MCP compatibility matrix
What each MCP client puts on the wire, and what it presents when it gets there. Every cell cites a source and the date someone checked it.
Why this matters
Check the clients your callers use before you decide how your MCP server authenticates. A client that doesn't run the specification's OAuth flow needs a header instead. A client that never sends the RFC 8707 resource parameter can't obtain a token bound to your server, so an audience check you rely on will reject every call it makes. Both facts are per client, and neither is in the specification.
How to read a cell
- Yes
- The client's own documentation, source, or release notes state that it supports this.
- Partial
- Supported with a condition that changes how you build against it. Every partial cell has a note naming the condition and citing it.
- No
- The client's own documentation or source states that it doesn't support this.
- Unknown
- No primary source states it either way. Read it as missing evidence, not as a no.
An unsourced cell is worse than a missing one, so a capability nobody documents is marked unknown rather than guessed at. Of 220 client capability cells, 176 cite a primary source and 44 are explicitly unknown. Every client name below links to that client's own page, which carries the note behind its cells, every caveat, and a source for each one.
What 2026-07-28 changed
The 2026-07-28 revision changes what two columns mean. Dynamic client registration (RFC 7591) is deprecated, and the specification names Client ID Metadata Documents as the replacement, so a Yes in the Registration column records what a client does rather than what the specification recommends. Sending the RFC 8707 resource parameter became a client MUST: clients send it whether or not the authorization server supports it.
Adoption is real on the server side and thin on the client side, and that asymmetry is the most useful thing on this page. The revision shipped with launch partners, including Amazon Bedrock AgentCore, Prefect Horizon, Runlayer and mcp-use, and Cloudflare says its Agents SDK supports the specification from day zero. GitHub's MCP server shipped support on July 23, 2026, ahead of the release. So a server can speak 2026-07-28 today.
The clients can't yet. Of the 22 rows here, 2 reach 2026-07-28: MCP Inspector 2.0.0, MCP Python SDK 2.0.0. 8 publish an older revision, 12 publish none at all, and Anthropic's own wording is that support is rolling
out across Claude products. So build your server to prefer the current revision
and still accept the initialize handshake.
The legacy HTTP+SSE transport is deprecated rather than removed. The specification's lifecycle policy has it deprecated since 2025-03-26 and eligible for removal in a future revision, which is why it's still a column here.
What each client supports
- stdio
- Partial
- Streamable HTTP
- Yes
- Legacy SSE
- Unknown
- Revision
initializeera- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Yes
- Client ID
- Yes
- resource
- Yes
- iss
- Unknown
- Headers
- Partial
- stdio
- Partial
- Streamable HTTP
- Yes
- Legacy SSE
- Unknown
- Revision
- Not published
- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Yes
- Client ID
- Yes
- resource
- Yes
- iss
- Unknown
- Headers
- No
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Partial
- Revision
initializeera- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Yes
- Client ID
- Yes
- resource
- Yes
- iss
- Unknown
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
initializeera- OAuth flow
- No
- Registration
- No
- Metadata doc
- No
- Client ID
- No
- resource
- No
- iss
- No
- Headers
- Yes
- stdio
- No
- Streamable HTTP
- Yes
- Legacy SSE
- Partial
- Revision
initializeera- OAuth flow
- No
- Registration
- No
- Metadata doc
- No
- Client ID
- Partial
- resource
- Unknown
- iss
- Unknown
- Headers
- No
- stdio
- No
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
2025-11-25- OAuth flow
- No
- Registration
- No
- Metadata doc
- No
- Client ID
- No
- resource
- No
- iss
- No
- Headers
- No
- stdio
- No
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
- Not published
- OAuth flow
- No
- Registration
- No
- Metadata doc
- No
- Client ID
- No
- resource
- No
- iss
- No
- Headers
- No
- stdio
- No
- Streamable HTTP
- Yes
- Legacy SSE
- No
- Revision
- Not published
- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Unknown
- Client ID
- Yes
- resource
- Unknown
- iss
- Unknown
- Headers
- Unknown
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- No
- Revision
- Not published
- OAuth flow
- Yes
- Registration
- Unknown
- Metadata doc
- Unknown
- Client ID
- Unknown
- resource
- Unknown
- iss
- Unknown
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
