Handshake Tool Checks MCP Server Compatibility After July 2026 Spec Changes

·22 views

A developer tool called Handshake has been built to help MCP server authors identify which clients will break following the Model Context Protocol revision dated 28 July 2026. The update dropped several methods including initialize, Mcp-Session-Id, ping, and logging/setLevel, while adding new features like server/discover and cache hints. Handshake accepts a server manifest and outputs a colour-coded grid showing per-feature, per-client compatibility verdicts sourced from Sanity-hosted spec and client-support content. The tool uses a deterministic function rather than an AI model to assign verdict colours, achieving 16 correct results out of 18 test cases compared to just 6 for keyword search. Content is structured to enable multi-fact joins, such as flagging Cursor's Roots support as amber because the client docs still list it as supported while the spec marks it deprecated since July 2026.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Pagure Token Scoping and Forge Exposure: Index Counts and Review Guidance

An analysis of Pagure, a self-hosted git forge, examines how many public instances appear in the ZoomEye search index. Count-only queries on November 9, 2026 returned 22 title matches, 181 body-domain matches, and zero application fingerprints. The author notes that body matches are only candidates and that the counts do not prove any instance is public or misconfigured. The piece distinguishes project-scoped tokens, which limit access to one repository, from project-less user tokens that can act across projects and resemble a password for the forge identity. It recommends auditing token scope, ACLs, expiry, last use, and related SSH keys, deploy keys, and CI webhooks, along with restricting management interfaces and running controlled authorization tests.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OpenCode Warns Some Users' AI Provider Keys Were Exposed in Console Breach

OpenCode, an open-source AI coding project, told some users of its hosted Console on October 17, 2026 that third-party provider keys stored in their workspaces may have been exposed. The company said 1.4% of Console users, those who had linked providers such as OpenAI, Anthropic and Google, were affected. Reports say attackers entered through a legacy system the project was preparing to retire, and that Anthropic and Google blocked keys believed to be compromised. One report indicates OpenAI was refunding affected customers, though OpenCode has not detailed how many keys were involved or how the intrusion occurred. The incident was part of a wider October pattern in which several companies disclosed breaches exposing API keys, tokens or environment variables.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hard vs. Soft Payment Declines: Why Retry Systems Must Split Them First

Developers handling payment declines should first determine whether a refusal is final or temporary, since this single distinction shapes every retry decision. Hard declines reflect the credential itself, such as a closed or stolen card, and repeated attempts are futile and can harm the descriptor's standing with issuers. Soft declines stem from transient conditions like insufficient funds or incomplete authentication, and they respond better to spaced retries, credential checks, and a single early customer message. Grey-zone cases, including authentication-required and generic responses, need explicit routing based on transaction history. Splitting outcomes into this branch also yields clearer metrics that reveal whether problems lie in scheduling or customer messaging.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo Maintainer Ships Turso PHP Extension Reliability Overhaul and Installer Fix

A freelance engineer who maintains Turso and libSQL PHP tools in spare time reported major progress on November 9, 2026. The core turso-client-php project merged a reliability overhaul fixing crash-prone error handling, memory safety issues, statement reuse bugs, and configuration problems. A follow-up release, turso-php-extension v1.7.0, restored Windows builds and added PHP 8.5 binaries, with Windows NTS support deferred to v1.7.1. The installer project also closed a long-standing PHP 8.5 issue by suppressing a PDO deprecation warning at the entry point. The author noted that the underlying libSQL engine was not upgraded in this release, focusing instead on stability and compatibility.

0 comments Read more at DEV Community