What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A strict MCP server handles every incoming request in the same order. It first decides which protocol revision the request belongs to, then checks the JSON-RPC envelope and routing metadata, then validates the parameters against what the server advertised. Only after those checks does it run the tool, resource, or prompt code. This article walks through five payload patterns against the current revision, 2026-07-28, and includes one older lifecycle request as a comparison point.
“Five” is an editorial selection. These are common, documented call shapes from the official protocol announcement and SDK guides. They are not a canonical list defined by the specification, and they are not captures of any particular client’s traffic.
Start with the revision, not the payload
The 2026-07-28 revision changed the lifecycle and the transport envelope, so it cannot be read as a small update to earlier examples. It retires the initialize / initialized exchange and the Mcp-Session-Id header. Instead, the protocol version, client identity, and client capabilities travel in request metadata on each call. The MCP project’s announcement, “The 2026-07-28 Specification” (published 2026-07-28), is the primary reference for this change.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesThe practical consequence is that a strict server should decide the revision before it reads anything else. Mixing a 2025-era sessionful envelope with a 2026-07-28 stateless one is the most likely source of confusing failures when a client and server disagree. The release material establishes the change but does not prescribe one universal rejection response for a mismatched revision, so the exact error a server returns depends on its implementation.
#1 Best Overall
- More for the money with this high quality Product
- Offers premium quality at outstanding saving
- Excellent product
- 100% satisfaction
The five payloads at a glance
| Payload | Method | What a strict server checks | Where failures surface |
|---|---|---|---|
| 1. Legacy handshake (comparison only) | initialize |
Protocol version and capabilities at session start; session ID on later requests | Not stated for a mismatched revision in the reviewed official material |
| 2. Tool invocation | tools/call |
Envelope, routing headers, tool name, arguments against the tool’s input schema | Unknown tool or timeout is a protocol-level error; a failed tool run is a result marked isError |
| 3. Resource read | resources/read |
Presence and usability of uri; the resource server’s own access rules |
Not stated as a universal policy; defined by the resource server |
| 4. Prompt retrieval | prompts/get |
name and arguments against the prompt definition the server advertised |
Not stated as a universal policy for extra fields |
| 5. Multi-round input | The original request, retried | Declared client capabilities, fresh request ID, echoed requestState, submitted input against its schema |
The client retries; the TypeScript SDK’s automatic driver defaults to a maximum of ten rounds |
1. Legacy initialize handshake: a comparison point
Earlier revisions used a sessionful flow. The client POSTed a JSON-RPC initialize request carrying a protocol version, its capabilities, and client information. The server replied with a session ID, and the client attached that ID to every subsequent request. The 2026-07-28 announcement describes this as the older flow it replaces.
Keep this payload in your test corpus for migration work, not as a valid current request. A strict server must choose whether it intentionally supports this compatibility path. If it does not, it should not accept the envelope as though it were a stateless 2026-07-28 request. If it does, it must keep session state and version negotiation clearly separate from the current metadata-based path.
2. Tool invocation with tools/call
This is the payload most clients send first. The current release example uses a JSON-RPC request with method: "tools/call", the tool’s name, an arguments object, and client identity under _meta:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "search",
"arguments": { "q": "otters" },
"_meta": {
"io.modelcontextprotocol/clientInfo": {
"name": "my-app",
"version": "1.0"
}
}
}
}Over Streamable HTTP, the same request also carries MCP-Protocol-Version, Mcp-Method, and Mcp-Name headers. The 2026-07-28 revision requires the Mcp-Method and Mcp-Name routing headers for Streamable HTTP requests.
What a strict server does, in order
- Confirm the protocol version from the request metadata and headers, and reject a version it does not serve.
- Check that the envelope is well formed and that
params.nameand the routing headers identify the same call. Rejecting a mismatch is a reasonable strict policy, though the specification does not require one specific response. - Confirm the tool exists. An unknown tool is a protocol-level error, not a tool result.
- Validate
argumentsagainst the tool’s advertised input schema before calling the handler. - Run the handler. If the tool fails during execution, return a normal result marked
isError. Do not turn that failure into a protocol error. - If the tool advertises an output schema, return
structuredContentthat conforms to it. The TypeScript SDK’s client validates returnedstructuredContentagainst that schema, so a non-conforming result will fail on the client side.
