MCP, Nov 2026 to May 2027: the breaking change already shipped

What 2026-07-28 took out of the handshake

A protocol version here is a date, and the date only moves when a change breaks old peers. The versioning page says 2026-07-28 is current, and that backwards-compatible edits stay on that string. 105 days later, the string has not moved. The changelog measures the revision against 2025-11-25, which is the last handshake-based revision the versioning page names. ¹²

The wire is stateless

The changes a server author has to implement start with the session. Protocol sessions and the Mcp-Session-Id header are gone, so tools/list, resources/list, and prompts/list no longer vary per connection. State that must survive a call is a handle the server mints and the client passes back as an ordinary argument. The initialize and notifications/initialized handshake is gone. Each request carries io.modelcontextprotocol/protocolVersion and client capabilities in _meta. A mismatch returns UnsupportedProtocolVersionError. Servers must implement server/discover, which advertises supported versions, capabilities, and identity. Clients may call it first, or they may send any request and handle the error. ²

The HTTP GET stream and resources/subscribe are replaced by subscriptions/listen, one long-lived POST response for the change notifications a client opts into. Progress and log notifications still ride the response stream of the request they belong to. ping, logging/setLevel, and notifications/roots/list_changed are removed. Log level is a per-request _meta field. SSE resume via Last-Event-ID is removed: a broken stream means the client sends a new request with a new id. Experimental tasks left the core protocol for an extension, io.modelcontextprotocol/tasks, polled with tasks/get. ²

Elicitation comes back as a result, not a server request

Multi round-trip requests replace the old pattern in which a server opened a request of its own, such as elicitation/create, sampling/createMessage, or roots/list. The server now returns resultType input_required, with the questions in inputRequests. The client retries the original call and supplies inputResponses. Ordinary results use resultType complete. Clients must treat a missing resultType from an older server as complete. The elicitation completion notification and the elicitationId field added in 2025-11-25 are removed, because the retry is the completion signal. A server that needs to correlate retries puts its own identifier in requestState. ²

Two smaller edits matter for anyone caching tools or rendering output. Servers should return tools/list in a stable order, so a prompt cache can hit. inputSchema, outputSchema, and structuredContent are looser: any JSON Schema 2020-12 keyword, and any JSON value for structured content, with bounds on $ref. List and read results carry ttlMs and cacheScope. Streamable HTTP requests must send Mcp-Method and Mcp-Name. ²

OAuth got stricter, and one registration path was deprecated

Authorization servers should send iss on the authorization response, per RFC 9207, and clients must check a present iss against the issuer they stored before redeeming the code. A client must key stored credentials by issuer, must not reuse them at a different authorization server, and must re-register when the authorization server changes. Dynamic Client Registration stays available for authorization servers that do not support Client ID Metadata Documents, and new implementations are told not to adopt it. The removal clock for that deprecation is in the next section. ²³

The current protocol version is 2026-07-28.

Who can actually change the next revision

The governance page read on November 10 says the project is Model Context Protocol, a series of LF Projects, LLC. Code and specification contributions use Apache-2.0. Membership in the technical roles is personal. The page says there are no seats reserved for companies. Lead Maintainers hold a veto. The page names David Soria Parra and Den Delimarsky. Core Maintainers named on the same page are Peter Alexander, Caitie McCaffrey, Kurtis Van Gent, Clare Liguori, Paul Carleton, and Nick Cooper. Justin Spahr-Summers is listed as lead maintainer emeritus. ⁶

The Linux Foundation's December 9, 2025 release is the donation record. It announces the Agentic AI Foundation, with founding contributions of MCP from Anthropic, goose from Block, and AGENTS.md from OpenAI. That release is how the project acquired a foundation home. The governance page, not the press release, is the document that says who votes on a SEP. Specification changes go through Specification Enhancement Proposals. SEP-3398 is the process SEP that tries to put those votes on a calendar. ⁶⁷⁴

SEP-3398's status on November 10 is Accepted, with an accepted date of October 14, 2026. It is a process SEP. It adds no protocol message. It says specification releases generally fall on the last Tuesday of March and September, on an eight-month cycle with a soft freeze 2.5 months out, an SDK beta 1.5 months out, and a hard freeze one month out. Release managers confirm the exact day in a published calendar. The transition sentence is the one that matters for this brief: move the release previously targeted for December 2026 to March 30, 2027, subject to that calendar. The page says managers publish the calendar within two weeks of adoption. This brief did not find a page that is that calendar. ⁴

