Spec 2026-07-28 · readiness

Will your MCP server survive the rewrite?

The 2026-07-28 revision made MCP stateless, formalized OAuth 2.1, and dropped several capabilities — a refactor, not a version bump. Point the checker at a running endpoint to see what breaks.

Try

Runs server-side against the live endpoint. Internal targets like localhost and private IPs are refused. Nothing is stored.

no auth — completes the handshakeOAuth-guarded — probed unauthenticated

MCP001Legacy initialize handshakeMCP002Session-id dependenceMCP003Deprecated logging capabilityMCP004Deprecated sampling capabilityMCP005Deprecated roots capabilityMCP006Missing OAuth 2.1 postureMCP007SDK still on the v1 line
MCP001Legacy initialize handshakeMCP002Session-id dependenceMCP003Deprecated logging capabilityMCP004Deprecated sampling capabilityMCP005Deprecated roots capabilityMCP006Missing OAuth 2.1 postureMCP007SDK still on the v1 line
MCP001Legacy initialize handshakeMCP002Session-id dependenceMCP003Deprecated logging capabilityMCP004Deprecated sampling capabilityMCP005Deprecated roots capabilityMCP006Missing OAuth 2.1 postureMCP007SDK still on the v1 line
MCP001Legacy initialize handshakeMCP002Session-id dependenceMCP003Deprecated logging capabilityMCP004Deprecated sampling capabilityMCP005Deprecated roots capabilityMCP006Missing OAuth 2.1 postureMCP007SDK still on the v1 line
The other half

This page tells you what breaks. Fixing it takes a week.

A probe only sees the outside. Removing session state is a design change no tool can make for you — the official codemod handles the SDK rename and stops there, by its own description. So the same rule engine also ships as an agent skill that reads the code, triages what is real, and works through the rest in order.

Run it anywhere

One file, no dependencies beyond Node. Works in any terminal, any agent, any CI.

node mcpcheck.mjs --source ./my-server
node mcpcheck.mjs https://example.com/mcp
Or install the skill

Diagnosis plus the per-rule migration procedure, keyed by the rule ids above.

Download .skill
Read the source