{
  "title": "MCP Architecture Myths and Evidence",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "2026-07-28",
  "count": 40,
  "records": [
    {
      "mythId": "R5-MYTH01",
      "myth": "MCP has only clients and servers.",
      "correction": "The specification defines a host that manages clients, model integration, permissions and cross-server context.",
      "packageSourceIds": [
        "S001"
      ],
      "sourceIds": [
        "S121"
      ]
    },
    {
      "mythId": "R5-MYTH02",
      "myth": "Host and client are synonyms.",
      "correction": "A host creates and coordinates multiple clients; a client is scoped to one server.",
      "packageSourceIds": [
        "S001"
      ],
      "sourceIds": [
        "S121"
      ]
    },
    {
      "mythId": "R5-MYTH03",
      "myth": "Every product called an MCP client is only a client.",
      "correction": "Products such as Claude Desktop and VS Code are host applications containing client implementations.",
      "packageSourceIds": [
        "S035",
        "S043"
      ],
      "sourceIds": [
        "S258",
        "S141"
      ]
    },
    {
      "mythId": "R5-MYTH04",
      "myth": "One MCP client connects to every server.",
      "correction": "The host creates a separate logical client relationship for each server.",
      "packageSourceIds": [
        "S001"
      ],
      "sourceIds": [
        "S121"
      ]
    },
    {
      "mythId": "R5-MYTH05",
      "myth": "One client means one TCP connection.",
      "correction": "Client is a logical role; network connections are transport implementation details.",
      "packageSourceIds": [
        "S001",
        "S007"
      ],
      "sourceIds": [
        "S121",
        "S131"
      ]
    },
    {
      "mythId": "R5-MYTH06",
      "myth": "One server means one process.",
      "correction": "A logical remote server may be implemented by many replicas behind a load balancer.",
      "packageSourceIds": [
        "S013",
        "S015"
      ],
      "sourceIds": [
        "S058",
        "S061"
      ]
    },
    {
      "mythId": "R5-MYTH07",
      "myth": "The MCP server contains the LLM.",
      "correction": "The model normally operates through the host; a server need not use a model.",
      "packageSourceIds": [
        "S001"
      ],
      "sourceIds": [
        "S121"
      ]
    },
    {
      "mythId": "R5-MYTH08",
      "myth": "The model speaks MCP directly.",
      "correction": "The host interprets model output and invokes an MCP client.",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "mythId": "R5-MYTH09",
      "myth": "The client chooses tools using AI.",
      "correction": "The host/model loop chooses tools; the client transports protocol requests.",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "mythId": "R5-MYTH10",
      "myth": "The client executes every tool.",
      "correction": "The server executes or delegates `tools/call`; the client sends it.",
      "packageSourceIds": [
        "S009"
      ],
      "sourceIds": [
        "S123"
      ]
    },
    {
      "mythId": "R5-MYTH11",
      "myth": "The server controls the confirmation dialog.",
      "correction": "The host owns user-facing consent and permission interfaces.",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "mythId": "R5-MYTH12",
      "myth": "The server sees the full conversation.",
      "correction": "The host retains the full conversation and sends minimal necessary context.",
      "packageSourceIds": [
        "S001"
      ],
      "sourceIds": [
        "S121"
      ]
    },
    {
      "mythId": "R5-MYTH13",
      "myth": "MCP still requires initialization.",
      "correction": "`initialize` and `initialized` were removed in `2026-07-28`; they remain legacy behavior.",
      "packageSourceIds": [
        "S002",
        "S003"
      ],
      "sourceIds": [
        "S055",
        "S056"
      ]
    },
    {
      "mythId": "R5-MYTH14",
      "myth": "MCP has always been stateless.",
      "correction": "Revisions through `2025-11-25` used stateful initialization and protocol sessions.",
      "packageSourceIds": [
        "S017",
        "S018",
        "S022"
      ],
      "sourceIds": [
        "S249",
        "S026",
        "S160"
      ]
    },
    {
      "mythId": "R5-MYTH15",
