To build an MCP client for an AI agent, choose an SDK that supports the protocol version your server uses, use stdio when your host launches a local server process, and use Streamable HTTP for a remote server. Add OAuth only according to the server’s advertised authorization flow, and bind credentials to the authorization server that issued them.
Version compatibility matters: the MCP specification dated July 28, 2026 changes the request and lifecycle model, but servers and SDKs do not necessarily upgrade together. Confirm the versions on both ends before adopting its stateless behavior or HTTP requirements.
As an Amazon Associate I earn from qualifying purchases.
Decide what the client is responsible for
MCP is an open protocol that lets an AI application connect to server-provided tools, resources and prompts. An SDK wraps protocol operations in APIs suited to a programming language; it does not decide which tools your agent should be allowed to use or how their results affect the agent.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A useful implementation separates three concerns. This is an application design recommendation, not a protocol-mandated architecture:
#1 Best Overall
- ESP32-C5 Core Processor: Equipped with ESP32-C5-WROOM-1 module, it supports dual-band Wi-Fi 6 and provides strong math for IoT edge AI applications
- 2.8" Touchscreen Display:Built-in 2.8" TFT color touchscreen, plug and play, support intuitive touch interactive operation
- ESP-Claw AI Smart Body Framework: Built-in ESP-Claw Chat Programming AI Smart Body Framework that supports event driving, structured memory, MCP communication, and custom skill extensions
- Multi-model LLM Compatible: ESP-Claw supports OpenAI style and Anthropic API, native compatible with major language models such as GPT, Qwen, Claude and DeepSeek
- (Wide Interface) Compatible with Arduino (USB-C), TF card slot, UART, FPC-IO and other interfaces, and is fully compatible with Arduino development environments, allowing for quick prototyping development
- Host or agent policy: choose which tools to expose to the model, require approvals where appropriate, and decide how to handle returned results.
- MCP client: use the SDK to connect and perform protocol operations such as listing and calling tools or listing prompts and resources.
- Connection configuration: keep the endpoint or local process command and arguments, environment, working directory, authentication provider, timeouts and proxy settings together.
Make protocol-version support explicit in configuration or compatibility checks. Do not assume that a client using the July 28, 2026 request model can connect unchanged to an older server.
Choose an SDK that matches the runtime and server
MCP does not require a particular programming language. Compare SDKs against the actual server you need to reach, not just the language your agent uses.
| SDK | What its documentation establishes | What to verify |
|---|---|---|
| TypeScript | The official SDK provides a high-level Client, stdio and Streamable HTTP transports, and helpers for listing and calling tools and listing or reading prompts and resources. |
The v2 documentation identifies v2 as the stable line implementing the July 28, 2026 specification. The separate v1 client documentation shows older lifecycle patterns; check which major version an example uses before adopting it. |
| Go | The SDK overview separates client and server APIs in an MCP package, custom-transport building blocks in a JSON-RPC package, and authentication-related packages. | Confirm that the SDK release and target server agree on protocol revision, transport and authorization behavior. |
| Python | The guide describes a client that accepts a URL for Streamable HTTP, process parameters for stdio, or a supplied transport. HTTP client configuration covers headers, authentication, proxies and timeouts. | Check the installed SDK version for exact API names and defaults, especially for timeout and streaming behavior. |
The TypeScript v2 documentation is the relevant line when implementing the July 28, 2026 specification; examples in v1 documentation may illustrate compatibility with an older lifecycle instead. The Go and Python overviews describe SDK surfaces, but the target server’s supported protocol version still determines what will work.
Rank #2
- ESP32-C5 Core Processor: Equipped with ESP32-C5-WROOM-1U module, it supports dual-band Wi-Fi 6 and provides strong math for IoT edge AI applications. FCC ID: 2AC7Z-ESPC5WROOMU
- 2.8" Touchscreen Display:Built-in 2.8" TFT color touchscreen, plug and play, support intuitive touch interactive operation
- ESP-Claw AI Smart Body Framework: Built-in ESP-Claw Chat Programming AI Smart Body Framework that supports event driving, structured memory, MCP communication, and custom skill extensions
- Multi-model LLM Compatible: ESP-Claw supports OpenAI style and Anthropic API, native compatible with major language models such as GPT, Qwen, Claude and DeepSeek
- (Wide Interface) Compatible with Arduino (USB-C), TF card slot, UART, FPC-IO and other interfaces, and is fully compatible with Arduino development environments, allowing for quick prototyping development
Select the transport for where the server runs
| Transport | Use it when | Key considerations |
|---|---|---|
| stdio | Your host launches and owns a local server process. | The client and server exchange JSON-RPC over the child process’s standard input and output. Keep protocol traffic on stdout; handle stderr separately for diagnostics. |
| Streamable HTTP | The MCP server is a remote service. | It works with HTTP infrastructure and remote authorization configuration. Check the deployed server’s protocol version and required routing headers. |
| Legacy HTTP+SSE | A server you must support only offers the older SSE transport. | Keep it as a compatibility path, not the default for a new client. The July 28, 2026 release calls legacy HTTP+SSE deprecated and provides an offramp of at least twelve months. |
Local server: stdio
The TypeScript SDK’s StdioClientTransport launches a child process and exchanges JSON-RPC over stdin and stdout. Its documented configuration includes the command, arguments, environment and working directory, with stderr handled separately from protocol output. This suits a host that is responsible for starting and supervising the local server.
