Internals

How MCP actually works underneath the patterns: the roles, the capability primitives, the wire transports, and the message flow, plus the part this repo exists for: what changes when the server is a Vercel Function instead of a resident process. As of the 2026-07-28 revision the protocol itself is stateless, so that fit is now native rather than negotiated. Start with the overview, then dip into the specific mechanism you need. If you only read one page beyond the overview, read serverless sessions; it is where cross-call state lives now that the protocol no longer defines sessions at all.

Pages

• MCP internals overview - host, client, and server roles; the stateless per-request model (no handshake, no session, every request carries its own version and capabilities); why each client-server pairing stays isolated; and the security implications that follow when every server is a remote HTTP endpoint.
• Capability primitives - the building blocks a server exposes (tools, resources, prompts) and the auxiliary ones, including how a server gets model inference or user input under 2026-07-28: an input_required result the client answers by retrying (MRTR), with roots, sampling, and logging documented as deprecated. Plus who is in control of each and the full method reference.
• Transports - Streamable HTTP in depth (one POST per message, per-request SSE streams, the mirrored Mcp-Method/Mcp-Name headers, subscriptions/listen, the Origin-check 403), stdio for local development, and the earlier shapes as history: the session-and-resumability era of Streamable HTTP and the legacy HTTP+SSE transport with its Redis-on-Vercel caveat.
• Serverless sessions - the flagship page: the protocol dropped sessions (SEP-2567) and adopted the shape functions always forced, so this page covers where cross-call state can still live (server-minted handles, an external store, or nowhere), Fluid compute instance reuse, and what maxDuration means for long tool calls.
• The 2026-07-28 stateless revision - the revision-history record: what the now-current published revision changed relative to 2025-11-25, why serverless is its happy path, and what the pinned handler and SDK client each emit on the wire.
• Annotated message trace - a complete JSON-RPC exchange walked line by line under 2026-07-28, from optional discovery through a tool call and the input_required retry loop, including the HTTP layer a deployed server actually sees.
• Tasks (extension) - the official io.modelcontextprotocol/tasks extension (moved out of core in 2026-07-28) for long-running work behind a pollable task handle, and how it relates to the async-jobs backing store.

Where to look now

• Patterns - how these mechanisms compose into deployable shapes on Vercel.
• Security - the authorization and identity rules that ride on top of the transport and lifecycle described here.
• Deployment - the Vercel project mechanics (vercel.json, environments, Deployment Protection) that every internals page assumes.