MCP source library

JSON-RPC 2.0 Specification ↗

JSON-RPC Working Group

Supports: Defines requests, responses, notifications, errors, and batching used by MCP. Requests, responses, notifications, errors and transport independence. Request, response, notification, error and transport-agnostic RPC semantics Request, response, notification and error object semantics used by MCP. Underlying request, response, notification and error model. Request, response, notification and error message model used by MCP and one A2A binding.

Language Server Protocol Overview ↗

Microsoft

Supports: Primary architectural background for editor-client/language-server reuse and JSON-RPC capability negotiation.

RFC 6749: The OAuth 2.0 Authorization Framework ↗

IETF

Supports: Background for delegated authorization terminology. Foundation for delegated authorization in remote protocol deployments. OAuth roles and authorization framework.

RFC 7636: Proof Key for Code Exchange by OAuth Public Clients ↗

IETF

Supports: PKCE requirements used in MCP authorization. PKCE security properties for public clients PKCE for public clients. Proof Key for Code Exchange.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

RFC 8707: Resource Indicators for OAuth 2.0 ↗

IETF

Supports: Resource Indicators added to MCP authorization hardening. Audience-bound resource parameter Resource-bound token requests and audience restrictions. Resource-specific token targeting.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

RFC 9728: OAuth 2.0 Protected Resource Metadata ↗

IETF

Supports: Protected-resource metadata used by MCP resource servers. Protected-resource metadata used by MCP authorization Protected resource metadata used in remote MCP authorization. Protected-resource metadata and authorization-server discovery.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

OAuth 2.1 Internet-Draft ↗

IETF OAuth WG

Supports: Status and evolving basis of MCP authorization framework.

OpenID Connect Discovery 1.0 ↗

OpenID Foundation

Supports: Discovery mechanism supported in MCP 2025-11-25.

ChatGPT plugins ↗

OpenAI

Supports: Pre-MCP vendor plugin architecture using manifests, APIs, and OAuth. Earlier vendor-specific plugin model using manifests, OpenAPI and OAuth.

Function calling and other API updates ↗

OpenAI

Supports: Pre-MCP model function-calling history. Pre-MCP function-calling history and structured model action selection. Public OpenAI function-calling introduction, JSON arguments and early security warning

Tool use with Claude ↗

Anthropic

Supports: Distinguishes vendor tool-use APIs from MCP interoperability. Client versus server tools and structured tool_use behavior

Specification repository metadata ↗

Model Context Protocol

Supports: Repository creation predates the public announcement.

Initial import of MCP specification repository ↗

Model Context Protocol

Supports: Earliest public commit; states LSP inspiration, host/client/server/session terminology, resources, prompts, tools, sampling, stdio and SSE. Earliest public repository evidence and explicit LSP inspiration.

Initial TypeScript SDK import ↗

Model Context Protocol

Supports: Earliest public TypeScript SDK evidence.

Initial Python SDK import ↗

Model Context Protocol

Supports: Earliest public Python SDK evidence.

Add required capabilities for resources ↗

Model Context Protocol

Supports: Shows capability declarations still being refined before launch.

Initial guide documentation merge ↗

Model Context Protocol

Supports: Pre-launch documentation work.

Reference servers repository ↗

Model Context Protocol

Supports: Repository creation and evolution of reference servers. Reference-server distribution, local examples and warning that examples are not production-ready.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Initial reference servers commit ↗

Model Context Protocol

Supports: First public reference-server monorepo commit. Earliest verified public reference server set.

Initial reference-server repository tree ↗

Model Context Protocol

Supports: Confirms initial public directories including everything, Google Drive, Git, Postgres, and Puppeteer.

Introducing the Model Context Protocol ↗

Anthropic

Supports: Public launch, creators, SDKs, Claude Desktop support, example integrations, and stated integration problem. Public announcement, integration-fragmentation rationale, SDKs, Claude Desktop and example servers. MCP public announcement, integration-fragmentation rationale, initial SDK and host context Public launch, initial local-first integration rationale, initial SDK and host context Public launch, reusable integration problem and original example servers. Public MCP launch and original integration problem statement.

Zed and the Model Context Protocol ↗

Zed Industries

Supports: Launch-day non-Anthropic host integration and explicit LSP comparison. Zed launch-day MCP integration and collaboration with Anthropic.

Model Context Protocol repository README ↗

Model Context Protocol

Supports: Current creator credit to David Soria Parra and Justin Spahr-Summers. Official creator credit for David Soria Parra and Justin Spahr-Summers.

MCP specification 2024-11-05 ↗

Model Context Protocol

Supports: Authoritative launch-era specification overview. Launch-era stateful architecture, initialization, stdio, HTTP+SSE and original capabilities. Initial released protocol overview and date-based revision Launch-era architecture, lifecycle, capabilities and trust guidance

Architecture 2024-11-05 ↗

Model Context Protocol

Supports: Launch-era host/client/server architecture. Launch-era host, client, server, JSON-RPC and stateful-session architecture

Lifecycle 2024-11-05 ↗

Model Context Protocol

Supports: Initialize/initialized handshake, version and capability negotiation. Launch-era initialize/initialized lifecycle and capability negotiation. Original initialize/initialized handshake, sessions and capability negotiation. Original initialize/initialized handshake and capability negotiation.

Transports 2024-11-05 ↗

Model Context Protocol

Supports: stdio and HTTP+SSE semantics. Original stdio and HTTP+SSE transport behavior Original stdio and HTTP+SSE transport semantics Original stdio and HTTP+SSE transports. Original stdio and HTTP+SSE transport semantics.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Tools 2024-11-05 ↗

Model Context Protocol

Supports: Launch-era tool listing and invocation. Launch-era tool definition and model-controlled interaction guidance Launch-era tool discovery, invocation and human-control guidance Launch-era tools/list, tools/call, input schemas and content results. Original tool discovery and invocation.

Resources 2024-11-05 ↗

Model Context Protocol

Supports: URI-addressed resources, templates, and subscriptions. Launch-era resource semantics Launch-era resources, subscriptions and data exposure semantics Launch-era resources/list, resources/read, URI templates and direct resources/subscribe. Original resource listing, reading, templates and direct subscriptions.

Prompts 2024-11-05 ↗

Model Context Protocol

Supports: Server-exposed prompt templates and user-controlled workflows. Launch-era prompt-template semantics Launch-era prompts/list, prompts/get, arguments and embedded resources. Original prompt discovery and retrieval.

Roots 2024-11-05 ↗

Model Context Protocol

Supports: Client-declared filesystem/project boundaries.

Sampling 2024-11-05 ↗

Model Context Protocol

Supports: Server requests model sampling through client/host. Launch-era server-to-client sampling and user-control expectations

Logging 2024-11-05 ↗

Model Context Protocol

Supports: Protocol logging method and notifications.

Completion 2024-11-05 ↗

Model Context Protocol

Supports: Argument-completion utility present at launch.

MCP specification 2025-03-26 ↗

Model Context Protocol

Supports: Authoritative March 2025 revision.

Key changes 2025-03-26 ↗

Model Context Protocol

Supports: OAuth framework, Streamable HTTP, batching, tool annotations, audio, progress, completions capability. OAuth-based authorization, Streamable HTTP, JSON-RPC batching, tool annotations, audio, progress text and completions capability entered the released specification. OAuth framework, Streamable HTTP, batching, annotations, audio and completions Initial authorization framework, Streamable HTTP, annotations and batching Streamable HTTP, OAuth framework, batching and tool annotations. Tool annotations, audio, completions, OAuth, Streamable HTTP and batching. OAuth framework, Streamable HTTP, JSON-RPC batching, tool annotations and audio.

Authorization 2025-03-26 ↗

Model Context Protocol

Supports: First protocol authorization framework. Initial OAuth-oriented remote authorization framework First protocol authorization framework for HTTP deployments First core OAuth authorization framework. First MCP authorization framework and OAuth 2.1 relationship.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Streamable HTTP 2025-03-26 ↗

Model Context Protocol

Supports: Original Streamable HTTP, stateful session, optional SSE, backwards compatibility. Original Streamable HTTP semantics, including POST/GET, optional SSE, resumability and optional Mcp-Session-Id session management. Original Streamable HTTP and HTTP+SSE backward-compatibility path. Original Streamable HTTP, handshake-era sessions and backward compatibility.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

PR #206: Streamable HTTP transport ↗

Model Context Protocol

Supports: Design history for replacing HTTP+SSE.

PR #133: Authorization specification ↗

Model Context Protocol

Supports: Authorization proposal and merge history.

PR #185: Tool annotations ↗

Model Context Protocol

Supports: Origin of read-only, destructive, idempotent, and open-world hints.

MCP specification 2025-06-18 ↗

Model Context Protocol

Supports: Authoritative June 2025 revision.

Key changes 2025-06-18 ↗

Model Context Protocol

Supports: Batching removal, structured output, resource-server classification, Resource Indicators, elicitation, resource links. JSON-RPC batching was removed; structured tool output, resource links, elicitation and authorization hardening were added. Batching removal, structured output, elicitation and authorization hardening Resource-server classification, protected-resource metadata, Resource Indicators and structured output Removal of batching, structured tool output, elicitation and authorization hardening. Structured tool output, resource links, titles, batching removal and authorization hardening. Batching removed, structured tool output, elicitation and OAuth hardening.