Treat process configuration as security-sensitive. Do not log secrets supplied through environment or configuration, and do not expose them to the agent model. This is prudent application security guidance, not a quoted MCP protocol requirement.
Remote server: Streamable HTTP
Use Streamable HTTP for remote connections unless the server you need to reach requires a legacy transport. The TypeScript and Python SDK documentation both cover it; the Python guide recommends it as the first choice for production remote connections.
Rank #3
- MAX II EPM240 CPLD Development Board Experiment Board Learning Breadboard
For Python, the guide places headers, authentication, proxies and timeouts in the HTTP client layer and calls out longer read-timeout behavior for response streams. Exact defaults vary by SDK version, so verify them against the version you deploy rather than relying on a remembered default.
Legacy server: add SSE only when necessary
The TypeScript SDK documents an HTTP-first fallback approach for legacy SSE servers, and the Python guide says SSE has been superseded. If your client must reach servers that still provide only HTTP+SSE, implement and test that fallback deliberately. Otherwise, avoid making a deprecated transport part of the normal connection path.
Account for the July 28, 2026 protocol revision
The MCP release announcement for July 28, 2026 describes a stateless core: it removes the required initialize/initialized exchange and the protocol session header Mcp-Session-Id. Each request carries protocol version, client identity and client capabilities in _meta; an optional server/discover method can reveal server capabilities beforehand. As MCP Lead Maintainer David Soria Parra put it, “Every request now travels on its own, carrying its protocol version, client identity, and client capabilities in _meta.”
That behavior is specific to the revised protocol, not a safe assumption about every deployed server or SDK. Older protocol versions and SDK lines may still expect the earlier lifecycle. Check the version documented by your SDK and the server, and test the exact pairing. Discovery is optional under the described revision; do not make a discovery call a universal prerequisite unless your integration or server requires it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Configure OAuth around the server’s authorization issuer
For a protected remote server, follow the authorization flow it advertises and use the SDK’s OAuth support where it fits. Do not guess token endpoints or treat credentials for different authorization servers as interchangeable.
Recommended Free Tools
- Discover the authorization metadata. Follow the protected-resource or server authorization flow to identify the relevant authorization server and its metadata.
- Validate the issuer. The July 28, 2026 release says authorization servers should return
issunder RFC 9207 and clients must validate it before redeeming an authorization code. Reject an issuer mismatch. - Bind credentials to that issuer. Store tokens and client information with the issuer that minted them. Do not reuse a credential set with another authorization server, or forward bearer credentials to a different server or authorization origin.
- Use a registration method the server supports. The release formally deprecates Dynamic Client Registration (DCR) in favor of Client ID Metadata Documents (CIMD), while retaining DCR for backward compatibility. The August 2026 roadmap calls CIMD the preferred registration path and says Enterprise-Managed Authorization is stable. Confirm the server’s supported method and deployment policy.
- Keep secrets out of logs and model context. Restrict access to stored tokens and client credentials; redact sensitive values from diagnostics and never present them as agent instructions or tool data.
The official TypeScript SDK documents client-credentials and private-key-JWT helpers and advises setting the expected issuer for them. Its provider guidance also retains issuer identity with saved client information and tokens. Its v1 documentation includes an older DCR example, so an available SDK example should not be mistaken for the current protocol direction.
Handle routing, caching and stateless operation over HTTP
For the July 28, 2026 revision, Streamable HTTP requests must include Mcp-Method and Mcp-Name headers. The release describes these as enabling gateways to route or meter requests without parsing their bodies. Make sure the SDK version or transport adapter you use supplies them when required by the server.
List responses include cache hints, ttlMs and cacheScope, as well as deterministic order. A client can use the server-provided scope and lifetime when caching catalogs; do not substitute an assumed lifetime or scope. The revised stateless core permits requests to reach any instance behind round-robin load balancing. If your application needs longer-lived workflow state, use an explicit handle rather than assuming a transport session will preserve it.
Quick Recap
Implement and validate the connection in stages
- Record the compatibility target. Note the SDK version, protocol revision, server version if available, transport and authorization method you intend to support.
- Build transport configuration. For stdio, configure the process command, arguments, environment and working directory. For remote HTTP, configure the endpoint, headers, auth provider, proxy and timeouts supported by your SDK.
- Connect using the selected transport. Keep local process management separate from remote HTTP setup so a compatibility fallback does not silently change the normal route.
- Check server capabilities and catalog operations. Where appropriate, use the revision’s optional discovery method, then exercise the SDK operations your host needs: tool listing and calls, and prompt or resource listing and reads.
- Test authorization boundaries. Verify issuer validation, credential storage by issuer, and that tokens are not sent to a different server or authorization origin.
- Exercise failure and deployment paths. Test the exact server/SDK version pair, network timeouts, stream reads, proxy behavior, and any required SSE fallback. For remote deployments, confirm that routing headers are present and that requests behave correctly when load balancing sends them to different instances.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
