What the Newest MCP Version Means for M&A Tools With an MCP Server
The newest Model Context Protocol specification, MCP 2026-07-28, is a partly breaking rewrite of the 2025-11-25 version. It shifts MCP from a session-oriented, bidirectional protocol to a stateless request/response model built for enterprise-scale agent platforms. For M&A tools — VDRs, target scouts, IP-intelligence engines, DD workbenches — that already ship an MCP server, this is a real migration, not a cosmetic bump.
From sessions to stateless calls
initialize, initialized, and Mcp-Session-Id are gone. Each request now carries version, capabilities, and client identity in _meta. For M&A tools, that means the MCP layer can no longer be your carrier for deal state. A DD assistant can no longer assume "this session belongs to Project Falcon." Instead, every tool must accept explicit handles like engagement_id, dataroom_id, or target_id. Practically: your Prolog/graph reference model, your target lists, and your findings database now become the single source of truth — MCP is just the transport.
Upside: horizontal scaling, gateway routing, and multi-tenant isolation become straightforward. That matters when a Big Four buyer or a boutique like PATEV wants to place your MCP behind their own gateway.
Interactive DD without server-initiated calls
sampling/createMessage, elicitation/create, and roots/list are replaced by Multi Round-Trip Requests (MRTR). Instead of the server pushing "please clarify," it responds with resultType: "input_required", and the client resubmits with inputResponses.
For M&A this is actually a natural fit. A tool call like run_financial_dd(target_id) can pause and ask "Which fiscal year definition applies?" or "Confirm the IFRS-to-HGB reconciliation basis?" — all inside one auditable request thread. That is much easier to log, replay, and defend in a QoE workpaper than an opaque bidirectional stream.
Caching, discovery, and gateway control
server/discover is now mandatory — buyers can inspect capabilities before wiring you in.
Mcp-Method and Mcp-Name headers let corporate gateways route and authorize by tool, without parsing bodies. Expect procurement to require this.
ttlMs / cacheScope on lists and resources means a target catalog or patent family list can be cached deterministically — cheaper prompt-cache hits, less polling against your backend.
Long-running DD workflows
Tasks move out of the core into the io.modelcontextprotocol/tasks extension, with tasks/get and tasks/update. A full technical DD, patent freedom-to-operate check, or QoE run is exactly this shape: kick off, poll, receive incremental deliverables. Model these explicitly as tasks now rather than relying on the old long-lived connection.
Security and deprecations you must plan for
OAuth iss validation and issuer-bound credentials are required.
Dynamic Client Registration is deprecated; migrate toward Client ID Metadata Documents (CIMD).
HTTP+SSE transport, ping, logging/setLevel, and SSE resume are gone. Streamable HTTP is the target.
Bottom line for M&A tool builders
MCP 2026-07-28 makes your product genuinely enterprise-deployable — behind API gateways, WAFs, and issuer-bound OAuth — at the cost of a real migration. Move deal state into your domain model, expose explicit handles, adopt tasks and MRTR for anything interactive or long-running, and treat this as the moment your MCP becomes an actual enterprise integration surface rather than a demo transport.
Source: MCP specification 2026-07-28, modelcontextprotocol.io.
Advertising section
Build your AI skills by licensing our offerings
A Modern Post-Merger Integration Playbook: From M&A Models to AI Solutions
By Dr. Karl Michael Popp
Master integration due diligence to transform your M&A success. Learn more at manda-automation.com