Vercel MCP Ships the 2026-07-28 Spec: The MCP Migration Clock Starts
TL;DR
Vercel MCP now serves the stateless 2026-07-28 spec and the 2025 protocol from one endpoint via mcp-handler 2.x. What it means for server authors and clients.
Last updated: August 1, 2026
On July 31, Vercel MCP became the first major hosted MCP server to serve the 2026-07-28 Model Context Protocol specification in production. The server now speaks both the new stateless protocol and the 2025-era protocol from the same endpoint, and clients on either side get the right version without changing anything on their end. For a spec that landed only three days earlier, that is fast.
What actually shipped#
The change is a protocol-level upgrade of mcp.vercel.com plus the mcp-handler 2.x open source package that powers it. Three concrete things happened:
- One endpoint, two protocols. The server negotiates per-connection. Clients built for the 2025 protocol keep working exactly as before; clients that understand the 2026-07-28 spec get the stateless request model and updated authorization behavior automatically. Setup is unchanged:
npx add-mcp https://mcp.vercel.comorvercel mcp. - mcp-handler went 2.0. The July 29 v2.0.0 release rebuilt the handler on the official MCP SDK v2. It serves the stateless protocol natively (per-request
_metaenvelope,server/discover) with the SDK's stateless legacy fallback answering 2025-era Streamable HTTP clients from the same handler. - The old transport is gone. The 2024-11-05 HTTP+SSE transport was removed;
/sseand/messagenow answer410 Gone. Theredisdependency,redisUrl,maxDuration, andsessionIdGeneratoroptions are deprecated no-ops.
For self-hosters, the 2.0 upgrade carries real breaking changes beyond the transport: @modelcontextprotocol/server ^2.0.0 replaces the SDK peer dependency, schemas need zod ^4.2.0, Node.js 20+ is required, and tool registration uses the SDK v2 registerTool API with Standard Schemas. If you run a custom handler, this is the same migration checklist our 2026-07-28 migration guide laid out, now with a concrete vendor implementation to copy from.
Why this matters#
The 2026-07-28 spec is the largest revision since MCP launched, and the migration clock has been the open question since the breaking changes were announced. A spec revision only becomes real when major servers and clients actually ship it. Vercel MCP is the first big hosted server to cross over, and the way it did it is the template everyone else will follow: dual-protocol support from one endpoint, automatic negotiation, no client action required.
Three implications worth naming.
The compatibility shim is now proven at scale. The claim that old clients keep working was always the riskiest part of the stateless redesign. Vercel is now serving both protocols from production infrastructure, which is evidence the fallback path is not just theoretical. If you are a client-side integrator, this is the signal that upgrading your client does not strand you on a server island.
Authorization moved, and Vercel is shipping it. The 2026-07-28 spec hardens OAuth: Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents, and withMcpAuth now builds 401/403 challenges with the SDK's consolidated OAuth error handling, keeping RFC 9728 resource_metadata discovery in place. We covered the zero-touch OAuth direction earlier this year; this release is that direction becoming the default in a mainstream server.
Self-hosted handlers now have a deadline in practice. If your team runs mcp-handler or a custom server, the old HTTP+SSE transport answering anything other than 410 is now a compat risk. Vercel's own handler dropped it, and other major servers will follow the same path. The migration that was optional in June is now the only supported route on the biggest hosted example.
My take#
Vercel shipping the new spec three days after it landed is the strongest signal yet that the 2026-07-28 revision is being adopted as a real standard, not a paper exercise. The dual-protocol approach is the right call: it buys the ecosystem time to migrate without a coordinated cutover day, which is the only realistic way a protocol used by thousands of servers migrates without breaking the world.
The honest caveats: the 410 response for legacy SSE is the shape of things to come, and anyone with a pinned old SDK should test their handler against mcp-handler 2.0 soon. And while Vercel is first among hosted servers, the more important migrations are in the client layer - Claude, Codex, and the rest of the client field are where the new authorization and app capabilities actually surface for most developers. That is the next checkpoint to watch.
FAQ#
Does Vercel MCP support the 2026-07-28 MCP spec?#
Yes. Since July 31, mcp.vercel.com serves both the stateless 2026-07-28 protocol and the 2025-era protocol from the same endpoint, negotiating per connection. Clients on either version get the right protocol automatically, and setup is unchanged: npx add-mcp https://mcp.vercel.com or vercel mcp.
What breaks when upgrading to mcp-handler 2.0?#
The 2024-11-05 HTTP+SSE transport was removed, so /sse and /message now answer 410 Gone. @modelcontextprotocol/server ^2.0.0 replaces the SDK peer dependency, schemas need zod ^4.2.0, Node.js 20+ is required, and tools register through the SDK v2 registerTool API with Standard Schemas. The redis dependency, redisUrl, maxDuration, and sessionIdGenerator options are now deprecated no-ops.
Do existing MCP clients need to change anything to keep working with Vercel MCP?#
No. Clients built for the 2025 protocol keep working exactly as before, because mcp-handler 2.x uses the SDK's stateless legacy fallback to answer 2025-era Streamable HTTP clients from the same handler.
What changed for MCP authorization in the 2026-07-28 spec?#
The spec deprecates Dynamic Client Registration in favor of Client ID Metadata Documents. In mcp-handler 2.x, withMcpAuth builds 401/403 challenges with the SDK's consolidated OAuth error handling while keeping RFC 9728 resource_metadata discovery in place.
Continue Reading#
- The MCP 2026-07-28 Rewrite: What Breaks and How to Migrate - the full breaking-change list for server authors
- Cloudflare Gateway Can Now Detect MCP Traffic - the 2026-07-28 headers as a network-level security signal
- MCP Goes Stateless: The 2026-07-28 Migration Guide - step-by-step migration for your own server
- MCP Clients Compared 2026 - which clients support which protocol features today
- Zero-Touch OAuth MCP Enterprise Auth - the authorization direction the new spec hardens
- The Complete Guide to MCP Servers - baseline reference for building and running servers
Sources#
Get the next deep dive like this in your inbox
One email a week on News and the rest of the AI dev stack. Free.
Read next on AI coding tools
The MCP 2026-07-28 Rewrite: What Breaks and How to Migrate
MCP 2026-07-28 breaking changes: a stateless core, deprecated Roots, Sampling and Logging, and tougher OAuth, plus a migration checklist for server authors.
11 min readMCP Goes Stateless: The 2026-07-28 Migration Guide
MCP 2026-07-28 spec migration guide: sessions and the initialize handshake are gone. What changed, what breaks, and how to move your MCP servers to stateless.
9 min readMCP Clients Compared: How to Pick a Host for 2026
Claude Code, Claude Desktop, Cursor, VS Code, Zed, and opencode all speak MCP differently. Here is how their transport, auth, and tool-limit support compares.
9 min readNew here? Start with
Technical content at the intersection of AI and development. Building with AI agents, Claude Code, and modern dev tools - then showing you exactly how it works.