Authorization 2025-06-18 ↗

Model Context Protocol

Supports: OAuth resource-server model, protected resource metadata, PKCE, Resource Indicators. Resource Indicators, token audience validation and resource-server model Audience restrictions, protected resource metadata and token validation OAuth Resource Server classification, protected resource metadata and Resource Indicators. Resource-server classification, protected resource metadata and resource indicators.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Tools 2025-06-18 ↗

Model Context Protocol

Supports: Structured tool output and output schema. Structured tool output and outputSchema semantics June-era outputSchema, structuredContent and resource links.

Elicitation 2025-06-18 ↗

Model Context Protocol

Supports: Server-initiated user information request capability. First elicitation capability and server-initiated interaction.

Security best practices 2025-06-18 ↗

Model Context Protocol

Supports: Token passthrough, confused deputy, least privilege, and proxy risks.

MCP specification 2025-11-25 ↗

Model Context Protocol

Supports: Authoritative one-year revision.

Key changes 2025-11-25 ↗

Model Context Protocol

Supports: OIDC discovery, icons, incremental scopes, URL elicitation, sampling tools, client metadata documents, experimental tasks, governance. OIDC discovery, icon metadata, incremental scope consent, richer elicitation, CIMD, tool use in sampling and experimental Tasks entered the released specification. One-year revision changes including experimental Tasks OIDC discovery, CIMD, incremental consent, URL elicitation and experimental Tasks OIDC discovery, CIMD, expanded elicitation, experimental Tasks and governance changes. Icons, tool naming guidance, JSON Schema 2020-12 default and expanded elicitation. OIDC discovery, icons, CIMD, richer elicitation and experimental Tasks.

Tasks 2025-11-25 ↗

Model Context Protocol

Supports: Experimental core Tasks semantics. Experimental core Tasks wire model before extension migration. Historical experimental core Tasks model before redesign as extension.

URL-mode elicitation 2025-11-25 ↗

Model Context Protocol

Supports: Sensitive/out-of-band user interactions.

Update on the next MCP protocol release ↗

Model Context Protocol

Supports: RC date and 14-day validation process.

The 2026-07-28 specification release candidate ↗

Model Context Protocol

Supports: RC chronology and rationale for stateless core, extensions, tasks, apps, and deprecation. RC date, validation window, motivations and distinction between RC and GA. RC chronology and technical motivation for stateless architecture Infrastructure motivation for statelessness, routing and caching Release-candidate chronology and before/after architecture rationale. Release-candidate rationale and infrastructure motivations. RC chronology, rationale and pre-GA status. Motivation for removing sessions, horizontal scaling, explicit handles and HTTP infrastructure. Operational motivation for stateless routing and gateways.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

MCP specification 2026-07-28 ↗

Model Context Protocol

Supports: Current authoritative specification at verification date. Current authoritative protocol overview, roles, JSON-RPC basis, primitives, security principles. Authoritative current specification landing page. Current MCP core specification. Current core protocol architecture and distinction from extension-layer App–Host lifecycle.

Key changes 2026-07-28 ↗

Model Context Protocol

Supports: Stateless core, discovery, MRTR, subscriptions/listen, routing headers, caching, tasks extension, deprecations. Removal of handshake and sessions; discovery, subscriptions, routing, caching, extensions and deprecations. Canonical list of 2026 additions, removals, deprecations and compatibility effects Stateless core, removal of sessions and initialization, routing headers, cache scope, auth hardening, MRTR and deprecations Removal of initialize, initialized, protocol sessions and Mcp-Session-Id; addition of server/discover, MRTR, routing headers and cacheable results. Removal of initialization and sessions; cacheable results; resultType; MRTR; deterministic tool order; routing and subscription changes. Removal of initialization and sessions; MRTR, discovery, routing, caching, extensions and deprecations. Stateless core, MRTR, routing, caching, authorization, Tasks and deprecations. Removal of initialization and sessions, MRTR, caching, routing and deprecations. Canonical breaking changes and deprecations.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Versioning and compatibility 2026-07-28 ↗

Model Context Protocol

Supports: Modern/legacy/dual-era compatibility and per-request versioning. Current version declaration and compatibility behavior Per-request version declaration, modern versus legacy eras, discovery and dual-era compatibility. Date-based versions, current per-request version declaration and legacy compatibility. Date-based versions, current request declarations, compatibility and version errors. Date-based protocol versions and per-request selection.

Transports overview 2026-07-28 ↗

Model Context Protocol

Supports: Current transport bindings and no server-initiated JSON-RPC requests in modern core. Current stdio and Streamable HTTP semantics Current sessionless HTTP transport and request header rules Transport is separate from protocol semantics; current stdio and Streamable HTTP transports. Current transport overview and separation of transport from protocol semantics. stdio and Streamable HTTP transport architecture. Transport is separate from protocol semantics; current standard bindings.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

The 2026-07-28 Specification ↗

Model Context Protocol

Supports: GA announcement, SDK support, architecture rationale, download claims. GA announcement and maintainer explanation of the stateless revision. GA release, stateless core, MRTR, routing, caching, auth and extensions Maintainer explanation of the current release GA announcement and maintainers’ explanation of stateless architecture, discovery, MRTR, caching and extensions. Official release explanation of stateless core, no handshake/session, server/discover, MRTR and cacheable lists. Official GA explanation, Tier 1 SDK readiness and architecture overview. Official GA explanation of current architectural changes. Current stateless core and independent versioning from the Apps extension. GA context and infrastructure rationale for stateless protocol processing. GA overview of stateless core, routing headers, caching, extensions and authorization.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

MCP Apps: Bringing UI capabilities to MCP clients ↗

Model Context Protocol

Supports: First official extension; sandboxed server-provided UI. Launch of the first official MCP extension and historical context. MCP Apps origin and server-provided UI concept Official server-provided interactive UI extension. Stable launch, first official extension, launch-era clients and architecture.

SEP-2663: Tasks extension ↗

Model Context Protocol

Supports: Tasks moved from experimental core to official extension. Migration of Tasks from experimental core into an official extension.

SEP-2575: Stateless protocol ↗

Model Context Protocol

Supports: Removal of handshake/sessions and per-request metadata model. Motivation and proposal history for removing initialization state. Design rationale for eliminating the initialization handshake.

SEP-2322: Multi Round-Trip Requests ↗

Model Context Protocol

Supports: InputRequiredResult retry pattern.

Enterprise-Managed Authorization: Zero-touch OAuth for MCP ↗

Model Context Protocol

Supports: Stable enterprise authorization extension. Release status and rationale for enterprise-managed authorization.

The New MCP Roadmap ↗

Model Context Protocol

Supports: Post-2026-07-28 priorities; proposals, not shipped features. Current roadmap priorities; proposals are not shipped features. Agent identity, enterprise-ready security and HTTP hardening priorities Current roadmap and retrospective confirmation of session and handshake removal. Current roadmap and retrospective on the July revision. Agentic messaging, transport, identity, primitives and SDK priorities.

Feature lifecycle and deprecation policy ↗

Model Context Protocol

Supports: Active, Deprecated, Removed states and minimum deprecation window. Current user-facing deprecation and removal policy.

Introducing the MCP Registry ↗

Model Context Protocol

Supports: Official registry preview launch and origin history. Registry launch date, preview status and collaborative origin. Registry launch, namespace verification and metadata role Registry launch, metadata discovery and distribution distinction. Official Registry launch and intended aggregator role.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

The MCP Registry: About ↗

Model Context Protocol

Supports: Current preview status, metadata role, namespaces, package-registry relationship, scanning limits. Official registry scope, metadata role, namespace verification and security-scanning limits. Registry metadata role and limits; code/package scanning delegated elsewhere Registry metadata, namespace verification and security limitations. Registry metadata and aggregation role.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

MCP Registry ↗

Model Context Protocol

Supports: Current registry endpoint.

Building to Last: A New Governance Model for MCP ↗

Model Context Protocol

Supports: SEP process and maintainer roles. Formal governance roles and SEP process. Maintainer roles, SEPs and protocol governance structure.

MCP joins the Agentic AI Foundation ↗

Model Context Protocol

Supports: Donation to AAIF, technical autonomy, project-reported adoption statistics. MCP's Linux Foundation/AAIF organizational home and retained technical governance. MCP as a founding AAIF project with technical autonomy.

Governance and stewardship ↗

Model Context Protocol

Supports: Current lead/core maintainer structure and LF project status. Current maintainer structure and individual rather than corporate membership.

Project license and licensing transition ↗

Model Context Protocol

Supports: MIT-to-Apache-2.0 transition and CC BY 4.0 documentation license.

SDK Tiering System ↗

Model Context Protocol

Supports: Tier 1–3 requirements and conformance-based governance. Meaning of SDK tiers and maintenance/conformance expectations. Tier definitions, conformance requirements and release timelines.

SEP-2148: MCP Contributor Ladder ↗

Model Context Protocol

Supports: Contributor progression and governance transparency.

TypeScript SDK repository ↗

Model Context Protocol

Supports: Official launch SDK; current status live-check.

Python SDK repository ↗

Model Context Protocol

Supports: Official launch SDK; current status live-check.

Go SDK repository ↗

Model Context Protocol

Supports: Official SDK status and history.

C# SDK repository ↗

Model Context Protocol

Supports: Official SDK status and history. Official C# SDK status and release documentation.

Java SDK repository ↗

Model Context Protocol

Supports: Official SDK status and history.

Kotlin SDK repository ↗

Model Context Protocol

Supports: Official SDK status and history. Current official Kotlin SDK development status.

Rust SDK repository ↗

Model Context Protocol

Supports: Official SDK status and history.

Swift SDK repository ↗

Model Context Protocol

Supports: Official SDK status and history. Current official Swift SDK development status.

Ruby SDK repository ↗

Model Context Protocol

Supports: Official SDK status and history.

