1,157 pages for head.

SEP-2484: Require Conformance Tests for Standards Track SEPs to Reach Final Status Model Context Protocol · in the page seps/2484-conformance-tests-required-for-final-seps …es on the wire, transport-observable side effects (HTTP status codes, headers, connection lifecycle, OAuth redirects), or process-observable side effects for local transports (stdio stream content, ex… SEP-2549: TTL for List Results Model Context Protocol · in the page seps/2549-TTL-for-list-results …. While HTTP-based transports could theoretically use `Cache-Control` headers, MCP also operates over stdio, and supports pluggable transports where HTTP headers may not be available. Embedding the TT… SEP-2567: Sessionless MCP via Explicit State Handles Model Context Protocol · in the page seps/2567-sessionless-mcp …e complementary change that removes sessions and the `Mcp-Session-Id` header. Together they make MCP stateless at the protocol layer. After more than a year in the spec, sessions have not converged o… SEP-2575: Make MCP Stateless Model Context Protocol · in the page seps/2575-stateless-mcp …vide simple, stateless features by default and only introduce the overhead of stateful, long-lived connections for cases where that functionality is actually required. Specifically, this SEP proposes… SEP-2596: Specification Feature Lifecycle and Deprecation Policy Model Context Protocol · in the page seps/2596-spec-feature-lifecycle-and-deprecation …`changelog.mdx` for that revision gains an entry under a "Deprecated" heading. This SEP introduces "Deprecated" and "Removed" as standing changelog headings alongside the existing Major/Minor/Othe… SEP-2640: Skills Extension Model Context Protocol · in the page seps/2640-skills-extension …valent to a digest mismatch. Hosts MUST NOT retrieve a skill's files ahead of need, whether on connection, on listing, or at approval. A `SKILL.md` is fetched when the skill is loaded, and a supportin… SEP-2663: Tasks Extension Model Context Protocol · in the page seps/2663-tasks-extension …(https://modelcontextprotocol.io/seps/2322-MRTR.md) * [SEP-2243: HTTP Header Standardization for Streamable HTTP Transport](https://modelcontextprotocol.io/seps/2243-http-standardization.md) * [SEP-25… SEP-3392: Extension Lifecycle Model Context Protocol · in the page seps/3392-extension-lifecycle …n?** The two exits from Beta set different expectations. An extension heading for Core will later be defined by core protocol revisions and its identifier will stop being advertised, while one heading… SEP-414: Document OpenTelemetry Trace Context Propagation Conventions Model Context Protocol · in the page seps/414-request-meta …ll/2028) - builds on this SEP for forwarding `_meta` values to HTTP headers ## Backward Compatibility This SEP documents existing conventions and is backward compatible. ## Security Implications… SEP-985: Align OAuth 2.0 Protected Resource Metadata with RFC 9728 Model Context Protocol · in the page seps/985-align-oauth-20-protected-resource-metadata-with-rf …Currently, the MCP spec requires the use of the HTTP WWW-Authenticate header when returning a 401 Unauthorized to indicate the location of the protected resource metadata. However, [RFC 9728, Section… SEP-991: Enable URL-based Client Registration using OAuth Client ID Metadata Documents Model Context Protocol · in the page seps/991-enable-url-based-client-registration-using-oauth-c …Server: Cache metadata for future requests<br/>(respecting HTTP cache headers) ``` ### Client Requirements * Clients MUST host their metadata document at an HTTPS URL following RFC requirements * Th… Specification Enhancement Proposals (SEPs) Model Context Protocol · in the page seps/index …s://modelcontextprotocol.io/seps/2243-http-standardization.md) | HTTP Header Standardization for Streamable HTTP Transport | Final | Standards Track | 2026-02-04 | | [SEP-2207](https://modelcontextpro… Architecture Model Context Protocol · in the page specification/2024-11-05/architecture/index …fined capabilities * Simple interfaces minimize implementation overhead * Clear separation enables maintainable code 2. **Servers should be highly composable** * Each server provides focused… Transports Model Context Protocol · in the page specification/2024-11-05/basic/transports …g HTTP with SSE transport: 1. Servers **MUST** validate the `Origin` header on all incoming connections to prevent DNS rebinding attacks 2. When running locally, servers **SHOULD** bind only to local… Ping Model Context Protocol · in the page specification/2024-11-05/basic/utilities/ping …nment * Excessive pinging **SHOULD** be avoided to reduce network overhead ## Error Handling * Timeouts **SHOULD** be treated as connection failures * Multiple failed pings **MAY** trigger connectio… Architecture Model Context Protocol · in the page specification/2025-03-26/architecture/index …fined capabilities * Simple interfaces minimize implementation overhead * Clear separation enables maintainable code 2. **Servers