The 2026-07-28 MCP specification removes protocol-level sessions, shifting security and state validation responsibilities to server developers. This guide covers building a working Node.js MCP server with the current SDK, plus critical changes to implement before the stateless spec finalizes.
The MCP TypeScript SDK just split into six packages, and if you start a new server on the v1 import paths today, you'll rewrite them before July 28. The 2026-07-28 specification release candidate removes protocol-level sessions entirely, which sounds like a simplification — until you realize it shifts every security invariant that sessions used to guarantee into your application code. Building an MCP server in Node.js has never been easier to get running, and it has never required more careful thinking about what happens once it's live.
Here's the practical reality: the server code itself is the cheap part. The protocol gives you a clean abstraction for exposing tools, resources, and prompts. But authentication, state validation, and header integrity checks are now your responsibility, not the protocol's. This guide walks through building a working server with the current SDK, then maps exactly what changes when the stateless spec lands — so you're not caught mid-migration.
The SDK Landscape: v1 Production vs. v2 Alpha
You have two SDK lines to choose from right now, and the choice isn't subtle. The production v1.x line ships as @modelcontextprotocol/sdk, and it's what every tutorial and most production servers use today.
If you enjoyed this, read the full post at SaaS with Alex
Top comments (0)