The lifecycle, step by step

JSON-RPC 2.0, newline-delimited on stdio, one POST each on HTTP. Since July 2026, no handshake at all. This lesson is mostly one big interactive: every message of four scenarios, exactly as it appears on the wire.

By the end of this lesson you can

walk through a modern exchange: discover, call, input required, retry, shutdown;
walk through the legacy handshake and spot the server-initiated request;
explain how a dual-era client tells a modern server from a legacy one;
read the same message as a stdio line and as an HTTP exchange.

First question: which era is the server?

A dual-era client does not know in advance whether a server is modern or legacy. On HTTP the headers and status codes help; on stdio, the first request is the probe. Here is the decision it makes.

The era probe

The client sends server/discover (or any request) as a modern request, with _meta.
A DiscoverResult means a modern server. Carry on: no handshake, version and capabilities on every request.
Error -32022 is a recognised modern error: the server is modern but wants another version. Pick one from supported and retry. Do not fall back to initialize.
Anything else, any other error code or a timeout, means a legacy server that expected initialize first. Fall back to the handshake.
Legacy servers answer early requests with arbitrary codes (-32600, -32601, -32602) or not at all, so the fallback must never depend on one specific code.

Step through four scenarios

Pick a scenario. Switch the transport (here or with Show in the top bar) to see the same message as a stdio line or as an HTTP exchange with its headers. The bottom panel shows what the server has to remember between requests.

Things to look for

In the modern scenarios, every request has _meta, and the server-memory panel stays empty.
The retry after input_required uses a new id and echoes requestState exactly.
On HTTP, Mcp-Session-Id appears only in the legacy scenarios. Modern requests carry Mcp-Method and Mcp-Name instead.
A notification has no id and gets no reply; on HTTP it is answered 202 Accepted.
In the legacy scenario, the elicitation arrow points from server to client: a server-initiated request, which the modern protocol forbids.

Legacy rules worth knowing

You will meet legacy servers for a long time. Their handshake has a few rules of its own:

Spec rule (legacy, 2025-11-25)

initialize MUST be the first interaction. Until the server has answered it, the client SHOULD NOT send anything but ping; until notifications/initialized arrives, the server SHOULD NOT send anything but ping and logging. On HTTP the server may mint Mcp-Session-Id, which means sticky routing or shared session storage, and the session is ended with an HTTP DELETE (which a server may answer with 405).

Quick check

A dual-era client's probe gets back error -32601 "Method not found". What should it conclude?

The server is modern but does not support discover
The server is probably legacy: fall back to initialize
The server is broken: give up

Only a DiscoverResult or -32022 identify a modern server. Any other error, or a timeout, is treated as legacy, and the fallback must not depend on any one code.

The server answered tools/call (id 2) with input_required, and the user clicked Confirm. What does the client send next?

The same request again with id 2, so the server can link it to the first one
The same request again with a new id (3), plus the user's answer and the server's requestState copied back unchanged
A notification with just the answer, since the server is already waiting

The server is not waiting: it finished id 2 and forgot it. So the retry is a brand-new request (new id) that carries everything needed to finish: the answer in inputResponses and the server's own saved work in requestState. That is also why any replica can handle it.

How does shutdown differ between modern stdio and modern HTTP?

Both send a DELETE
stdio: close stdin; HTTP: nothing to do, there is no session
stdio: send shutdown; HTTP: close the TCP connection

End-of-file is the only goodbye on stdio. Modern HTTP has no session to tear down; only legacy HTTP needed DELETE.

Recap

Modern: optional server/discover, self-contained calls, input_required then a retry with a new id, shutdown by closing stdin (stdio) or nothing (HTTP).
Version mismatch: -32022, pick a supported version, retry. One extra round trip, nothing to rebuild.
Legacy: initialize first, then initialized, a session in server memory, and server-initiated requests mid-call.
A dual-era client treats a DiscoverResult or -32022 as modern and anything else as legacy.