Vercel MCP Ships the 2026-07-28 Spec: The MCP Migration Clock Starts

On July 31, Vercel MCP became the first major hosted MCP server to serve the 2026-07-28 Model Context Protocol specification in production. The server now speaks both the new stateless protocol and the 2025-era protocol from the same endpoint, and clients on either side get the right version without changing anything on their end. For a spec that landed only three days earlier, that is fast.

What actually shipped#

The change is a protocol-level upgrade of mcp.vercel.com plus the mcp-handler 2.x open source package that powers it. Three concrete things happened:

• One endpoint, two protocols. The server negotiates per-connection. Clients built for the 2025 protocol keep working exactly as before; clients that understand the 2026-07-28 spec get the stateless request model and updated authorization behavior automatically. Setup is unchanged: npx add-mcp https://mcp.vercel.com or vercel mcp.
• mcp-handler went 2.0. The July 29 v2.0.0 release rebuilt the handler on the official MCP SDK v2. It serves the stateless protocol natively (per-request _meta envelope, server/discover) with the SDK's stateless legacy fallback answering 2025-era Streamable HTTP clients from the same handler.
• The old transport is gone. The 2024-11-05 HTTP+SSE transport was removed; /sse and /message now answer 410 Gone. The redis dependency, redisUrl, maxDuration, and sessionIdGenerator options are deprecated no-ops.

For self-hosters, the 2.0 upgrade carries real breaking changes beyond the transport: @modelcontextprotocol/server ^2.0.0 replaces the SDK peer dependency, schemas need zod ^4.2.0, Node.js 20+ is required, and tool registration uses the SDK v2 registerTool API with Standard Schemas. If you run a custom handler, this is the same migration checklist our 2026-07-28 migration guide laid out, now with a concrete vendor implementation to copy from.

Why this matters#

The 2026-07-28 spec is the largest revision since MCP launched, and the migration clock has been the open question since the breaking changes were announced. A spec revision only becomes real when major servers and clients actually ship it. Vercel MCP is the first big hosted server to cross over, and the way it did it is the template everyone else will follow: dual-protocol support from one endpoint, automatic negotiation, no client action required.

Three implications worth naming.

The compatibility shim is now proven at scale. The claim that old clients keep working was always the riskiest part of the stateless redesign. Vercel is now serving both protocols from production infrastructure, which is evidence the fallback path is not just theoretical. If you are a client-side integrator, this is the signal that upgrading your client does not strand you on a server island.

Authorization moved, and Vercel is shipping it. The 2026-07-28 spec hardens OAuth: Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents, and withMcpAuth now builds 401/403 challenges with the SDK's consolidated OAuth error handling, keeping RFC 9728 resource_metadata discovery in place. We covered the zero-touch OAuth direction earlier this year; this release is that direction becoming the default in a mainstream server.

Self-hosted handlers now have a deadline in practice. If your team runs mcp-handler or a custom server, the old HTTP+SSE transport answering anything other than 410 is now a compat risk. Vercel's own handler dropped it, and other major servers will follow the same path. The migration that was optional in June is now the only supported route on the biggest hosted example.

My take#

Vercel shipping the new spec three days after it landed is the strongest signal yet that the 2026-07-28 revision is being adopted as a real standard, not a paper exercise. The dual-protocol approach is the right call: it buys the ecosystem time to migrate without a coordinated cutover day, which is the only realistic way a protocol used by thousands of servers migrates without breaking the world.

The honest caveats: the 410 response for legacy SSE is the shape of things to come, and anyone with a pinned old SDK should test their handler against mcp-handler 2.0 soon. And while Vercel is first among hosted servers, the more important migrations are in the client layer - Claude, Codex, and the rest of the client field are where the new authorization and app capabilities actually surface for most developers. That is the next checkpoint to watch.

Continue Reading#

• The MCP 2026-07-28 Rewrite: What Breaks and How to Migrate - the full breaking-change list for server authors
• MCP Goes Stateless: The 2026-07-28 Migration Guide - step-by-step migration for your own server
• MCP Clients Compared 2026 - which clients support which protocol features today
• Zero-Touch OAuth MCP Enterprise Auth - the authorization direction the new spec hardens
• The Complete Guide to MCP Servers - baseline reference for building and running servers

Sources#

• Vercel changelog: Vercel MCP now supports the 2026-07-28 MCP specification (July 31, 2026)
• mcp-handler v2.0.0 release notes (July 29, 2026)
• MCP specification 2026-07-28 changelog