should be highly composable** * Each server provides focused… Authorization Model Context Protocol · in the page specification/2025-03-26/basic/authorization …Continue with authorization flow ``` #### Server Metadata Discovery Headers MCP clients *SHOULD* include the header `MCP-Protocol-Version: <protocol-version>` during Server Metadata Discovery to al… Transports Model Context Protocol · in the page specification/2025-03-26/basic/transports …Streamable HTTP transport: 1. Servers **MUST** validate the `Origin` header on all incoming connections to prevent DNS rebinding attacks 2. When running locally, servers **SHOULD** bind only to local… Ping Model Context Protocol · in the page specification/2025-03-26/basic/utilities/ping …nment * Excessive pinging **SHOULD** be avoided to reduce network overhead ## Error Handling * Timeouts **SHOULD** be treated as connection failures * Multiple failed pings **MAY** trigger connectio… Architecture Model Context Protocol · in the page specification/2025-06-18/architecture/index …fined capabilities * Simple interfaces minimize implementation overhead * Clear separation enables maintainable code 2. **Servers should be highly composable** * Each server provides focused… Authorization Model Context Protocol · in the page specification/2025-06-18/basic/authorization …c9728#name-authorization-servers). MCP servers **MUST** use the HTTP header `WWW-Authenticate` when returning a *401 Unauthorized* to indicate the location of the resource server metadata URL as desc… Lifecycle Model Context Protocol · in the page specification/2025-06-18/basic/lifecycle …**MUST** include the `MCP-Protocol-Version: <protocol-version>` HTTP header on all subsequent requests to the MCP > server. > For details, see [the Protocol Version Header section in Transports](http… Transports Model Context Protocol · in the page specification/2025-06-18/basic/transports …Streamable HTTP transport: 1. Servers **MUST** validate the `Origin` header on all incoming connections to prevent DNS rebinding attacks 2. When running locally, servers **SHOULD** bind only to local… Ping Model Context Protocol · in the page specification/2025-06-18/basic/utilities/ping …nment * Excessive pinging **SHOULD** be avoided to reduce network overhead ## Error Handling * Timeouts **SHOULD** be treated as connection failures * Multiple failed pings **MAY** trigger connectio… Key Changes Model Context Protocol · in the page specification/2025-06-18/changelog …ocol.io/specification/2025-06-18/basic/transports.md#protocol-version-header) via `MCP-Protocol-Version` header in subsequent requests when using HTTP (PR [#548](https://github.com/modelcontextprot… Architecture Model Context Protocol · in the page specification/2025-11-25/architecture/index …fined capabilities * Simple interfaces minimize implementation overhead * Clear separation enables maintainable code 2. **Servers should be highly composable** * Each server provides focused… Authorization Model Context Protocol · in the page specification/2025-11-25/basic/authorization …on server location information to MCP clients: 1. **WWW-Authenticate Header**: Include the resource metadata URL in the `WWW-Authenticate` HTTP header under `resource_metadata` when returning `401 Un… Overview Model Context Protocol · in the page specification/2025-11-25/basic/index …Fetch icons without credentials. Do not send cookies, `Authorization` headers, or client credentials. * Verify that icon URIs are from the same origin as the server. This minimizes the risk of exposin… Lifecycle Model Context Protocol · in the page specification/2025-11-25/basic/lifecycle …**MUST** include the `MCP-Protocol-Version: <protocol-version>` HTTP header on all subsequent requests to the MCP > server. > For details, see [the Protocol Version Header section in Transports](http… Transports Model Context Protocol · in the page specification/2025-11-25/basic/transports …Streamable HTTP transport: 1. Servers **MUST** validate the `Origin` header on all incoming connections to prevent DNS rebinding attacks * If the `Origin` header is present and invalid, servers **… Ping Model Context Protocol · in the page specification/2025-11-25/basic/utilities/ping …nment * Excessive pinging **SHOULD** be avoided to reduce network overhead ## Error Handling * Timeouts **SHOULD** be treated as connection failures * Multiple failed pings **MAY** trigger connectio… Key Changes Model Context Protocol · in the page specification/2025-11-25/changelog …that servers must respond with HTTP 403 Forbidden for invalid Origin headers in Streamable HTTP transport. (PR [#1439](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1439)) 4. Upda… Architecture Model Context Protocol · in the page specification/2026-07-28/architecture/index …fined capabilities * Simple interfaces minimize implementation overhead * Clear separation enables maintainable code 2. **Servers should be highly composable** * Each server provides focused… Authorization Server