FeatureJuly 28, 20261 min read

MCP servers speak the 2026-07-28 spec revision

Runtype MCP endpoints now serve the handshake-free 2026-07-28 MCP revision alongside 2025-11-25 on the same URLs, with cache hints, deterministic tool ordering, and RFC 9207 issuer validation.

mcpintegrationssecurity

Runtype's hosted MCP endpoints now speak the MCP 2026-07-28 spec revision, released today, alongside the 2025-11-25 revision they already served. Same URLs, no migration.

Modern clients connect handshake-free: requests carry the spec's _meta envelope, and server/discover advertises 2026-07-28 in supportedVersions.
Existing clients keep the initialize handshake and identical behavior. Era detection uses the official SDK's own classifier, so routing can never disagree with the protocol.
Cache hints (SEP-2549): tools/list, prompts/list, resources/list, resources/templates/list, and resources/read now carry ttlMs and cacheScope freshness hints, backed by deterministic result ordering.
RFC 9207 issuer validation: MCP OAuth connections verify the authorization server's iss against its discovery document before redeeming a code, closing the authorization-server mix-up attack.

This applies to the platform MCP server, per-product MCP surfaces, Code Mode MCP, and the @runtypelabs/mcp npm package.

One compat note: an unknown tool call now returns JSON-RPC error -32602 (the spec-correct code) instead of -32601. If your client branches on -32601 for unknown tools, accept both.