The Official Ruby SDK for MCP Reaches 1.0 ↗

Model Context Protocol

Supports: Ruby 1.0 and Tier 2 milestone. Ruby stable release and then-current Tier 2 status.

Announcing the Official PHP SDK for MCP ↗

Model Context Protocol

Supports: PHP official GA announcement and initial server-only scope.

PHP SDK repository ↗

Model Context Protocol

Supports: Current official PHP SDK status.

Agent mode: available to all users and supports MCP ↗

Microsoft / Visual Studio Code

Supports: Official VS Code MCP host/client support and LSP influence statement. Initial official VS Code MCP host support.

Beyond the tools, adding MCP in VS Code ↗

Microsoft / Visual Studio Code

Supports: Expansion from tools toward richer capabilities and installation UX. VS Code host behavior, tool picker and server integration.

Evidence note: First-party product documentation rechecked and normalized on 2026-08-25; the package URL remains in the package source map.

New tools and features in the Responses API ↗

OpenAI

Supports: First unequivocal official remote MCP support in OpenAI API product. Official remote MCP support in the Responses API. First official OpenAI remote MCP support announcement

Model Context Protocol in the OpenAI Agents SDK ↗

OpenAI

Supports: Current hosted, Streamable HTTP, SSE, and stdio MCP integration modes. MCP schema conversion, name prefixing, hosted/local transport, filtering, approvals and caching Hosted, Streamable HTTP, legacy SSE and stdio MCP client options; manager for multiple servers. The OpenAI Agents SDK documents programmatic support for MCP tools, resources, and prompts. Client support for hosted MCP, Streamable HTTP, stdio and legacy SSE. OpenAI agent client patterns for hosted and local MCP servers.

Evidence note: First-party product documentation rechecked and normalized on 2026-08-26; the package URL remains available through the package source map. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Introducing AWS MCP Servers for code assistants, Part 1 ↗

Amazon Web Services

Supports: Official open-source AWS server suite. Official AWS server suite adoption.

MCP Toolbox for Databases supports MCP ↗

Google Cloud

Supports: Official Google Cloud server/platform support. Official Google Cloud MCP server/platform adoption.

Build and deploy remote MCP servers to Cloudflare ↗

Cloudflare

Supports: Remote hosting, OAuth provider, and Agents SDK support. Early official remote MCP hosting and OAuth infrastructure.

Streamable HTTP and Python support for MCP servers ↗

Cloudflare

Supports: Rapid transport adoption and dual-transport migration.

Thirteen new MCP servers from Cloudflare ↗

Cloudflare

Supports: Official managed remote servers.

MCP Demo Day ↗

Cloudflare and vendors

Supports: Remote servers from multiple SaaS vendors; useful but partly promotional.

Atlassian Remote MCP Server beta ↗

Atlassian

Supports: Official Atlassian remote-server beta.

GitHub MCP Server repository ↗

GitHub

Supports: Official GitHub server implementation.

GitHub MCP Server generally available ↗

GitHub

Supports: Official remote server GA and authorization model.

Cursor MCP documentation ↗

Cursor

Supports: Current host support; first historical date remains separately qualified.

Cursor changelog: MCP image support ↗

Cursor

Supports: Early dated Cursor MCP capability evidence.

MCP support in IntelliJ IDEA 2025.1 ↗

JetBrains

Supports: Official JetBrains host/client support.

Notion MCP documentation ↗

Notion

Supports: Official Notion server documentation; current state live-check.

LangChain MCP adapters ↗

LangChain

Supports: Framework adapter demonstrating MCP-to-native-tool mapping.

MCP integration guide ↗

LlamaIndex

Supports: Framework integration.

Semantic Kernel MCP documentation ↗

Microsoft

Supports: MCP adaptation into Semantic Kernel plugin abstraction.

AutoGen MCP Workbench ↗

Microsoft

Supports: MCP integration in AutoGen.

MCP Security Notification: Tool Poisoning Attacks ↗

Invariant Labs

Supports: Canonical disclosure of hidden tool-description attacks, rug pulls, and tool shadowing. Original tool-poisoning, rug-pull and cross-server-shadowing research. Original public disclosure of tool poisoning, shadowing and rug-pull patterns Original tool-poisoning disclosure and description-based attack paths. Tool poisoning, shadowing and description risk. Tool poisoning and schema/description trust.

MCP Inspector missing authentication ↗

Model Context Protocol

Supports: Inspector proxy exposure; implementation vulnerability, not core-protocol semantics. Representative host/developer-tool implementation vulnerability. Remote code execution due to unauthenticated Inspector proxy; patched/fixed status: 0.14.1 Local development proxies can become exposed network execution surfaces.

Evidence note: Layer: Host/developer tool. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

MCP Inspector XSS advisory ↗

Model Context Protocol

Supports: Inspector implementation vulnerability with potential command-execution path. Representative Inspector UI vulnerability and patch boundary. Cross-site scripting in Inspector; patched/fixed status: 0.16.6

Evidence note: Layer: Host/developer tool. Verify current affected and fixed ranges before publication.

TypeScript SDK DNS rebinding advisory ↗

Model Context Protocol

Supports: HTTP SDK default-binding risk; stdio unaffected. Representative local HTTP SDK exposure and Origin/bind protection. DNS rebinding protection disabled by default for unauthenticated localhost HTTP servers; patched/fixed status: 1.24.0 Localhost HTTP mode can create remote website access without host/origin protection.

Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Python SDK DNS rebinding advisory ↗

Model Context Protocol

Supports: Python HTTP SDK default-binding risk. Representative Python SDK DNS-rebinding vulnerability. DNS rebinding protection disabled by default for localhost HTTP servers; patched/fixed status: 1.23.0 Local HTTP deployment security risk in Python SDK defaults.

Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Python FastMCP validation denial of service ↗

Model Context Protocol

Supports: SDK validation resource-exhaustion issue.

TypeScript UriTemplate ReDoS advisory ↗

Model Context Protocol

Supports: SDK parsing/regular-expression vulnerability.

Java SDK DNS rebinding advisory ↗

Model Context Protocol

Supports: Java SDK HTTP exposure hardening.

MCPTox: A Benchmark for Tool Poisoning Attacks ↗

Academic researchers

Supports: Academic evaluation of malicious MCP tool metadata and behavior.

Mind Your Server: A Systematic Study of MCP Security ↗

Academic researchers

Supports: Broader empirical MCP security analysis.

A2A: A new era of agent interoperability ↗

Google

Supports: Agent-to-agent protocol launch and complementary positioning to MCP. Google introduced A2A for agent interoperability and described it as complementary to MCP.

Evidence note: First-party documentation rechecked and normalized for research/8 on 2026-08-26; the checksum-preserved package URL remains available through the source map.

Linux Foundation launches the Agent2Agent Protocol project ↗

Linux Foundation

Supports: A2A governance transition. Formation of the Linux Foundation A2A project and initial supporting organizations.

Introducing the Agent Communication Protocol ↗

IBM

Supports: ACP as an agent-to-agent protocol, not an MCP substitute at the same layer.

Architecture 2026-07-28 ↗

Model Context Protocol

Supports: Current host, client, server definitions; one client per server; stateless per-request model. Current host, client, and server definitions; one host manages multiple clients; each client relates to one server; stateless per-request architecture. Current host/client/server roles, host mediation, stateless requests and isolation. Current host/client/server architecture and stateless per-request model. Host/client/server roles and stateless request architecture. Current host, client and server architecture and logical relationships. Core MCP defines hosts, clients and servers; gateways are composed intermediary deployments.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

MCP Architecture Guide ↗

Model Context Protocol

Supports: Conceptual architecture, data and transport layers, local and remote servers.

Tools ↗

Model Context Protocol

Supports: Tool discovery, schemas, invocation, result content, structured output, annotations and security rules. Current tool schemas, calls, results, annotations and state-handle guidance Current tool semantics, annotations, schemas, explicit handles and security considerations Tool discovery and invocation, host human-in-the-loop guidance, annotations, explicit handles and MRTR. Current tool discovery, schemas, annotations, results, structured content, MRTR, routing headers, caching and explicit state handles. Current tools, structured output, MRTR, routing headers, cache semantics and explicit state handles. Bounded tool discovery, invocation, schemas, structured output and explicit state handles. Current tool definitions and results that MCP Apps enriches. Tool schemas, annotations, calls, structured content and result behavior.

Resources ↗

Model Context Protocol

Supports: URI-identified resources, list/read/templates and subscriptions behavior. Current resource primitive Server-exposed resources, URI identification, list/read behavior and subscriptions. Current URI resources, list/read/templates, caching, HTTPS behavior and subscriptions/listen update model. Current resource list/read behavior, templates, caching and subscription events. URI-addressable resource discovery, reading, templates, caching and updates. Current resource semantics used to deliver UI resources. Resource URIs, listing, reading and current subscriptions.

MCP Prompts specification ↗

Model Context Protocol

Supports: Protocol-exposed prompt templates, arguments, list/get behavior and user control. Current prompt primitive Server-exposed prompt templates and host presentation. Current prompt list/get behavior, arguments, message content, user-control model, caching, MRTR and list-change subscriptions. Current prompt discovery, retrieval, caching and content behavior. Server-defined user-selected prompt templates. MCP prompts are server-defined, user-controlled templates that clients can list and retrieve. This corrects the package bibliography duplicate that pointed S029 at Extensions Overview while the article used S029 for prompt semantics.

Evidence note: First-party documentation rechecked and normalized for research/9 on 2026-08-26; the archive URL remains available through the package source map.