Discovery Model Context Protocol · in the page specification/2026-07-28/basic/authorization/authorization-server-discovery …on server location information to MCP clients: 1. **WWW-Authenticate Header**: Include the resource metadata URL in the `WWW-Authenticate` HTTP header under `resource_metadata` when returning `401 Un… Client Registration Model Context Protocol · in the page specification/2026-07-28/basic/authorization/client-registration …hes the URL exactly * **SHOULD** cache metadata respecting HTTP cache headers * **MUST** validate redirect URIs presented in an authorization request against those in the metadata document * **MUST**… Authorization Model Context Protocol · in the page specification/2026-07-28/basic/authorization/index …vers **SHOULD** include a `scope` parameter in the `WWW-Authenticate` header as defined in [RFC 6750 Section 3](https://datatracker.ietf.org/doc/html/rfc6750#section-3) to indicate the scopes required… Overview Model Context Protocol · in the page specification/2026-07-28/basic/index …the following error codes: | Code | Name | | - | - | | `-32020` | [`HeaderMismatch`](https://modelcontextprotocol.io/specification/2026-07-28/schema#headermismatcherror) | | `-32021` | [`MissingRequ… Overview Model Context Protocol · in the page specification/2026-07-28/basic/transports/index …elope metadata. The Streamable HTTP transport mirrors them into [HTTP headers](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http.md#request-metadata) so that in… stdio Model Context Protocol · in the page specification/2026-07-28/basic/transports/stdio …method name and arguments live where JSON-RPC puts them. There is no header layer. [meta-fields]: https://modelcontextprotocol.io/specification/2026-07-28/basic/index.md#meta ## Cancellation To ca… Streamable HTTP Model Context Protocol · in the page specification/2026-07-28/basic/transports/streamable-http …Streamable HTTP transport: 1. Servers **MUST** validate the `Origin` header on all incoming connections to prevent DNS rebinding attacks. * If the `Origin` header is present and invalid, server… Versioning and Compatibility Model Context Protocol · in the page specification/2026-07-28/basic/versioning …) field. On HTTP, this is also carried in the [`MCP-Protocol-Version` header](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http#protocol-version-header). If th… Key Changes Model Context Protocol · in the page specification/2026-07-28/changelog …r changes 1. Remove protocol-level sessions and the `Mcp-Session-Id` header from the Streamable HTTP transport. List endpoints (`tools/list`, `resources/list`, `prompts/list`) no longer vary per-conn… Schema Reference Model Context Protocol · in the page specification/2026-07-28/schema …nsport, this value MUST match the <code>MCP-Protocol-Version</code> header; otherwise the server MUST return a <code>400 Bad Request</code>. If the server does not support the requested version, i… Discovery Model Context Protocol · in the page specification/2026-07-28/server/discover …status codes returned for unknown methods, see the [Protocol Version Header](https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http.md#protocol-version-header) sect… Tools Model Context Protocol · in the page specification/2026-07-28/server/tools …(including with properties) * Properties **MAY** include an [`x-mcp-header`](#x-mcp-header) annotation to expose parameter values as HTTP headers * `outputSchema`: Optional JSON Schema defining… Architecture Model Context Protocol · in the page specification/draft/architecture/index …fined capabilities * Simple interfaces minimize implementation overhead * Clear separation enables maintainable code 2. **Servers should be highly composable** * Each server provides focused… Authorization Server Discovery Model Context Protocol · in the page specification/draft/basic/authorization/authorization-server-discovery …on server location information to MCP clients: 1. **WWW-Authenticate Header**: Include the resource metadata URL in the `WWW-Authenticate` HTTP header under `resource_metadata` when returning `401 Un… Client Registration Model Context Protocol · in the page specification/draft/basic/authorization/client-registration …hes the URL exactly * **SHOULD** cache metadata respecting HTTP cache headers * **MUST** validate redirect URIs presented in an authorization request against those in the metadata document * **MUST**… Authorization Model Context Protocol · in the page specification/draft/basic/authorization/index …vers **SHOULD** include a `scope` parameter in the `WWW-Authenticate` header as defined in [RFC 6750 Section 3](https://datatracker.ietf.org/doc/html/rfc6750#section-3) to indicate the scopes required… Overview Model Context Protocol · in the page specification/draft/basic/index …the following error codes: | Code | Name | | - | - | | `-32020` | [`HeaderMismatch`](https://modelcontextprotocol.io/specification/draft/schema#headermismatcherror) | | `-32021` | [`MissingRequiredC…