chore(mcp): MCP 2026-07-28 readiness — impact map for apps/mcp

[kl3inIT]

Tracking issue. No action possible yet: Spring AI 2.0 and MCP Java SDK 2.0.0 implement spec 2025-11-25. The 2026-07-28 spec was finalized on 2026-07-28 and Anthropic states support is "rolling out across Claude products" with no published date or compatibility matrix. This issue records the impact so the work is not re-derived when the Java SDK ships support.

Direction confirmed

The protocol core became stateless: sessions and Mcp-Session-Id are removed. apps/mcp already runs protocol: STATELESS with per-request bearer plus token exchange, which is the shape the new spec standardizes. Do not move to a stateful transport.

Impact map

Spec change	Effect on apps/mcp
Sessions and Mcp-Session-Id removed; list endpoints no longer vary per connection (SEP-2567)	Confirms the current transport. Closes the idea of per-actor tools/list filtering — enforce at call time, as GitHub MCP does for OAuth
initialize handshake removed; version and capabilities ride in _meta (SEP-2575)	SDK-level
server/discover MUST be implemented	SDK-level
Mcp-Method / Mcp-Name headers required on POST (SEP-2243)	Lets McpRateLimitFilter account per method without reading the body
ttlMs + cacheScope required on tools/list, prompts/list, resources/list, resources/read (SEP-2549)	Must choose a freshness policy per list; private for anything varying by identity
MRTR replaces server-initiated requests (SEP-2322)	Elicitation becomes reachable without a stateful transport. notifications/elicitation/complete and elicitationId are removed; correlate through requestState
notifications/progress and notifications/message flow on the originating request response stream	Progress no longer needs a session. Log level is per-request _meta; a server MUST NOT emit notifications/message for a request that did not ask
Roots, Sampling, Logging deprecated, 12-month window (SEP-2577)	Do not adopt Sampling. Use OpenTelemetry for logging
Tasks graduated to an official extension with tasks/get polling	The correct answer for long-running ingestion or export exposed over MCP, rather than progress notifications
SSE resumability removed (Last-Event-ID)	Not used
resultType required on every result	SDK-level
Error codes renumbered; resource-not-found -32002 to -32602	SDK-level, but assert it once support lands
DCR deprecated for Client ID Metadata Documents; iss validation (RFC 9207); credentials keyed by issuer	Client-side concerns — review apps/cli, not the resource server
inputSchema / outputSchema loosened to full JSON Schema 2020-12	generateOutputSchema = true stays valid

When the Java SDK ships 2026-07-28

• Upgrade and re-run the apps/mcp suite
• Publish ttlMs / cacheScope on every list result
• Re-evaluate elicitation through MRTR for ambiguous Knowledge scope
• Evaluate the Tasks extension for long-running work
• Reconcile the assistant-and-mcp spec

References

• https://blog.modelcontextprotocol.io/posts/2026-07-28/
• https://modelcontextprotocol.io/specification/2026-07-28/changelog
• https://claude.com/blog/bringing-mcp-2026-07-28-to-claude
• https://github.com/github/github-mcp-server/blob/main/docs/scope-filtering.md