Skip to content

What is checked

The scanner implements 33 rules, each traced to a published specification page, changelog entry or protocol enhancement proposal. Every rule and its source is listed in the rule matrix in the open-source repository.

Files are scanned in TypeScript, JavaScript, JSON and YAML. Dependency folders, build output and version-control directories are always ignored.

Sessions and statelessness

The next revision is designed so any server instance can answer any request. Session identifiers, session-creating transport options, in-memory state keyed by connection, and sticky-routing configuration are all reported.

MCP2026-SESSION-001 · MCP2026-SESSION-002 · MCP2026-SESSION-003 · MCP2026-SESSION-004

Start-up and removed calls

The initialisation handshake is gone, as are the keep-alive check and resource subscriptions. Older streaming and connection-termination mechanics are flagged too.

MCP2026-LIFECYCLE-001 · MCP2026-LIFECYCLE-002 · MCP2026-LIFECYCLE-003

Request labelling and metadata

New required headers identify the protocol version, the method and — for some calls — the target name, so gateways can route without reading the body. Missing headers, missing validation and missing request metadata are all reported.

MCP2026-HEADER-001 · MCP2026-HEADER-002 · MCP2026-HEADER-003 · MCP2026-META-001

Long-running work

The tasks design changed: listing and result retrieval were removed, capability negotiation changed shape, and several fields were renamed.

MCP2026-TASKS-001 · MCP2026-TASKS-002 · MCP2026-TASKS-003 · MCP2026-TASKS-004

Asking the client for something

Sampling, roots and protocol logging are deprecated; the folder-change notification and the log-level call were removed outright. Servers that interrupt a call to ask for input must now return a result saying so.

MCP2026-SAMPLING-001 · MCP2026-SAMPLING-002 · MCP2026-ROOTS-001 · MCP2026-ROOTS-002 · MCP2026-LOGGING-001 · MCP2026-LOGGING-002 · MCP2026-ELICITATION-001 · MCP2026-MRTR-001 · MCP2026-MRTR-002 · MCP2026-MRTR-003

Results and errors

Results must declare their type and carry caching hints; several numeric error codes were reassigned or replaced by named errors; server discovery moved where it reports its own name and version.

MCP2026-RESULT-001 · MCP2026-CACHE-001 · MCP2026-DISCOVERY-001 · MCP2026-ERROR-001 · MCP2026-ERROR-002 · MCP2026-ERROR-003

Library and opportunities

The protocol library your server is built on is usually the single largest item. We also flag where a server could present an interactive interface rather than plain text.

MCP2026-SDK-001 · MCP2026-APPS-001

Limits worth knowing