Accura.devAccura.dev

MCP servers, 2026-07-28 spec

Your SaaS has a dashboard.Your customers want to run it by talking.

Production MCP servers: audit, migration to the 2026-07-28 spec, built from scratch. Two servers in production that I run myself.

Get my server auditedWhat changed on 28 July

Reply within one business day. First written opinion, free.

Works with
  • Claude
  • ChatGPT
  • Cursor
  • Le Chat
  • Perplexity
  • VS Code
The idea

One sentence in Claude. Four tool calls. No screen opened.

Without an MCP server, the assistant can talk about your product. It cannot use it. Below, the real tools of Brieform, the form SaaS I run.

The user, in Claude

“Create a contact form in French, put it in my brand colours, publish it, and tell me who replied.”

The MCP server

  1. create_formwrite

    Form created, four fields

  2. set_form_themewrite

    Brand colours applied

  3. publish_formwrite

    Live, link ready to share

  4. get_responsesread

    Twelve responses retrieved

An illustrated exchange. Tool names and annotations as exposed by the production server.
2026-07-28 spec

What changed on 28 July 2026, and what I do about it

The largest revision since the protocol launched. Seven groups of changes, with their SEPs.

  1. Stateless core

    SEP-2575SEP-2567

    What breaks

    The initialize handshake and the Mcp-Session-Id header are gone. Anything keyed on the session loses its anchor: auth context, caches, rate limits.

    What I do

    Self-contained handlers. Application state moves into explicit handles that a tool returns and takes back as an argument.

  2. Required headers

    SEP-2243

    What breaks

    Mcp-Method and Mcp-Name become mandatory on Streamable HTTP, and the server must reject any mismatch with the body. A WAF or proxy that strips Mcp-* headers breaks everything, silently.

    What I do

    Header against body validation on the server, and a check of the whole chain: proxy, WAF, CDN.

  3. No more long-lived SSE

    SEP-2260SEP-2322

    What breaks

    The server can no longer push to the client outside an active request. Progress and notifications on the GET channel stop.

    What I do

    Move to Multi Round-Trip Requests: the tool returns an InputRequiredResult, the client answers with inputResponses.

  4. Error codes

    SEP-2164

    What breaks

    Resource-not-found moves from -32002 to -32602. Tests and in-house clients that check the code literally break quietly.

    What I do

    Codes updated, and tests that check them.

  5. Tasks

    SEP-2663

    What breaks

    Tasks leaves the core for an extension, with a different lifecycle. tasks/list is removed.

    What I do

    Port to the extension, or remove it if usage does not justify it.

  6. Hardened OAuth

    6 SEPs

    What breaks

    iss validation per RFC 9207, issuer-bound credentials, exact RFC 9728 metadata, audience-bound tokens. Dynamic Client Registration is deprecated in favour of Client ID Metadata Documents.

    What I do

    Metadata and token validation brought into line, a stable issuer, Client ID Metadata Documents supported.

  7. Deprecations

    SEP-2577SEP-2596

    What breaks

    Roots, Sampling and Logging are deprecated, as is the legacy HTTP+SSE transport.

    What I do

    Replaced with tool parameters and configuration, direct model API calls, stderr and OpenTelemetry.

Source: MCP specification 2026-07-28, published 28 July 2026.

Offers

Three ways in. The prices are published.

Everything is set against €520 per day. A fixed fee is a rounded number of days.

  • MCP server audit

    2 days

    1 revision round included

    Full diff against the 2026-07-28 specTool annotations, OAuth and RFC 9728 metadataPrioritised, costed migration plan, in writing

    €950

  • Migration to the 2026-07-28 specMost requested

    5 days

    2 revision rounds included

    The audit includedStateless core, headers, error codes, Multi Round-Trip, OAuthValidated from

    €2,400

  • Production MCP server

    2 to 3 weeks

    3 revision rounds included

    Tools, naming and schemas designed for an agent with no screenOAuth 2.1, quotas and rights per planWrite audit log, deployment, observability

    €4,500to €7,500

AlsoClaude directory submission €1,200Monitoring and compliance €290 per month

Ask for a quote

Prices exclude VAT, revision rounds included. What is not included is written in the terms. Read the terms

Proof

Two MCP servers in production, run by me

No client logos. Public endpoints and listed tools, checkable from outside.

Brieform

MCP server

A form SaaS whose main interface is its MCP server

  • Streamable HTTP, OAuth 2.1 or API key
  • readOnlyHint and destructiveHint on every tool
  • Write audit log, visible to the user
  • Form preview rendered in the chat, through MCP Apps
Tested from

Stack

  • Next.js
  • Supabase
  • Vercel
  • Polar
  • PostHog
Visit

Endpoint

https://brieform.app/api/mcp/mcp

12tools exposed

  • create_form
  • update_form
  • get_form
  • list_forms
  • publish_form
  • unpublish_form
  • set_form_theme
  • get_responses
  • duplicate_form
  • delete_form
  • get_form_analytics
  • get_form_share_assets
  • Read only
  • Write
  • Destructive

  • DirectoryFast AI

    MCP server

    39tools exposed

    A product rebuilt around agent control, not just its transport

    • The agent designs the niche's typed schema, then validates every listing against it
    • A write shows on the public site at the next read, with no rebuild
    • Business model redesigned around the conversation

    Stack

    • Next.js
    • Supabase
    • Stripe
    • Vercel
    Visit
The sequence

A migration, step by step

  1. Before any code

    The written audit

    The diff against the spec, breakages by severity, the costed plan. If you need nothing, I say so, and you keep the document.

  2. Days 1 to 3

    The migration, on a branch

    Your production does not move. Every change points back to an item in the audit.

  3. Day 4

    Validation from real clients

    The migrated server is tested from the clients your users actually have.

    • Claude
    • ChatGPT
    • Cursor
    • VS Code

  4. Day 5

    Back into production

    Deployed on your infrastructure, code in your repository, directory submission if it is planned. Bugs fixed at no cost for 30 days.

Questions

The objections I hear, and my answers

Tell me what the assistant should be able to do.

Five minutes. I reply within one business day with a written opinion, and I tell you whether an MCP server is really the right tool.

Get my server auditedOr straight by email : dany@accura.dev
MCP servers: audit, 2026-07-28 migration, build | Accura.dev