Part of #5743 (Workstream C: 2026-07-28 stateless readiness).
Work
Teach the MCP parser middleware (pkg/mcp/parser.go) and the authz/audit/telemetry consumers the 2026-07-28 vocabulary, so policy and audit aren't blind to the new protocol:
- New methods:
server/discover, subscriptions/listen, tasks/update (extension).
- Removed methods to stop expecting:
initialize, ping, logging/setLevel, resources/subscribe/unsubscribe, notifications/roots/list_changed, notifications/elicitation/complete.
- MRTR shapes: results with required
resultType (complete / input_required), inputRequests/inputResponses — server→client asks now live inside responses, which authz/audit should see.
_meta protocol fields: io.modelcontextprotocol/protocolVersion, clientInfo, clientCapabilities, subscriptionId, logLevel, task refs.Mcp-Method/Mcp-Name request headers (required in 2026-07-28): these give middleware the method and tool/resource name without body parsing — a significant simplification/perf win for the whole chain; validate against the body (-32020 HeaderMismatch).- Error-code renumbering: MCP range
-32020..-32099; resource-not-found -32002 → -32602 (audit/response parsing).
Depends on: the go-sdk v1.7 adoption issue for wire shapes; header handling can start from the RC schema now.
Part of #5743 (Workstream C: 2026-07-28 stateless readiness).
Work
Teach the MCP parser middleware (
pkg/mcp/parser.go) and the authz/audit/telemetry consumers the 2026-07-28 vocabulary, so policy and audit aren't blind to the new protocol:server/discover,subscriptions/listen,tasks/update(extension).initialize,ping,logging/setLevel,resources/subscribe/unsubscribe,notifications/roots/list_changed,notifications/elicitation/complete.resultType(complete/input_required),inputRequests/inputResponses— server→client asks now live inside responses, which authz/audit should see._metaprotocol fields:io.modelcontextprotocol/protocolVersion,clientInfo,clientCapabilities,subscriptionId,logLevel, task refs.Mcp-Method/Mcp-Namerequest headers (required in 2026-07-28): these give middleware the method and tool/resource name without body parsing — a significant simplification/perf win for the whole chain; validate against the body (-32020 HeaderMismatch).-32020..-32099; resource-not-found-32002→-32602(audit/response parsing).Depends on: the go-sdk v1.7 adoption issue for wire shapes; header handling can start from the RC schema now.