MCP Just Broke Its Own Handshake — Here's a Free Checker for the 2026-07-28 Spec

On July 28th, the Model Context Protocol spec shipped its biggest breaking change since the protocol launched: the initialize/initialized handshake and the Mcp-Session-Id header — the thing every MCP server and client has been built around since day one — are gone. In their place, every single request now has to carry its own protocol version and capabilities in a _meta object, on every call, with no more one-time negotiation. There's also new header-based routing (Mcp-Method, Mcp-Name, MCP-Protocol-Version), a resultType field that's now mandatory on every successful result, and a Multi Round-Trip Requests mechanism that replaces server-initiated streams for mid-call user input.

All four Tier 1 SDKs — TypeScript, Python, Go, C# — already speak the new spec. Which means if you've got a hand-rolled MCP server, a custom transport layer, or anything that isn't just calling an official SDK's helpers, it can look completely fine in isolation and still fail the moment it talks to an updated client or gateway, with nothing more informative than a routing failure or a silently-dropped request.

I added a free MCP 2026-07-28 Migration Checker to Bracketly, my free client-side dev tools site, for exactly this. Paste a JSON-RPC message and it flags the deprecated initialize handshake if it's still there, checks whether params._meta has the required io.modelcontextprotocol/protocolVersion and clientCapabilities fields, and validates that responses declare resultType and that input_required results carry the inputRequests/requestState fields the new Multi Round-Trip flow needs. If you paste a full raw HTTP block instead of just the JSON body, it also checks the new routing headers — including flagging a lingering Mcp-Session-Id header as a sign you're still on the old stateful model.

Building this meant going straight to the published TypeScript schema for the 2026-07-28 revision rather than trusting summaries, since a wire-protocol checker that's subtly wrong about field names is worse than no checker at all — so every check is tuned to how confident I actually am in it: the required-field checks are strict (spec violations), while corners of the spec I'm less certain are fully nailed down, like the exact shape of individual Multi Round-Trip entries, are flagged as gentler notes instead of hard failures.

Like every tool on the site, it runs entirely in your browser — nothing you paste is sent anywhere. If you're migrating an MCP server or client right now, it's a quick first pass before you go digging through logs.