Audit & migration
You already built one. We’ll tell you what the July release broke.
The MCP specification revision 2026-07-28, shipped 28 July 2026, removed protocol-level sessions and the initialization handshake and deprecated three primitives. If your server was built against 2025-11-25 or earlier, it is now on a superseded revision. We audit it, fix what broke, and can take over maintenance, for a fixed fee quoted before we start.
What 2026-07-28 changed
| Change | What it breaks |
|---|---|
| Protocol-level sessions removed | Any server holding per-session state |
| Initialization handshake removed | Clients expecting the old capability exchange |
| HTTP+SSE deprecated | Transports still pinned to /sse |
| Roots, Sampling, Logging deprecated | Features on a 12-month removal clock |
Run the scanner first. It is free and ungated.
You do not need to talk to us to find out where you stand. Paste a public endpoint into the scanner and it reports the negotiated revision, transport, deprecated-feature usage, auth posture and tool count. If it comes back clean, you owe us nothing.
What happens after the audit
Two honest paths, and we will name the cheaper one for you. Hand back: you take the report and your team fixes it. Hand over: the server moves onto the monthly retainer and we own the migration and everything after it. There is no obligation to take the second path to get the first.
Audit questions
- What does the audit cost?
- A fixed fee, quoted from the scanner output and the size of your tool surface before we start, so there is no hourly meter running while we read your code. After the audit you can take the report and fix it yourself, or hand the server to the monthly retainer. Both are fine, and we will tell you which is cheaper for your case.
- What does the audit actually cover?
- Protocol conformance against 2026-07-28, auth posture, prompt-injection handling, scope minimality, error-message quality, and deploy hygiene. It is the same pre-ship checklist we gate our own builds on, run against your server instead of ours.
- Our own devs can migrate it. Why pay you?
- They can, and for a simple server they probably should. The reason to pay someone is that the 2026-07-28 changes are not a find-and-replace: sessions and the handshake are gone, and the compatibility between old clients and new servers is not symmetric. If your team has the two or three days and owns it afterwards, do it yourselves.
- What if the scanner says we are fine?
- Then we tell you that and you owe us nothing for the check, because the scanner is free and ungated. Being current on 2026-07-28 today does not mean current forever; the deprecation policy runs a twelve-month clock on Roots, Sampling and Logging, and the retainer is what watches that clock.
- Can you migrate a server you did not build?
- Yes. Most audit work is on servers built by someone else, often against the 2025-11-25 revision or earlier. We do not need the original author, only a reachable endpoint and, for the fix, the source repository.