# mcp-handler v2.0.0

- Product: mcp-handler (https://whatsnew.fyi/product/mcp-handler)
- Vendor: Vercel
- Date: 2026-07-29
- Version: v2.0.0
- Original notes: https://github.com/vercel/mcp-handler/releases/tag/v2.0.0
- Permalink: https://whatsnew.fyi/product/mcp-handler/releases/v2.0.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **changed** — Upgrade to MCP SDK v2 and the 2026-07-28 MCP specification
- **changed** — Handler now serves the stateless 2026-07-28 protocol with per-request _meta envelope and server/discover natively
- **changed** — SDK's stateless legacy fallback answers 2025-era Streamable HTTP clients from the same handler
- **removed** — Legacy HTTP+SSE transport (protocol 2024-11-05) has been removed
- **changed** — The /sse and /message endpoints answer 410 Gone
- **deprecated** — redis dependency and redisUrl, maxDuration, and sessionIdGenerator config options are deprecated no-ops
- **changed** — Tool/prompt/resource registration follows SDK v2 with registerTool using z.object(...) Standard Schemas
- **removed** — Variadic server.tool(...) is gone
- **changed** — extra.authInfo is now ctx.http?.authInfo
- **changed** — withMcpAuth now builds 401/403 challenges with the SDK's consolidated OAuthError/bearerAuthChallengeResponse
- **deprecated** — Dynamic Client Registration is deprecated by the spec in favor of Client ID Metadata Documents

###### Major Changes

- 33c06b6: Upgrade to MCP SDK v2 and the 2026-07-28 MCP specification (CIMD era).

  - The handler now serves the stateless 2026-07-28 protocol (per-request `_meta` envelope, `server/discover`) natively, with the SDK's stateless legacy fallback answering 2025-era Streamable HTTP clients from the same handler.
  - **Breaking**: requires `@modelcontextprotocol/server` ^2.0.0 (replaces the `@modelcontextprotocol/sdk` peer dependency), `zod` ^4.2.0 for schemas, and Node.js 20+.
  - **Breaking**: the legacy HTTP+SSE transport (protocol 2024-11-05) has been removed. `/sse` and `/message` endpoints answer `410 Gone`; the `redis` dependency and `redisUrl`, `maxDuration`, and `sessionIdGenerator` config options are deprecated no-ops.
  - **Breaking**: tool/prompt/resource registration follows SDK v2 (`registerTool` with `z.object(...)` Standard Schemas; variadic `server.tool(...)` is gone; `extra.authInfo` is now `ctx.http?.authInfo`).
  - `withMcpAuth` now builds its 401/403 challenges with the SDK's consolidated `OAuthError`/`bearerAuthChallengeResponse`, keeping RFC 9728 `resource_metadata` discovery in place for CIMD-era authorization flows. Dynamic Client Registration is deprecated by the spec in favor of Client ID Metadata Documents — see README.