The 2026-07-28 spec revision removes protocol sessions, replaces the
initialize handshake with server/discover, and deletes
ping, logging/setLevel and resources/subscribe.
mcp-migrate finds all 21 of those breakages in your code and rewrites
your server for the ones it can fix safely.
$ uvx mcp-migrate check . $ uvx mcp-migrate fix . --write
No install, no config, no account. Exit code 1 if it finds anything, so it drops straight into CI.
We scanned 578 Python servers from the official registry. The change that dominated every discussion of this revision — Mcp-Session-Id going away — appears in 3.3% of them.
17 public MCP servers, graded against 2026-07-28 (7× A, 8× B, 2× C). Every row here was produced by this project scanning a public repository. It is a survey, not a list of adopters — nobody below has endorsed this tool. If you maintain one of them, submit your own entry and it becomes yours to correct.
| Server | Grade | Score | Lang | What it does |
|---|---|---|---|---|
| mcp-server-motherduckmotherduckdb/mcp-server-motherduck | A | 100/100 | python | Local MCP server connecting AI assistants to DuckDB and MotherDuck for SQL analytics and data engineering. |
| mcp-server-qdrantqdrant/mcp-server-qdrant | A | 100/100 | python | Official MCP server for Qdrant that acts as a semantic memory layer for keeping and retrieving memories in the vector search engine. |
| aws-documentation-mcp-serverawslabs/mcp | A | 97/100 | python | AWS Labs MCP server that fetches, searches, and recommends AWS documentation pages, converted to markdown. |
| cloudwatch-mcp-serverawslabs/mcp | A | 97/100 | python | AWS Labs MCP server for CloudWatch that gives troubleshooting agents alarm, metric, and log data for root cause analysis. |
| duckduckgo-mcp-servernickclyde/duckduckgo-mcp-server | A | 97/100 | python | MCP server that provides web search through DuckDuckGo, with additional content fetching and parsing features. |
| dynamodb-mcp-serverawslabs/mcp | A | 97/100 | python | Official AWS DynamoDB MCP server providing expert data modeling guidance, validation, and cost analysis tools. |
| mcp-server-tree-sitterwrale/mcp-server-tree-sitter | A | 97/100 | python | MCP server providing tree-sitter code analysis so AI assistants get structure-aware access to codebases in many languages. |
| mcp-neo4j-cypherneo4j-contrib/mcp-neo4j | B | 92/100 | python | MCP server for Neo4j that runs Cypher graph queries and supports Text2Cypher workflows over graph data. |
| arxiv-mcp-serverblazickjp/arxiv-mcp-server | B | 91/100 | python | Search, download, and read arXiv papers, with semantic search and citation tools, over MCP. |
| mcp-obsidianMarkusPfundstein/mcp-obsidian | B | 91/100 | python | MCP server that lets clients read, search, and modify Obsidian vault content through the Local REST API. |
| mcp-server-fetchmodelcontextprotocol/servers | B | 91/100 | python | Reference MCP server that fetches web pages and converts HTML to markdown so LLMs can read them in chunks. |
| mcp-server-sentrymodelcontextprotocol/servers-archived | B | 91/100 | python | Archived reference MCP server for retrieving and analyzing issues, stacktraces, and debugging info from Sentry.io. |
| mcp-server-sqlitemodelcontextprotocol/servers-archived | B | 91/100 | python | Archived reference MCP server for SQLite that runs SQL queries and auto-generates business insight memos. |
| mcp-server-timemodelcontextprotocol/servers | B | 91/100 | python | Reference MCP server giving LLMs current time and timezone conversion using IANA timezone names. |
| excel-mcp-serverharis-musa/excel-mcp-server | B | 89/100 | python | Read, write, and format Excel workbooks (formulas, charts, pivot tables) over MCP, via SSE or Streamable HTTP. |
| mcp-server-gitmodelcontextprotocol/servers | C | 66/100 | python | Reference MCP server for Git repository interaction, giving LLMs tools to read, search, and manipulate repos. |
| mcp-atlassiansooperset/mcp-atlassian | C | 64/100 | python | MCP server for Atlassian products (Confluence and Jira), supporting both Cloud and Server/Data Center deployments. |
Every rule, what it means, and the spec change behind it. If your server is failing and you landed here from a search, find the symptom below.
