What you will achieve now
A decision or test applied to “MCP 2026-07-28: safe migration and read-only server”.
- 1 Understand the criterion
- 2 Do a small practice exercise
- 3 Save evidence
A brief note with what you did, what went well, what failed, and what you would review later.
- Understand what changes and what MCP 2026-07-28 does not guarantee.
- Test a local read-only server with a sandbox folder.
- Prepare a migration with pinned versions and least privilege.
What changes in the revision
The official announcement of the 2026-07-28 specification describes a core that can run stateless over common HTTP infrastructure, an extensions framework, and a lifecycle policy so that future revisions do not force a transport rewrite. It does not mean that all SDKs, clients, or servers update at the same time.
Lab path
- Pin the SDK version and read your client’s changelog.
- Create sandbox-mcp/ with two fictional documents.
- Expose only a list_documents tool and a read by identifier.
- Deny absolute paths, writes, commands, and secrets.
- Test a malicious input in a document and verify it is treated as content, not as an instruction.
Migration without surprises
Make a copy of the current server, run contract tests, and record transport, authentication, lifecycle, and schema changes. Keep a compatible client during the transition and define a rollback. The specification does not replace a security review.
Official sources
- MCP 2026-07-28 revision announcement .
- MCP specification and published versions .
- MCP security best practices .
cliente IA
-> MCP server (solo lectura)
-> sandbox-mcp/entrada
-> sin shell, sin escritura, sin secretos
-> respuesta con source + id + fechaIf you have saved the evidence from this lesson, continue with “WhatsApp and Telegram with human approval”. If not, repeat the check before moving on.
Learn with a verifiable reference
Aulafy distinguishes stable concepts from data that changes —versions, prices, models, and commands—. Check the course page for the review date, verified scope, and primary sources.
“Editorial review” means that structure, claims, and sources have been reviewed. It does not mean that every command has been executed: when a technical test exists, it will be marked as such.