Tag: mcp

MCP is a JSON-RPC protocol that lets any AI host call tools, read resources and use prompts from any server, the way LSP did for language support. Here is how it works on the wire under revision 2026-07-28, captured from a real server, and why VS Code, Visual Studio, JetBrains, Xcode, Zed and Cursor all converged on it.

Every agent request pays for its system prompt, the provider's hidden tool-use preamble, and every tool schema before the user says anything. How to measure that fixed cost with differential count_tokens calls on the Anthropic API, the input_tokens endpoint on OpenAI, an MCP listTools probe, and /context in Claude Code, anchored to claude-opus-5-5, claude-sonnet-5, and @modelcontextprotocol/client 2.1.0.

Scoping a token does not stop a prompt-injected agent from leaking it. Moving the token out of the agent's process does. Three working setups: a 50-line gateway any agent can call, Claude Code 2.1.199+ sandbox masking with injectHosts, and Claude Managed Agents vaults, plus the measured leak that host-level injection still allows.

Move a local stdio MCP server to a remote Streamable HTTP server behind OAuth on MCP spec 2026-07-28 and TypeScript SDK 2.0.0. Dynamic Client Registration is now deprecated, so use Client ID Metadata Documents first and keep DCR only as a fallback. Covers the steps, a measured CIMD/DCR test matrix, and the misleading error you get when the two sides disagree.

Your MCP URL 307/308-redirects to another host, the client follows it, the Authorization header is stripped, and the target answers 401. Register the final URL.

OAuth succeeded but every MCP call gets 401 invalid_token? Make the PRM resource, the token's aud and your validator agree on one canonical server URL.

The agent-framework-hosting packages are conversion helpers, not a runtime. One Agent instance, one AgentState, and three thin adapters give you a Telegram bot, an A2A peer, and an MCP tool from the same process. Here is the wiring, the per-channel session-ID policy, and the four things each channel refuses to do.

Until now the only way to hand every developer the same MCP servers was managed-mcp.json, a file at a system path that takes exclusive control of MCP. Claude Code 2.1.259 adds a managedMcpServers setting for HTTP and SSE servers, and quietly narrows what allowedMcpServers governs.

Defensive system prompts are heuristic. Information-flow control is not: label every piece of content with integrity and confidentiality, propagate most-restrictive-wins through every tool call, and check the label at the sink before it runs. An 80-line runnable harness, the Agent Framework FIDES implementation, and the false positives the pattern buys you.

ModelContextProtocol 2.0.0 flipped HTTP transport to stateless by default, which is the one change that can drop every client still speaking 2025-11-25. HttpServerSessionMode.StatefulForInitializeClients in 2.2.0 serves both revisions on one endpoint. Here is the ordered upgrade, the ten breaking changes that matter, and the discover-probe bug that only a 2.1.0 client fixes.