mcp

A server that vanished from /mcp with no error is almost always an allowlist. Run claude mcp add on the same server: the add path prints the reason the load path swallows.

MCP9005 is advisory, but MCP9004 crashes at startup and stateless mode makes SampleAsync throw. Here is what each diagnostic means and how to fix it properly.

MCP error -32022 means your client opened at 2025-11-25 but the server only serves 2026-07-28. Make one side dual-era instead of pinning a version.

Stop shipping SKILL.md folders inside every agent deployment. Serve them from an MCP server and pull them with UseMcpSkills on Microsoft.Agents.AI.Mcp 1.18. Includes the exact skill://index.json shape, a working C# server, the wire trace, and the SEP-2640 drift that will bite you.

Claude Code and GitHub Copilot both ship allowedMcpServers and deniedMcpServers, but the matchers behave differently. serverName is a fallback that a single serverCommand entry silently disables, deny is a union while allow is not, and an invalid allowlist locks everything out.

Agent Plugins 1.0 says plugin.json at the root and mcp.json beside it. Claude Code 2.1.x wants .claude-plugin/plugin.json and .mcp.json. Here is what each client actually loads, tested against a real plugin, and the dual-layout directory that satisfies both.

MCP 2026-07-28 mirrors the JSON-RPC method and target name into HTTP headers so a gateway can route, throttle, and audit without parsing the body. Here is a working gateway, plus the header-body agreement rule that will bite you.

A write tool that asks before it writes needs three things the MCP SDK does not give you: an approval bound to the exact diff, a precondition on the file it previewed, and an integrity-protected requestState. Verified end to end on @modelcontextprotocol/server 2.0.0 against protocol revision 2026-07-28, including the argument-swap that gets past a naive confirm.

Mapping 200 internal REST endpoints to 200 MCP tools puts 200 KB of JSON schema in front of every request. The 2026-07-28 spec also made the usual escape hatch illegal: tools/list MUST NOT vary per-connection, so per-session dynamic registration is gone. Here are the three levers that still work, with measured wire sizes and verified code on @modelcontextprotocol/server 2.0.0.

The GitHub, Postgres, and Slack MCP servers from modelcontextprotocol/servers were archived in 2025 and their npm packages are deprecated. They pin SDK 1.0.1, which cannot negotiate past protocol 2024-11-05. Here is the audit script, the current replacement for each, and the two pointers in the archive README that are themselves stale.