Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11A strict MCP server does not trust a payload because it parses as JSON-RPC. It first decides which protocol revision the request belongs to, then checks the envelope, routing headers, declared capabilities, and method parameters before any tool, resource, or prompt handler runs. The examples below use the current 2026-07-28 revision, with one older handshake included only as a comparison point.
“Five” is an editorial selection of representative patterns, not a canonical list defined by the protocol. The five are: a legacy initialize handshake, a tools/call, a resources/read, a prompts/get, and a multi-round input_required retry. A task-polling extension is covered as an alternative fifth case.
As an Amazon Associate I earn from qualifying purchases.
Which protocol revision you are validating against
Every payload check starts with the revision. The official MCP blog announcement of the 2026-07-28 specification (published 2026-07-28) identifies that date as the current revision and states that its lifecycle and transport envelope changed from the earlier 2025-11-25 revision. Mixing the two in one test suite produces false failures, because a request that is valid in one revision can be meaningless in the other.
| Aspect | Earlier sessionful flow (2025-era comparison) | Revision 2026-07-28 |
|---|---|---|
| Session setup | initialize request, then initialized; server returns a session ID |
initialize and initialized retired; no session setup exchange |
| Session header | Mcp-Session-Id carried on later requests |
Mcp-Session-Id retired |
| Version and client identity | Sent in the initialize request |
Carried in request metadata on each request |
| Streamable HTTP routing headers | Not stated in the cited announcement for this flow | MCP-Protocol-Version, Mcp-Method, and Mcp-Name are shown in the current examples |
| Server-initiated input | Standalone elicitation/create, sampling/createMessage, and roots/list requests |
Replaced by multi-round requests using resultType: "input_required" and client retries |
The announcement establishes the revision change but does not prescribe one universal rejection response for a revision mismatch. How a server answers a stale envelope depends on its implementation, so the behavior described under payload 1 is a recommendation for a strict server, not a rule every server follows.
#1 Best Overall
The order a strict server checks a request
- Determine the protocol revision the request claims, and whether this server serves it.
- Validate the JSON-RPC envelope:
jsonrpcversion,id,method, andparamsobject shape. - On Streamable HTTP, compare routing headers against the body.
Mcp-MethodandMcp-Nameshould agree with the method and target name in the body. This comparison is an implementation check inferred from the documented headers; the sources do not define a single mismatch error. - Confirm that any capability the request depends on was declared by the client for that request.
- Validate method parameters against the definition the server advertised: tool input schema, resource URI, or prompt arguments.
- Invoke the handler only after steps 1 to 5 pass.
- If the tool advertises an output schema, validate its
structuredContentbefore returning it.
Steps 1 to 5 produce protocol-level rejections. Failures inside step 6 belong to the tool, and step 7 belongs to the server’s own output.
Payload 1: legacy initialize handshake
The older flow starts with a JSON-RPC initialize request POSTed by the client. It carries a protocol version, client capabilities, and client info, and the server answers with a session ID that later requests must send back. It remains useful for migration testing because many existing clients and logs still contain it.
A strict server handles it this way:
- It identifies the request as belonging to the earlier lifecycle before treating it as a current stateless request.
- It accepts the old envelope only when it intentionally implements that compatibility path. Otherwise it should reject it explicitly, not silently create a session under the newer rules.
- It does not expect an
Mcp-Session-Idon requests that the 2026-07-28 revision governs.
Payload 2: tools/call
A current tools/call is a JSON-RPC request with method: "tools/call", a tool name, an arguments object, and client identity in _meta. Over Streamable HTTP, the 2026-07-28 examples also carry MCP-Protocol-Version, Mcp-Method, and Mcp-Name headers.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
{n "jsonrpc": "2.0",n "id": 1,n "method": "tools/call",n "params": {n "name": "search",n "arguments": { "q": "otters" },n "_meta": {n "io.modelcontextprotocol/clientInfo": {n "name": "my-app",n "version": "1.0"n }n }n }n}The TypeScript SDK’s client guide calls a tool by name with a plain arguments object. It also makes an important distinction for error handling. A tool that ran and failed can still return a normal result marked with isError. An unknown tool name or a timeout is a protocol-level failure instead. Clients and tests should check both paths separately.