Keeping steps 3 and 5 separate matters for debugging. A client that treats every failure as the same kind of error will hide whether the problem is a wrong tool name, a timeout, or a bug inside the tool.
3. Resource read with resources/read
A client usually discovers resources first and then reads one by URI. The TypeScript SDK’s client guide shows a read request with only a uri parameter:
{
"jsonrpc": "2.0",
"id": 2,
"method": "resources/read",
"params": { "uri": "orders://recent" }
}A strict server should confirm that uri is present and that it resolves to a resource it actually offers. It should then return content in the documented shape, which includes the URI, a MIME type, and either text or a base64-encoded blob.
Free tools Windows power users keep installed
One-click scans. No signup required.
The SDK example does not define which URI schemes are valid, and it does not set access-control rules. Those belong to the resource server. A request that names a resource a caller is not allowed to read should be refused by that server’s own authorization logic, whatever the URI looks like.
Rank #3
- Product type: Screw kit
- Made by Super Micro
- Manufacturer part number: MCP-410-00005-0N
- Supermicro MCP-410-00005-0N Screw Bag(100PCS) and Label for 24x Hot swap
- Mfr Part Number: MCP-410-00005-0N
4. Prompt retrieval with prompts/get
A client asks for a prompt by name and supplies arguments. The server returns messages with those arguments filled into its template:
{
"jsonrpc": "2.0",
"id": 3,
"method": "prompts/get",
"params": {
"name": "summarize-order",
"arguments": { "id": "A-1041", "tone": "terse" }
}
}A strict server should check the prompt name against the prompts it advertised, then reject missing or wrongly shaped arguments according to that prompt’s definition. Unknown arguments should not be treated as meaningful unless the prompt’s contract allows them. The SDK guide documents the client’s call shape and the returned messages. It does not set one universal policy for extra fields, so the prompt definition is the authority.
5. Multi-round input: input_required and the retry
Under the 2026-07-28 revision, the server no longer sends standalone server-initiated requests such as elicitation/create, sampling/createMessage, or roots/list. Instead, a server that needs more information returns a result with resultType: "input_required". The client then retries the original call. The flow works like this:
- The client sends the original request and declares the capabilities it supports.
- The server returns
resultType: "input_required"instead of a final result, along with arequestStatevalue it needs to recover context. - The client retries the original call with a fresh request ID, an
inputResponsesobject containing the answers, and therequestStateechoed back byte for byte. The TypeScript migration guide describes this retry behavior. - The server verifies that the client declared the capabilities this request needs, then validates the submitted input against its schema before using it.
The Python SDK documentation specifically recommends schema-aware validation of accepted elicitation content. The TypeScript migration guide notes that typed input-response readers can tell apart missing, declined, and mismatched content, which is useful when deciding whether to re-prompt or fail. If a returned requestState has been altered, a strict server should treat the retry as invalid. The reviewed material does not name the exact error code for that case.
Each round is a full retry, so a server that keeps asking for input should bound its own loop. The TypeScript SDK’s automatic driver defaults to a maximum of ten rounds. That is a client-side default; the reviewed material does not state a server-side limit.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where tasks fit: an extension, not a sixth payload
The Tasks extension covers long-running work. Support is declared in per-request client capabilities. A server may respond with a durable task handle, and the client then polls tasks/get with the task ID. If a request requires a task capability the client did not declare, the extension documents error -32003, “Missing required client capability.” Tasks are an optional extension pattern, not a replacement for ordinary tools/call, so a server should only use this path for clients that declared support.
Sources
- Model Context Protocol Blog, “The 2026-07-28 Specification,” published 2026-07-28: the revision change, the removed handshake and session header, and the input_required model.
- MCP TypeScript SDK, “Call tools, read resources, get prompts”: client call shapes, the
isErrorconvention, and output-schema validation. - MCP TypeScript SDK, “Supporting protocol revision 2026-07-28”: retry behavior, the fresh request ID,
requestStateecho, and the automatic driver’s round limit. - MCP Tasks Extension, “Overview”: capability declaration, the task lifecycle, and error
-32003. - MCP Python SDK, “Dependencies”: schema-aware validation guidance for elicitation input.
The protocol-level behavior described above is what the official announcement and SDK guides document. Where those documents leave a choice to the implementer, such as the rejection response for a mismatched revision, extra-field policy, and URI access rules, the choice belongs to your server and should be documented in your own API contract.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
