MCP cheat sheet 2026-07-28

Personal study aid. Spec pin: modelcontextprotocol.io/specification/2026-07-28

Roles

Host = AI app (consent + orchestration). Client = one connector, 1:1 with one server. Server = tools / resources / prompts. Servers must not see the full multi-server conversation.

Every request _meta

Key	Who	Purpose
`protocolVersion`	Client	`2026-07-28`
`clientCapabilities`	Client	elicitation, extensions, …
`clientInfo`	Client SHOULD	name + version
`serverInfo`	Server SHOULD	on results
`logLevel`	Client opt.	replaces logging/setLevel

Keys live under io.modelcontextprotocol/… in _meta.

Core RPCs

Side	Method	Notes
MUST	`server/discover`	versions, capabilities, identity
Server	`tools/list\|call`	stable list order SHOULD
Server	`resources/list\|read`	+ templates
Server	`prompts/list\|get`	templated workflows
Either	`subscriptions/listen`	change stream
Pattern	MRTR	`input_required` then retry

resultType

`complete`	Done. Older omit ⇒ treat as complete.
`input_required`	Collect `inputRequests`, echo `requestState`, retry with a new JSON-RPC id.

Transports

stdio	Local process, one client
Streamable HTTP	Remote POST. No session id. No Last-Event-ID resume.

Security

Consent before tool calls and data exposure.
Treat tool annotations as untrusted unless you trust the server.
Integrity-protect requestState if it affects auth (HMAC/AEAD).
Validate iss when present. Prefer Client ID Metadata Documents over DCR.
Host keeps history. Servers stay isolated.

2026-07-28 breaks (vs 2025-11-25)

No initialize / notifications/initialized. No Mcp-Session-Id.
server/discover is required. Every request carries version + capabilities in _meta.
MRTR replaces server-initiated requests. subscriptions/listen replaces old subscribe/GET notify.
Tasks left core → extension io.modelcontextprotocol/tasks.
Deprecated: Roots, Sampling, Logging, HTTP+SSE. Broken streams ⇒ re-issue with a new id.

Extensions (opt-in)

io.modelcontextprotocol/tasks
MCP Apps / UI
Auth extensions (client credentials, enterprise-managed)

First Inspector sequence

server/discover
list tools/resources/prompts
one read-only call
optional subscriptions/listen