Summary
The src/mcp/ implementation hand-rolls the MCP protocol (no rmcp/official SDK dependency) and is pinned to protocol version 2025-06-18 (src/mcp/protocol.rs), two revisions behind the current 2026-07-28 spec. The most impactful gap is that the Streamable HTTP transport uses the session model the new spec specifically removes.
1. HTTP transport session store — breaks under horizontal scaling (highest priority)
src/mcp/http_transport.rs mints a Mcp-Session-Id UUID on initialize and stores a per-session Arc<Mutex<McpServer>> in a DashMap<String, _> (McpHttpState::sessions). Every subsequent request must carry that header to find its session.
This is exactly the sticky-session / shared-session-store pattern that MCP 2026-07-28's stateless core (SEP-2575, SEP-2567) removes — initialize/Mcp-Session-Id are gone from the spec, and every request is meant to be self-contained (client identity/capabilities carried in _meta per-call). If recalld's HTTP transport is ever run as more than one instance behind a plain load balancer, this design breaks (no sticky routing = requests land on an instance without the session).
Given almost all real state already lives in the redb storage layer rather than in McpServer (whose only mutable field is the initialized bool), migrating to the stateless model looks low-risk: drop the session map, and gate on _meta-carried info per request instead of a remembered initialized flag.
2. Protocol version pinned to 2025-06-18
PROTOCOL_VERSION in protocol.rs predates even the 2025-11-25 revision. Bumping it is backward-compatible (older clients still get the old handshake per the spec's fallback rules) and is a prerequisite for negotiating anything below.
3. No cacheable list results
ToolsListResult/ResourcesListResult have no ttlMs/cacheScope fields (SEP-2549). recalld's tool catalog is static, so this is a cheap addition that would let clients cache the catalog across stdio restarts/reconnects instead of re-fetching every session.
4. No Mcp-Method/Mcp-Name headers on HTTP transport
SEP-2243 adds these so gateways/rate-limiters can route without parsing the JSON-RPC body. Notable here since the HTTP transport is mounted on the same axum app that already uses tower-http (cors/trace/timeout) for the REST API — these headers would let MCP traffic participate in the same gateway infra.
Lower priority / not applicable
- MRTR (SEP-2322): only relevant if/when an interactive-confirmation tool flow (e.g. confirm-before-delete) is added — should be built against the new request/response pattern directly rather than the now-deprecated
elicitation/create.
- Tasks / MCP Apps extensions: low value today — tools are fast in-process
redb calls, not long-running work, and there's no interactive-UI use case.
- OAuth-hardening SEPs (issuer validation, DCR deprecation): not applicable — recalld's MCP transports are unauthenticated (stdio + localhost HTTP), not exposed multi-tenant/remote.
- Deprecated capabilities (
Roots, Sampling, Logging): already not declared/implemented, nothing to remove.
References
Summary
The
src/mcp/implementation hand-rolls the MCP protocol (normcp/official SDK dependency) and is pinned to protocol version2025-06-18(src/mcp/protocol.rs), two revisions behind the current 2026-07-28 spec. The most impactful gap is that the Streamable HTTP transport uses the session model the new spec specifically removes.1. HTTP transport session store — breaks under horizontal scaling (highest priority)
src/mcp/http_transport.rsmints aMcp-Session-IdUUID oninitializeand stores a per-sessionArc<Mutex<McpServer>>in aDashMap<String, _>(McpHttpState::sessions). Every subsequent request must carry that header to find its session.This is exactly the sticky-session / shared-session-store pattern that MCP 2026-07-28's stateless core (SEP-2575, SEP-2567) removes —
initialize/Mcp-Session-Idare gone from the spec, and every request is meant to be self-contained (client identity/capabilities carried in_metaper-call). If recalld's HTTP transport is ever run as more than one instance behind a plain load balancer, this design breaks (no sticky routing = requests land on an instance without the session).Given almost all real state already lives in the
redbstorage layer rather than inMcpServer(whose only mutable field is theinitializedbool), migrating to the stateless model looks low-risk: drop the session map, and gate on_meta-carried info per request instead of a rememberedinitializedflag.2. Protocol version pinned to 2025-06-18
PROTOCOL_VERSIONinprotocol.rspredates even the 2025-11-25 revision. Bumping it is backward-compatible (older clients still get the old handshake per the spec's fallback rules) and is a prerequisite for negotiating anything below.3. No cacheable list results
ToolsListResult/ResourcesListResulthave nottlMs/cacheScopefields (SEP-2549). recalld's tool catalog is static, so this is a cheap addition that would let clients cache the catalog across stdio restarts/reconnects instead of re-fetching every session.4. No
Mcp-Method/Mcp-Nameheaders on HTTP transportSEP-2243 adds these so gateways/rate-limiters can route without parsing the JSON-RPC body. Notable here since the HTTP transport is mounted on the same axum app that already uses
tower-http(cors/trace/timeout) for the REST API — these headers would let MCP traffic participate in the same gateway infra.Lower priority / not applicable
elicitation/create.redbcalls, not long-running work, and there's no interactive-UI use case.Roots,Sampling,Logging): already not declared/implemented, nothing to remove.References