What a strict server does
- Checks that
namerefers to a tool it actually advertises. An unknown name is a protocol-level error, not anisErrorresult. - Validates
argumentsagainst the selected tool’s input schema before calling the handler. Invalid arguments should never reach handler code. - Keeps
_metaclient identity separate from tool arguments. Client metadata must not be read as a tool parameter. - Returns handler failures as results marked with
isError, so the client can distinguish a broken tool call from a broken request. - If the tool declares an output schema, makes sure its
structuredContentconforms, because the SDK client validates returned content against that schema.
Payload 3: resources/read
A client normally reads a resource after discovering it. The request carries a single uri:
{n "jsonrpc": "2.0",n "id": 2,n "method": "resources/read",n "params": { "uri": "orders://recent" }n}The response contains content items with a URI and MIME type, plus either text or a base64 blob.
What a strict server does
- Requires
urito be present and to be a string the server can map to one of its resources. - Rejects URIs outside the schemes and paths it publishes, and does not guess at a resource from a partial match.
- Returns exactly one of
textorblobper content item, matching the declared MIME type. - Applies its own access control before reading. The SDK example does not define which URIs a given user may read, and that policy belongs to the resource server.
Payload 4: prompts/get
To retrieve a prompt, the client sends its name and an arguments object. The server fills the prompt’s template with those values and returns messages.
Free tools Windows power users keep installed
One-click scans. No signup required.
{n "jsonrpc": "2.0",n "id": 3,n "method": "prompts/get",n "params": {n "name": "summarize-order",n "arguments": { "id": "A-1041", "tone": "terse" }n }n}What a strict server does
- Checks the prompt name against the prompts it advertised.
- Rejects missing required arguments and arguments of the wrong type, using the argument definitions from the prompt’s advertised contract.
- Decides explicitly how to handle unknown argument keys. Ignoring them silently can hide client bugs, while rejecting them can break clients that send extra fields. The SDK documentation describes the call shape and returned messages, not a universal policy here, so the choice should follow the prompt’s contract.
Payload 5: multi-round input with input_required
The 2026-07-28 revision removes the standalone server-initiated requests for elicitation, sampling, and root listing. In their place, a server can answer an ordinary request with resultType: "input_required", asking the client for more information. The client then retries the original call with an inputResponses field.
The TypeScript migration guide adds two details that matter for implementers. The retry uses a fresh request ID, and the server’s requestState must be echoed back byte-exact. Its automatic driver defaults to a maximum of ten rounds. Those details come from the SDK documentation for the 2026-07-28 revision, so a client that exceeds its own round limit should fail the call rather than loop.
What a strict server does
- Confirms that the client declared the capabilities needed for the input it is requesting before asking for it.
- Validates submitted input against the schema it sent before using it. The Python SDK’s dependency guidance recommends schema-aware validation of accepted elicitation content.
- Verifies that
requestStatecomes back unchanged. A modified or missing state should fail the round rather than being reconstructed. - Distinguishes missing, declined, and mismatched content. The migration guide notes that typed input-response readers can make these distinctions.
Alternative fifth case: task capability and polling
The Tasks extension is a separate pattern, not a replacement for tools/call. Support is declared in per-request client capabilities. A server can return a durable task handle, and the client then polls tasks/get with the task ID. When a required task capability is absent, the extension documents error -32003, “Missing required client capability.”
A strict server should reject a task-dependent request that lacks the capability with -32003 instead of falling back silently to a synchronous call, and should treat an unknown task ID on tasks/get as a request error.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Testing checklist for implementers
- Send one request per payload family under the 2026-07-28 revision and confirm each is accepted only with its required headers and metadata.
- Send the legacy
initializeflow and confirm your server either handles it through a deliberate compatibility path or rejects it explicitly. - Send a tool call with invalid arguments and confirm the handler is never invoked.
- Send a tool that throws and confirm the response is an
isErrorresult, not a protocol error. - Send a
resources/readwith an unknown URI and aprompts/getwith a missing argument and confirm both are rejected before any content is generated. - Alter the
requestStatein an input round and confirm the server fails the round.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