| Rule | Severity | What it finds & what to do | Spec |
|---|---|---|---|
| R001 | breaking | Uses Mcp-Session-Id, which no longer existsSessions are gone from the transport. Mint an explicit handle server-side and take it as an ordinary tool argument instead. | SEP-2567 |
| R002 | breaking | Keeps per-connection state in a module-level dictA stateless server can sit behind a round-robin load balancer. Move this into a store keyed by an explicit handle you return to the client. | SEP-2567 |
| R003 | advisory | Custom HTTP client does not send Mcp-Method (or Mcp-Name where required)POST requests now carry Mcp-Method on every request so proxies can route and rate-limit without parsing the body. Add it, and add Mcp-Name too if this call is tools/call, resources/read, or prompts/get -- those are the only methods that carry a name to route on. Or move to an SDK that sets both for you. | spec |
| R004 | advisory | tools/list order is not deterministicSort the tools you return. Stable ordering lets clients cache and it lifts LLM prompt-cache hit rates for everyone downstream. | Deterministic tool ordering (SHOULD) |
| R005 | advisory | Server capabilities declare no extensions mapOptional features now negotiate through `extensions` on ServerCapabilities. Declare an empty map if you support none -- it tells clients you speak 2026-07-28. | extensions field on ServerCapabilities |
| R006 | deprecated | Uses the deprecated HTTP+SSE transportMove to Streamable HTTP. HTTP+SSE stays in the spec for 12+ months, then goes. | HTTP+SSE deprecated in favour of Streamable HTTP |
| R007 | deprecated | Depends on a deprecated core feature (Roots / Sampling / Logging)These stay in the spec for at least 12 months, then leave. Start moving now. | Roots, Sampling and Logging deprecated |
| R008 | advisory | Does not propagate OpenTelemetry trace context from _metaRead `traceparent`, `tracestate` and `baggage` off `_meta` and hand them to your tracer. Without it, agent traces break at your server. | SEP-414 |
| R009 | breaking | Still implements the initialize / notifications/initialized handshakeThe initialize handshake is gone -- there is no more negotiation round trip before a server is usable. Delete your initialize/notifications/initialized handling and advertise protocol versions, capabilities and identity through server/discover instead. | SEP-2575 |
| R010 | advisory | Registers MCP request handlers but never implements server/discoverServers MUST implement server/discover so clients can learn supported protocol versions, capabilities and server identity before doing anything else. On Python, upgrade to mcp>=2.0 -- Server.__init__ registers the handler for you, and there is no handler to register on 1.x because the method does not exist there. The TypeScript SDK has not shipped server/discover as of 1.30.0, so there is nothing to call yet. | SEP-2575 |
| R011 | breaking | Implements the removed ping request/responseping is gone from the protocol -- liveness now rides on the transport itself. Remove the handler and rely on your HTTP stack's own keepalive/health checks. | SEP-2575 |
| R012 | breaking | Implements the removed logging/setLevel requestlogging/setLevel is gone. Log level is now per-request: read it off `_meta["io.modelcontextprotocol/logLevel"]` on each incoming request instead of tracking one process-wide level. | SEP-2575 |
| R013 | breaking | Uses resources/subscribe or resources/unsubscribe, replaced by subscriptions/listenresources/subscribe and resources/unsubscribe are gone. Move subscription management to the new subscriptions/listen call. | SEP-2575 |
| R014 | breaking | Implements SSE resumability (Last-Event-ID / event redelivery)Stream resumability via Last-Event-ID and replayed events is gone. Drop your event store / replay logic -- a dropped connection is just a dropped connection now, the client issues a fresh request. | SEP-2575 |
| R015 | advisory | Results are returned without the required resultType fieldEvery result now carries resultType: "complete" or "input_required". If you build JSON-RPC responses yourself, set it on each result you return. On the official SDK you do not need to do anything: the runner stamps resultType on every result it serializes. | SEP-2322 |
| R016 | advisory | List/read results are returned without ttlMs / cacheScopetools/list, prompts/list, resources/list, resources/read and resources/templates/list results now require CacheableResult's ttlMs and cacheScope. With the official SDK you configure this once rather than per handler: Server(cache_hints={method: CacheHint(...)}). Without hints the SDK emits no cache metadata at all. | SEP-2549 |
| R017 | breaking | Uses the old -32002 resource-not-found error codeThe resource-not-found error code changed from -32002 to -32602 (Invalid params). Update whatever raises or checks for -32002 in this context. | spec |
| R018 | breaking | Uses a server-initiated request replaced by Multi Round-Trip RequestsServer-initiated roots/list, sampling/createMessage and elicitation/create are gone, along with notifications/elicitation/complete and elicitationId. Return an InputRequiredResult instead and let the client retry the call with inputResponses. | SEP-2322 |
| R019 | breaking | Uses removed tasks/list or the removed blocking tasks/resulttasks/list is gone, and blocking tasks/result is replaced by polling tasks/get + tasks/update. Tasks itself moved out of core into the io.modelcontextprotocol/tasks extension -- declare it there instead. | SEP-2663 |
| R020 | deprecated | Uses Dynamic Client Registration (RFC 7591), now deprecatedRFC 7591 Dynamic Client Registration is deprecated in favour of Client ID Metadata Documents. Plan a migration to CIMD for onboarding new OAuth clients. | spec |
| R021 | advisory | Pins an older JSON Schema dialect than 2020-12Implementations MUST support at least JSON Schema 2020-12 for inputSchema/outputSchema. If you pin an older draft explicitly, move it to 2020-12 (or drop the pin and let a modern validator pick the default). | SEP-2106 |
uvx mcp-migrate check . —
prints a graded report and exits 1 if anything is wrong.
The GitHub Action runs the same check on every push and uploads SARIF to code scanning.
Pinned to a release tag, so a breaking pattern never lands on main in the first place.