Elicitation ↗

Model Context Protocol

Supports: Server requests for user input, form and URL modes, restrictions on sensitive data. Current client-side elicitation through MRTR and host-controlled user interaction. Current elicitation via Multi Round-Trip Requests.

MCP Server Discovery ↗

Model Context Protocol

Supports: Mandatory server/discover implementation and optional client invocation for versions and capabilities. Optional sessionless capability and version discovery server/discover semantics, supported versions and capabilities, optional client use, self-reported identity caveat. server/discover semantics, server capabilities and supported versions. server/discover supported-version and capability advertisement. MCP 2026-07-28 servers MUST implement server/discover. A client may omit the preflight call, invoke another RPC directly, and handle an unsupported-version error. Modern server discovery before ordinary requests. server/discover reports supported revisions and capabilities without a protocol session.

Evidence note: First-party documentation rechecked and normalized for research/8 on 2026-08-26; the checksum-preserved package URL remains available through the source map. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Caching ↗

Model Context Protocol

Supports: Cache hints and scope for complete list/read/discovery results. Complete lists and resource reads carry cache lifetime and authorization scope.

Multi Round-Trip Requests ↗

Model Context Protocol

Supports: Current mechanism for additional client input without server-initiated JSON-RPC requests.

Base protocol overview ↗

Model Context Protocol

Supports: JSON-RPC messages, current statelessness, explicit state identifiers and authorization applicability. Current JSON-RPC base messages and request metadata JSON-RPC basis, current message directions, requests, responses, notifications and result types. JSON-RPC envelope, request/response/notification model, result types and error semantics. Current JSON-RPC envelopes, requests, responses, notifications, result types and error allocation.

Streamable HTTP ↗

Model Context Protocol

Supports: Current remote transport, one POST endpoint, optional request-scoped SSE, routing headers and security. Current single-endpoint HTTP behavior, removal of GET stream and protocol sessions, request-scoped SSE, Origin requirements. Current sessionless Streamable HTTP, request-scoped SSE, routing headers and cancellation behavior. Single POST endpoint, request-scoped SSE, no protocol sessions, routing headers, local HTTP security. Current independent POST requests, routing headers, validation and streaming.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

stdio transport ↗

Model Context Protocol

Supports: Local subprocess transport, newline-delimited JSON-RPC and stdout/stderr requirements. Local subprocess lifecycle, stdin/stdout framing, stderr logging, shutdown and restart behavior. Current stdio process and framing behavior. Subprocess lifecycle, newline-delimited JSON-RPC, stderr logging, cancellation, restart and compatibility.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Authorization ↗

Model Context Protocol

Supports: Current HTTP authorization framework, OAuth resource-server roles, protected resource metadata and resource indicators. Current HTTP authorization roles, metadata, issuer validation, Resource Indicators, token handling and CIMD preference Current authorization requirements, discovery, issuer validation, client identification and scope handling. OAuth resource-server model and current authorization requirements. Optional HTTP authorization, OAuth roles, CIMD, resource indicators and stdio credential guidance. Current remote authorization responsibilities, token validation and protected resources.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Security Best Practices ↗

Model Context Protocol

Supports: Confused deputy, token passthrough, SSRF, state handles, stdio proxy, redirect and issuer security. Layered security guidance, token handling and deployment risks Current official guidance on confused deputy, token passthrough, SSRF, local servers, state handles and OAuth URLs Current security guidance for untrusted content, tokens, local servers, URLs and state handles. Current MCP security guidance across transports, authorization and local server trust. Token passthrough, SSRF, local trust and authorization guidance.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Deprecated Features ↗

Model Context Protocol

Supports: Roots, sampling, logging, DCR and HTTP+SSE deprecation status and migration paths. HTTP+SSE and other features are deprecated rather than erased from history.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

MCP Apps ↗

Model Context Protocol

Supports: Interactive HTML interfaces, tool-linked UI resources, sandbox and host support variability. Server-provided interactive UI, sandboxing and host security boundary Current architecture, security model, supported clients, frameworks and use cases. App-only tool visibility, UI resources and host mediation.

Tasks ↗

Model Context Protocol

Supports: Durable asynchronous operations, task IDs, polling, input and cancellation semantics. Long-running task handles and lifecycle semantics Tasks moved from experimental core to an independently versioned extension. Optional durable task handles, polling, input, notifications and cancellation. Long-running Task lifecycle and methods.

Official SDKs for MCP 2026-07-28 ↗

Model Context Protocol

Supports: Current official SDK list and tier assignments. The current official SDK list and tier assignments; Rust is Tier 1 as checked on 2026-08-26.

Evidence note: First-party documentation rechecked and normalized for research/7 on 2026-08-26; the package URL remains available through the source map.

Language Server Extension Guide ↗

Microsoft

Supports: LSP client/server architecture and the M × N integration problem.

Developer mode and MCP apps in ChatGPT ↗

OpenAI

Supports: Current ChatGPT remote MCP limitations, local-server tunnel requirement and plan-dependent access. ChatGPT as a host with remote MCP connector support and MCP Apps; current availability and remote-only direct connection constraints. ChatGPT developer mode and MCP apps document MCP tool discovery and invocation; native resources or prompts UI is not inferred from this source. ChatGPT developer mode documents remote MCP tool discovery and invocation without declaring one exact MCP protocol revision. Current web availability, write actions, admin review, RBAC, frozen tool snapshots and limitations. ChatGPT connects directly to remote MCP servers; Secure MCP Tunnel for local/private/on-prem servers.

Evidence note: First-party product documentation rechecked and normalized on 2026-08-25; the package URL remains in the package source map. First-party product documentation rechecked and normalized on 2026-08-26; the package URL remains available through the package source map. First-party documentation rechecked and normalized for research/7 on 2026-08-26; the package URL remains available through the source map. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Add and manage MCP servers in VS Code ↗

Microsoft / Visual Studio Code

Supports: Current local/remote installation, trust, sandboxing, prompts/resources/apps and enterprise policy support. VS Code host/client support for tools, resources, prompts and MCP Apps; local and remote servers, trust and policy. Current MCP primitive, resource, prompt and app behavior in VS Code. VS Code local/remote server support and capability interfaces. VS Code local/remote configuration, trust prompts, local sandboxing and remote placement.

Evidence note: First-party product documentation rechecked and normalized on 2026-08-25; the package URL remains in the package source map. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

The Complete MCP Experience: Full Specification Support in VS Code ↗

Microsoft / Visual Studio Code

Supports: Official authorization, prompts, resources and sampling adoption. Official VS Code support for tools, prompts, resources, authorization and sampling.

Giving Agents a Visual Voice: MCP Apps Support in VS Code ↗

Microsoft / Visual Studio Code

Supports: Official MCP Apps host support. VS Code support, UI examples and Storybook case study.

MCP servers with Gemini CLI ↗

Google

Supports: Gemini CLI support for stdio, legacy SSE and Streamable HTTP, tools/resources/prompts, OAuth and confirmations. Gemini CLI local and remote MCP support and host permission flow. Current Gemini CLI support for tools, resources, prompts, resource references and slash commands. Gemini CLI MCP integration and capability support. Gemini CLI local command and remote HTTP/SSE configuration plus OAuth.

Evidence note: First-party product documentation rechecked and normalized on 2026-08-25; the package URL remains in the package source map. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Get started with custom connectors using remote MCP ↗

Anthropic

Supports: Claude custom remote MCP connector availability and trust cautions. Claude remote connector behavior and cloud-originated connections. Claude custom connectors connect to remote MCP servers for tool-based interactions and connected data; this source does not establish native host UI for every MCP primitive. Claude documents remote MCP custom connectors; this product documentation does not state one exact MCP protocol revision. Remote custom connector availability, interactive UI behavior and security warning. Remote connection origination, private network allowlisting and remote connector behavior.

Evidence note: First-party product documentation rechecked and normalized on 2026-08-26; the package URL remains available through the package source map. First-party documentation rechecked and normalized for research/7 on 2026-08-26; the package URL remains available through the source map. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Use connectors to extend Claude's capabilities ↗

Anthropic

Supports: Remote connectors connect from Anthropic cloud and product terminology differs from protocol roles.

TypeScript SDK cross-client data leak ↗

GitHub Advisory Database

Supports: Representative multi-client isolation implementation defect. Cross-client response data leakage when server/transport instances are reused; patched/fixed status: 1.26.0 Remote multi-user server implementations must isolate client and transport state.

Evidence note: Layer: SDK/multi-tenancy. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Creating helpful, reliable, people-first content ↗

Google Search Central

Supports: People-first, original, well-sourced content and no preferred word count. People-first, original, trustworthy content and authorship guidance People-first content, no preferred word count, authorship/process transparency and satisfying user intent. People-first, source-driven content guidance.

Google's guidance on generative AI content ↗

Google Search Central

Supports: Accuracy, quality, relevance and transparent production context.

Influencing your title links in search results ↗

Google Search Central

Supports: Descriptive, concise and consistent title/H1 recommendations. Descriptive concise titles, distinctive H1 and avoidance of keyword stuffing. Clear page-title guidance.

Introduction to structured data markup ↗

Google Search Central

Supports: Structured data implementation and validation guidance.

Article structured data ↗

Google Search Central

Supports: Article author, date, headline and image markup guidance. Article structured-data recommendations

Breadcrumb structured data ↗

Google Search Central

Supports: BreadcrumbList implementation and validation. BreadcrumbList markup guidance BreadcrumbList implementation and validation guidance. BreadcrumbList structured-data recommendations.

Changes to HowTo and FAQ rich results ↗

Google Search Central

Supports: FAQ rich results are generally restricted to authoritative government and health sites.

