v0.4.1 — MCP 2026-07-28, both transports, verified on Linux

The 2026-07-28 revision made MCP stateless — no initialize handshake, no sessions, no server-initiated requests. That is a far better fit for a shell script than what came before, so this release brings the SDK up to that revision and takes advantage of it.

Highlights

• MCP 2026-07-28 — per-request version negotiation via params._meta, server/discover, resultType, cache hints on list results.
• Both standard transports — stdio and Streamable HTTP, from the same server file (--http). Both call the same process_request, so they cannot drift.
• Four runnable examples — git, weather (API wrapping), filesystem (path-traversal boundary), movies — plus a build-your-own walkthrough.
• Verified on macOS, Debian, Alpine and Ubuntu. ./scripts/test-linux.sh all reproduces it.
• Documentation site with 7 ADRs and 3 runnable spikes.

Bugs fixed that only appeared on Linux

• Tool payloads over ~128 KB failed. Linux caps a single argv entry at MAX_ARG_STRLEN regardless of ARG_MAX; macOS has no such cap. Passing tool output through jq --arg worked on the dev machine and failed in production. Large content now goes to jq on stdin.
• The HTTP server could not be stopped. bash defers traps until the current foreground command finishes, and nc blocks waiting for a connection, so SIGTERM stayed pending forever. The accept pipeline now runs backgrounded with an interruptible wait — shutdown is instant, no orphans, and the HTTP suite went from ~2 minutes to ~2 seconds.
• Dropped the bc dependency (absent from slim images); the netcat listen syntax is probed rather than sniffed.

Breaking changes

• Clients older than 2026-07-28 are rejected with -32022. The revision removed the initialize handshake; this SDK implements the new one only. See ADR-0002.
• A tool returning non-zero is now a successful result with isError: true, not a JSON-RPC -32603, so the model can see the failure and self-correct. Tool authors keep the same echo + return 0|1 contract. Missing tool moves -32601 → -32602.
• MCP_CONFIG_FILE is now a server/discover body (supportedVersions, capabilities, ttlMs, cacheScope, serverInfo) rather than an initialize result.
• Internal: create_response reads its result object from stdin instead of $2. A custom transport calling it with two arguments must pipe instead.

Verification

31 unit · 19 HTTP transport · 6 schema-conformance tests against the official published schema (vendored at spec/schema-2026-07-28.json). Green on macOS under both bash 3.2 and 5.3, and on Debian, Alpine (musl + busybox) and Ubuntu.

Full changelog in VERSIONS.md.