HomeDocs changes
Documentation changes
What the docs quietly changed.
Anthropic's published documentation, fetched on a schedule and diffed against the last copy. Every edit dated, including the ones that never made a release note.
Last poll read all 4 cleanly: Claude Code CLI, Claude Developer Platform, Claude Documentation, Model Context Protocol. A date here is when this site noticed, not when Anthropic edited.
Claude Developer Platform
821pages tracked
774 changed this week · last read 23 Oct 2026
Claude Code CLI
228pages tracked
148 changed this week · last read 23 Oct 2026
Claude Documentation
280pages tracked
81 changed this week · last read 23 Oct 2026
Model Context Protocol
357pages tracked
171 changed this week · last read 23 Oct 2026
100 on this page
ReadSourcePageWhatLines
29 Jul 2026
33 pages
+1001 −1198 lines
mcp
seps/1036-url-mode-elicitation-for-secure-out-of-band-intera
±changed
+14−14
mcpchanged
seps/1036-url-mode-elicitation-for-secure-out-of-band-intera
| Field | Value |
| ------------- | ------------------------------------------------------------------------------------------------------------------------- |
| **SEP** | 1036 |
| **Title** | URL Mode Elicitation for secure out-of-band interactions |
| **Status** | Final |
+14 −14 lines
Upstream edited 29 Jul 2026 22:46 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
seps/1034--support-default-values-for-all-primitive-types-in
±changed
+10−10
mcpchanged
seps/1034--support-default-values-for-all-primitive-types-in
| Field | Value |
| ------------- | ------------------------------------------------------------------------------- |
| **SEP** | 1034 |
| **Title** | Support default values for all primitive types in elicitation schemas |
| **Status** | Final |
+10 −10 lines
Upstream edited 29 Jul 2026 22:46 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
seps/1024-mcp-client-security-requirements-for-local-server-
±changed
+10−10
mcpchanged
seps/1024-mcp-client-security-requirements-for-local-server-
| Field | Value |
| ------------- | ------------------------------------------------------------------------------- |
| **SEP** | 1024 |
| **Title** | MCP Client Security Requirements for Local Server Installation |
| **Status** | Final |
+10 −10 lines
Upstream edited 29 Jul 2026 22:46 UTC Recorded here 28 Sep 2026 22:07 UTC
28 Jul 2026
41 pages
+17519 −17761 lines
mcp
docs/2026-07-28/tutorials/security/security_best_practices
±changed
+13−13
mcpchanged
docs/2026-07-28/tutorials/security/security_best_practices
[MCP Authorization](/specification/latest/basic/authorization)
[MCP Authorization](/specification/latest/basic/authorization.md)
[dynamic client registration](/specification/latest/basic/authorization#dynamic-client-registration))
[dynamic client registration](/specification/latest/basic/authorization.md#dynamic-client-registration))
[authorization specification](/specification/latest/basic/authorization)
+13 −13 lines
Upstream edited 28 Jul 2026 16:18 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2026-07-28/develop/clients/client-best-practices
±changed
+3−3
mcpchanged
docs/2026-07-28/develop/clients/client-best-practices
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
specification's [caching utility](/specification/2026-07-28/server/utilities/caching). In particular,
specification's [caching utility](/specification/2026-07-28/server/utilities/caching.md). In particular,
* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to
+3 −3 lines
Upstream edited 28 Jul 2026 16:18 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2026-07-28/develop/build-with-agent-skills
±changed
+8−8
mcpchanged
docs/2026-07-28/develop/build-with-agent-skills
[elicitation](/specification/2026-07-28/client/elicitation), or rich UI widgets
[elicitation](/specification/2026-07-28/client/elicitation.md), or rich UI widgets
**Remote [Streamable HTTP](/specification/2026-07-28/basic/transports/streamable-http)**
**Remote [Streamable HTTP](/specification/2026-07-28/basic/transports/streamable-http.md)**
**[MCP apps](/extensions/apps/overview)** extend a server with interactive
+8 −8 lines
Upstream edited 28 Jul 2026 16:18 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2026-07-28/develop/build-client
±changed
+4−4
mcpchanged
docs/2026-07-28/develop/build-client
Before you begin, it helps to have gone through our [Build an MCP Server](/docs/2026-07-28/develop/build-server) tutorial so you can understand how clients and servers communicate.
Before you begin, it helps to have gone through our [Build an MCP Server](/docs/2026-07-28/develop/build-server.md) tutorial so you can understand how clients and servers communica
* Tool names can be validated according to the format specified [here](/specification/2026-07-28/server/tools#tool-names)
* Tool names can be validated according to the format specified [here](/specification/2026-07-28/server/tools.md#tool-names)
* Tool names can be validated according to the format specified [here](/specification/2026-07-28/server/tools#tool-names)
+4 −4 lines
Upstream edited 28 Jul 2026 16:18 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2026-07-28/tutorials/security/security_best_practices
±changed
+26−26
mcpchanged
docs/2026-07-28/tutorials/security/security_best_practices
<Note>
Avoid implementing IP validation manually. Attackers exploit encoding tricks
(octal, hex, IPv4-mapped IPv6) that custom parsers often miss.
</Note>
> [!NOTE]
+26 −26 lines
Upstream edited 28 Jul 2026 16:18 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2026-07-28/develop/clients/client-best-practices
±changed
+2−2
mcpchanged
docs/2026-07-28/develop/clients/client-best-practices
<img src="https://mintcdn.com/mcp/JXfd5cBmEUh_qPUI/images/progressive-discovery.svg?fit=max&auto=format&n=JXfd5cBmEUh_qPUI&q=85&s=db39f47006107f04af43b5eeae2d6022" alt="Comparison
**
+9 −11 lines
Upstream edited 28 Jul 2026 16:18 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2026-07-28/develop/build-client
±changed
+2436−2452
mcpchanged
docs/2026-07-28/develop/build-client
<Tabs>
<Tab title="Python">
[You can find the complete code for this tutorial here.](https://github.com/modelcontextprotocol/quickstart-resources/tree/main/mcp-client-python)
## System Requirements
+2436 −2452 lines
Upstream edited 28 Jul 2026 16:18 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2026-07-28/develop/clients/client-best-practices
±changed
+12−12
mcpchanged
docs/2026-07-28/develop/clients/client-best-practices
| Guideline | Rationale
| -------------------------------- | -----------------------------------------------------------------------------------------------------------------------------------------------
| **Offer multiple detail levels** | Let the model choose between name-only, name-and-description, or full-schema responses.
| **Cache tool definitions** | Once fetched from a server, memoize the definition host-side so re-injecting it later doesn't need another `tools/list` round trip. This is sep
| **Refresh on `list_changed`** | Re-index the search catalog when a server sends `notifications/tools/list_changed`.