General structured data guidelines ↗

Google Search Central

Supports: JSON-LD recommendation, relevance, accuracy and no guarantee of rich-result display. Accurate visible structured data and no rich-result guarantee

Lifecycle 2025-03-26 ↗

Model Context Protocol

Supports: Initialization, protocol-version agreement, capability negotiation, initialized notification and session-era lifecycle semantics. Initialization, version and capability negotiation in March 2025 Stateful initialization and negotiated capabilities during the first Streamable HTTP era. Handshake-era lifecycle retained in March 2025.

Agent2Agent (A2A) Protocol Specification ↗

A2A Project

Supports: The A2A 1.0 specification defines agent discovery, messages, tasks, artifacts, versioning, security, and multiple protocol bindings.

Tools ↗

Model Context Protocol

Supports: Tool annotations and March 2025 tool semantics Tool annotations as descriptive hints rather than guarantees March-era tool annotations and tool semantics.

Lifecycle ↗

Model Context Protocol

Supports: June 2025 retained initialization and sessions Handshake/session lifecycle retained in June 2025.

Lifecycle ↗

Model Context Protocol

Supports: Last released initialization/session lifecycle before 2026 stateless core Last released handshake/session-era lifecycle before the 2026 revision. Last released initialize/session lifecycle before 2026.

Tools ↗

Model Context Protocol

Supports: November 2025 tool fields and taskSupport execution metadata One-year tool semantics before stateless revision.

One Year of MCP: November 2025 Spec Release ↗

Model Context Protocol

Supports: Official retrospective and Tasks explanation

Tool Annotations as Risk Vocabulary: What Hints Can and Can't Do ↗

Model Context Protocol

Supports: Annotations are untrusted hints, not enforcement or prompt-injection defenses

Extensions Overview ↗

Model Context Protocol

Supports: Extensions are separate from core protocol and version independently Extensions framework and independent versioning of optional capabilities.

MCP Tasks Extension Overview ↗

Model Context Protocol

Supports: Tasks are a separately versioned extension in the 2026 architecture

Protocol Versions ↗

Model Context Protocol Python SDK

Supports: Modern versus handshake-era compatibility model Default modern probe and fallback, legacy mode and version pins.

Client ↗

Model Context Protocol Python SDK

Supports: Local, remote and in-process client options Client connection forms: in-process, Streamable HTTP and stdio; client represents one server relationship.

Supporting protocol revision 2026-07-28 ↗

Model Context Protocol TypeScript SDK

Supports: Per-era codecs and current auth migration details SDK implementation notes for discovery, identity and MRTR. Current versus legacy protocol behavior and subscriptions/listen migration. Explicit opt-in details, codecs, subscriptions, cache fields and migration.

Function calling ↗

OpenAI

Supports: Current function definitions, tool loop, strict mode, tool choice and tool search

MCP and Connectors ↗

OpenAI

Supports: Remote MCP listing/calling, approvals and provider-hosted execution

OpenAI Agents SDK — Tools ↗

OpenAI

Supports: Function tools, hosted MCP tools, tool search, namespaces and execution options

Structured model outputs ↗

OpenAI

Supports: Distinction between constrained model output and external tool result structure

Handle tool calls ↗

Anthropic

Supports: Application tool execution and result-return loop

Tool search tool ↗

Anthropic

Supports: Deferred tool loading and large-catalog search

MCP connector in the Messages API ↗

Anthropic

Supports: Messages API connection to remote MCP servers The beta Messages API connector uses tools from public HTTPS remote MCP servers over Streamable HTTP or legacy SSE. The Anthropic Messages API MCP connector imports tools from remote MCP servers; it does not expose MCP resources or prompts. Messages API connector requires public remote HTTP and does not directly support local stdio.

Evidence note: First-party product documentation rechecked and normalized on 2026-08-25; the package URL remains in the package source map. First-party product documentation rechecked and normalized on 2026-08-26; the package URL remains available through the package source map. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Advanced tool use ↗

Anthropic

Supports: Tool search and large-catalog context/selection concerns

Function calling with the Gemini API ↗

Google

Supports: Gemini function declarations, developer execution, parallel/compositional calls and remote MCP

Thought signatures ↗

Google

Supports: Provider-specific continuity requirements around tool calls

What is OpenAPI? ↗

OpenAPI Initiative

Supports: OpenAPI as a machine-readable HTTP API description

OpenAPI Specification ↗

OpenAPI Initiative

Supports: Current OpenAPI versioned specifications

JSON Schema 2020-12 ↗

JSON Schema

Supports: Schema dialect used as current MCP default JSON Schema dialect used by current MCP tool schemas.

MCP vs Direct Function Calling: When to Use Which ↗

MCP Institute

Supports: Current SERP framing and comparison gaps

MCP vs. Function Calling ↗

Goodcall

Supports: Outdated HTTP+SSE framing in current results

MCP vs Function Calling: When to Use Each ↗

AI Agents Kit

Supports: Stateful-MCP comparison still appearing in results

MCP vs OpenAI Function Calling ↗

Tetrate

Supports: Persistent-session framing and search-intent coverage

Model Context Protocol vs. Function Calling: A Practical Comparison ↗

ClearPeaks

Supports: Example benchmark methodology and limits

Authorization 2025-11-25 ↗

Model Context Protocol

Supports: Late-2025 authorization semantics and registration options OIDC discovery, client metadata documents and incremental authorization. OIDC discovery, CIMD and late-2025 remote authorization model.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Model Context Protocol: Security Design Considerations for AI-Driven Automation ↗

NSA Artificial Intelligence Security Center

Supports: Government threat model and production recommendations; session-specific passages require version qualification

NSA Releases Security Design Considerations for AI-Driven Automation Leveraging MCP ↗

NSA

Supports: Release date, adoption context and continuum-of-security framing

OWASP MCP Top 10 ↗

OWASP Foundation

Supports: Community risk taxonomy; beta rather than final standard Community threat categorization.

Best Current Practice for OAuth 2.0 Security ↗

IETF

Supports: OAuth security best current practice OAuth security best current practice.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

OAuth 2.0 Authorization Server Issuer Identification ↗

IETF

Supports: Authorization-response issuer validation Issuer identification and mix-up mitigation. Issuer identification and mix-up defense.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

OAuth 2.0 Bearer Token Usage ↗

IETF

Supports: Bearer-token transmission and challenge rules Bearer-token handling and disclosure risks.

Evidence note: Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

OAuth 2.0 Dynamic Client Registration Protocol ↗

IETF

Supports: Historical DCR mechanism now deprecated by current MCP

WhatsApp MCP Exploited: Exfiltrating Your Message History via MCP ↗

Invariant Labs

Supports: Practical cross-server/rug-pull demonstration

A First Measurement Study on Authentication Security in Real-World Remote MCP Servers ↗

Zhou et al.

Supports: 7,973 live servers, authentication distribution, 119-server OAuth subset and nine CVEs; preprint with selection limits Empirical remote-server authentication study and methodological caveats.

Evidence note: Do not generalize OAuth flaw rates beyond the testable subset. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in MCP Servers ↗

VIPER-MCP authors

Supports: Large-scale repository audit; 106 confirmed findings and 67 CVEs as reported by authors

Evidence note: Preprint statistics require method and version qualification.

Model Context Protocol Threat Modeling and Analysis of Vulnerabilities to Prompt Injection with Tool Poisoning ↗

Huang et al.

Supports: STRIDE/DREAD model and seven-client tool-poisoning evaluation

MCP-38: A Comprehensive Threat Taxonomy for MCP Systems ↗

Shen, Toyoda and Leung

Supports: 38-category MCP threat taxonomy

Securing the Model Context Protocol: Defending LLMs Against Tool Poisoning and Adversarial Attacks ↗

Jamshidi et al.

Supports: Tool poisoning, shadowing, rug pulls and layered defense evaluation

MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP ↗

Li et al.

Supports: Implicit tool poisoning and adaptive attack study

ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP ↗

Liu et al.

Supports: Multi-tool threshold poisoning research

CASCADE: A Cascaded Hybrid Defense Architecture for Prompt Injection Detection in MCP-Based Systems ↗

Turgut and Gümüş

Supports: Prompt-injection detector evaluation and limitations

Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale ↗

Corvus study author

Supports: Dynamic audit of internet-facing servers; reported exposure and churn figures

Evidence note: Very recent preprint; preserve methodology caveats.

CVE-2025-53366: Validation error amplification / denial of service ↗

MCP Python SDK

Supports: Validation error amplification / denial of service; patched/fixed status: 1.9.4

Evidence note: Layer: SDK. Verify current affected and fixed ranges before publication.

CVE-2025-53365: Closed-resource handling denial of service ↗

MCP Python SDK

Supports: Closed-resource handling denial of service; patched/fixed status: 1.10.0

Evidence note: Layer: SDK. Verify current affected and fixed ranges before publication.

CVE-2026-34742: DNS rebinding protection gap for localhost HTTP servers ↗

MCP Go SDK

Supports: DNS rebinding protection gap for localhost HTTP servers; patched/fixed status: 1.4.0 Localhost HTTP servers require origin and host protections across SDKs.

Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

CVE-2026-35568: DNS rebinding protection gap for localhost HTTP servers ↗

MCP Java SDK

Supports: DNS rebinding protection gap for localhost HTTP servers; patched/fixed status: 1.0.0 Local HTTP is a network boundary even when bound near the user.

Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

CVE-2026-42559: DNS rebinding protection gap ↗

MCP Rust SDK

Supports: DNS rebinding protection gap; patched/fixed status: 1.4.0

Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication.

