Track migration to MCP spec 2026-07-28 (stateless, MRTR, deprecated Sampling)

[mattpodwysocki]

Summary

The MCP spec released a new revision on 2026-07-28 (announced at https://blog.modelcontextprotocol.io/posts/2026-07-28/) that moves from the stateful bidirectional protocol to a stateless request/response model. Key changes relevant to us:

• The initialize/initialized handshake and session IDs are eliminated; each request is self-describing.
• Server-initiated elicitation is replaced by "Multi Round-Trip Requests" (MRTR).
• Sampling is deprecated.
• Roots and Logging are also deprecated.
• Header-based routing, cacheable list results, tasks moved to an official extensions framework.
• Security: RFC 9207 issuer validation required, shift from Dynamic Client Registration toward Client ID Metadata Documents (CIMD).
• Deprecations get a 12-month minimum window; legacy HTTP+SSE transport gets a year-long offramp. No fire drill, but not indefinite either.

As of this issue, @modelcontextprotocol/sdk on npm is still on the 1.x line (1.30.0 latest) — there is no separate 2.0.0 package. The new spec appears to be supported via 1.x releases, not a major SDK version bump.

Why this needs a dedicated pass, not an incidental bump

This repo is actively building on the mechanisms this spec revision replaces/deprecates — most concretely, the in-progress add-preview-token-elicitation work (PR #57) depends on server-initiated elicitation, the exact thing MRTR replaces. Migrating means redesigning against whatever MRTR's actual API surface turns out to be, not just bumping a dependency version.

What to check before starting

• Confirm real client support for MRTR (Claude Desktop, Claude Code, VS Code Copilot) — no point redesigning against a mechanism clients can't use yet.
• Read the SDK's actual migration guide/changelog for the TypeScript SDK version(s) that implement 2026-07-28 support.
• Audit this repo for every current use of elicitInput/Sampling beyond the in-progress PR [security] Add MCP elicitation for secure preview token handling #57 work.

Non-goals for now

• No urgency given the 12-month deprecation window.
• The routine SDK dependency bump (1.29.0 → 1.30.0) is handled separately and does not itself adopt the new spec — see the corresponding PR.

See also mapbox/mcp-server#245 for the equivalent tracking issue there.

[mattpodwysocki]

Correction/clarification: the "2.0" isn't a future release of `@modelcontextprotocol/sdk` — that package is being retired entirely. Per https://blog.modelcontextprotocol.io/posts/sdk-betas-2026-07-28/, TypeScript v2 splits it into separate focused packages (`@modelcontextprotocol/server`, `@modelcontextprotocol/client`), currently beta-only (`npm install @modelcontextprotocol/server@beta`), no stable release yet, with a dedicated codemod (`npx @modelcontextprotocol/codemod@beta v1-to-v2 .`) to help migrate.

So this migration is two layers, not one:

1. The spec revision itself (stateless model, MRTR, deprecated Sampling) — already covered above, and directly relevant given the in-progress `add-preview-token-elicitation` work (PR [security] Add MCP elicitation for secure preview token handling #57).
2. A full package rewrite: every `@modelcontextprotocol/sdk` import in this repo would need to move to the new package(s), likely with API surface changes beyond just import paths, plus whatever `@modelcontextprotocol/ext-apps` needs on its end.

Given it's beta with no stable release and a provided codemod (a strong signal the API surface actually changed meaningfully, not just moved), this reinforces: no urgency, worth revisiting once v2 stabilizes.