+12 −12 lines
Upstream edited 28 Jul 2026 16:18 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/2026-07-28/develop/build-with-agent-skills
±changed
+4−4
mcpchanged
docs/2026-07-28/develop/build-with-agent-skills
| Skill | Purpose |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------- |
| Skill | Purpose |
| - | - |
| `build-mcp-app` | Adds interactive UI widgets (forms, pickers, dashboards) rendered inline in chat. |
+4 −4 lines
Upstream edited 28 Jul 2026 16:18 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/2024-11-05/develop/build-with-agent-skills
±changed
+6−6
mcpchanged
docs/2024-11-05/develop/build-with-agent-skills
**Remote [HTTP with SSE](/specification/2024-11-05/basic/transports#http-with-sse)**
**Remote [HTTP with SSE](/specification/2024-11-05/basic/transports.md#http-with-sse)**
**[MCP apps](/extensions/apps/overview)** extend a server with interactive
**[MCP apps](/extensions/apps/overview.md)** extend a server with interactive
**Local [stdio](/specification/2024-11-05/basic/transports#stdio)** remains available
+6 −6 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2024-11-05/develop/build-client
±changed
+2−2
mcpchanged
docs/2024-11-05/develop/build-client
Before you begin, it helps to have gone through our [Build an MCP Server](/docs/2024-11-05/develop/build-server) tutorial so you can understand how clients and servers communicate.
Before you begin, it helps to have gone through our [Build an MCP Server](/docs/2024-11-05/develop/build-server.md) tutorial so you can understand how clients and servers communica
> **[Example servers](/examples)**
> **[Example servers](/examples.md)**
+2 −2 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
community/design-principles
±changed
+4−4
mcpchanged
community/design-principles
These principles guide how we evaluate protocol proposals, weigh tradeoffs, and evolve MCP. They reflect lessons from building and maintaining the project. They are meant as guidan
These principles guide how we evaluate protocol proposals, weigh tradeoffs, and evolve MCP. They reflect lessons from building and maintaining the project. They are meant as guidan
[Extensions](/extensions/overview) are where convergence gets tested; the specification is where it gets committed.
[Extensions](/extensions/overview.md) are where convergence gets tested; the specification is where it gets committed.
When someone asks why MCP doesn't support a feature directly, the answer is usually that it can be built from what MCP already provides. Extensions like [MCP Apps](/extensions/apps
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2024-11-05/develop/build-with-agent-skills
±changed
+9−11
mcpchanged
docs/2024-11-05/develop/build-with-agent-skills
<CardGroup cols={2}>
<Card title="MCP Inspector" icon="magnifying-glass" href="/docs/2024-11-05/tools/inspector">
Test your server's tools, resources, and prompts interactively
</Card>
> **[MCP Inspector](/docs/2024-11-05/tools/inspector)**
+9 −11 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2024-11-05/develop/build-client
±changed
+2436−2452
mcpchanged
docs/2024-11-05/develop/build-client
<Tabs>
<Tab title="Python">
[You can find the complete code for this tutorial here.](https://github.com/modelcontextprotocol/quickstart-resources/tree/main/mcp-client-python)
## System Requirements
+2436 −2452 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
community/sdk-tiers
±changed
+10−10
mcpchanged
community/sdk-tiers
<Note>
**Key dates:**
* **January 23, 2026**: Conformance tests available
* **February 23, 2026**: Official SDK tiering published
+10 −10 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2024-11-05/develop/build-with-agent-skills
±changed
+4−4
mcpchanged
docs/2024-11-05/develop/build-with-agent-skills
| Skill | Purpose |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------- |
| Skill | Purpose |
| - | - |
| `build-mcp-app` | Adds interactive UI widgets (forms, pickers, dashboards) rendered inline in chat. |
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
community/sdk-tiers
±changed
+28−28
mcpchanged
community/sdk-tiers
| Requirement | Tier 1: Fully Supported | Tier 2: Commitment to Full Support
| --------------------------- | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------
| **Conformance Tests** | 100% pass rate | 80% pass rate
| **New Protocol Features** | Before new spec version release, timeline agreed per release based on feature complexity | Within 6 months
| **Issue Triage** | Within 2 business days | Within a month
+28 −28 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/2025-11-25/develop/clients/client-best-practices
±changed
+2−2
mcpchanged
docs/2025-11-25/develop/clients/client-best-practices
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to
* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to
+2 −2 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-11-25/develop/build-with-agent-skills
±changed
+8−8
mcpchanged
docs/2025-11-25/develop/build-with-agent-skills
[elicitation](/specification/2025-11-25/client/elicitation), or rich UI widgets
[elicitation](/specification/2025-11-25/client/elicitation.md), or rich UI widgets
**Remote [Streamable HTTP](/specification/2025-11-25/basic/transports#streamable-http)**
**Remote [Streamable HTTP](/specification/2025-11-25/basic/transports.md#streamable-http)**
**[MCP apps](/extensions/apps/overview)** extend a server with interactive
+8 −8 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-11-25/develop/build-client
±changed
+4−4
mcpchanged
docs/2025-11-25/develop/build-client
Before you begin, it helps to have gone through our [Build an MCP Server](/docs/2025-11-25/develop/build-server) tutorial so you can understand how clients and servers communicate.