CVE-2026-63118: DNS rebinding protection gap ↗

MCP Ruby SDK

Supports: DNS rebinding protection gap; patched/fixed status: 0.23.0 Cross-SDK history of localhost HTTP rebinding issues.

Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

CVE-2026-67431: Protocol-session poisoning / state confusion in legacy session architecture ↗

MCP Ruby SDK

Supports: Protocol-session poisoning / state confusion in legacy session architecture; patched/fixed status: 0.23.0

Evidence note: Layer: SDK/session. Verify current affected and fixed ranges before publication.

CVE-2026-67430: Unbounded stdio message handling can exhaust resources ↗

MCP Ruby SDK

Supports: Unbounded stdio message handling can exhaust resources; patched/fixed status: 0.23.0 reported stdio is not risk-free; unbounded local message processing can exhaust resources.

Evidence note: Layer: SDK/stdio. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

CVE-2026-67432: Legacy session retention / cleanup flaw ↗

MCP Ruby SDK

Supports: Legacy session retention / cleanup flaw; patched/fixed status: 0.23.0 reported

Evidence note: Layer: SDK/session. Verify current affected and fixed ranges before publication.

CVE-2026-0621: UriTemplate regular-expression denial of service ↗

MCP TypeScript SDK

Supports: UriTemplate regular-expression denial of service; patched/fixed status: 1.25.2

Evidence note: Layer: SDK/parser. Verify current affected and fixed ranges before publication.

CVE-2025-68143: Repository path validation weakness ↗

MCP reference Git server

Supports: Repository path validation weakness; patched/fixed status: 2025.9.25 / server removed

Evidence note: Layer: Server implementation. Verify current affected and fixed ranges before publication.

CVE-2026-44430: Server-side request forgery in registry processing ↗

Official MCP Registry

Supports: Server-side request forgery in registry processing; patched/fixed status: 1.7.7

Evidence note: Layer: Registry. Verify current affected and fixed ranges before publication.

CVE-2026-44428: OIDC token replay / validation flaw ↗

Official MCP Registry

Supports: OIDC token replay / validation flaw; patched/fixed status: 1.7.6

Evidence note: Layer: Registry/auth. Verify current affected and fixed ranges before publication.

CVE-2026-44427: Open redirect ↗

Official MCP Registry

Supports: Open redirect; patched/fixed status: 1.7.5

Evidence note: Layer: Registry/web. Verify current affected and fixed ranges before publication.

GHSA-rqv2-m695-f8j4: Stored cross-site scripting ↗

Official MCP Registry

Supports: Stored cross-site scripting; patched/fixed status: LIVE-CHECK REQUIRED

Evidence note: Layer: Registry/web. Verify current affected and fixed ranges before publication.

GHSA-2v5f-5r6w-p67r: OCI verification fail-open behavior ↗

Official MCP Registry

Supports: OCI verification fail-open behavior; patched/fixed status: 1.7.9

Evidence note: Layer: Registry/supply chain. Verify current affected and fixed ranges before publication.

CVE-2025-9611: DNS rebinding against localhost HTTP mode ↗

Microsoft Playwright MCP

Supports: DNS rebinding against localhost HTTP mode; patched/fixed status: 0.0.40

Evidence note: Layer: Server/transport. Verify current affected and fixed ranges before publication.

CVE-2026-9739: DNS rebinding in legacy SSE/local deployment ↗

Google MCP Toolbox for Databases

Supports: DNS rebinding in legacy SSE/local deployment; patched/fixed status: 1.2.0

Evidence note: Layer: Server/transport. Verify current affected and fixed ranges before publication.

GHSA-jwj7-74jh-p5c4: DNS rebinding protection weakness ↗

CircleCI MCP Server

Supports: DNS rebinding protection weakness; patched/fixed status: 0.17.0

Evidence note: Layer: Server/transport. Verify current affected and fixed ranges before publication.

CVE-2026-23744: Remote command execution ↗

MCPJam Inspector

Supports: Remote command execution; patched/fixed status: 1.4.3

Evidence note: Layer: Host/developer tool. Verify current affected and fixed ranges before publication.

CVE-2026-27124: OAuth proxy callback missing consent binding; confused deputy ↗

FastMCP

Supports: OAuth proxy callback missing consent binding; confused deputy; patched/fixed status: 3.2.0

Evidence note: Layer: Framework/auth. Verify current affected and fixed ranges before publication.

CVE-2026-49257: Network service bound broadly without authentication ↗

mcp-pinot

Supports: Network service bound broadly without authentication; patched/fixed status: 3.1.0

Evidence note: Layer: Server/deployment. Verify current affected and fixed ranges before publication.

CVE-2026-47427: Nil-pointer denial of service ↗

GitHub MCP Server

Supports: Nil-pointer denial of service; patched/fixed status: 1.1.0

Evidence note: Layer: Server implementation. Verify current affected and fixed ranges before publication.

CVE-2026-48529: Lockdown mode cross-user authorization separation flaw ↗

GitHub MCP Server

Supports: Lockdown mode cross-user authorization separation flaw; patched/fixed status: 1.1.2

Evidence note: Layer: Server/authorization. Verify current affected and fixed ranges before publication.

CVE-2026-46519: Presentation-only authorization without server-side enforcement ↗

Kubernetes MCP Server

Supports: Presentation-only authorization without server-side enforcement; patched/fixed status: 3.6.0

Evidence note: Layer: Server/authorization. Verify current affected and fixed ranges before publication.

CVE-2026-55786: Unauthenticated command execution through MCP capability ↗

flyto-core

Supports: Unauthenticated command execution through MCP capability; patched/fixed status: 2.26.4

Evidence note: Layer: Server implementation. Verify current affected and fixed ranges before publication.

CVE-2026-11529: SQL injection through insufficient input handling ↗

MySQL MCP Server

Supports: SQL injection through insufficient input handling; patched/fixed status: 0.3.0

Evidence note: Layer: Server implementation. Verify current affected and fixed ranges before publication.

CVE-2026-5059: Command injection ↗

aws-mcp

Supports: Command injection; patched/fixed status: No patch listed when recorded

Evidence note: Layer: Server implementation. Verify current affected and fixed ranges before publication.

CVE-2026-47751: Malicious repository .mcp.json can execute configured server code ↗

Claude Code Action

Supports: Malicious repository .mcp.json can execute configured server code; patched/fixed status: 1.0.74 Project-provided MCP configuration can trigger local code execution.

Evidence note: Layer: Host/project config. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

CVE-2026-50143: Path/token authorization weakness ↗

Apify MCP Server

Supports: Path/token authorization weakness; patched/fixed status: 0.10.11

Evidence note: Layer: Server/authorization. Verify current affected and fixed ranges before publication.

CVE-2026-31944: OAuth callback binding/account-linking weakness ↗

LibreChat

Supports: OAuth callback binding/account-linking weakness; patched/fixed status: 0.8.3-rc1 reported

Evidence note: Layer: Host/auth. Verify current affected and fixed ranges before publication.

CVE-2026-32625: Environment-expanded MCP URL can expose secrets ↗

LibreChat

Supports: Environment-expanded MCP URL can expose secrets; patched/fixed status: 0.8.4-rc1 reported

Evidence note: Layer: Host/configuration. Verify current affected and fixed ranges before publication.

GHSA-pmw7-gqwj-f954: Attacker-controlled headers can expose tokens ↗

LibreChat

Supports: Attacker-controlled headers can expose tokens; patched/fixed status: >=0.8.3-rc2

Evidence note: Layer: Host/auth. Verify current affected and fixed ranges before publication.

CVE-2026-40159: Environment variables inherited by local MCP processes ↗

PraisonAI

Supports: Environment variables inherited by local MCP processes; patched/fixed status: 4.5.128 Local process launch can disclose inherited environment secrets.

Evidence note: Layer: Host/local process. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

CVE-2026-41497: Unsafe command parsing for MCP server configuration ↗

PraisonAI

Supports: Unsafe command parsing for MCP server configuration; patched/fixed status: Patched after 4.5.148

Evidence note: Layer: Host/local process. Verify current affected and fixed ranges before publication.

CVE-2026-57124: Unauthenticated remote MCP connect path ↗

PraisonAI

Supports: Unauthenticated remote MCP connect path; patched/fixed status: 4.6.59

Evidence note: Layer: Host/network. Verify current affected and fixed ranges before publication.

CVE-2026-47394: Arbitrary local file read through MCP integration ↗

PraisonAI

Supports: Arbitrary local file read through MCP integration; patched/fixed status: 4.6.40

Evidence note: Layer: Host/server. Verify current affected and fixed ranges before publication.

CVE-2026-33032: Unauthenticated MCP endpoint enabling administrative takeover ↗

Nginx UI MCP integration

Supports: Unauthenticated MCP endpoint enabling administrative takeover; patched/fixed status: 2.3.4 reported

Evidence note: Layer: Server/product integration. Verify current affected and fixed ranges before publication.

CVE-2025-6514: Command injection in remote-server launcher ↗

mcp-remote

Supports: Command injection in remote-server launcher; patched/fixed status: LIVE-CHECK REQUIRED A local proxy for remote MCP adds its own package and command-execution risk.

Evidence note: Layer: Launcher/supply chain. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

MALICIOUS-PACKAGE: Malicious npm package impersonating an official server and exfiltrating API keys ↗

Postmark MCP impersonator

Supports: Malicious npm package impersonating an official server and exfiltrating API keys; patched/fixed status: Remove package; use verified vendor source

Evidence note: Layer: Supply chain. Verify current affected and fixed ranges before publication.

