chore: upgrade MCP extensions to Python SDK 2.0 and protocol revision 2026-07-28

Tracked under posit-dev/connect#38478.

1. Condition

Two extensions in this repository carry MCP dependencies.

simple-mcp-server pins the Python MCP SDK to a 1.x release:

mcp==1.28.1
    # via simple-mcp-server

Source: extensions/simple-mcp-server/requirements.txt.

The Python MCP SDK released v2.0.0 on 28 July 2026, alongside specification revision 2026-07-28. v1.29.0 shipped the same day as the final 1.x release.

Source: python-sdk releases.

simple-shiny-chat-with-mcp is an MCP client. It reaches MCP servers through chatlas==0.19.0, which carries its own mcp dependency.

Source: extensions/simple-shiny-chat-with-mcp/requirements.txt.

The server extension already sets stateless_http=True and disables the SDK's DNS-rebinding host check:

mcp = FastMCP(
    name="MCP Server",
    ...
    stateless_http=True,
    transport_security=TransportSecuritySettings(
        enable_dns_rebinding_protection=False
    ),
)

Source: extensions/simple-mcp-server/main.py.

2. Requirement

Publishers copy these extensions. They set the default shape of customer MCP servers on Connect. An example that serves an older protocol revision teaches an older pattern.

Revision 2026-07-28 removes the initialize handshake and the Mcp-Session-Id header, and makes stateless operation a protocol requirement rather than a deployment preference.

Sources: The 2026-07-28 Specification, SEP-2575.

3. Task

1. Upgrade simple-mcp-server to Python MCP SDK 2.0.0. Regenerate requirements.txt with uv export.
2. Read the 2.0.0 release notes and migration guidance. Apply every required source change in main.py.
3. Confirm which protocol revision the upgraded server serves. Record the value in the extension README.md.
4. Confirm that stateless_http=True remains correct under 2.0.0, or record its replacement.
5. Confirm that transport_security and the DNS-rebinding setting still exist under 2.0.0 and behave the same. Connect terminates and authenticates requests in front of the app, and the served host varies per deployment.
6. Verify the viewer-identity path still works. The server exchanges the viewer session token through client.with_user_session_token(token), and caches one client per token.
7. Upgrade simple-shiny-chat-with-mcp to a chatlas release that carries an MCP 2.x client, once one exists. If none exists, record the blocker in this issue and leave the extension pinned.
8. Test both extensions against a Connect server that serves the new revision, using the interactive MCP console and the paired chat extension.
9. Raise minimumConnectVersion in extensions/simple-mcp-server/manifest.json if the upgraded server needs Connect behaviour that older releases lack. The current value is 2025.04.0.
10. Add a CHANGELOG.md entry to each extension that changes.

4. Acceptance criteria

• simple-mcp-server runs on Python MCP SDK 2.0.0.
• The server serves protocol revision 2026-07-28, and the README.md records it.
• Tool calls run as the signed-in viewer, as they do today.
• The interactive MCP console in Connect lists and calls every tool.
• simple-shiny-chat-with-mcp calls the upgraded server, or the issue records why it cannot yet.
• manifest.json states a correct minimumConnectVersion.
• Each changed extension has a CHANGELOG.md entry.

5. References

• The 2026-07-28 Specification
• python-sdk v2.0.0
• SEP-2575: Make MCP stateless
• MCP servers user guide
• FastMCP HTTP deployment guide

Start with extensions/simple-mcp-server/requirements.txt and the Python SDK 2.0.0 release notes, then inspect main.py for required migration changes. Check the README.md, manifest.json, and each affected CHANGELOG.md, and verify both extensions with Connect's interactive MCP console and paired chat extension. Done means the server serves revision 2026-07-28, viewer identity and tool calls work, and any chatlas or Connect-version blocker is recorded.