Before you begin, it helps to have gone through our [Build an MCP Server](/docs/2025-11-25/develop/build-server.md) tutorial so you can understand how clients and servers communica
* Tool names can be validated according to the format specified [here](/specification/2025-11-25/server/tools#tool-names)
* Tool names can be validated according to the format specified [here](/specification/2025-11-25/server/tools.md#tool-names)
* Tool names can be validated according to the format specified [here](/specification/2025-11-25/server/tools#tool-names)
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-06-18/tutorials/security/security_best_practices
±changed
+4−4
mcpchanged
docs/2025-06-18/tutorials/security/security_best_practices
[MCP Authorization](/specification/2025-06-18/basic/authorization)
[MCP Authorization](/specification/2025-06-18/basic/authorization.md)
[dynamic client registration](/specification/2025-06-18/basic/authorization#dynamic-client-registration))
[dynamic client registration](/specification/2025-06-18/basic/authorization.md#dynamic-client-registration))
[authorization specification](/specification/2025-06-18/basic/authorization)
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-06-18/tutorials/security/authorization
±changed
+7−7
mcpchanged
docs/2025-06-18/tutorials/security/authorization
MCP uses standardized authorization flows to build trust between MCP clients and MCP servers. Its design doesn't focus on one specific authorization or identity system, but rather
MCP uses standardized authorization flows to build trust between MCP clients and MCP servers. Its design doesn't focus on one specific authorization or identity system, but rather
> For MCP servers using the [STDIO transport](/specification/2025-06-18/basic/transports#stdio), you can use environment-based credentials or credentials provided by third-party li
> For MCP servers using the [STDIO transport](/specification/2025-06-18/basic/transports.md#stdio), you can use environment-based credentials or credentials provided by third-party
We will now set up our MCP server to use the locally-running Keycloak authorization server. Depending on your programming language preference, you can use one of the supported [MCP
+7 −7 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-06-18/tools/inspector
±changed
+5−3
mcpchanged
docs/2025-06-18/tools/inspector
The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) is an interactive developer tool for testing and debugging MCP servers. While the [Debugging Guide](/docs/202
The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) is an interactive developer tool for testing and debugging MCP servers. While the [Debugging Guide](/docs/202
The MCP Inspector interface
* Allows selecting the [transport](/specification/2025-06-18/basic/transports) for connecting to the server
+5 −3 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-06-18/sdk
±changed
+4−4
mcpchanged
docs/2025-06-18/sdk
Build MCP servers and clients using our official SDKs. SDKs are classified into tiers based on feature completeness, protocol support, and maintenance commitment. Learn more about
Build MCP servers and clients using our official SDKs. SDKs are classified into tiers based on feature completeness, protocol support, and maintenance commitment. Learn more about
See [SDK Tiering System](/community/sdk-tiers) for details on what each tier means.
See [SDK Tiering System](/community/sdk-tiers.md) for details on what each tier means.
> **[Build a Server](/docs/2025-06-18/develop/build-server)**
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-06-18/develop/clients/client-best-practices
±changed
+2−2
mcpchanged
docs/2025-06-18/develop/clients/client-best-practices
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to
* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to
+2 −2 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-06-18/develop/build-with-agent-skills
±changed
+8−8
mcpchanged
docs/2025-06-18/develop/build-with-agent-skills
[elicitation](/specification/2025-06-18/client/elicitation), or rich UI widgets
[elicitation](/specification/2025-06-18/client/elicitation.md), or rich UI widgets
**Remote [Streamable HTTP](/specification/2025-06-18/basic/transports#streamable-http)**
**Remote [Streamable HTTP](/specification/2025-06-18/basic/transports.md#streamable-http)**
**[MCP apps](/extensions/apps/overview)** extend a server with interactive
+8 −8 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-06-18/develop/build-client
±changed
+2−2
mcpchanged
docs/2025-06-18/develop/build-client
Before you begin, it helps to have gone through our [Build an MCP Server](/docs/2025-06-18/develop/build-server) tutorial so you can understand how clients and servers communicate.
Before you begin, it helps to have gone through our [Build an MCP Server](/docs/2025-06-18/develop/build-server.md) tutorial so you can understand how clients and servers communica
> **[Example servers](/examples)**
> **[Example servers](/examples.md)**
+2 −2 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-03-26/tutorials/security/security_best_practices
±changed
+4−4
mcpchanged
docs/2025-03-26/tutorials/security/security_best_practices
[MCP Authorization](/specification/2025-03-26/basic/authorization)
[MCP Authorization](/specification/2025-03-26/basic/authorization.md)
[dynamic client registration](/specification/2025-03-26/basic/authorization#dynamic-client-registration))
[dynamic client registration](/specification/2025-03-26/basic/authorization.md#dynamic-client-registration))
[authorization specification](/specification/2025-03-26/basic/authorization)
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-03-26/tutorials/security/authorization
±changed
+7−7
mcpchanged
docs/2025-03-26/tutorials/security/authorization
MCP uses standardized authorization flows to build trust between MCP clients and MCP servers. Its design doesn't focus on one specific authorization or identity system, but rather
MCP uses standardized authorization flows to build trust between MCP clients and MCP servers. Its design doesn't focus on one specific authorization or identity system, but rather
> For MCP servers using the [STDIO transport](/specification/2025-03-26/basic/transports#stdio), you can use environment-based credentials or credentials provided by third-party li
> For MCP servers using the [STDIO transport](/specification/2025-03-26/basic/transports.md#stdio), you can use environment-based credentials or credentials provided by third-party
We will now set up our MCP server to use the locally-running Keycloak authorization server. Depending on your programming language preference, you can use one of the supported [MCP
+7 −7 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-03-26/tools/inspector
±changed
+5−3
mcpchanged
docs/2025-03-26/tools/inspector
The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) is an interactive developer tool for testing and debugging MCP servers. While the [Debugging Guide](/docs/202
The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) is an interactive developer tool for testing and debugging MCP servers. While the [Debugging Guide](/docs/202
The MCP Inspector interface
* Allows selecting the [transport](/specification/2025-03-26/basic/transports) for connecting to the server
+5 −3 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-03-26/sdk
±changed
+4−4
mcpchanged
docs/2025-03-26/sdk
Build MCP servers and clients using our official SDKs. SDKs are classified into tiers based on feature completeness, protocol support, and maintenance commitment. Learn more about
Build MCP servers and clients using our official SDKs. SDKs are classified into tiers based on feature completeness, protocol support, and maintenance commitment. Learn more about
See [SDK Tiering System](/community/sdk-tiers) for details on what each tier means.