      "myth": "MCP is still stateful because servers can keep databases.",
      "correction": "Application state and protocol-session state are different; current requests are self-describing.",
      "packageSourceIds": [
        "S002",
        "S009",
        "S015"
      ],
      "sourceIds": [
        "S055",
        "S123",
        "S061"
      ]
    },
    {
      "mythId": "R5-MYTH16",
      "myth": "Stateless MCP cannot support workflows.",
      "correction": "Explicit handles, Tasks and durable backend state support multi-step work.",
      "packageSourceIds": [
        "S009",
        "S013"
      ],
      "sourceIds": [
        "S123",
        "S058"
      ]
    },
    {
      "mythId": "R5-MYTH17",
      "myth": "`server/discover` creates a session.",
      "correction": "Discovery reports supported versions and capabilities; later requests remain self-describing.",
      "packageSourceIds": [
        "S003",
        "S004"
      ],
      "sourceIds": [
        "S056",
        "S127"
      ]
    },
    {
      "mythId": "R5-MYTH18",
      "myth": "`server/discover` proves publisher identity.",
      "correction": "Server information is self-reported and is not sufficient authentication.",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S127"
      ]
    },
    {
      "mythId": "R5-MYTH19",
      "myth": "Every MCP server supports every capability.",
      "correction": "Capabilities and extensions are optional and hosts may support only subsets.",
      "packageSourceIds": [
        "S001",
        "S004"
      ],
      "sourceIds": [
        "S121",
        "S127"
      ]
    },
    {
      "mythId": "R5-MYTH20",
      "myth": "Compatible hosts behave identically.",
      "correction": "Hosts differ in model, permissions, schema translation, primitive support and rendering.",
      "packageSourceIds": [
        "S001",
        "S043",
        "S047"
      ],
      "sourceIds": [
        "S121",
        "S141",
        "S265"
      ]
    },
    {
      "mythId": "R5-MYTH21",
      "myth": "A tool annotation is an enforceable permission.",
      "correction": "Annotations are descriptive hints and must be treated as untrusted absent server trust.",
      "packageSourceIds": [
        "S009"
      ],
      "sourceIds": [
        "S123"
      ]
    },
    {
      "mythId": "R5-MYTH22",
      "myth": "JSON Schema makes a tool safe.",
      "correction": "Shape validation does not establish semantic authorization or business safety.",
      "packageSourceIds": [
        "S009"
      ],
      "sourceIds": [
        "S123"
      ]
    },
    {
      "mythId": "R5-MYTH23",
      "myth": "An SDK is an MCP client.",
      "correction": "An SDK supplies classes; a running instantiated component performs the role.",
      "packageSourceIds": [
        "S026",
        "S029"
      ],
      "sourceIds": [
        "S252",
        "S167"
      ]
    },
    {
      "mythId": "R5-MYTH24",
      "myth": "An `mcpServers` configuration entry is a client.",
      "correction": "It is host-specific configuration used to create or locate a relationship.",
      "packageSourceIds": [
        "S036",
        "S043",
        "S057"
      ],
      "sourceIds": [
        "S259",
        "S141",
        "S274"
      ]
    },
    {
      "mythId": "R5-MYTH25",
      "myth": "A server package is a running server.",
      "correction": "It is distributed code that becomes a server when executed and connected.",
      "packageSourceIds": [
        "S006"
      ],
      "sourceIds": [
        "S132"
      ]
    },
    {
      "mythId": "R5-MYTH26",
      "myth": "Every connector is an MCP server.",
      "correction": "Connector is product terminology and may map to a client, server, gateway or managed integration.",
      "packageSourceIds": [
        "S038",
        "S040"
      ],
      "sourceIds": [
        "S145",
        "S140"
      ]
    },
    {
      "mythId": "R5-MYTH27",
      "myth": "Every local server uses stdio.",
      "correction": "stdio is common, but local HTTP and in-process SDK connections also exist.",
      "packageSourceIds": [
        "S005",
        "S029"
      ],
      "sourceIds": [
        "S057",
        "S167"
      ]
    },
    {
      "mythId": "R5-MYTH28",
      "myth": "Every remote server uses an always-open SSE connection.",
