MCP clients

Hosted connector runtime

claude.ai, Claude Desktop, mobile, and Cowork connectors One hosted runtime backs all four surfaces, and it connects from Anthropic's infrastructure rather than from the reader's machine — which is why DNS, redirect, and firewall behavior differ from every local client here. initialize era Client notes ChatGPT connectors and apps The strictest of the two big chat hosts on credentials: user-consented OAuth or nothing. Streamable HTTP is required, and ChatGPT prefers a client ID metadata document over dynamic registration. Not published Client notes

Terminal agent

Claude Code The most configurable client here on every axis except protocol revision: four transports, its own client metadata document, flags for a client ID and callback port, an override for the discovery chain, and a command hook that generates headers at connection time. initialize era Client notes

SDK

Claude Agent SDK Same engine as Claude Code without the browser, so authorization is headers only in practice. Server status is observable per server, which is how you find out a token expired. initialize era Client notes

Hosted agent runtime

Claude Managed Agents Credentials live in a vault keyed by server URL, in one of two shapes: a static bearer token, or an OAuth access token with an optional refresh block. The agent declares servers; the session supplies credentials. initialize era Client notes

API

Messages API MCP connector The thinnest Anthropic client by design: tool calls only, one bearer token per server, and no local servers. Anthropic documents that you obtain and refresh the token before the API call. 2025-11-25 Client notes OpenAI Responses API mcp tool A bearer-token relay rather than an OAuth client, and the one client here that accepts the legacy HTTP+SSE transport without calling it deprecated. Not published Client notes

Automation platform

Microsoft Copilot Studio Streamable HTTP only, and the connector path wants Microsoft's own protocol marker in the OpenAPI document. Generative orchestration has to be on before MCP works at all, and it caps an agent at 128 tools. Not published Client notes

Terminal agent

Codex CLI Two kinds of server, a local process or an address, with per-server tool allowlists and short default timeouts: 10 seconds to start a server and 60 seconds for a tool call. Not published Client notes Gemini CLI The strictest resource behavior after Zed: Gemini CLI derives the value from the server URL rather than from protected resource metadata, so it sends it even when your server publishes none. It also rewrites tool names aggressively, forcing an mcp_ prefix and truncating at 64 characters. 2025-06-18 Client notes

Editor

Cursor Cursor's own table lists all three transports with no deprecation note on SSE, and marks the two HTTP transports as OAuth-capable. Variable interpolation works in the command, arguments, environment, URL, headers, and auth fields. Not published Client notes VS Code and GitHub Copilot VS Code negotiates the transport for you: it tries the HTTP stream transport and falls back to SSE. It also accepts two transports nothing else here does, a Unix socket and a named pipe, and it caps a request at 128 tools. 2025-11-25 Client notes Devin Desktop, legacy Cascade agent This is the client most people still call Windsurf. It runs OAuth on all three transports, interpolates environment variables and file contents into configuration, and caps the agent at 100 tools. Not published Client notes

Terminal agent

Devin CLI The current default agent in Devin, and the only client here that lets you turn the resource parameter off. Configuration reads from three tiers, with the gitignored local file first. Not published Client notes

Editor

Zed The strictest RFC 8707 behavior in this matrix: source appends resource to the authorization URL, the token exchange, and the refresh, unconditionally. Zed follows the specification's registration priority, preferring a metadata document and falling back to dynamic registration. 2025-11-25 Client notes JetBrains AI Assistant The authorization row is unknown end to end, and that's the finding rather than a gap in our research: the MCP page documents no authentication mechanism at all. Not published Client notes

Reference tooling

MCP Inspector 2.0.0 Released the same day as the 2026-07-28 revision, as one package with a web, CLI, and terminal client. It's the reference client for the current revision and the only one here that drives the tasks extension. 2026-07-28 Client notes

Bridge

mcp-remote 0.1.38 The bridge that retrofits OAuth onto a client that lacks it, by presenting a remote server over stdio. Its --transport flag chooses which HTTP transport to try first, and it keeps a separate token cache per combination of URL, resource, and headers. 2025-11-25 at most Client notes

Reference SDK, 1.x line

MCP TypeScript SDK 1.29.0 The 1.x line is where most frameworks and agents actually sit. Two of its cells explain a whole class of support tickets: resource is conditional on protected resource metadata, and there's no issuer validation at all. 2025-11-25 Client notes MCP Python SDK 1.29.0 More permissive than the TypeScript 1.x line on two cells: it sends resource unconditionally and takes a metadata document URL directly. It still performs no issuer validation. 2025-11-25 Client notes

Reference SDK, 2.x line

MCP TypeScript SDK 2.0.0 Any framework that delegates MCP to this SDK inherits its revision. Note that the default is still the 2025-era protocol even at 2.0.0 — the version number and the wire revision move independently. 2025-11-25 Client notes MCP Python SDK 2.0.0 The two reference SDKs made opposite default choices at version 2.0.0, and this is the half that defaults to the current revision. It's also the only row here with a yes in the issuer-validation column. 2026-07-28 Client notes