2025-06-18- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- No
- Client ID
- Yes
- resource
- Yes
- iss
- No
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
- Not published
- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Unknown
- Client ID
- Yes
- resource
- Unknown
- iss
- Unknown
- Headers
- Partial
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Partial
- Revision
2025-11-25- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Partial
- Client ID
- Yes
- resource
- Partial
- iss
- Unknown
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
- Not published
- OAuth flow
- Yes
- Registration
- Unknown
- Metadata doc
- Unknown
- Client ID
- Unknown
- resource
- Unknown
- iss
- Unknown
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Partial
- Revision
- Not published
- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Unknown
- Client ID
- Yes
- resource
- Yes
- iss
- Unknown
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Unknown
- Revision
2025-11-25- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Yes
- Client ID
- No
- resource
- Yes
- iss
- Unknown
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Partial
- Revision
- Not published
- OAuth flow
- Unknown
- Registration
- Unknown
- Metadata doc
- Unknown
- Client ID
- Unknown
- resource
- Unknown
- iss
- Unknown
- Headers
- Unknown
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Unknown
- Revision
2026-07-28- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Unknown
- Client ID
- Yes
- resource
- Unknown
- iss
- Unknown
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
2025-11-25at most- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Unknown
- Client ID
- Yes
- resource
- Unknown
- iss
- Unknown
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
2025-11-25- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Partial
- Client ID
- Yes
- resource
- Partial
- iss
- No
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
2025-11-25- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Yes
- Client ID
- Yes
- resource
- Yes
- iss
- No
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
2025-11-25- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Yes
- Client ID
- Yes
- resource
- Yes
- iss
- Unknown
- Headers
- Yes
- stdio
- Yes
- Streamable HTTP
- Yes
- Legacy SSE
- Yes
- Revision
2026-07-28- OAuth flow
- Yes
- Registration
- Yes
- Metadata doc
- Yes
- Client ID
- Yes
- resource
- Yes
- iss
- Yes
- Headers
- Yes
Transports and protocol revision
Whether a client can reach your server, and which revision it puts on the wire.
| Client | stdio | Streamable HTTP | Legacy HTTP+SSE | Protocol revision |
|---|---|---|---|---|
| claude.ai, Claude Desktop, mobile, and Cowork connectors Client notes Hosted connector runtime | Partial | Yes | Unknown | initialize era |
| ChatGPT connectors and apps Client notes Hosted connector runtime | Partial | Yes | Unknown | Not published |
| Claude Code Client notes Terminal agent | Yes | Yes | Partial | initialize era |
| Claude Agent SDK Client notes SDK | Yes | Yes | Yes | initialize era |
| Claude Managed Agents Client notes Hosted agent runtime | No | Yes | Partial | initialize era |
| Messages API MCP connector Client notes API | No | Yes | Yes | 2025-11-25 |
| OpenAI Responses API mcp tool Client notes API | No | Yes | Yes | Not published |
| Microsoft Copilot Studio Client notes Automation platform | No | Yes | No | Not published |
| Codex CLI Client notes Terminal agent | Yes | Yes | No | Not published |
| Gemini CLI Client notes Terminal agent | Yes | Yes | Yes | 2025-06-18 |
| Cursor Client notes Editor | Yes | Yes | Yes | Not published |
| VS Code and GitHub Copilot Client notes Editor | Yes | Yes | Partial | 2025-11-25 |
| Devin Desktop, legacy Cascade agent Client notes Editor | Yes | Yes | Yes | Not published |
| Devin CLI Client notes Terminal agent | Yes | Yes | Partial | Not published |
| Zed Client notes Editor | Yes | Yes | Unknown | 2025-11-25 |
| JetBrains AI Assistant Client notes Editor | Yes | Yes | Partial | Not published |
| MCP Inspector 2.0.0 Client notes Reference tooling | Yes | Yes | Unknown | 2026-07-28 |
| mcp-remote 0.1.38 Client notes Bridge | Yes | Yes | Yes | 2025-11-25 at most |
| MCP TypeScript SDK 1.29.0 Client notes Reference SDK, 1.x line | Yes | Yes | Yes | 2025-11-25 |
| MCP Python SDK 1.29.0 Client notes Reference SDK, 1.x line | Yes | Yes | Yes | 2025-11-25 |
| MCP TypeScript SDK 2.0.0 Client notes Reference SDK, 2.x line | Yes | Yes | Yes | 2025-11-25 |
| MCP Python SDK 2.0.0 Client notes Reference SDK, 2.x line | Yes | Yes | Yes | 2026-07-28 |
Client support last verified July 31, 2026 against the 2026-07-28 revision. That is the oldest date across these rows, so a stale row can't hide behind a fresher one.
