MCP 2026-07-28 RC — fleet migration tracking

[asachs01]

Why

MCP Release Candidate 2026-07-28 (final release Jul 28 2026; prior 2025-11-25; ~10-week SDK validation window) is a major, mostly-breaking update. Highlights: stateless core (Mcp-Session-Id removed), initialize/initialized handshake removed (protocol version + clientInfo + capabilities now in _meta on every request), new server/discover, routable Mcp-Method/Mcp-Name headers, InputRequiredResult replacing SSE server-push, -32002→-32602, Tasks-as-extension, full JSON Schema 2020-12, and 6 OAuth/OIDC hardening SEPs.
Ref: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/

Phase 0 — stateless per-request transport (DONE as PRs; also fixes a live multi-client bug)

A fleet sweep (54 *-mcp repos) found 6 using a single shared Server+StreamableHTTPServerTransport reused across requests. Behind the gateway this means only the first user since container start gets tools; everyone else sees 0 until a restart. This is both a current prod bug AND RC step 1 (the RC removes sessions). All 6 fixed via per-request stateless transport + crash-hardening; PRs open, verified, awaiting merge:

• qbo-mcp — fix: per-request Server + StreamableHTTP transport (stateless HTTP) — fixes #47 qbo-mcp#48 — verified: 133 tools, multi-client, gateway modes; 39 tests green
• action1-mcp — fix: per-request stateless Streamable HTTP server (multi-client 0-tools bug) action1-mcp#45 — verified: 6 tools; 16 tests (SDK ^1.12→1.29, no bump needed)
• knowbe4-mcp — fix: build fresh Server+transport per HTTP request (multi-client 0-tools bug) knowbe4-mcp#42 — verified: 30 tools; 42 tests
• proofpoint-mcp — fix: per-request stateless HTTP transport (multi-client 0-tools bug) proofpoint-mcp#48 — verified: 40 tools (repo has no test files)
• sherweb-mcp — fix: per-request Server+transport for Streamable HTTP (multi-client 0-tools bug) sherweb-mcp#53 — verified: 11 tools; 4 tests
• pax8-mcp — wyre-technology/pax8-mcp#27 — fix verified via curl; ⚠️ repo CI red on main (PRE-EXISTING toolchain: @types/node@26/typescript@6/eslint@10 no flat config) — needs a separate toolchain PR; our fix adds 0 new errors

45 repos already per-request (OK). 3 N/A (stdio-only / external-proxy): afkbot-mcp, brain-mcp, sentinelone-mcp.

Related follow-ups surfaced during Phase 0

• pax8-mcp toolchain PR — fix pre-existing red build/lint (@types/node@26, typescript@6, eslint@10 missing flat config)
• pax8-mcp — state.currentDomain is module-global shared across clients (multi-tenant concurrency bug, pre-existing)
• action1-mcp — pre-existing critical Dependabot alert on main (unrelated to transport fix)

Phase 1 — spec compliance (after Tier-1 SDK ships RC support)

Per HTTP server:

• Remove initialize/initialized handshake; read protocol version + clientInfo + capabilities from _meta per request
• Implement server/discover
• Validate routable Mcp-Method / Mcp-Name headers; send MCP-Protocol-Version: 2026-07-28
• InputRequiredResult instead of SSE for server→client requests
• -32002 → -32602 for missing resources
• Full JSON Schema 2020-12 in tool input/output schemas
• ttlMs / cacheScope on list/resource results
• W3C Trace Context in _meta (traceparent/tracestate/baggage) where structured logging is used

Phase 2 — gateway + auth

• mcp-gateway: session removal, routable-header routing, protocol version
• OAuth/OIDC hardening: SEP-2468 (iss/RFC9207), SEP-837 (application_type DCR), SEP-2352 (cred binding/migration), SEP-2207 (refresh), SEP-2350/2351 (scope + .well-known)

Deprecations to plan away from (annotation-only; functional >=1yr)

• roots -> tool params / resource URIs / server config
• sampling -> direct LLM provider APIs
• logging -> stderr (stdio) / OpenTelemetry

---

Reference: mcp-streamable-http-multi-client-init skill; superops/hudu/rocketcyber/autotask as per-request templates. Continuity: cases/mcp-2026-07-28-release-candidate.

[asachs01]

Phase 0 deploy status — 2026-07-01

✅ Live in prod (transport fix deployed):

• qbo-mcp v1.5.1
• knowbe4-mcp v1.0.3
• proofpoint-mcp v1.0.5
• sherweb-mcp v1.3.7

qbo needed a follow-up fix: its .releaserc.json had npmPublish: true → semantic-release hit 401 on npm.pkg.github.com and aborted before docker/deploy. Set to npmPublish: false (fleet standard, matches sherweb/proofpoint/knowbe4) + removed the orphan v1.5.1 tag the failed run left; re-release succeeded.

⚠️ Blocked on infra (not code):

• action1-mcp — fix released (v1.0.6, image in GHCR) but Deploy failed: Container App mcpgw-prod-action1 does not exist. Not provisioned → not running in prod. Needs a provisioning decision.
• pax8-mcp — no .github/workflows at all (only dependabot). Transport fix fix(release): supply GitHub Packages auth to the reusable Docker build #27 + toolchain fix feat(janitor): auto-merge green dev/CI-tooling major bumps #28 are ready, but nothing deploys until pax8 is wired into the fleet CI/release template and provisioned.

Open follow-ups:

• Sweep the rest of the fleet for .releaserc npmPublish: true (qbo's latent bug)
• Provision action1-mcp Container App (or confirm it's intentionally not live)
• Wire pax8-mcp into fleet CI/release + provision, then merge feat(janitor): auto-merge green dev/CI-tooling major bumps #28 → rebase/merge fix(release): supply GitHub Packages auth to the reusable Docker build #27