{"slug": "the-mcp-2026-07-28-spec-is-final-check-your-server-in-one-command", "title": "The MCP 2026-07-28 spec is final - check your server in one command!", "summary": "The Model Context Protocol's 2026-07-28 spec revision went final, moving to stateless requests. The open-source tool mcpscore, built by the mcp-box team, provides a one-command audit for MCP servers, scoring them 0–100 based on 72 deterministic rules and supporting auth-gated servers with token-based audits and partial audits for 401 responses.", "body_md": "The [Model Context Protocol's 2026-07-28 revision](https://blog.modelcontextprotocol.io/posts/2026-07-28/) went final on July 28. It's a meaningful one: the lifecycle moves to stateless requests. If you maintain an MCP server, the two questions are: *is my server still well-built, and is it ready for the new spec?*\n\n**mcpscore** answers both in one command:\n\n```\nuvx mcpscore https://your-server.example/mcp\n```\n\nNo install, no API key. In a few seconds you get a 0–100 quality score and a list of exactly what to fix.\n\n72 deterministic rules, each citing the spec section it enforces, grouped into four categories:\n\nIt's deterministic - the same server always gets the same score, so it's stable in CI, and it's read-only: it lists your tools and probes behavior but never calls a tool, so auditing is side-effect-free. Local servers in any language audit over stdio too — `mcpscore --stdio ./my-go-server`\n\n, `--stdio java -jar server.jar`\n\n— not just `.py`\n\n/`.js`\n\nfiles.\n\nMost production MCP servers are auth-gated, and until now that meant unauditable. This release changes that:\n\n```\n# full audit with your token (also reads MCPSCORE_TOKEN)\nuvx mcpscore --token $TOKEN https://api.example.com/mcp\n```\n\nAnd with no credentials at all, a 401 server gets a **partial audit** of its observable surface, including auth-posture rules that check the `WWW-Authenticate`\n\nchallenge, RFC 9728 protected-resource metadata, the authorization server's RFC 8414 metadata, and PKCE support. The gate itself Tokens never appear in logs or reports.\n\n```\n- uses: mcp-box/mcpscore-action@v1\n  with:\n    target: https://your-server.example/mcp\n    min-score: 90\n```\n\nIt comments the report on the PR and fails the check below your threshold.\n\nAdd a live score badge to your README from the report page at [mcpscore.dev](https://mcpscore.dev) - it reflects your server's latest score.\n\nThere's a good official conformance suite for \"is my server legal.\" mcpscore is the other question - \"how good is it\" - the way Lighthouse scores a web page's quality, not just its validity. It runs on the official MCP Python SDK v2, it's open source (MIT), and the methodology is public: [https://docs.mcpscore.dev/methodology](https://docs.mcpscore.dev/methodology)\n\nPoint it at your server and see where you land!", "url": "https://wpnews.pro/news/the-mcp-2026-07-28-spec-is-final-check-your-server-in-one-command", "canonical_source": "https://dev.to/mcpscore/the-mcp-2026-07-28-spec-is-final-check-your-server-in-one-command-438k", "published_at": "2026-08-03 05:24:56+00:00", "updated_at": "2026-08-03 05:39:52.717876+00:00", "lang": "en", "topics": ["developer-tools", "ai-infrastructure", "ai-tools"], "entities": ["Model Context Protocol", "mcpscore", "mcp-box", "MCP Python SDK", "RFC 9728", "RFC 8414", "PKCE", "Lighthouse"], "alternates": {"html": "https://wpnews.pro/news/the-mcp-2026-07-28-spec-is-final-check-your-server-in-one-command", "markdown": "https://wpnews.pro/news/the-mcp-2026-07-28-spec-is-final-check-your-server-in-one-command.md", "text": "https://wpnews.pro/news/the-mcp-2026-07-28-spec-is-final-check-your-server-in-one-command.txt", "jsonld": "https://wpnews.pro/news/the-mcp-2026-07-28-spec-is-final-check-your-server-in-one-command.jsonld"}}