Where clients disagree, and what it costs you
No cell can show these, because each one is a difference between clients rather than a fact about any single client. Each also decides something you have to build around.
- The resource parameter splits three ways
- Zed, Gemini CLI, and the Python SDK send
resourceunconditionally. VS Code and anything on the TypeScript SDK 1.x line send it only after discovering RFC 9728 protected resource metadata, so a server that publishes none never receives it. Devin CLI sends it by default and lets you switch it off. If your server validates a token audience, that one column decides whether a client can ever obtain a token you'll accept. - The iss check has reached one row
- The
2026-07-28revision makes validating a present RFC 9207issa client MUST. The check landed in the reference SDKs' 2.x line, and the MCP Python SDK 2.0.0 is the only row here that has it — every other client pins 1.x or publishes no revision, so the column reads No or Unknown across the rest of the table. Read that as a gap the ecosystem has not closed yet rather than a fault in any one client, and don't assume a caller validated the issuer for you. - The two hosted runtimes disagree about static credentials
- ChatGPT refuses machine-to-machine grants, service accounts, JWT bearer assertions, custom API keys, and customer-supplied client certificates, and says so outright. claude.ai refuses the machine-to-machine grant too, but offers a beta request-header path with an allowlist of header names. So a server that authenticates with an API key can reach one of them, conditionally, and not the other.
- A header can win or lose against OAuth discovery
- Zed treats a configured
Authorizationheader as a decision and skips the OAuth flow. Cursor starts the flow first and never sends the header, which its own staff confirmed as a bug. Claude Code does something different again: a rejectedAuthorizationheader fails the connection rather than falling back. Same configuration, three outcomes.
What this page doesn't cover
Clients not listed
Agent frameworks and automation platforms aren't here yet: the OpenAI Agents SDKs, LangChain's MCP adapters, the Vercel AI SDK, Pydantic AI, Mastra, CrewAI, AutoGen, Semantic Kernel, n8n, and Zapier. Neither are Cline, Continue, Goose, LibreChat, Antigravity, Amazon Q Developer, Kiro, Warp, or JetBrains Air. A client lands on this page when every column can be answered from its own documentation, source, or release notes — a half-sourced row is worse than an absent one, because the value of the grid is that each cell is checkable.
One inheritance rule covers most of the missing names in the meantime. A framework that delegates MCP to a reference SDK inherits that SDK's cells, so the two 1.x rows in these tables are the ceiling for anything pinned to the 1.x line.
Protocol features
Sampling, elicitation, roots, logging, progress, structured output, tool annotations, and the tasks extension aren't columns here. The 2026-07-28 revision deprecates three of them and replaces server-initiated requests with multi-round-trip requests, so one grid would describe two different wires at once and read as a single answer.
Metadata documents per identity provider
The provider table has no column for client ID metadata documents. That support isn't verified per provider yet, and until it is, the column would be unknown end to end. Its Registration column records what each provider does, which is a different question from what the current revision recommends.
Tool caps and timeouts
Three tool caps here have a current citable source — VS Code's and Copilot Studio's 128, and Cascade's 100 — and they sit in those clients' notes rather than in a column. Widely repeated numbers for other clients trace back to forum threads and appear in no current documentation, so they're absent. The most-repeated of them, a 40-tool cap for Cursor, is named in Cursor's notes precisely so nobody reads its blank cell as a confirmation.
Errors these gaps produce
When a mismatch in these tables turns into a failed connection, the string your client printed is in the MCP error reference.
The detail behind the cells
One policy engine for APIs, AI, and MCP
A gateway in front of your MCP servers answers discovery, binds token audiences, and validates tokens once — for every server and every client in this matrix.