Track migration to MCP spec 2026-07-28 (stateless, MRTR, deprecated Sampling)

Summary

The MCP spec released a new revision on 2026-07-28 (announced at https://blog.modelcontextprotocol.io/posts/2026-07-28/) that moves from the stateful bidirectional protocol to a stateless request/response model. Key changes relevant to us:

• The initialize/initialized handshake and session IDs are eliminated; each request is self-describing.
• Server-initiated elicitation is replaced by "Multi Round-Trip Requests" (MRTR).
• Sampling is deprecated.
• Roots and Logging are also deprecated.
• Header-based routing (Mcp-Method, Mcp-Name), cacheable list results, tasks moved to an official extensions framework.
• Security: RFC 9207 issuer validation required, shift from Dynamic Client Registration toward Client ID Metadata Documents (CIMD).
• Deprecations get a 12-month minimum window; legacy HTTP+SSE transport gets a year-long offramp. No fire drill, but not indefinite either.

As of this issue, @modelcontextprotocol/sdk on npm is still on the 1.x line (1.30.0 latest) — there is no separate 2.0.0 package. The new spec appears to be supported via 1.x releases, not a major SDK version bump.

Why this needs a dedicated pass, not an incidental bump

This directly affects features we've shipped recently in this repo:

• directions_tool's route-selection elicitation and search_and_geocode_tool's disambiguation elicitation are both built on server.elicitInput(...) — the exact mechanism MRTR replaces.
• ground_location_tool's grounding-strategy detection is built on server.createMessage(...) (Sampling) — deprecated outright.

Migrating means redesigning these three UX features against whatever MRTR's actual API surface turns out to be, not just bumping a dependency version.

What to check before starting

• Confirm real client support for MRTR (Claude Desktop, Claude Code, VS Code Copilot) — no point redesigning against a mechanism clients can't use yet.
• Read the SDK's actual migration guide/changelog for the TypeScript SDK version(s) that implement 2026-07-28 support.
• Check hosted-mcp-server's OAuth flow for any Dynamic Client Registration dependency, given the spec's shift toward CIMD.
• Decide whether mcp-devkit-server and mcp-docs-server need the same migration (devkit also uses elicitation per its own patterns; docs-server does not use elicitation/sampling as far as known — verify).

Non-goals for now

• No urgency given the 12-month deprecation window.
• The routine SDK dependency bump (1.29.0 → 1.30.0) is handled separately and does not itself adopt the new spec — see the corresponding PR.

Start by checking client support for MRTR and reading the TypeScript SDK migration guide or changelog for the 2026-07-28 revision. Then inspect directions_tool, search_and_geocode_tool, ground_location_tool, hosted-mcp-server, mcp-devkit-server, and mcp-docs-server; done means the affected protocol, OAuth, and server usage has been verified and a migration scope is agreed.