The roadmap is older than the SEP. It says last updated 2026-08-22, and it says the text is current thinking rather than firm commitments. Five areas are named: agentic messaging primitives, HTTP-native transport unification (including HTTP over stdio and ETags), agent identity (DPoP, workload identity, token exchange), a cleaner tools/call result and progressive discovery, and SDK generation from the spec plus conformance tests. Those are the maintainers' review priorities. They are not the table of contents of a March 30 release. ⁵

The registry proves a namespace. It does not review a server

The about page calls the registry the official centralized metadata repository for publicly accessible MCP servers, backed by Anthropic, GitHub, PulseMCP, and Microsoft. It is in preview. The page says breaking changes or a data reset can still happen. A server name is reverse-DNS, such as io.github.user/server-name, and the publisher proves the GitHub account or the domain with GitHub, DNS, or an HTTP challenge. The record is a server.json: name, where the package or remote URL lives, how to run it, and a description. Private servers are out of scope. The page says to run a private registry for those. ⁸

Two sentences on that page should decide how you use the list. The metadata is deliberately unopinionated, and downstream aggregators are where curation and ratings belong. Host applications are not supposed to consume the official registry directly. They are supposed to use a marketplace that implements the same OpenAPI shape. Security scanning is delegated to npm, PyPI, Docker Hub, and to those aggregators. The registry's own controls are namespace authentication, field limits, and manual takedown. ⁸

The metadata hosted by the MCP Registry is deliberately unopinionated.

The walk behind the chart followed nextCursor with version=latest and limit=100 until the cursor ended. It started at 10:45:53 GMT and finished at 10:49:01 GMT, 612 pages, 61,146 records. 60,183 were active and 963 were deprecated. 60,183 + 963 = 61,146. Active share is 98.4 percent. This site's November 8 walk, same filter, counted 59,506. The difference is 1,640. The earlier page also showed the list moving by two records inside a few minutes, and it showed one namespace holding 2,366 records that pointed at one repository. This November 10 walk did not re-count namespaces. Use that page for the shape of the list. Use this one for the size on this date. ⁹¹⁰

A search of the same API for aiagentsinfo at 10:49:59 GMT returned zero servers. This site publishes a read-only Streamable HTTP server at /api/mcp and says the official-registry publish step is still a domain proof plus mcp-publisher. A public URL and a row in the official registry are different facts. The prompt and tool checker validates MCP tool JSON. It does not list servers. ⁹

Clients agree on tools. They do not agree on the revision

Support, on the pages below, means a documented way to reach a server and call its tools. It does not mean the client has implemented every major change from July 28. Where a page names a revision, the cell says so. Where it does not, the cell says the page does not. These pages were read on November 10, 2026. ^{16171819202122}

Claude Code is the page that names the new revision in public. The v2 runtime is described as the same client on MCP TypeScript SDK 2.0, which adds 2026-07-28. The doc says that runtime is selected when feature flags are fetched, on Claude Code v2.1.232 or later, and by default in listed session types on v2.1.274 or later. On v2 it asks HTTP, stdio, and claude.ai connector servers whether they support the newer revision, and it connects to every other server as v1 does. An operator can force v1 or v2 with MCP_SDK_GENERATION, and can force legacy negotiation with MCP_PROTOCOL_NEGOTIATION. SSE is marked deprecated. On v2.1.265 or later the HTTP transport is tried first and SSE is the fallback. ¹⁶

The Agents SDK draws the same line from the other direction. It says the installed mcp package version is separate from the protocol version negotiated with a server. With Python SDK v2 it sends server/discover at the newest version the SDK supports. If the server does not implement that method, the client uses the initialize handshake and the version negotiated there. Installing SDK v2 does not force every connection onto 2026-07-28. That is the dual stack, written down by the SDK that many hosted agents import. ¹⁹

The Windsurf docs URL is a redirect, which is worth recording because buyers still say Windsurf. On November 10, https://docs.windsurf.com/windsurf/cascade/mcp returned HTTP 308 to https://docs.devin.ai/desktop/cascade/mcp. The markdown for that path resolved to the Devin Local customizations page. That page documents MCP for the Devin Local agent in Devin Desktop, with project config at .devin/mcp_config.json and user config at ~/.config/devin/mcp_config.json. It also says legacy .windsurf rule files are imported. The page does not name a protocol revision. ²²

The counts you can check, and what they leave out

Three public counters moved on November 10, and none of them is a count of agents in production. They are worth printing because each one has a URL, a clock time, and a unit. ^11121314

