mcpscoreMCP 2026-07-28 is here. Check your migration with mcpscore
MCP’s 2026-07-28 specification is a substantial protocol change, not a routine schema update. The mcpscore CLI and mcpscore.dev now understand the new lifecycle and can show where a server’s migration is complete—and where old behavior is still leaking through.
What changed in MCP
The new specification removes protocol-level sessions and the initialize handshake. Requests carry their protocol version and client capabilities directly, while the new server/discover method lets a server advertise what it supports.
Streamable HTTP is now stateless: the GET stream and Mcp-Session-Id are gone. Each JSON-RPC message uses its own POST, with protocol and routing metadata mirrored into HTTP headers. Results also gain explicit result types and cache metadata.
There are important details beyond the lifecycle change: new request-header validation, revised error codes, full JSON Schema 2020-12 support for tools, and formal deprecations for features including Roots, Sampling, Logging, and HTTP+SSE.
The official MCP 2026-07-28 key changes page is the source of truth. The Streamable HTTP specification covers the transport requirements in detail.
Why migration gaps are easy to miss
A server can appear healthy while still mixing protocol eras. It might answer the new discovery method but emit a legacy session header, accept modern requests without their required metadata, or return old error codes. A client that exercises only the happy path may never reveal the mismatch.
Migration also extends beyond connecting successfully. Tool schemas must remain usable, authorization discovery still needs to work, and modern cache and result metadata must be present. That is why a single “connected” test is not a migration assessment.
How mcpscore helps
mcpscore 1.1 added support for the final 2026-07-28 specification. It recognizes legacy, modern, and dual-era servers, then applies version-aware rules rather than judging every server against the same lifecycle.
The report scores Protocol, Tools Quality, Security & Auth, and Readiness. Readiness identifies modern-lifecycle gaps such as missing discovery, request metadata, routing-header validation, cache metadata, result types, updated errors, removed methods, and lingering sessions. Every rule links back to the specification or RFC behind it.
An audit is read-only. mcpscore lists server capabilities and sends safe protocol probes, but it never invokes a server’s tools.
Check a server before and during migration
Run the CLI without installing anything:
uvx mcpscore https://your-server.example/mcpOr paste the endpoint into mcpscore.dev. Both surfaces use the same rule engine and produce an actionable report.
- Record the report before changing the server.
- Migrate the lifecycle and transport, then run the same audit again.
- Work through failed readiness and protocol rules before moving to quality improvements.
- Add the GitHub Action to keep regressions out after the migration lands.
The complete rules reference explains what each check means and what it contributes to the score.