See [SDK Tiering System](/community/sdk-tiers.md) for details on what each tier means.
> **[Build a Server](/docs/2025-03-26/develop/build-server)**
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-03-26/develop/clients/client-best-practices
±changed
+2−2
mcpchanged
docs/2025-03-26/develop/clients/client-best-practices
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to
* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to
+2 −2 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-03-26/develop/build-with-agent-skills
±changed
+6−6
mcpchanged
docs/2025-03-26/develop/build-with-agent-skills
**Remote [Streamable HTTP](/specification/2025-03-26/basic/transports#streamable-http)**
**Remote [Streamable HTTP](/specification/2025-03-26/basic/transports.md#streamable-http)**
**[MCP apps](/extensions/apps/overview)** extend a server with interactive
**[MCP apps](/extensions/apps/overview.md)** extend a server with interactive
**Local [stdio](/specification/2025-03-26/basic/transports#stdio)** remains available
+6 −6 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-03-26/develop/build-client
±changed
+2−2
mcpchanged
docs/2025-03-26/develop/build-client
Before you begin, it helps to have gone through our [Build an MCP Server](/docs/2025-03-26/develop/build-server) tutorial so you can understand how clients and servers communicate.
Before you begin, it helps to have gone through our [Build an MCP Server](/docs/2025-03-26/develop/build-server.md) tutorial so you can understand how clients and servers communica
> **[Example servers](/examples)**
> **[Example servers](/examples.md)**
+2 −2 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2024-11-05/tutorials/security/security_best_practices
±changed
+3−3
mcpchanged
docs/2024-11-05/tutorials/security/security_best_practices
[MCP Authorization](/specification/2025-03-26/basic/authorization)
[MCP Authorization](/specification/2025-03-26/basic/authorization.md)
[dynamic client registration](/specification/2025-03-26/basic/authorization#dynamic-client-registration))
[dynamic client registration](/specification/2025-03-26/basic/authorization.md#dynamic-client-registration))
[authorization specification](/specification/2025-03-26/basic/authorization)
+3 −3 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2024-11-05/tutorials/security/authorization
±changed
+7−7
mcpchanged
docs/2024-11-05/tutorials/security/authorization
MCP uses standardized authorization flows to build trust between MCP clients and MCP servers. Its design doesn't focus on one specific authorization or identity system, but rather
MCP uses standardized authorization flows to build trust between MCP clients and MCP servers. Its design doesn't focus on one specific authorization or identity system, but rather
> For MCP servers using the [STDIO transport](/specification/2024-11-05/basic/transports#stdio), you can use environment-based credentials or credentials provided by third-party li
> For MCP servers using the [STDIO transport](/specification/2024-11-05/basic/transports.md#stdio), you can use environment-based credentials or credentials provided by third-party
We will now set up our MCP server to use the locally-running Keycloak authorization server. Depending on your programming language preference, you can use one of the supported [MCP
+7 −7 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2024-11-05/tools/inspector
±changed
+5−3
mcpchanged
docs/2024-11-05/tools/inspector
The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) is an interactive developer tool for testing and debugging MCP servers. While the [Debugging Guide](/docs/202
The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) is an interactive developer tool for testing and debugging MCP servers. While the [Debugging Guide](/docs/202
The MCP Inspector interface
* Allows selecting the [transport](/specification/2024-11-05/basic/transports) for connecting to the server
+5 −3 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2024-11-05/sdk
±changed
+4−4
mcpchanged
docs/2024-11-05/sdk
Build MCP servers and clients using our official SDKs. SDKs are classified into tiers based on feature completeness, protocol support, and maintenance commitment. Learn more about
Build MCP servers and clients using our official SDKs. SDKs are classified into tiers based on feature completeness, protocol support, and maintenance commitment. Learn more about
See [SDK Tiering System](/community/sdk-tiers) for details on what each tier means.
See [SDK Tiering System](/community/sdk-tiers.md) for details on what each tier means.
> **[Build a Server](/docs/2024-11-05/develop/build-server)**
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2024-11-05/develop/clients/client-best-practices
±changed
+2−2
mcpchanged
docs/2024-11-05/develop/clients/client-best-practices
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to
* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to
+2 −2 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-11-25/develop/clients/client-best-practices
±changed
+2−2
mcpchanged
docs/2025-11-25/develop/clients/client-best-practices
<img src="https://mintcdn.com/mcp/JXfd5cBmEUh_qPUI/images/progressive-discovery.svg?fit=max&auto=format&n=JXfd5cBmEUh_qPUI&q=85&s=db39f47006107f04af43b5eeae2d6022" alt="Comparison
**
+9 −11 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-11-25/develop/build-client
±changed
+2444−2460
mcpchanged
docs/2025-11-25/develop/build-client
<Tabs>
<Tab title="Python">
[You can find the complete code for this tutorial here.](https://github.com/modelcontextprotocol/quickstart-resources/tree/main/mcp-client-python)
## System Requirements
+2444 −2460 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-06-18/tutorials/security/security_best_practices
±changed
+4−4
mcpchanged
docs/2025-06-18/tutorials/security/security_best_practices
<Note>
Avoid implementing IP validation manually. Attackers exploit encoding tricks
(octal, hex, IPv4-mapped IPv6) that custom parsers often miss.