The tall bar is the package whose latest npm tag is still 1.32.2. 307,682,080 file requests from October 11 through November 9. GitHub published typescript-sdk v2.4.0 on October 23, the same day as tag 1.32.2, and the 2.x line on GitHub is split into @modelcontextprotocol/core 102,038,883, server 79,656,643, client 53,405,727, and node 20,311,677. Adding those four bars treats overlapping installs as one population, so this page leaves them side by side. Python is a different registry. pypistats last_month for mcp was 235,193,557, last_week 79,237,289, last_day 11,679,389, retrieved 10:45 GMT. PyPI's project record said version 2.3.0, matching the GitHub release v2.3.0 published October 2. The pypistats JSON does not say it excluded mirrors, and it does not split versions. ¹²¹³¹⁵

The servers repository leads at 91,902 stars. It is the reference-server repo. python-sdk is next at 24,820. The specification repository, modelcontextprotocol/modelcontextprotocol, had 9,655. Stars are a reason the repository is easy to find. They are not a concurrency number and not a security review. ¹¹

GitHub's search index is a third object. At 10:47:15 GMT, topic:mcp-server returned total_count 42,138, with incomplete_results false. This site's count of the same query at 03:35 UTC the same day was 42,072. The difference is 66. A topic is a label a repository owner sets. The topic note explains why that label and the registry list are not the same census. The registry figure on November 10 is 19,008 higher than this topic total, and the two counts were taken about three hours apart. ¹⁴³⁰⁹

The attacks that are already written down

The specification's security pages, read November 10, are about authorization. The attack that shows up in tool descriptions was written up earlier, by a lab, and it is still the threat model for any client that pastes tools/list into the prompt. This chapter keeps those apart. ²³²⁴²⁵

Tool descriptions are part of the prompt

Invariant Labs, on April 1, 2025, named a tool poisoning attack: instructions embedded in an MCP tool description that the model sees and a simplified user interface often hides. Their write-up says a malicious server can steer the agent, including across tools the user trusts. The July 28 changelog tells servers to return tools in a stable order so prompt caches hit. That is a performance rule. It also means the description stays in the context window. The official security best-practices page read for this brief does not use the phrase tool poisoning. The attack stands as a published demonstration, not as a CVE number. A related failure mode, agents claiming success when the MCP tools cannot do the job, is measured in the MCPHallu note. That paper is a benchmark of hallucinations. It is not a vulnerability advisory. ²²⁵

Confused deputy, and the token you must not forward

The security best-practices page describes a confused deputy that appears when an MCP proxy uses one static client id at a third-party authorization server, lets MCP clients register dynamically, and relies on a consent cookie. A later request can skip the consent screen and deliver an authorization code to an attacker's redirect. The mitigation on that page is per-client consent at the MCP server before the third-party redirect. The normative security considerations repeat it: a proxy using a static client id must obtain user consent for each dynamically registered client before forwarding. The same considerations say a server must accept only tokens intended for itself, and must not pass the client's token through to an upstream API. The best-practices page says token passthrough is explicitly forbidden. Dynamic Client Registration is the mechanism in that attack write-up, and it is also the mechanism the July revision deprecated in favor of Client ID Metadata Documents. Deprecation is not removal. The earliest removal is still July 28, 2027. ³²³²⁴

The packages in the first two rows are still downloaded. In the October 11 to November 9 window, mcp-remote had 4,805,171 npm downloads and @modelcontextprotocol/inspector had 2,599,288. The downloads API does not split versions, so those figures are not a count of machines still on 0.1.15 or 0.14.0. They are a reason to pin the patched release if you still shell out to either package. ¹²²⁶²⁷

What is dated from November 2026 through May 2027

Announced means a linked spec page, SEP, or maintainer document says it. Likely means that document aims the work at this stretch and does not lock a day. Watch means a later check should confirm the item or drop it. A blank cell means no source read for this brief named that month. The general six-month outlook covers product filings and regulation. This table is the protocol only. ⁴⁵

Announced

The versioning page names one current revision, 2026-07-28, and the deprecated-features registry names one future eligibility day, July 28, 2027, which falls after May 2027. Inside the window, the dated proposal is March 30, 2027, in an Accepted process SEP, subject to a calendar. The SEP also says planning for September 2027 begins in late January 2027. The roadmap's five areas are written down and explicitly not committed. The registry about page says the registry is in preview and names no general-availability day. ¹³⁴⁵⁸

Likely

Likely, in the sense this site uses, is the March release sitting in this window because the accepted SEP aims it there, and the late-January planning phrase for the following cycle. It is not a probability from this desk. The feature content of that release is the part the roadmap refuses to promise. HTTP-over-stdio, ETags, DPoP, a redesigned tools/call result, and progressive discovery are the areas the August 22 page says maintainers will review first. A server author who builds all five before the SEP is Final will be building ahead of the spec. ⁴⁵

