MCP Reference

By the Syncfusion DevTutorials team · Last updated October 19, 2026

A quick-reference page for MCP 2026-07-28: MCP vs alternatives, roles, methods, error codes, HTTP statuses, headers, result fields, auth and security checklists, deprecations and a glossary.

What you will learn

• Look up methods, codes and headers
• Compare MCP with alternatives
• Review the auth and security checklists

This page is a quick reference for the 2026-07-28 version of the MCP specification. Use it to look up a method, code, header, or checklist while you build. For a step-by-step explanation, use the lesson for that topic.

MCP and the Alternatives

MCP does not replace function calling. A host still uses its model's function-calling feature under the hood. MCP standardizes where the tools come from, so the same server can be used by different hosts.

Roles and Primitives

These roles describe who offers a feature and who uses it. Keeping them straight helps when you look up which side sends a method or owns a capability.

Methods

The method list shows who sends each request or notification and what it does. This is useful when tracing a message between a client and a server.

Methods at a glance

// Quick lookup: which side sends each method, and what it is for.
const methods = {
  "server/discover": ["client", "ask for versions, capabilities and server info"],
  "tools/list": ["client", "list tools"],
  "tools/call": ["client", "run a tool"],
  "resources/list": ["client", "list resources"],
  "resources/templates/list": ["client", "list resource templates"],
  "resources/read": ["client", "read a resource by URI"],
  "prompts/list": ["client", "list prompts"],
  "prompts/get": ["client", "fill in a prompt"],
  "subscriptions/listen": ["client", "open a stream for change notices"],
  "notifications/tools/list_changed": ["server", "tools changed"],
  "notifications/resources/updated": ["server", "one resource changed"],
};

for (const [m, [from, what]] of Object.entries(methods)) {
  console.log(m.padEnd(34), from.padEnd(7), what);
}

Expected output:

server/discover                    client  ask for versions, capabilities and server info
tools/list                         client  list tools
tools/call                         client  run a tool
resources/list                     client  list resources
resources/templates/list           client  list resource templates
resources/read                     client  read a resource by URI
prompts/list                       client  list prompts
prompts/get                        client  fill in a prompt
subscriptions/listen               client  open a stream for change notices
notifications/tools/list_changed   server  tools changed
notifications/resources/updated    server  one resource changed

Other client requests you may meet: resources/subscribe and resources/unsubscribe start and stop updates for one resource; completion/complete suggests values for an argument; and ping checks whether the connection is responsive. Elicitation uses multi round-trip requests (MRTR): the server returns input_required with inputRequests, and the client retries with answers in inputResponses.

Error Codes

JSON-RPC errors describe problems with the request or protocol. A tool can also run and fail; that is reported separately with isError: true in a normal tool result.

Error codes

// Error codes you will meet, with what to do about each.
const codes = {
  "-32700": "Parse error: the JSON is broken",
  "-32600": "Invalid request: not a valid JSON-RPC message",
  "-32601": "Method not found: check capabilities first",
  "-32602": "Invalid params: unknown tool, missing resource or broken request",
  "-32603": "Internal error: a bug on the server",
  "-32020": "Header mismatch: Mcp-Method or Mcp-Name differs from the body",
  "-32021": "Missing required client capability",
  "-32022": "Unsupported protocol version",
};

const explain = (code) => codes[String(code)] ?? "Not a standard MCP or JSON-RPC code";
for (const c of [-32602, -32022, -32020, 404]) {
  console.log(String(c).padEnd(7), explain(c));
}

Expected output:

-32602  Invalid params: unknown tool, missing resource or broken request
-32022  Unsupported protocol version
-32020  Header mismatch: Mcp-Method or Mcp-Name differs from the body
404     Not a standard MCP or JSON-RPC code

Tool failures are not protocol error codes. The server returns a normal tool result with isError: true, so the client can distinguish a failed action from a broken request.

HTTP Status Codes

HTTP status codes describe the transport-level response. For MCP over HTTP, read the status first, then inspect the JSON-RPC body or authentication headers as needed.

HTTP status codes

// HTTP status codes from a remote MCP server, and the client's next step.
const http = {
  200: "OK: read the JSON-RPC result or error",
  400: "Bad request: check headers and body",
  401: "Sign in: follow resource_metadata in WWW-Authenticate",
  403: "Need more scope: step up with the scope in WWW-Authenticate",
  404: "Wrong URL",
  429: "Too many requests: wait, then retry",
  503: "Server busy or down: retry with backoff",
};

for (const s of [401, 403, 429, 503]) {
  console.log(s, http[s]);
}

Expected output:

401 Sign in: follow resource_metadata in WWW-Authenticate
403 Need more scope: step up with the scope in WWW-Authenticate
429 Too many requests: wait, then retry
503 Server busy or down: retry with backoff

Headers

These headers carry routing information or authentication details alongside the JSON-RPC message. They help an HTTP server or gateway handle a request without guessing what the message means.

If Mcp-Method or Mcp-Name doesn't match the method or name in the request body, the server answers -32020 (header mismatch).

Result Fields

These fields help the client interpret a response, page through lists, and decide whether a cached copy is still fresh.

Authorization Checklist

Use this checklist when a remote server asks for a token:

1. Call the server and read the 401 WWW-Authenticate header.
2. Fetch protected resource metadata. Choose an entry from authorization_servers.
3. Fetch authorization server metadata. Check that its issuer matches the issuer you requested.
4. Register the client: use a pre-registered client or a Client ID Metadata Document. Use Dynamic Client Registration only with older authorization servers that still support it.
5. Sign in with PKCE (S256), the resource parameter, and minimal scopes. Check iss on the redirect.
6. Send Authorization: Bearer on every request. On 403 insufficient_scope, request the additional permission through step-up authorization.

Security Checklist

These checks help keep untrusted content, credentials, and network access within the intended boundaries. The host, client, server, and deployment each have responsibilities here; MCP does not enforce every item by itself.

• Treat tool descriptions, resources, and results as untrusted data.
• Use narrow tools, least privilege, sandboxing, and human approval for risky actions.
• Match redirect URIs exactly, get consent for each client, and use single-use state values.
• No token passthrough. Check that each token's audience is this server.
• Block SSRF: allow only intended HTTPS destinations, reject private addresses, and use an egress proxy where appropriate.
• Use random state handles and bind them to the user or session.
• Show the full command before running a local server. Open only http(s) URLs.

Deprecated in 2026-07-28

A deprecated feature still works for at least 12 months, but new implementations should use the recommended alternative.

Glossary

Common mistakes

• Mixing up tools, resources and prompts. The model chooses tools, the app reads resources, and the user selects prompts.
• Reading cursors. Pass nextCursor back as is.
• Forgetting isError. A failed tool still returns a result, not a protocol error.

Where to Go Next

• The official specification at modelcontextprotocol.io, version 2026-07-28.
• The TypeScript and Python SDK documentation.
• Start with the MCP Inspector when debugging a server.
• Use the MCP Registry to find existing servers or publish one.