</Note>
> [!NOTE]
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-06-18/tutorials/security/authorization
±changed
+841−861
mcpchanged
docs/2025-06-18/tutorials/security/authorization
<Tip>
**Authorization for Local MCP Servers**
For MCP servers using the [STDIO transport](/specification/2025-06-18/basic/transports#stdio), you can use environment-based credentials or credentials provided by third-party li
+841 −861 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-06-18/tools/inspector
±changed
+36−44
mcpchanged
docs/2025-06-18/tools/inspector
<Tabs>
<Tab title="npm package">
```bash theme={null}
npx -y @modelcontextprotocol/inspector npx <package-name> <args>
# For example
+36 −44 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-06-18/sdk
±changed
+16−18
mcpchanged
docs/2025-06-18/sdk
| <Icon icon="square-js" size={24} /> [TypeScript](https://ts.sdk.modelcontextprotocol.io) | [modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescr
| <Icon icon="python" size={24} /> [Python](https://py.sdk.modelcontextprotocol.io) | [modelcontextprotocol/python-sdk](https://github.com/modelcontextprotocol/python-sdk) | <Bad
| <Icon icon="square-c" size={24} /> [C#](https://csharp.sdk.modelcontextprotocol.io) | [modelcontextprotocol/csharp-sdk](https://github.com/modelcontextprotocol/csharp-sdk) | <B
| <Icon icon="golang" size={24} /> [Go](https://go.sdk.modelcontextprotocol.io) | [modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) | <Badge color="bl
| <Icon icon="java" size={24} /> [Java](https://java.sdk.modelcontextprotocol.io) | [modelcontextprotocol/java-sdk](https://github.com/modelcontextprotocol/java-sdk) | <Badge col
+16 −18 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-06-18/develop/clients/client-best-practices
±changed
+2−2
mcpchanged
docs/2025-06-18/develop/clients/client-best-practices
<img src="https://mintcdn.com/mcp/JXfd5cBmEUh_qPUI/images/progressive-discovery.svg?fit=max&auto=format&n=JXfd5cBmEUh_qPUI&q=85&s=db39f47006107f04af43b5eeae2d6022" alt="Comparison
**
+9 −11 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-06-18/develop/build-client
±changed
+2436−2452
mcpchanged
docs/2025-06-18/develop/build-client
<Tabs>
<Tab title="Python">
[You can find the complete code for this tutorial here.](https://github.com/modelcontextprotocol/quickstart-resources/tree/main/mcp-client-python)
## System Requirements
+2436 −2452 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-03-26/tutorials/security/security_best_practices
±changed
+4−4
mcpchanged
docs/2025-03-26/tutorials/security/security_best_practices
<Note>
Avoid implementing IP validation manually. Attackers exploit encoding tricks
(octal, hex, IPv4-mapped IPv6) that custom parsers often miss.
</Note>
> [!NOTE]
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-03-26/tutorials/security/authorization
±changed
+841−861
mcpchanged
docs/2025-03-26/tutorials/security/authorization
<Tip>
**Authorization for Local MCP Servers**
For MCP servers using the [STDIO transport](/specification/2025-03-26/basic/transports#stdio), you can use environment-based credentials or credentials provided by third-party li
+841 −861 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-03-26/tools/inspector
±changed
+36−44
mcpchanged
docs/2025-03-26/tools/inspector
<Tabs>
<Tab title="npm package">
```bash theme={null}
npx -y @modelcontextprotocol/inspector npx <package-name> <args>
# For example
+36 −44 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-03-26/sdk
±changed
+16−18
mcpchanged
docs/2025-03-26/sdk
| <Icon icon="square-js" size={24} /> [TypeScript](https://ts.sdk.modelcontextprotocol.io) | [modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescr
| <Icon icon="python" size={24} /> [Python](https://py.sdk.modelcontextprotocol.io) | [modelcontextprotocol/python-sdk](https://github.com/modelcontextprotocol/python-sdk) | <Bad
| <Icon icon="square-c" size={24} /> [C#](https://csharp.sdk.modelcontextprotocol.io) | [modelcontextprotocol/csharp-sdk](https://github.com/modelcontextprotocol/csharp-sdk) | <B
| <Icon icon="golang" size={24} /> [Go](https://go.sdk.modelcontextprotocol.io) | [modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) | <Badge color="bl
| <Icon icon="java" size={24} /> [Java](https://java.sdk.modelcontextprotocol.io) | [modelcontextprotocol/java-sdk](https://github.com/modelcontextprotocol/java-sdk) | <Badge col
+16 −18 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-03-26/develop/clients/client-best-practices
±changed
+2−2
mcpchanged
docs/2025-03-26/develop/clients/client-best-practices
<img src="https://mintcdn.com/mcp/JXfd5cBmEUh_qPUI/images/progressive-discovery.svg?fit=max&auto=format&n=JXfd5cBmEUh_qPUI&q=85&s=db39f47006107f04af43b5eeae2d6022" alt="Comparison
**
+9 −11 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-03-26/develop/build-client
±changed
+2436−2452
mcpchanged
docs/2025-03-26/develop/build-client
<Tabs>
<Tab title="Python">
[You can find the complete code for this tutorial here.](https://github.com/modelcontextprotocol/quickstart-resources/tree/main/mcp-client-python)
## System Requirements
+2436 −2452 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2024-11-05/tutorials/security/security_best_practices
±changed
+4−4
mcpchanged
docs/2024-11-05/tutorials/security/security_best_practices
<Note>
Avoid implementing IP validation manually. Attackers exploit encoding tricks
(octal, hex, IPv4-mapped IPv6) that custom parsers often miss.
