MCP 2026-07-28 Migration Lint for Server Code and Agent Config

Six lines that a US platform team's MCP server still ships stopped being protocol on 28 July 2026 - and the server still starts up clean.

That is the whole trap. The 2026-07-28 revision of the Model Context Protocol did not rename those calls or soften them into warnings. It removed them. A server written against 2025-06-18 or 2025-11-25 keeps answering old clients perfectly, and breaks the first morning a client upgrades. Nothing goes red in your editor, because none of it is a syntax error.

Here is what a working server looked like in June, and what each line is now:

The second trap is that your assistant cannot help you find them. It was trained before 28 July 2026. Ask it for an MCP server today and it will write InitializeRequestSchema, "type": "sse" and -32002, and if you ask whether that is current it will tell you yes. The tool that produced the debt is not the tool that clears it.

And the config files carry their own version of this. "type": "sse" is the HTTP+SSE transport, deprecated since protocol 2025-03-26 and now formally Deprecated under the new feature-lifecycle policy, which sets a minimum twelve-month window before removal. Roots, Sampling and Logging entered that same window on 28 July 2026 - so the earliest they can disappear is 28 July 2027. That is your migration budget, and it is already six weeks spent.

MCP 2026 Migration Lint is 27 rules that read the file you have open - .vscode/mcp.json, .mcp.json, claude_desktop_config.json, .cursor/mcp.json, or JS/TS/Python server source - and put a line number, the change it comes from, and the replacement on each finding. It runs offline; nothing is uploaded.

{
  "mcpServers": {
    "github": {
      "type": "sse",
      "headers": { "Mcp-Session-Id": "abc123" },
      "env": { "GITHUB_TOKEN": "ghp_9f2k1JqR7sT4vW0xYz" }
    }
  }
}

Four findings on those eight lines: the key mcpServers shows nothing in VS Code, which reads servers; "type": "sse" is the deprecated transport; Mcp-Session-Id was removed outright; and the token is a literal credential in a file that usually gets committed.

The file you have open is free - all 27 rules, no key, no account. Doing it by hand instead means reading the changelog and mapping every removal across every file yourself; freelance senior software engineers publish an average of $101 an hour. The paid tier does not give better answers, it changes the scale: the whole repository in one pass, an exported report, and CI output so a removed RPC cannot be merged back in. $29 once.