      "correction": "Current Streamable HTTP uses independent POSTs and optional request-scoped SSE/subscriptions.",
      "packageSourceIds": [
        "S007"
      ],
      "sourceIds": [
        "S131"
      ]
    },
    {
      "mythId": "R5-MYTH29",
      "myth": "The original HTTP+SSE transport is current Streamable HTTP.",
      "correction": "Streamable HTTP replaced the original transport in March 2025 and changed again in 2026.",
      "packageSourceIds": [
        "S007",
        "S023"
      ],
      "sourceIds": [
        "S131",
        "S036"
      ]
    },
    {
      "mythId": "R5-MYTH30",
      "myth": "Servers still send ordinary JSON-RPC requests to clients in current core MCP.",
      "correction": "MRTR and explicit subscriptions replaced the legacy direct-request pattern.",
      "packageSourceIds": [
        "S002",
        "S009",
        "S012"
      ],
      "sourceIds": [
        "S055",
        "S123",
        "S126"
      ]
    },
    {
      "mythId": "R5-MYTH31",
      "myth": "MCP Apps make the server the host.",
      "correction": "The host still negotiates, sandboxes, renders and mediates server-provided UI.",
      "packageSourceIds": [
        "S001",
        "S043"
      ],
      "sourceIds": [
        "S121",
        "S141"
      ]
    },
    {
      "mythId": "R5-MYTH32",
      "myth": "Resources are tool results.",
      "correction": "Resources are a distinct URI-addressed primitive, though tools may return resource links.",
      "packageSourceIds": [
        "S009",
        "S010"
      ],
      "sourceIds": [
        "S123",
        "S124"
      ]
    },
    {
      "mythId": "R5-MYTH33",
      "myth": "MCP prompts are the model’s system prompt.",
      "correction": "They are server-exposed prompt templates the host may surface or use.",
      "packageSourceIds": [
        "S011"
      ],
      "sourceIds": [
        "S125"
      ]
    },
    {
      "mythId": "R5-MYTH34",
      "myth": "MCP requires an LLM.",
      "correction": "Programmatic clients can invoke MCP without model reasoning.",
      "packageSourceIds": [
        "S008",
        "S029"
      ],
      "sourceIds": [
        "S130",
        "S167"
      ]
    },
    {
      "mythId": "R5-MYTH35",
      "myth": "A gateway is a fourth core MCP role.",
      "correction": "Gateway is an ecosystem deployment term; the core role model remains host, client and server.",
      "packageSourceIds": [
        "S001",
        "S005"
      ],
      "sourceIds": [
        "S121",
        "S057"
      ]
    },
    {
      "mythId": "R5-MYTH36",
      "myth": "Local MCP needs no authorization.",
      "correction": "OS identity, path restrictions, project trust and underlying permissions remain authorization controls.",
      "packageSourceIds": [
        "S006",
        "S055"
      ],
      "sourceIds": [
        "S132",
        "S272"
      ]
    },
    {
      "mythId": "R5-MYTH37",
      "myth": "Remote MCP is automatically multi-tenant.",
      "correction": "A remote service may be single-tenant, per-user, shared or gateway-mediated.",
      "packageSourceIds": [
        "S007"
      ],
      "sourceIds": [
        "S131"
      ]
    },
    {
      "mythId": "R5-MYTH38",
      "myth": "One host can safely combine every server result by default.",
      "correction": "Cross-server content is untrusted and must be governed by host policy and provenance.",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "mythId": "R5-MYTH39",
      "myth": "Current client/server compatibility can be inferred from a product name.",
      "correction": "Version, transport, capability, authorization and extension support must be checked per product.",
      "packageSourceIds": [
        "S003",
        "S027",
        "S043"
      ],
      "sourceIds": [
        "S056",
        "S253",
        "S141"
      ]
    },
    {
      "mythId": "R5-MYTH40",
      "myth": "The 2026 redesign made legacy servers unusable everywhere.",
      "correction": "Official versioning supports dual-era implementations and product-specific fallback strategies.",
      "packageSourceIds": [
        "S003",
        "S027",
        "S030"
      ],
      "sourceIds": [
        "S056",
        "S253",
        "S254"
      ]
    }
  ]
}