</Note>
> [!NOTE]
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2024-11-05/tutorials/security/authorization
±changed
+841−861
mcpchanged
docs/2024-11-05/tutorials/security/authorization
<Tip>
**Authorization for Local MCP Servers**
For MCP servers using the [STDIO transport](/specification/2024-11-05/basic/transports#stdio), you can use environment-based credentials or credentials provided by third-party li
+841 −861 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2024-11-05/tools/inspector
±changed
+36−44
mcpchanged
docs/2024-11-05/tools/inspector
<Tabs>
<Tab title="npm package">
```bash theme={null}
npx -y @modelcontextprotocol/inspector npx <package-name> <args>
# For example
+36 −44 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2024-11-05/sdk
±changed
+16−18
mcpchanged
docs/2024-11-05/sdk
| <Icon icon="square-js" size={24} /> [TypeScript](https://ts.sdk.modelcontextprotocol.io) | [modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescr
| <Icon icon="python" size={24} /> [Python](https://py.sdk.modelcontextprotocol.io) | [modelcontextprotocol/python-sdk](https://github.com/modelcontextprotocol/python-sdk) | <Bad
| <Icon icon="square-c" size={24} /> [C#](https://csharp.sdk.modelcontextprotocol.io) | [modelcontextprotocol/csharp-sdk](https://github.com/modelcontextprotocol/csharp-sdk) | <B
| <Icon icon="golang" size={24} /> [Go](https://go.sdk.modelcontextprotocol.io) | [modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) | <Badge color="bl
| <Icon icon="java" size={24} /> [Java](https://java.sdk.modelcontextprotocol.io) | [modelcontextprotocol/java-sdk](https://github.com/modelcontextprotocol/java-sdk) | <Badge col
+16 −18 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2024-11-05/develop/clients/client-best-practices
±changed
+2−2
mcpchanged
docs/2024-11-05/develop/clients/client-best-practices
<img src="https://mintcdn.com/mcp/JXfd5cBmEUh_qPUI/images/progressive-discovery.svg?fit=max&auto=format&n=JXfd5cBmEUh_qPUI&q=85&s=db39f47006107f04af43b5eeae2d6022" alt="Comparison
 | [modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescr
| <Icon icon="python" size={24} /> [Python](https://py.sdk.modelcontextprotocol.io) | [modelcontextprotocol/python-sdk](https://github.com/modelcontextprotocol/python-sdk)
| <Icon icon="square-c" size={24} /> [C#](https://csharp.sdk.modelcontextprotocol.io) | [modelcontextprotocol/csharp-sdk](https://github.com/modelcontextprotocol/csharp-sdk)
+12 −12 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/2025-06-18/develop/clients/client-best-practices
±changed
+12−12
mcpchanged
docs/2025-06-18/develop/clients/client-best-practices
| Guideline | Rationale
| -------------------------------- | -----------------------------------------------------------------------------------------------------------------------------------------------
| **Offer multiple detail levels** | Let the model choose between name-only, name-and-description, or full-schema responses.
| **Cache tool definitions** | Once fetched from a server, memoize the definition host-side so re-injecting it later doesn't need another `tools/list` round trip. This is sep
| **Refresh on `list_changed`** | Re-index the search catalog when a server sends `notifications/tools/list_changed`.
+12 −12 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/2025-06-18/develop/build-with-agent-skills
±changed
+4−4
mcpchanged
docs/2025-06-18/develop/build-with-agent-skills
| Skill | Purpose |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------- |
| Skill | Purpose |
| - | - |
| `build-mcp-app` | Adds interactive UI widgets (forms, pickers, dashboards) rendered inline in chat. |
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/2025-03-26/sdk
±changed
+12−12
mcpchanged
docs/2025-03-26/sdk
| SDK | Repository
| :----------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------
| <Icon icon="square-js" size={24} /> [TypeScript](https://ts.sdk.modelcontextprotocol.io) | [modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescr
| <Icon icon="python" size={24} /> [Python](https://py.sdk.modelcontextprotocol.io) | [modelcontextprotocol/python-sdk](https://github.com/modelcontextprotocol/python-sdk)
| <Icon icon="square-c" size={24} /> [C#](https://csharp.sdk.modelcontextprotocol.io) | [modelcontextprotocol/csharp-sdk](https://github.com/modelcontextprotocol/csharp-sdk)
+12 −12 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/2025-03-26/develop/clients/client-best-practices
±changed
+12−12
mcpchanged
docs/2025-03-26/develop/clients/client-best-practices
| Guideline | Rationale
| -------------------------------- | -----------------------------------------------------------------------------------------------------------------------------------------------
| **Offer multiple detail levels** | Let the model choose between name-only, name-and-description, or full-schema responses.
| **Cache tool definitions** | Once fetched from a server, memoize the definition host-side so re-injecting it later doesn't need another `tools/list` round trip. This is sep
| **Refresh on `list_changed`** | Re-index the search catalog when a server sends `notifications/tools/list_changed`.
+12 −12 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/2025-03-26/develop/build-with-agent-skills
±changed
+4−4
mcpchanged
docs/2025-03-26/develop/build-with-agent-skills
| Skill | Purpose |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------- |
| Skill | Purpose |
| - | - |
| `build-mcp-app` | Adds interactive UI widgets (forms, pickers, dashboards) rendered inline in chat. |
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/2024-11-05/sdk
±changed
+12−12
mcpchanged
docs/2024-11-05/sdk
| SDK | Repository
| :----------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------
| <Icon icon="square-js" size={24} /> [TypeScript](https://ts.sdk.modelcontextprotocol.io) | [modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescr
| <Icon icon="python" size={24} /> [Python](https://py.sdk.modelcontextprotocol.io) | [modelcontextprotocol/python-sdk](https://github.com/modelcontextprotocol/python-sdk)
| <Icon icon="square-c" size={24} /> [C#](https://csharp.sdk.modelcontextprotocol.io) | [modelcontextprotocol/csharp-sdk](https://github.com/modelcontextprotocol/csharp-sdk)
+12 −12 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/2024-11-05/develop/clients/client-best-practices
±changed
+12−12
mcpchanged
docs/2024-11-05/develop/clients/client-best-practices
| Guideline | Rationale
| -------------------------------- | -----------------------------------------------------------------------------------------------------------------------------------------------
| **Offer multiple detail levels** | Let the model choose between name-only, name-and-description, or full-schema responses.
| **Cache tool definitions** | Once fetched from a server, memoize the definition host-side so re-injecting it later doesn't need another `tools/list` round trip. This is sep
| **Refresh on `list_changed`** | Re-index the search catalog when a server sends `notifications/tools/list_changed`.
+12 −12 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
extensions/auth/overview
±changed
+10−10
mcpchanged
extensions/auth/overview
The core MCP specification includes a robust [authorization framework](/specification/latest/basic/authorization) built on OAuth 2.0. That framework handles the common case well: a
The core MCP specification includes a robust [authorization framework](/specification/latest/basic/authorization.md) built on OAuth 2.0. That framework handles the common case well
> **[OAuth Client Credentials](/extensions/auth/oauth-client-credentials)**
> **[OAuth Client Credentials](/extensions/auth/oauth-client-credentials.md)**
> **[Enterprise-Managed Authorization](/extensions/auth/enterprise-managed-authorization)**
+10 −10 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
extensions/auth/oauth-client-credentials
±changed
+1−1
mcpchanged
extensions/auth/oauth-client-credentials
Check the [client matrix](/extensions/client-matrix) for current implementation status across MCP clients.
