Rule catalogue
Every check mcp-stateless performs against MCP 2026-07-28, with the
changelog entry it enforces.
By area
What the revision changed, and which checks cover each part of it.
| Area | What changed | Rules |
|---|---|---|
| Discovery | How a client learns what a server can do, now that no handshake tells it. | MCP001 |
| Statelessness | The handshake and per-connection sessions are gone; every request stands alone. | MCP002 · MCP003 |
| Removed methods | Methods deleted in this revision, and the one that replaced subscriptions. | MCP006 · MCP007 · MCP008 · MCP009 · MCP010 · MCP021 |
| Result shape | Fields every result must now carry, including who produced it. | MCP004 · MCP005 · MCP018 |
| Error codes | Codes that moved into the reserved range, or changed meaning. | MCP011 · MCP012 |
| Request envelope | The per-request _meta block and the headers that accompany it. |
MCP013 · MCP014 |
| Deprecations | Still works today, scheduled for removal or degrading behaviour. | MCP015 · MCP016 · MCP017 |
| Authorization | What an OAuth-protected server publishes so a client can trust its tokens. | MCP019 · MCP020 |
Who has to fix it
Every rule declares an owner, and it is the most useful column in the table below. 16 of the 21 rules are protocol plumbing your MCP SDK owns: upgrading to a release that targets 2026-07-28 resolves them with no change to your own code. Only MCP013, MCP015, MCP017, MCP019, MCP020 can ever be something you wrote.
So the order to work in is fixed: upgrade the SDK, re-run the check, and then look at what is left — rather than reading a list of twenty-one findings, most of which describe code you did not write.
Breaking
A server failing any of these will not work with 2026-07-28 clients.
| Rule | Severity | Check | Fixed by | Transports |
|---|---|---|---|---|
| MCP001 | error |
server/discover is not implemented | SDK upgrade | stdio, http |
| MCP002 | error |
Server still requires the initialize handshake | SDK upgrade | stdio, http |
| MCP003 | error |
Server still uses the removed Mcp-Session-Id header | SDK upgrade | http |
| MCP004 | error |
Results are missing the required resultType field | SDK upgrade | stdio, http |
| MCP005 | error |
List results are missing the required ttlMs and cacheScope fields | SDK upgrade | stdio, http |
| MCP006 | error |
The removed ping method is still implemented | SDK upgrade | stdio, http |
| MCP007 | error |
The removed logging/setLevel method is still implemented | SDK upgrade | stdio, http |
| MCP008 | error |
The removed resources/subscribe methods are still implemented | SDK upgrade | stdio, http |
| MCP009 | error |
subscriptions/listen is missing despite advertised listChanged capabilities | SDK upgrade | stdio, http |
| MCP010 | error |
The removed HTTP GET stream endpoint is still served | SDK upgrade | http |
| MCP011 | error |
Resource-not-found still returns the old -32002 error code | SDK upgrade | stdio, http |
| MCP012 | error |
Protocol error codes were not renumbered into the reserved range | SDK upgrade | stdio, http |
| MCP013 | error |
Server rejects requests carrying the _meta protocol envelope | your code | stdio, http |
| MCP014 | error |
Server rejects the required Mcp-Method and Mcp-Name headers | SDK upgrade | http |
| MCP021 | error |
Tasks are still served from the core protocol, not the tasks extension | SDK upgrade | stdio, http |
Deprecations and advisories
These still work today, but are scheduled for removal or degrade behaviour.
| Rule | Severity | Check | Fixed by | Transports |
|---|---|---|---|---|
| MCP015 | warning |
Server declares deprecated Roots, Sampling or Logging capabilities | your code | stdio, http |
| MCP016 | warning |
Deprecated HTTP+SSE transport detected | SDK upgrade | http |
| MCP017 | warning |
tools/list ordering is not deterministic | your code | stdio, http |
| MCP018 | warning |
Results do not identify the server via _meta serverInfo | SDK upgrade | stdio, http |
| MCP019 | warning |
Authorization server does not advertise RFC 9207 iss support | your code | http |
| MCP020 | warning |
Authorization server offers only deprecated Dynamic Client Registration | your code | http |
Not yet covered
One 2026-07-28 change needs an interactive scenario to probe properly, and is deliberately left out rather than checked unreliably:
- Multi Round-Trip Requests (
InputRequiredResult) conformance — SEP-2322
It has a tracking issue. Contributions welcome — see CONTRIBUTING.md.
Generated by scripts/gen-rule-docs.mjs. Edit the rule sources, not this page.