MCP Core Maintainer Meeting (SDK edition) - Jun 10, 2026

Attendees

• David Soria Parra (@dsp-ant)
• Paul Carleton (@pcarleton)
• Felix Weinberger (@felixweinberger)
• Max Isbey (@maxisbey)
• Stefano Ortolani [Broadcom]
• Stephen Halter (@halter73)
• Kurtis Van Gent (@kurtisvg)
• Clare Liguori (@clareliguori)
• Caitie McCaffrey (@CaitieM20)
• Mike Kistler (@mikekistler)
• Sam Morrow (@SamMorrowDrums)
• Nick Cooper (@nickcoai)
• Jeremiah Lowin (@jlowin)
• Guglielmo Colombo (Google)
• Peter Alexander (@pja-ant)

Thank you to all SDK maintainers for attending the call and providing feedback!

Topics

Server info in stateless responses (Stefano, Broadcom)

• Use case: needs server name + version in _meta on every server response so network-level tooling can identify servers without the old handshake
• Pushback: spoofable, not a real identity signal, traditional vuln scanning is the right tool
• Counter: infra works with what's on the wire (same as user-agent); enterprise on-prem servers can't be inferred from domain
• Outcome: parked; follow up with Paul + security folks on Discord

Breaking schema changes (Max)

• First non-additive spec rev: newly required fields (e.g. resultType) mean a naive new-schema client breaks deserializing old-server responses
• Python/TS plan: per-spec-version type modules unioned together, serialize per negotiated version
• C# and Go already decouple wire types from user-facing types, so less exposed
• Separate nit: stale comment says resultType optional when it's now required (Caitie: just a leftover bug)

Header-promoted tool params (Max/Mike/Kurtis)

• New: tools can mark params as must-be-in-header; breaks "list tools, hand to LLM, fire call" flow because client now needs to retain the original schema annotations
• Motivation (Kurtis): data-residency/GDPR routing without parsing the body; would be used on nearly every regionalized Google MCP server
• C# approach: register API for prior schema knowledge, warn if missing, fall back to retry-after-error per spec
• Outcome: taken offline; ergonomics concern noted

subscriptions/listen has no response object

• First request-with-no-response in the protocol; awkward for SDK machinery
• Decision: add an empty ack response. No objections from C# or Go.

Step-up auth in SDKs (Sam Morrow)

• Still basically no SDK implementations; GitHub does it via custom middleware in front of the SDK
• Opinionated PR opened against TypeScript SDK (shared with Felix)
• Stephen: hesitant due to provider-specific quirks, but spec is now standardized enough; willing to invest if there's a broad push. Needs real testing against Entra/Okta/WorkOS. C# also has the "headers already flushed by the time you're in handler" problem.
• We'll need to experiment here to see what we can do with different providers and have reference implementations.

JSON-RPC error code collisions (Felix)

• New protocol-defined error codes landed in the implementation-reserved range; existing SDKs (incl. Go) already use some of those codes
• Kurtis: SDKs picking their own codes defeats the point; need a canonical enumerated list + a general fallback code
• Action: Felix is DRI. Survey tier-1 SDK error code usage, schedule a session next week, attempt to land the agreed list in this spec version.

URL-mode elicitation complete notification (Felix/Caitie)

• Out-of-band, optional, didn't get full MRTR treatment
• Caitie: client can't rely on it (optional), retry can arrive before the URL data anyway, server has to block/retry regardless; with MRTR the result lands in the retried tool call response
• Decision: remove the notification

SSE keep-alive now that ping is gone (Felix)

• subscriptions/listen is long-lived; common idle timeouts ~2 min (Cloudflare), ~4 min hard cap (Azure)
• TCP keep-alive isn't usable at the app layer; de-facto SSE pattern is :\r\n comment lines
• Decision: add a non-normative note in the HTTP transport doc recommending the comment-line keep-alive; clients must not choke on SSE comments

logging/setLevel deprecation wording (Go SDK)

• SEP-2577 says "fully functional" but it's actually replaced (level now sent in-request)
• Flagged as not matching our own stated deprecation lifecycle
• Likely OK because the feature is there, just in a different shape

7/28 release readiness (DSP)

• C#: comfortable; shipping 1.x and 2.x simultaneously, 2.x defaults to 7/28. Simple servers are turn-key; experimental tasks users will need rewrites.
• Go: beta by end of June, stable by end of July, aiming for full backward compat
• All four Tier 1 SDKs plan 7/28 protocol as the default.

Launch-day client probing

• New clients will fail their first request against not-yet-upgraded servers (negotiation-by-failure)
• Need to test top ~50 servers don't fall over, and document the expected failure pattern

Python upper-cap problem (Max)

• ~84% of top Python dependents on mcp have no upper version pin; a V2 release could break them on update

Cross-SDK conformance (Jeremiah)

• Asked for canonical shared tests across SDKs
• Conformance suite exists; alpha-2 with stateless + sessionless is coming; all new SEPs now require conformance tests
• Separately: Python/TS building a spec-language-derived unit test suite that could generalize across SDKs (not for this release)

Actions

• @felixweinberger: survey tier-1 SDK error codes, set up alignment meeting next week, target this spec version
• Follow up with @pcarleton + security on Broadcom server-info ask
• Add empty response to subscriptions/listen (@kurtisvg)
• Remove notifications/elicitation/complete notification (@pja-ant)
• Add SSE keep-alive note to HTTP transport doc (@kurtisvg)
• Fix stale resultType optional comment (@CaitieM20)
• Offline: header-promotion client ergonomics discussion (@kurtisvg)
• Test top servers for graceful negotiation-by-failure before 7/28 (@localden @pcarleton @pja-ant)