MCP concepts

A stable MCP authorization extension that lets an organization's identity provider decide which MCP servers its users can reach. The client obtains an Identity Assertion JWT Authorization Grant (ID-JAG) from the IdP during single sign-on and exchanges it for an access token at the MCP server's authorization server, so the user never sees a per-server consent screen.

The extension that lets a tool return an interactive HTML interface rendered inside the chat: the tool description points at a ui:// resource, the host renders it in a sandboxed iframe, and app and host speak a JSON-RPC dialect over postMessage with bidirectional data flow.

The 2026-07-28 requirement (SEP-2243) that streamable HTTP POST requests carry standard MCP headers - Mcp-Method and Mcp-Name, alongside Mcp-Protocol-Version - so proxies and gateways can route, filter, and observe MCP traffic without parsing JSON-RPC bodies. Tool parameters can also surface as custom headers via x-mcp-header.

The 2026-07-28 pattern that replaces server-initiated requests (elicitation/create, sampling/createMessage, roots/list): when a request needs more input mid-call, the server returns a result with resultType "input_required" carrying the requests it needs answered, and the client retries the original call with the answers attached in inputResponses.

The three-tier classification for MCP SDKs: Tier 1 requires 100% conformance-test pass rate and same-release protocol support, Tier 2 requires 80% conformance and six-month feature timelines, Tier 3 is experimental. Advancement runs through self-assessment, conformance testing, and SDK Working Group approval.

The mandatory discovery RPC introduced in 2026-07-28 (SEP-2575): servers advertise their supported protocol versions, capabilities, and identity, and clients may call it before any other request for up-front version selection or as a backward-compatibility probe on stdio. It replaces the removed initialize handshake.

The 2026-07-28 revision's redesign of MCP from a bidirectional stateful protocol into a request/response stateless one: the initialize handshake and protocol-level session are removed, every request carries its protocol version, client identity, and capabilities in _meta, and any request can land on any server instance behind a plain load balancer.

MCP's HTTP transport, introduced in the 2025-03-26 revision as the replacement for the original HTTP+SSE transport. A single endpoint accepts JSON-RPC POST requests; since 2026-07-28, requests must carry the Mcp-Method and Mcp-Name headers for header-based routing, and the legacy HTTP+SSE transport is formally deprecated.

The 2026-07-28 replacement (SEP-2575) for the HTTP GET notification stream and resources/subscribe: one long-lived POST-response stream where clients opt in to specific change types (toolsListChanged, promptsListChanged, resourcesListChanged, resourceSubscriptions) and servers tag notifications with a subscription id.

The official extension (io.modelcontextprotocol/tasks, SEP-2663) that moved experimental long-running tasks out of the 2026-07-28 core: servers may return task handles unsolicited, clients poll with tasks/get and send input with tasks/update, and the blocking tasks/result method and tasks/list are gone.

An indirect prompt injection attack against MCP-connected agents: a malicious server returns tool descriptions or tool responses containing hidden instructions, which the model treats as trusted context and may follow - calling restricted tools, leaking data, or bypassing its system prompt. OWASP documents the root cause as a trust gap between connect-time review and unvalidated runtime responses.