The 2026-07-28 revision landed and I couldn't find any data on what it actually broke across the ecosystem — so I measured it. Sharing in case it's useful for prioritising, and because one of the numbers surprised me.

[dheerajjha]

Pre-submission Checklist

• This post follows the MCP community guidelines

What would you like to share?

Every thread about the new spec has been about protocol sessions and Mcp-Session-Id going away. I wanted to know what actually breaks in practice, so I scanned the official registry.

The registry first. It points at 14,249 unique GitHub repos, and 15.3% of them 404 — deleted, renamed, or gone private. That's from a random sample of 3,000, spot-checked by hand against github.com. Of the live ones: TypeScript 42%, Python 24%, JavaScript 15%.

Then the 620 Python servers in that sample:

	share
no server/discover	78.2%
tools returned unsorted	18.7%
still implements initialize	5.0%
still implements ping	2.9%
reads Mcp-Session-Id	1.6%
resources/subscribe / logging/setLevel	0.3% each

88.7% have nothing breaking to fix.

Two things I didn't expect. Mcp-Session-Id is a non-event — ten servers out of 620 — because almost nobody touched the transport directly; their framework did it for them. And the thing that actually needs doing is server/discover, missing from 78%. It's an addition rather than a removal, so nothing visibly broke and nobody's talking about it, but a new-spec client expects to discover capabilities before anything else.

Caveat I want to be straight about: server/discover is an absence check against a brand-new field, so pre-migration it fires on nearly everyone. 78% measures how early we are, not how negligent anyone is.

One more thing, because it nearly went wrong. Before publishing I pulled 30 findings at random back to the source lines and read every one by hand. Four false-positive classes turned up that a green test suite never caught. One rule was 91% false positives — it was matching any variable named capabilities, including an LLM backend's class attribute. Another handed a project a breaking grade because a docstring described the handshake. All fixed before these numbers existed. If you're going to publish grades about other people's code, audit before you publish, not after someone complains.

Data and the script that reproduces it: https://github.com/dheerajjha/mcp-migrate/blob/main/data/ecosystem-scan.json

Disclosure: I wrote the scanner (mcp-migrate, Apache-2.0). Happy to run it against your server if you want a second opinion.

The scanner is Apache-2.0 and Python-only today. TypeScript is the obvious gap — I've split it into 19 single-rule issues with two reference ports already merged, if anyone wants a small piece of it: https://github.com/dheerajjha/mcp-migrate/contribute

Relevant Links

No response