Check the [client matrix](/extensions/client-matrix.md) for current implementation status across MCP clients.
+1 −1 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
extensions/auth/enterprise-managed-authorization
±changed
+3−3
mcpchanged
extensions/auth/enterprise-managed-authorization
Check the [client matrix](/extensions/client-matrix) for current implementation status across MCP clients. Enterprise-Managed Authorization typically requires client-level support
Check the [client matrix](/extensions/client-matrix.md) for current implementation status across MCP clients. Enterprise-Managed Authorization typically requires client-level suppo
> **[SEP-990](/seps/990-enable-enterprise-idp-policy-controls-during-mcp-o)**
> **[SEP-990](/seps/990-enable-enterprise-idp-policy-controls-during-mcp-o.md)**
> **[MCP Authorization](/specification/latest/basic/authorization)**
+3 −3 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/draft/tutorials/security/security_best_practices
±changed
+13−13
mcpchanged
docs/draft/tutorials/security/security_best_practices
[MCP Authorization](/specification/latest/basic/authorization)
[MCP Authorization](/specification/latest/basic/authorization.md)
[dynamic client registration](/specification/latest/basic/authorization#dynamic-client-registration))
[dynamic client registration](/specification/latest/basic/authorization.md#dynamic-client-registration))
[authorization specification](/specification/latest/basic/authorization)
+13 −13 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/draft/tutorials/security/authorization
±changed
+7−7
mcpchanged
docs/draft/tutorials/security/authorization
MCP uses standardized authorization flows to build trust between MCP clients and MCP servers. Its design doesn't focus on one specific authorization or identity system, but rather
MCP uses standardized authorization flows to build trust between MCP clients and MCP servers. Its design doesn't focus on one specific authorization or identity system, but rather
> For MCP servers using the [STDIO transport](/specification/latest/basic/transports#stdio), you can use environment-based credentials or credentials provided by third-party librar
> For MCP servers using the [STDIO transport](/specification/latest/basic/transports.md#stdio), you can use environment-based credentials or credentials provided by third-party lib
We will now set up our MCP server to use the locally-running Keycloak authorization server. Depending on your programming language preference, you can use one of the supported [MCP
+7 −7 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/draft/develop/clients/client-best-practices
±changed
+3−3
mcpchanged
docs/draft/develop/clients/client-best-practices
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
This works especially well for general-purpose agents, where the user's intent isn't known upfront. The agent starts with a minimal set of always-on servers and connects others as
specification's [caching utility](/specification/draft/server/utilities/caching). In particular,
specification's [caching utility](/specification/draft/server/utilities/caching.md). In particular,
* **Per-call authorization**: The broker is still the MCP host for spec purposes. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to
+3 −3 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/draft/develop/build-with-agent-skills
±changed
+8−8
mcpchanged
docs/draft/develop/build-with-agent-skills
[elicitation](/specification/draft/client/elicitation), or rich UI widgets
[elicitation](/specification/draft/client/elicitation.md), or rich UI widgets
**Remote [Streamable HTTP](/specification/draft/basic/transports/streamable-http)**
**Remote [Streamable HTTP](/specification/draft/basic/transports/streamable-http.md)**
**[MCP apps](/extensions/apps/overview)** extend a server with interactive
+8 −8 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-11-25/tutorials/security/security_best_practices
±changed
+4−4
mcpchanged
docs/2025-11-25/tutorials/security/security_best_practices
[MCP Authorization](/specification/2025-11-25/basic/authorization)
[MCP Authorization](/specification/2025-11-25/basic/authorization.md)
[dynamic client registration](/specification/2025-11-25/basic/authorization#dynamic-client-registration))
[dynamic client registration](/specification/2025-11-25/basic/authorization.md#dynamic-client-registration))
[authorization specification](/specification/2025-11-25/basic/authorization)
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-11-25/tutorials/security/authorization
±changed
+7−7
mcpchanged
docs/2025-11-25/tutorials/security/authorization
MCP uses standardized authorization flows to build trust between MCP clients and MCP servers. Its design doesn't focus on one specific authorization or identity system, but rather
MCP uses standardized authorization flows to build trust between MCP clients and MCP servers. Its design doesn't focus on one specific authorization or identity system, but rather
> For MCP servers using the [STDIO transport](/specification/2025-11-25/basic/transports#stdio), you can use environment-based credentials or credentials provided by third-party li
> For MCP servers using the [STDIO transport](/specification/2025-11-25/basic/transports.md#stdio), you can use environment-based credentials or credentials provided by third-party
We will now set up our MCP server to use the locally-running Keycloak authorization server. Depending on your programming language preference, you can use one of the supported [MCP
+7 −7 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-11-25/tools/inspector
±changed
+5−3
mcpchanged
docs/2025-11-25/tools/inspector
The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) is an interactive developer tool for testing and debugging MCP servers. While the [Debugging Guide](/docs/202
The [MCP Inspector](https://github.com/modelcontextprotocol/inspector) is an interactive developer tool for testing and debugging MCP servers. While the [Debugging Guide](/docs/202
The MCP Inspector interface
* Allows selecting the [transport](/specification/2025-11-25/basic/transports) for connecting to the server
+5 −3 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
docs/2025-11-25/sdk
±changed
+4−4
mcpchanged
docs/2025-11-25/sdk
Build MCP servers and clients using our official SDKs. SDKs are classified into tiers based on feature completeness, protocol support, and maintenance commitment. Learn more about
Build MCP servers and clients using our official SDKs. SDKs are classified into tiers based on feature completeness, protocol support, and maintenance commitment. Learn more about
See [SDK Tiering System](/community/sdk-tiers) for details on what each tier means.
See [SDK Tiering System](/community/sdk-tiers.md) for details on what each tier means.
