MCP 2026-07-28 compliance

Find out exactly what's wrong with your MCP server.

createmcps.com is a free tool that checks whether your Model Context Protocol server conforms to the 2026-07-28 specification — the largest revision since MCP launched. Paste a server URL and get a graded, permalinked report that names each violation, quotes the exact spec requirement, and shows the fix.

Validate a server Read the migration guide

Example reportmcp.example.com

1 fail · 1 warn · 91% coverage

spec 2026-07-28 · ruleset 1.4.2

MCP-STL-001pass
MCP-HDR-003fail
MCP-CAC-002pass
MCP-AUT-005warn
MCP-SEC-001pass

Why now

Why this matters right now

MCP shipped its 2026-07-28 specification revision — the largest since the protocol launched. Every server built before it either needs migrating or needs to consciously decide not to.

breaking changes in the largest MCP revision to date

Change	Impact
Stateless core	Protocol-level sessions removed. Mcp-Session-Id and the initialize handshake are gone.
New required headers	Mcp-Method required on every request. Mcp-Name required on tools/call, resources/read, prompts/get.
Caching metadata	tools/list, prompts/list, resources/list, resources/read, resources/templates/list now carry ttlMs and cacheScope.
Auth hardening	Authorization servers should return iss per RFC 9207; clients must validate it before redeeming a code.
Extensions framework	Tasks moved out of core into an official extension. MCP Apps adds interactive UI elements.
Deprecation policy	A formal policy now exists — a minimum 12-month deprecation window for every future change.

Last verified: 8 August 2026, against the live spec — see the full rule catalog.

What it does

What createmcps.com actually checks

79 rules against the 2026-07-28 specification. 75 of them link to the exact sentence of the spec they come from — no vague “non-compliant” verdicts.

See all 79 rules →

Discovery & capabilities
Required headers
Statelessness
Caching metadata
Authorization
Deprecated & registry

How it works

Paste a URL. Get a graded report.

1Paste your server's URL
2We run read-only protocol probes — never a real tool call, never a real resource read
3Get a permalinked report: grade, specific findings, exact fix

Probes run inside an SSRF-safe sandbox with a pinned, IP-validated connection — see how we identify ourselves.

$ createmcps validate mcp.example.com

→ admission control: OK, resolved to 203.0.113.10

→ POST /mcp server/discover

200 OK era: modern

→ POST /mcp tools/list

✗ MCP-CAC-001 ttlMs missing

grade: D coverage: 91%

Grading

How grading works

A simple, published, versioned rubric — one you can argue with, not a black box. Any security-relevant fail caps the grade at D, and a fail we only detected heuristically bumps the overall grade up one level — an inference-based check alone won't tank a compliant server's grade.

A0 fails, 0 warns, coverage ≥ 80%
B0 fails, ≤ 3 warns
C0 fails, > 3 warns
D1–2 fails
F≥ 3 fails

Positioning

FastMCP, xmcp, and the official SDK are great. They don't do this.

Tool	What it does	Gap it leaves
Official SDK	Low-level control	Heavy boilerplate
FastMCP	High-level framework	No validation, hosting, or publishing
xmcp	Scaffolding	Nothing after git init

We're not building another framework. We're the layer above it.

Long-form

The definitive 2026-07-28 migration guide

Ten steps, before/after code for every one, every deprecated pattern and its replacement — grounded in the same verified spec facts the validator checks against.

Read the guide →

In this guide

1.Remove the initialize handshake and Mcp-Session-Id
2.Add the required headers
3.Implement server/discover
4.Add resultType to every result
5.Add ttlMs and cacheScope to list responses
6.Replace server-initiated requests with MRTR
7.Update your error codes
8.Remove retired methods
9.Harden authorization
10.If you still need to serve legacy clients

Distribution

Built for CI, not just your browser

Run the same 79 rules in GitHub Actions with npx createmcps — no install step. Fail the build on a real regression, not a vibe, and see each failing rule annotated on the pull request.

CLI docs →

$ npx createmcps validate https://mcp.example.com/mcp

fail MCP-HDR-004 Accepted the request when MCP-Protocol-Version was omitted

fail MCP-SEC-001 Accepted a request with an unrecognised Origin

https://mcp.example.com/mcp — grade unrated, 46% coverage, dual era

2 fail · 0 warn · 33 pass · 3 info · 21 skipped

$ echo $?

FAQ

Frequently asked

Is createmcps.com free?

Yes. Everything is free right now, with no limits and no account required to validate — the validator, the full rule catalog, public and private reports, continuous monitoring, and the CLI. Revenue isn't the year-one goal, adoption is.

What does createmcps.com check?

79 rules against the MCP 2026-07-28 specification, covering discovery & capabilities, required headers, statelessness, caching metadata, authorization, and deprecated & registry rules. 75 of them link to the exact sentence of the spec they come from; the remaining 4 are security and registry best practices.

How does grading work?

A simple, published, versioned rubric. Any security-relevant failure caps the grade at D. A failure detected only heuristically — by inference, not certainty — bumps the overall grade up one level, so an ambiguous signal alone can't tank a compliant server's grade.

Is my server's data safe when I validate it?

createmcps.com runs read-only protocol probes — never a real tool call, never a real resource read — inside an SSRF-safe sandbox with a pinned, IP-validated connection.

What changed in MCP 2026-07-28?

The largest revision since MCP launched: a stateless core (session headers removed), new required headers (Mcp-Method, Mcp-Name), caching metadata on list/read responses, RFC 9207 auth hardening, an extensions framework, and a formal 12-month deprecation policy for future changes.

Still not sure your server is compliant?

Point the validator at it. Every rule comes back as pass, warn or fail, each linked to the exact sentence of the specification behind it.

Validate a server →browse all 79 rules

Roadmap

The validator is where we start, not where we stop

1
Phase 1 · Shipped
Validator
79 rules, migration guide, CLI
2
Phase 2 · Shipped
Generator
Scaffolds servers that score 100%
3
Phase 3 · In progress
Deploy & Publish
Registry publishing, Cloudflare deploy and monitoring are live; email alerts next