Watch for

Watch the transition calendar. SEP-3398 says it gets published within two weeks of adoption, and the accepted date on the page is October 14, 2026. This brief did not find it, so March 30 can still move. Watch whether any client page that was silent on the revision starts naming 2026-07-28. Watch the removed section of the deprecated-features registry, which was empty on November 10. Watch an expedited-removal SEP: the policy allows a floor of 90 days for an active security risk, and no such shortening was on the registry. Watch the registry leaving preview. The about page does not date that. The rendered board at plan.modelcontextprotocol.io was not used. Its HTML shell contained no dates. ³⁴⁸²⁹

What to pin, and what to refuse

The tool layer under an agent harness is the set of servers the harness is willing to call, the transport those calls use, and the revision both sides negotiate. MCP is that layer's common port. The port's incompatible change shipped on July 28, 2026. From November 10, 2026 through May 2027 the public record adds a proposed release date, a preview catalog that grew by 1,640 latest rows in about 45 hours, and client docs that mostly still describe transports rather than the new revision. ¹⁴⁹

Builders should ship the new revision and the old handshake together. Implement server/discover, stateless Streamable HTTP, stable tool lists, structured content, and input_required for anything that used to be an elicitation callback. Keep initialize working for the clients whose docs do not yet name 2026-07-28. Skip Roots, Sampling, and Logging in new code. The migration on the registry is ordinary tool arguments, a direct provider call, and stderr or OpenTelemetry. Prefer Client ID Metadata Documents, and keep Dynamic Client Registration only for authorization servers that have not moved. Publish a server.json under a namespace you control. Point buyers at a marketplace or an allowlist, not at the official registry walk. ²³⁸

Buyers should write three questions into the order. Which protocol revision does the client negotiate, and what does the trace show when the server only speaks 2025-11-25? Which servers are allowlisted, and who approves a new one? Are tool calls shown in full before they run? A connector count, a star count, and a registry total do not answer those questions. Claude Code and the OpenAI Agents SDK are the two pages in this set that describe the fallback in public. Cursor, VS Code, Gemini CLI, Devin Desktop, and the Responses API document how to attach a server. Ask them for the revision separately. ^{16171819202122}

Refuse three shortcuts. Refuse a prompt that says the registry has 61,146 safe servers. The about page says the opposite. Refuse an install of mcp-remote or MCP Inspector that is not pinned at or above the patched versions in CVE-2025-6514 and CVE-2025-49596. Refuse a design that forwards the MCP client's access token to an upstream API. The specification forbids it. The general agent outlook and the 2027 forecast cover products and task cost. They are the wrong pages for the revision pin. ^8242627

Methodology

This page did not field a survey, recruit a panel, or interview vendors. It copies public pages and APIs and labels every arithmetic step. There is no hidden sample of practitioners.

What was counted

The registry walk requested https://registry.modelcontextprotocol.io/v0.1/servers with version=latest and limit=100, followed metadata.nextCursor, and counted _meta["io.modelcontextprotocol.registry/official"].status. It ran once, from 10:45:53 to 10:49:01 GMT on November 10, 2026, 188.4 seconds, 612 pages. 60,183 + 963 = 61,146. The active share is 60,183 / 61,146, shown to one decimal as 98.4 percent. The difference from the November 8 walk is 61,146 − 59,506 = 1,640. The November 8 figure is that page's Pass A, not a recount. ⁹¹⁰

Days from the revision to this brief are the UTC date difference from 2026-07-28 to 2026-11-10, which is 105. npm figures are the downloads field from the point API for 2026-10-11:2026-11-09. pypistats figures are the three fields in the recent endpoint. GitHub stars are stargazers_count. The topic total is total_count for q=topic:mcp-server. The 66 gap versus 03:35 UTC uses the figure published on this site's topic note. ^1112131430

What this does not measure

It does not measure how many of the 61,146 records answer a handshake, how many namespaces are spam, or how many distinct codebases they point at. Those questions are on the November 8 page, and this walk did not repeat them. It does not split npm or PyPI downloads by version, so it does not say how many of the 307.7 million requests installed 1.32.2. It does not claim the pypistats recent count excludes mirrors, because the JSON does not say. It did not install Claude Code, Cursor, VS Code, Gemini CLI, or Devin and capture a negotiation trace. A page that omits a protocol date may still negotiate one.

It did not read the Draft spec. It did not use the rendered release board at plan.modelcontextprotocol.io, because the HTML shell had no dates. It did not search the entire CVE corpus. The three advisories are the three this brief opened and checked against the GitHub Advisory Database. It did not use Ahrefs. Forward-looking cells are labeled announced, likely, or watch-for, and a month stays empty when no source names it.