> **[Build a Server](/docs/2025-11-25/develop/build-server)**
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 22 Oct 2026 20:37 UTC
mcp
extensions/auth/overview
±changed
+12−14
mcpchanged
extensions/auth/overview
<Card title="modelcontextprotocol/ext-auth" icon="github" href="https://github.com/modelcontextprotocol/ext-auth">
Source code, specifications, and reference implementations for MCP
authorization extensions.
</Card>
> **[modelcontextprotocol/ext-auth](https://github.com/modelcontextprotocol/ext-auth)**
+12 −14 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
extensions/auth/oauth-client-credentials
±changed
+309−323
mcpchanged
extensions/auth/oauth-client-credentials
<Card title="Specification" icon="file-lines" href="https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/oauth-client-credentials.mdx">
Full technical specification for the OAuth Client Credentials extension.
</Card>
> **[Specification](https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/oauth-client-credentials.mdx)**
>
+309 −323 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
extensions/auth/enterprise-managed-authorization
±changed
+19−21
mcpchanged
extensions/auth/enterprise-managed-authorization
<Card title="Specification" icon="file-lines" href="https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/stable/enterprise-managed-authorization.mdx">
Full technical specification for the Enterprise-Managed Authorization
extension.
</Card>
> **[Specification](https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/stable/enterprise-managed-authorization.mdx)**
+19 −21 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/draft/tutorials/security/security_best_practices
±changed
+26−26
mcpchanged
docs/draft/tutorials/security/security_best_practices
<Note>
Avoid implementing IP validation manually. Attackers exploit encoding tricks
(octal, hex, IPv4-mapped IPv6) that custom parsers often miss.
</Note>
> [!NOTE]
+26 −26 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/draft/tutorials/security/authorization
±changed
+893−913
mcpchanged
docs/draft/tutorials/security/authorization
<Tip>
**Authorization for Local MCP Servers**
For MCP servers using the [STDIO transport](/specification/latest/basic/transports#stdio), you can use environment-based credentials or credentials provided by third-party librar
+893 −913 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/draft/develop/clients/client-best-practices
±changed
+2−2
mcpchanged
docs/draft/develop/clients/client-best-practices
<img src="https://mintcdn.com/mcp/JXfd5cBmEUh_qPUI/images/progressive-discovery.svg?fit=max&auto=format&n=JXfd5cBmEUh_qPUI&q=85&s=db39f47006107f04af43b5eeae2d6022" alt="Comparison
**
+9 −11 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-11-25/tutorials/security/security_best_practices
±changed
+4−4
mcpchanged
docs/2025-11-25/tutorials/security/security_best_practices
<Note>
Avoid implementing IP validation manually. Attackers exploit encoding tricks
(octal, hex, IPv4-mapped IPv6) that custom parsers often miss.
</Note>
> [!NOTE]
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-11-25/tutorials/security/authorization
±changed
+841−861
mcpchanged
docs/2025-11-25/tutorials/security/authorization
<Tip>
**Authorization for Local MCP Servers**
For MCP servers using the [STDIO transport](/specification/2025-11-25/basic/transports#stdio), you can use environment-based credentials or credentials provided by third-party li
+841 −861 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-11-25/tools/inspector
±changed
+36−44
mcpchanged
docs/2025-11-25/tools/inspector
<Tabs>
<Tab title="npm package">
```bash theme={null}
npx -y @modelcontextprotocol/inspector npx <package-name> <args>
# For example
+36 −44 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
docs/2025-11-25/sdk
±changed
+16−18
mcpchanged
docs/2025-11-25/sdk
| <Icon icon="square-js" size={24} /> [TypeScript](https://ts.sdk.modelcontextprotocol.io) | [modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescr
| <Icon icon="python" size={24} /> [Python](https://py.sdk.modelcontextprotocol.io) | [modelcontextprotocol/python-sdk](https://github.com/modelcontextprotocol/python-sdk) | <Bad
| <Icon icon="square-c" size={24} /> [C#](https://csharp.sdk.modelcontextprotocol.io) | [modelcontextprotocol/csharp-sdk](https://github.com/modelcontextprotocol/csharp-sdk) | <B
| <Icon icon="golang" size={24} /> [Go](https://go.sdk.modelcontextprotocol.io) | [modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) | <Badge color="bl
| <Icon icon="java" size={24} /> [Java](https://java.sdk.modelcontextprotocol.io) | [modelcontextprotocol/java-sdk](https://github.com/modelcontextprotocol/java-sdk) | <Badge col
+16 −18 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 20 Oct 2026 20:07 UTC
mcp
extensions/auth/overview
±changed
+8−8
mcpchanged
extensions/auth/overview
| Scenario | Recommended extension |
| ---------------------------------------------------- | ------------------------------------------------------------------------------------- |
| Background service or daemon accessing an MCP server | [OAuth Client Credentials](/extensions/auth/oauth-client-credentials) |
| CI/CD pipeline calling MCP tools | [OAuth Client Credentials](/extensions/auth/oauth-client-credentials) |
| Server-to-server API integration | [OAuth Client Credentials](/extensions/auth/oauth-client-credentials) |
+8 −8 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/draft/develop/clients/client-best-practices
±changed
+12−12
mcpchanged
docs/draft/develop/clients/client-best-practices
| Guideline | Rationale
| -------------------------------- | -----------------------------------------------------------------------------------------------------------------------------------------------
| **Offer multiple detail levels** | Let the model choose between name-only, name-and-description, or full-schema responses.
| **Cache tool definitions** | Once fetched from a server, memoize the definition host-side so re-injecting it later doesn't need another `tools/list` round trip. This is sep
| **Refresh on `list_changed`** | Re-index the search catalog when a server sends `notifications/tools/list_changed`.
+12 −12 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
mcp
docs/draft/develop/build-with-agent-skills
±changed
+4−4
mcpchanged
docs/draft/develop/build-with-agent-skills
| Skill | Purpose |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------- |
| Skill | Purpose |
| - | - |
| `build-mcp-app` | Adds interactive UI widgets (forms, pickers, dashboards) rendered inline in chat. |
+4 −4 lines
Upstream edited 28 Jul 2026 15:42 UTC Recorded here 28 Sep 2026 22:07 UTC
Nothing on this page matches that. Press Enter to search every page of the ledger.