Migrate a Streamable HTTP MCP server from the 2025-11-25 session handshake to the stateless 2026-07-28 revision

Documented steps

1. Read the revision changelog first: https://modelcontextprotocol.io/specification/2026-07-28/changelog — the 2026-07-28 revision is a breaking rewrite of the transport and lifecycle, not an additive update.
2. Delete the initialize / notifications/initialized handshake path. There is no negotiation handshake in 2026-07-28; every request independently carries its protocol version and client capabilities.
3. Stop minting, echoing, or requiring the Mcp-Session-Id header. Protocol-level sessions are removed. If an incoming request still carries Mcp-Session-Id, ignore it (spec: SHOULD ignore).
4. Read required per-request metadata from params._meta on EVERY request: 'io.modelcontextprotocol/protocolVersion' (required) and 'io.modelcontextprotocol/clientCapabilities' (required). Optionally read 'io.modelcontextprotocol/clientInfo'.
5. Reject a request missing any required _meta field with JSON-RPC -32602 (Invalid params) and HTTP 400 Bad Request.
6. Add 'io.modelcontextprotocol/serverInfo' ({name, version}) to _meta of each result (spec: SHOULD).
7. Implement server/discover (REQUIRED for all servers) returning supportedVersions, capabilities, optional instructions, ttlMs and cacheScope. See https://modelcontextprotocol.io/specification/2026-07-28/server/discover
8. Add the required resultType field to every result: 'complete' for ordinary results, 'input_required' for multi-round-trip interim results.
9. Replace any state you previously kept per session with explicit, server-minted handles passed as ordinary tool arguments, or with opaque requestState encoded into MRTR results.
10. Remove the HTTP GET endpoint. Respond 405 Method Not Allowed to GET and DELETE on the MCP endpoint.
11. Replace resources/subscribe and resources/unsubscribe with subscriptions/listen — a single long-lived POST-response stream. See https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/subscriptions
12. Remove ping, logging/setLevel, and notifications/roots/list_changed. Read log level per-request from _meta 'io.modelcontextprotocol/logLevel' instead.
13. Remove SSE resumability: drop Last-Event-ID handling and SSE event ids. A dropped stream loses the in-flight request; the client must re-issue it with a NEW request id.
14. Rewrite any server-initiated request (roots/list, sampling/createMessage, elicitation/create) as a Multi Round-Trip Request: return InputRequiredResult instead of issuing a request to the client.
15. Add ttlMs and cacheScope to results of server/discover, tools/list, prompts/list, resources/list, resources/templates/list and resources/read (CacheableResult).
16. Validate the required Streamable HTTP headers MCP-Protocol-Version, Mcp-Method and Mcp-Name, returning -32020 HeaderMismatch / 400 when a header disagrees with the body.
17. Decide whether to be dual-era: a dual-era server may keep the legacy initialize path and select behavior per request (modern _meta => stateless 2026-07-28 semantics; initialize => legacy semantics).
18. Verify end to end: call server/discover, then tools/list, then tools/call from a fresh connection with no prior request, confirming nothing depends on connection state.