Spec 2026-07-28 · readiness

Will your MCP server survive the rewrite?

The 2026-07-28 revision made MCP stateless, formalized OAuth 2.1, and dropped several capabilities — a refactor, not a version bump. Point the browser checker at a running endpoint, or use the CLI and GitHub Action to scan TypeScript, Python, Rust and Go servers.

  • TypeScriptMCP007
  • PythonMCP009
  • RustMCP010
  • GoMCP011
60.1% legacy-only2026-08-23 snapshot
Try

Runs server-side against the live endpoint. Internal targets like localhost and private IPs are refused. Nothing is stored.

no auth — completes the handshakeOAuth-guarded — probed unauthenticated

MCP001Legacy-only: no modern surfaceMCP002Session id on a modern requestMCP003Deprecated logging capabilityMCP004Deprecated sampling capabilityMCP005Deprecated roots capabilityMCP006Missing OAuth 2.1 postureMCP007TypeScript SDK on the v1 lineMCP008No server/discoverMCP009Python SDK on the v1 lineMCP010Rust crate on a pre-2026-07-28 lineMCP011Go SDK not serving 2026-07-28MCP101Dual-era (not a defect)MCP102Legacy-only session ids (not a defect)
MCP001Legacy-only: no modern surfaceMCP002Session id on a modern requestMCP003Deprecated logging capabilityMCP004Deprecated sampling capabilityMCP005Deprecated roots capabilityMCP006Missing OAuth 2.1 postureMCP007TypeScript SDK on the v1 lineMCP008No server/discoverMCP009Python SDK on the v1 lineMCP010Rust crate on a pre-2026-07-28 lineMCP011Go SDK not serving 2026-07-28MCP101Dual-era (not a defect)MCP102Legacy-only session ids (not a defect)
MCP001Legacy-only: no modern surfaceMCP002Session id on a modern requestMCP003Deprecated logging capabilityMCP004Deprecated sampling capabilityMCP005Deprecated roots capabilityMCP006Missing OAuth 2.1 postureMCP007TypeScript SDK on the v1 lineMCP008No server/discoverMCP009Python SDK on the v1 lineMCP010Rust crate on a pre-2026-07-28 lineMCP011Go SDK not serving 2026-07-28MCP101Dual-era (not a defect)MCP102Legacy-only session ids (not a defect)
MCP001Legacy-only: no modern surfaceMCP002Session id on a modern requestMCP003Deprecated logging capabilityMCP004Deprecated sampling capabilityMCP005Deprecated roots capabilityMCP006Missing OAuth 2.1 postureMCP007TypeScript SDK on the v1 lineMCP008No server/discoverMCP009Python SDK on the v1 lineMCP010Rust crate on a pre-2026-07-28 lineMCP011Go SDK not serving 2026-07-28MCP101Dual-era (not a defect)MCP102Legacy-only session ids (not a defect)
One engine · four ways to use it

Check once, gate every PR, then fix what fired.

The browser is the fastest outside-in check. The same deterministic engine ships as a zero-install CLI, a GitHub Action, and an agent skill. Their source checks scan TypeScript, Python, Rust and Go repositories; the skill also works through each remediation.

Run once from the terminal

No install and no runtime dependencies. Probe a URL or scan a TypeScript, Python, Rust or Go repository, including SDK constraints.

npx mcp-migration-check <url>
npx mcp-migration-check --source .
Gate every pull request

The bundled Action scans TypeScript, Python, Rust and Go projects and fails only when the selected severity threshold is reached.

- uses: AlpayC/mcp-migration-check@v1
  with:
    source: .
    fail-on: critical
See Action inputs →
Fix it with an agent

Install the Claude Code plugin for diagnosis plus the per-rule migration procedure.

/plugin marketplace add AlpayC/mcp-migration-check
/plugin install mcp-migration@mcp-migration-check
Or download the .skill →
See where the ecosystem stands

60.1% of 10,890 graded servers still answer only the legacy protocol. Among the 6,191 touched since the revision shipped — 63.8%.

Read the 2026-08-23 snapshot →