CVE-2025-64109: Malicious project MCP configuration can trigger code execution ↗

Cursor

Supports: Malicious project MCP configuration can trigger code execution; patched/fixed status: 2025.09.17-25b418f Workspace MCP configuration is a local supply-chain/code-execution boundary.

Evidence note: Layer: Host/project config. Verify current affected and fixed ranges before publication. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

CVE-2025-68433: Malicious project MCP configuration can trigger code execution ↗

Zed

Supports: Malicious project MCP configuration can trigger code execution; patched/fixed status: 0.218.2-pre

Evidence note: Layer: Host/project config. Verify current affected and fixed ranges before publication.

CVE-2026-44118: Owner identity spoofing in MCP-connected workflow ↗

OpenClaw

Supports: Owner identity spoofing in MCP-connected workflow; patched/fixed status: 2026.4.22

Evidence note: Layer: Host/identity. Verify current affected and fixed ranges before publication.

Project Security Policy ↗

Model Context Protocol

Supports: Vulnerability reporting and scope

Specification Overview — MCP 2024-11-05 ↗

Model Context Protocol

Supports: Launch-era host, client and server roles and stateful capability-negotiated architecture. Original three primitives and launch-era architecture. Original stateful specification and launch-era capabilities.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

Base Protocol — MCP 2024-11-05 ↗

Model Context Protocol

Supports: Launch-era protocol layering and absence of the later core authorization framework.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

Architecture — MCP 2025-06-18 ↗

Model Context Protocol

Supports: Legacy architecture: host manages clients; each client maintains a stateful session with one server; isolation principles.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

TypeScript SDK v2 Documentation ↗

Model Context Protocol

Supports: Official TypeScript SDK v2 support for current MCP and examples of hosts connecting to servers. Official SDK support for implementing tools, resources and prompts under current protocol. Stable TypeScript line implementing 2026-07-28.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

TypeScript SDK Protocol Versions ↗

Model Context Protocol

Supports: Modern versus legacy protocol eras and automatic compatibility behavior. Legacy/modern era matrix, auto probing, pins and fallback. Modern probing, legacy fallback and dual-era behavior.

Evidence note: Normalized from the checksum-verified research/5 architecture package. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Ruby SDK Client Lifecycle ↗

Model Context Protocol

Supports: Official SDK handling of both legacy and current protocol eras.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

PHP SDK Client Connections ↗

Model Context Protocol

Supports: Current connection behavior without an initialization handshake.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

Java SDK Client Documentation ↗

Model Context Protocol

Supports: Official Java client implementation responsibilities and transports.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

Java SDK Server Documentation ↗

Model Context Protocol

Supports: Official Java server implementation responsibilities and capabilities.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

When to use desktop and web connectors ↗

Anthropic

Supports: Anthropic distinguishes local desktop extensions from cloud-brokered remote connectors across supported Claude surfaces. Remote versus desktop connector surfaces and mobile availability. Remote connector for cloud/SaaS and all surfaces; desktop extension for local files, localhost, OS access.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Connect Claude Code to tools via MCP ↗

Anthropic

Supports: Claude Code as an MCP host/client and optional MCP server through claude mcp serve. Claude Code documents MCP tools, resource references, and server prompts. Claude Code documents local and remote MCP configuration without publishing one exact protocol revision for every mode. Claude Code supports local stdio, remote HTTP/SSE and OAuth.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25. First-party product documentation rechecked and normalized on 2026-08-26; the package URL remains available through the package source map. First-party documentation rechecked and normalized for research/7 on 2026-08-26; the package URL remains available through the source map. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Getting started with local MCP servers on Claude Desktop ↗

Anthropic

Supports: Claude Desktop local server configuration and management.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.

Secure MCP Tunnel ↗

OpenAI

Supports: Supported private, on-premises, and developer-machine MCP servers can be exposed to ChatGPT through Secure MCP Tunnel.

Evidence note: Added during the 2026-08-25 first-party product-source review; not part of the byte-exact research/5 archive.

ChatGPT — Release Notes ↗

OpenAI

Supports: Initial ChatGPT custom connector support through remote MCP.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.

Visual Studio Code 1.99 Release Notes ↗

Microsoft

Supports: Initial VS Code MCP support in agent mode.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

The Coding Harness Behind GitHub Copilot in VS Code ↗

Microsoft

Supports: Agent harness responsibilities: context, model loop, tool calls and execution coordination.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.

Extending GitHub Copilot cloud agent with MCP ↗

GitHub

Supports: GitHub Copilot cloud agent can use tools from configured MCP servers, subject to its documented capability, authentication, and approval limitations. Coding-agent MCP feature and capability limitations.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.

Configuring MCP servers for GitHub Copilot cloud agent ↗

GitHub

Supports: GitHub documents how to configure MCP servers for GitHub Copilot cloud agent.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.

Use the GitHub MCP Server from Copilot Chat ↗

GitHub

Supports: Copilot Chat host/client behavior with a preconfigured GitHub MCP server and user approval.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

Adding MCP servers for GitHub Copilot CLI ↗

GitHub

Supports: Copilot CLI local and remote MCP server support.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.

Cursor Model Context Protocol documentation ↗

Cursor

Supports: Cursor as a host/client connecting to external MCP tools and data. Cursor documents local and remote MCP server configuration without stating one exact protocol revision. Cursor explicitly documents support for the MCP Apps extension and interactive UI views returned by MCP tools, with progressive enhancement for hosts that do not render Apps. Cursor stdio, SSE and Streamable HTTP support and deployment distinctions.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25. First-party documentation rechecked and normalized for research/7 on 2026-08-26; the package URL remains available through the source map. First-party documentation rechecked and normalized for research/9 on 2026-08-26; the archive URL remains available through the package source map. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Agent Host ↗

Microsoft

Supports: Microsoft Agent Host is a distinct AHP runtime or process and should not be confused with the MCP host role.

Evidence note: Added during the 2026-08-25 first-party product-source review; not part of the byte-exact research/5 archive.

Getting Started with Google MCP Servers ↗

Google

Supports: Gemini CLI registration and use of Google-hosted MCP servers.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

Zed Moves Toward Secure-by-Default: Introducing Worktree Trust ↗

Zed Industries

Supports: Zed host behavior around project trust and automatic MCP server execution.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

Tool Permissions in Zed ↗

Zed Industries

Supports: Host-level MCP tool allow, deny and confirm policy.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

Model Context Protocol in JetBrains AI Assistant ↗

JetBrains

Supports: JetBrains AI Assistant as MCP host/client; stdio, Streamable HTTP and legacy SSE support. Current JetBrains AI Assistant documentation centers on MCP tools. JetBrains host transports and capability support. JetBrains stdio, Streamable HTTP, legacy SSE and local Docker patterns.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

MCP Server ↗

JetBrains

Supports: JetBrains IDEs as MCP servers exposing IDE tools to external clients.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.

How JetBrains MCP Client and Server Options Differ ↗

JetBrains

Supports: Explicit distinction between JetBrains AI Assistant as client and the IDE as server.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

Agents ↗

JetBrains

Supports: JetBrains host can pass configured MCP tools to several agent implementations.

Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.

MCP Server vs Client ↗

Tricentis

Supports: Competitor page retaining initialize-based legacy architecture; used only for SERP gap analysis.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

MCP Architecture ↗

Stanza

Supports: Competitor page retaining initialization-centered architecture; used only for SERP gap analysis.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

MCP Glossary ↗

MCP Server Spot

Supports: Competitor glossary using legacy session terminology; used only for SERP gap analysis.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

SEO Guide for Web Developers ↗

Google Search Central

Supports: Unique title/meta, semantic HTML and DOM-accessible content.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

Ask Google to Recrawl Your URLs ↗

Google Search Central

Supports: URL Inspection, sitemap submission and no guarantee of immediate indexing.

Evidence note: Normalized from the checksum-verified research/5 architecture package.

Model Context Protocol in Cursor CLI ↗

Cursor

Supports: Cursor CLI is a distinct MCP-consuming surface that shares MCP configuration with the Cursor editor.

Evidence note: Added during the 2026-08-25 first-party product-source review; not part of the byte-exact research/5 archive.

Model Context Protocol in Zed ↗

Zed Industries

Supports: Zed documents current MCP server configuration and its host-side MCP integration. Zed documents MCP tools and prompts; support for other primitives is not inferred. Zed MCP host/client behavior. Zed documents both local and remote MCP servers and a standard OAuth flow for remote servers when no Authorization header is configured.

Evidence note: Added during the 2026-08-25 first-party product-source review; not part of the byte-exact research/5 archive. First-party product documentation rechecked and normalized on 2026-08-26; the package URL remains available through the package source map. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Worktree Trust ↗

Zed Industries

Supports: Restricted Mode blocks project-configured language and MCP servers until trust; globally configured servers are outside that gate.

Evidence note: Added during the 2026-08-25 first-party product-source review; not part of the byte-exact research/5 archive.

