MCP (Model Context Protocol)

Use this skill to decide whether MCP is the right abstraction, configure existing servers in Claude Code or Codex, or build a narrow custom server when repeated agent workflows justify it.

Protocol baseline: 2026-07-28 is the current spec — it shipped on 2026-07-28 (https://modelcontextprotocol.io/specification/2026-07-28/changelog), superseding 2025-11-25. It is a fundamental redesign, not an increment:

• Stateless protocol. The initialize/notifications/initialized handshake and the Mcp-Session-Id header are removed (SEP-2567, SEP-2575). Every request carries its protocol version and client capabilities in _meta; a mandatory server/discover RPC advertises supported versions and identity. Servers needing cross-call state mint explicit handles passed as ordinary tool arguments.
• Roots, Sampling, and Logging are deprecated (SEP-2577) — still functional, but new implementations should not adopt them. Migrate to tool-parameter directories / resource URIs, direct LLM provider API calls, and stderr or OpenTelemetry respectively.
• Server-initiated requests are gone. roots/list, sampling/createMessage, and elicitation/create are replaced by the Multi Round-Trip Requests (MRTR) pattern: the server returns resultType: "input_required" with inputRequests, and the client retries the original request carrying inputResponses.
• Transport changes. The HTTP GET endpoint and resources/subscribe/unsubscribe collapse into a single subscriptions/listen stream; SSE resumability (Last-Event-ID) is removed, so a broken stream means re-issuing the request with a new ID. ping and logging/setLevel are removed. HTTP+SSE transport is now formally Deprecated — migrate to Streamable HTTP.

The deprecation clock is the planning fact that matters. The spec adopted a formal feature lifecycle (Active / Deprecated / Removed) with a minimum twelve-month deprecation window (SEP-2596) and a published deprecated features registry. Anything you build on Roots, Sampling, or Logging today has a bounded, published lifetime — treat those as migration debt from the start rather than as supported surface. Verify the registry for current state before relying on a deprecated feature; the window is a floor, not a promise of a specific removal date.

TypeScript SDK v2 targets this spec; v1.x remains a supported production lane for a transition period. Confirm current SDK stability against the SDK repo before choosing a lane — that status moves independently of the spec.

Governance (factor into vendor-trust judgment, not just the tech): Anthropic donated MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation, effective 2025-12-09 (blog.modelcontextprotocol.io/posts/2025-12-09-mcp-joins-agentic-ai-foundation; AAIF founding members include AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI). The existing maintainers keep full technical authority over the spec via the SEP process — the foundation explicitly "will not dictate the technical direction of MCP" — so day-to-day spec/SDK guidance in this skill is unaffected. What changes for your judgment: MCP is no longer a single-vendor bet, which lowers long-term protocol-abandonment risk and is a legitimate factor when a customer or security review asks "who owns this protocol" — cite the foundation, not Anthropic, when that question comes up.

Quick Reference