Goal
Bring murl up to the MCP 2026-07-28 specification (release candidate, locked 2026-05-21, final 2026-07-28).
Key finding: most of this is SDK-gated, not murl work
murl is a thin client over the official mcp Python SDK. Every protocol-level operation delegates to the SDK:
streamable_http_client(...) — owns transport, session headers, SSE / multi-round-tripsession.initialize() — owns the handshakesession.call_tool() / list_tools() / read_resource() / get_prompt() — own request/response shapes
The pinned SDK is mcp>=1.0.0 (installed 1.27.0), whose LATEST_PROTOCOL_VERSION = "2025-11-25". The SDK does not yet speak 2026-07-28 — and neither does any other official SDK as of this writing (TypeScript 2.0.0-alpha.2, Rust rmcp 1.7.0 are both on 2025-11-25). The RC locked after those releases; Tier-1 SDKs are expected to ship support during the 10-week validation window before the July 28 final.
What the SDK delivers for free (do nothing until it ships)
These RC changes live entirely in the SDK's transport/session layer. A single dependency bump picks them all up:
What murl owns and may need to touch
OAuth hardening is tracked separately
The RC's auth changes (RFC 9207 iss validation, OIDC application_type in DCR, issuer-bound credentials) live in murl's hand-rolled auth.py, not the SDK — so they're actionable now, independent of the SDK release. Splitting that into its own issue rather than bundling here.
Verification before merge
Per our external-API discipline: do not merge a protocol bump without a live probe against a real 2026-07-28 server (Okta / AgentCore). A green test suite against mocks is not sufficient — the previous-version response shapes are baked into mocks.
Sequencing
The v1 redesign (#14) is reshaping the CLI surface. This work is orthogonal (protocol layer vs. argument surface) but should be rebased onto whichever lands first to avoid churn.
Watch signal
Track the SDK release: https://github.com/modelcontextprotocol/python-sdk/releases — act when a release notes 2026-07-28.
Goal
Bring murl up to the MCP 2026-07-28 specification (release candidate, locked 2026-05-21, final 2026-07-28).
Key finding: most of this is SDK-gated, not murl work
murl is a thin client over the official
mcpPython SDK. Every protocol-level operation delegates to the SDK:streamable_http_client(...)— owns transport, session headers, SSE / multi-round-tripsession.initialize()— owns the handshakesession.call_tool()/list_tools()/read_resource()/get_prompt()— own request/response shapesThe pinned SDK is
mcp>=1.0.0(installed 1.27.0), whoseLATEST_PROTOCOL_VERSION = "2025-11-25". The SDK does not yet speak 2026-07-28 — and neither does any other official SDK as of this writing (TypeScript2.0.0-alpha.2, Rustrmcp 1.7.0are both on2025-11-25). The RC locked after those releases; Tier-1 SDKs are expected to ship support during the 10-week validation window before the July 28 final.What the SDK delivers for free (do nothing until it ships)
These RC changes live entirely in the SDK's transport/session layer. A single dependency bump picks them all up:
initialize/initializedhandshake (client info →_metaon every request)Mcp-Session-Idheader / session pinningMCP-Protocol-Version: 2026-07-28,Mcp-Method,Mcp-NameInputRequiredResult/inputRequests/requestState)_metastructuredContentmay be any JSON valueWhat murl owns and may need to touch
mcpto the first version withLATEST_PROTOCOL_VERSION = "2026-07-28". Replace the floor pin (mcp>=1.0.0) with an explicit lower bound on that version so we don't silently run an old transport.-32002→-32602for resource-not-found. murl string-matches error text in a few places (cli.pyexception handling,detect_tool_auth_failure) — audit those against the new codes.ttlMs/cacheScopeontools/listand resource reads — optional client-side cache; out of scope for the bump, track separately if we want it.extensionscapability map. Out of scope unless we want a CLI surface for them.2025-11-25spec citations throughoutcli.pyandauth.pywill need updating where behavior changes.OAuth hardening is tracked separately
The RC's auth changes (RFC 9207
issvalidation, OIDCapplication_typein DCR, issuer-bound credentials) live in murl's hand-rolledauth.py, not the SDK — so they're actionable now, independent of the SDK release. Splitting that into its own issue rather than bundling here.Verification before merge
Per our external-API discipline: do not merge a protocol bump without a live probe against a real 2026-07-28 server (Okta / AgentCore). A green test suite against mocks is not sufficient — the previous-version response shapes are baked into mocks.
Sequencing
The v1 redesign (#14) is reshaping the CLI surface. This work is orthogonal (protocol layer vs. argument surface) but should be rebased onto whichever lands first to avoid churn.
Watch signal
Track the SDK release: https://github.com/modelcontextprotocol/python-sdk/releases — act when a release notes
2026-07-28.