Resources — MCP 2025-03-26 ↗

Model Context Protocol

Supports: March-era resources and direct subscription behavior.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Prompts — MCP 2025-03-26 ↗

Model Context Protocol

Supports: March-era prompt messages and audio-capable content.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Resources — MCP 2025-06-18 ↗

Model Context Protocol

Supports: June-era resource fields and subscription behavior.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Prompts — MCP 2025-06-18 ↗

Model Context Protocol

Supports: June-era prompt titles and content model.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Resources — MCP 2025-11-25 ↗

Model Context Protocol

Supports: One-year resource semantics before subscription redesign.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Prompts — MCP 2025-11-25 ↗

Model Context Protocol

Supports: One-year prompt semantics before stateless revision.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Python SDK Documentation ↗

Model Context Protocol

Supports: Official Python SDK decorators and server abstractions.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Python SDK Tools ↗

Model Context Protocol

Supports: Python tool-definition and invocation concepts.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Python SDK Resources ↗

Model Context Protocol

Supports: Python resource and template implementation concepts.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Python SDK Prompts ↗

Model Context Protocol

Supports: Prompt templates are selected by a person at the host; prompt implementation examples.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Ruby SDK Pagination ↗

Model Context Protocol

Supports: Pagination helpers for tools, resources, resource templates and prompts.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

MCP Inspector Documentation ↗

Model Context Protocol

Supports: Inspector tabs and testing behavior for resources, prompts and tools. The MCP Inspector is a developer test surface; its support does not establish product-host compatibility.

Evidence note: Normalized from the checksum-verified research/6 primitive package. First-party documentation rechecked and normalized for research/7 on 2026-08-26; the package URL remains available through the source map.

MCP Inspector Repository ↗

Model Context Protocol

Supports: Inspector CLI methods and support for listing/calling all three primitives.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Reference Servers README ↗

Model Context Protocol

Supports: Bounded list of maintained reference servers and reference-not-production caveat.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Reference Servers Tree ↗

Model Context Protocol

Supports: Frozen repository source tree used for primitive inventory.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Everything Reference Server README ↗

Model Context Protocol

Supports: Everything server implements tools, resources and prompts.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Fetch Reference Server README ↗

Model Context Protocol

Supports: Fetch reference server exposes a fetch tool and user-selected fetch prompt.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Memory Reference Server README ↗

Model Context Protocol

Supports: Memory server exposes tools plus a knowledge-graph resource and update notifications.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Filesystem Reference Server README ↗

Model Context Protocol

Supports: Filesystem reference server is tool-oriented and demonstrates embedded-resource tool results.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Git Reference Server README ↗

Model Context Protocol

Supports: Git reference server exposes repository operations as tools.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Sequential Thinking Reference Server README ↗

Model Context Protocol

Supports: Sequential Thinking exposes one MCP tool.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Cursor MCP Documentation ↗

Cursor

Supports: Current documented Cursor primitive-support table and MCP behavior.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

Tools vs Resources vs Prompts in MCP ↗

MCP Academy

Supports: Representative exact-match competitor and continued use of resources/subscribe.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

MCP Tools vs Resources vs Prompts ↗

RapidDev

Supports: Representative concise competitor, control-model framing and host-support caveat.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

MCP Tools vs Resources vs Prompts: Which to Use ↗

MCPOrbit

Supports: Representative exact-match competitor and practical rule-of-thumb framing.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

RFC 3986 — Uniform Resource Identifier ↗

IETF

Supports: URI terminology and identity model.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

RFC 6570 — URI Template ↗

IETF

Supports: URI-template syntax underlying resource-template concepts.

Evidence note: Normalized from the checksum-verified research/6 primitive package.

GitHub release 2026-07-28 ↗

Model Context Protocol

Supports: Stable release timestamp and tag.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

GitHub release 2026-07-28-RC ↗

Model Context Protocol

Supports: RC release timestamp and prerelease status.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

SEP-2596: Specification Feature Lifecycle and Deprecation Policy ↗

Model Context Protocol

Supports: Active, Deprecated and Removed states; minimum deprecation window.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

SEP-2567: Sessionless MCP ↗

Model Context Protocol

Supports: Design rationale for removing protocol sessions and Mcp-Session-Id.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

SEP-2322: Multi Round-Trip Requests ↗

Model Context Protocol

Supports: Replacement for server-initiated request flows in the stateless era. Replacement of server-initiated request patterns with retryable input-required results.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

SEP-2133: Extensions ↗

Model Context Protocol

Supports: SEP-2133 establishes the MCP extensions framework and Extensions Track governance; the package URL was corrected from a retired slug. SEP-2133 establishes the MCP extensions framework and Extensions Track governance; the package URL used a retired slug.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package; first-party documentation rechecked and corrected on 2026-08-26. First-party documentation rechecked and normalized for research/8 on 2026-08-26; the checksum-preserved package URL remains available through the source map.

Registry Versioning ↗

Model Context Protocol

Supports: Server package versions are distinct from protocol revisions; published versions are immutable.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

Transports — MCP 2025-06-18 ↗

Model Context Protocol

Supports: Sessionful Streamable HTTP and protocol-version header behavior. Mid-2025 Streamable HTTP transport, sessions and version header.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

Transports — MCP 2025-11-25 ↗

Model Context Protocol

Supports: Last released sessionful Streamable HTTP before 2026. Last handshake-era transport semantics before the 2026 architecture.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package. Research/10 source metadata comes from build_context.sources; its separate 78-row evidence_manifest uses an incompatible archive-only ID namespace.

TypeScript SDK v1-to-v2 Migration ↗

Model Context Protocol

Supports: Distinction between SDK major upgrade and protocol-revision adoption.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

Python SDK Serving Legacy Clients ↗

Model Context Protocol

Supports: One application serving both eras and operational cost of legacy sessions.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

Python SDK v2.0.0 release ↗

Model Context Protocol

Supports: The immutable Python SDK v2.0.0 release documents 2026-07-28 support and dual-era serving.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package; first-party documentation rechecked and corrected on 2026-08-26.

Go SDK Version Compatibility ↗

Model Context Protocol

Supports: Exact Go SDK-to-protocol compatibility table.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

Go SDK v1.7.0 release ↗

Model Context Protocol

Supports: The immutable Go SDK v1.7.0 release documents 2026-07-28 support and backward compatibility.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package; first-party documentation rechecked and corrected on 2026-08-26.

C# SDK documentation ↗

Model Context Protocol

Supports: Current C# SDK implementation documentation.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

Java SDK v2.0.0 release ↗

Model Context Protocol

Supports: The immutable Java SDK v2.0.0 release anchors the package compatibility snapshot; current support still requires a live check.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package; first-party documentation rechecked and corrected on 2026-08-26.

Java SDK issue #1072: 2026-07-28 support ↗

Model Context Protocol

Supports: Current implementation gap for server/discover and 2026 revision.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

Rust SDK rmcp-v3.0.0 release ↗

Model Context Protocol

Supports: The immutable rmcp-v3.0.0 release documents 2026-07-28 support; the current official SDK table now classifies Rust as Tier 1.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package; first-party documentation rechecked and corrected on 2026-08-26.

Ruby SDK Protocol Versions ↗

Model Context Protocol

Supports: All five revisions, auto probing and legacy fallback.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

Ruby SDK Tier 1 assessment request ↗

Model Context Protocol

Supports: Evidence of current support claims while official tier remained Tier 2.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

PHP SDK Protocol Versions ↗

Model Context Protocol

Supports: Dual-era behavior documented by PHP SDK.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

PHP SDK Tier Status ↗

Model Context Protocol

Supports: Current Tier 3 assessment and limitations.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

Semantic Versioning 2.0.0 ↗

Semantic Versioning

Supports: Contrast between SemVer software releases and MCP date-based protocol revisions.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

Specification releases ↗

Model Context Protocol

Supports: Canonical release tags, RCs, stable dates and release notes.

Evidence note: Normalized from the checksum-verified research/7 protocol-version package.

A2A Protocol Home ↗

A2A Protocol

Supports: Current project overview; A2A is agent-to-agent and complementary to MCP.

Evidence note: Normalized from the checksum-verified research/8 MCP-versus-A2A package.

A2A Protocol Ships v1.0: Production-Ready Standard for Agent-to-Agent Communication ↗

A2A Protocol

Supports: First stable production-ready A2A release; multiple bindings, signed Agent Cards, multi-tenancy and explicit complementarity with MCP.

Evidence note: Normalized from the checksum-verified research/8 MCP-versus-A2A package.

A2A Protocol Specification — stable 1.0 line ↗

A2A Protocol

Supports: Normative A2A operations, data model, bindings, security, discovery, Tasks, Messages, Artifacts, and versioning. The current A2A website labels the released protocol as 1.0.0, the specification repository lists v1.0.1 as its latest patch tag, and wire compatibility is negotiated as major.minor 1.0 rather than by patch. Agent-to-agent identity, Tasks and delegation.

Evidence note: Normalized from the checksum-verified research/8 MCP-versus-A2A package; first-party documentation rechecked and corrected on 2026-08-26.

A2A and MCP: Detailed Comparison ↗

A2A Protocol

Supports: Official distinction between tool/resource integration and inter-agent collaboration; combined architecture.

Evidence note: Normalized from the checksum-verified research/8 MCP-versus-A2A package.

Core Concepts ↗

A2A Protocol

Supports: Definitions of client agent, remote agent, Message, Task, Artifact, Part, context and security model.

Evidence note: Normalized from the checksum-verified research/8 MCP-versus-A2A package.

Agent Discovery ↗

A2A Protocol

Supports: Agent Cards, well-known discovery, direct configuration, registries, authenticated extended cards, caching and security.

Evidence note: Normalized from the checksum-verified research/8 MCP-versus-A2A package.

Life of a Task ↗

A2A Protocol

Supports: Task-versus-Message response, task lifecycle, terminal and interrupted states, contextId and multi-turn behavior.

Evidence note: Normalized from the checksum-verified research/8 MCP-versus-A2A package.

Streaming and Asynchronous Operations ↗

A2A Protocol

Supports: Polling, SSE streaming, task subscription and push-notification delivery.

Evidence note: Normalized from the checksum-verified research/8 MCP-versus-A2A package.

Enterprise Features ↗

A2A Protocol