it mints itself that travel as ordinary tool arguments. The code…
Read the post-32002 becomes -32602: the change that breaks clients silently
This is the smallest change in the MCP 2026-07-28 spec, and the one that generates the most annoying tickets. MCP had introduced as a custom error code for a missing resource. JSON-RPC 2.0 already had for invalid params. The two overlapped. The new revision drops the duplicate and keeps the standard code. Why it hurts…
Read the postHow to migrate an MCP server to the 2026-07-28 spec
On 28 July 2026, the Model Context Protocol shipped its largest revision since launch. This is not a few new fields. The transport core was rewritten, three primitives are deprecated, authorization got stricter, and two extensions were promoted to first class. If you run an MCP server in production on 2025-11-25,…
Read the post
Got an MCP server to audit?
Five minutes to describe it. I reply within one business day with a first written diagnosis, free of charge.
Get my MCP server audited