An unchanged laravel/mcp 0.9 setup can begin returning HTTP 400 after a Composer update. In 1.0, every POST must carry matching `MCP-Protocol-Version` and `Mcp-Method` headers. Requests such as `tools/call` also require `Mcp-Name`. Failures use JSON-RPC code `-32020`, even when the application code and tool classes have not changed.

terminal
grep -rn "sessionId()\|setSessionId(\|SessionInitialized" app/

The release adopts MCP revision 2026-07-28 and replaces the `initialize` handshake with `server/discover`. Requests no longer use server-side sessions. Each HTTP request and stdio message carries the protocol version and client capabilities through `params._meta`. The `sessionId()`, `setSessionId($id)`, and `SessionInitialized` APIs are gone. Applications must pass context explicitly through tool arguments or `_meta`, for example with a `correlation_id`. This supports horizontal scaling without sticky sessions or a shared session store.

Older clients still have a compatibility path. An `initialize` request using protocol revisions `2025-06-18` or `2025-11-25` can negotiate as before, so servers consumed by external agents need tests for both protocol eras.

Tool discovery also changes. Agents can use `search_tools` and `execute_tools` instead of receiving every tool schema at connection time. A server can still declare tools such as `SearchOrders` and `GetCustomer` in its `tools` array. The Statamic MCP server now exposes three tools on connection and keeps eight behind search. Cache hints can mark responses as reusable, provide a lifetime, and define their privacy scope. The Laravel MCP client honors these hints when consuming another server.

OAuth integration now requires PKCE. When an authorization server does not advertise `code_challenge_methods_supported`, `redirect()` fails before sending the user to the authorization endpoint. Client ID Metadata Documents are the preferred registration mechanism. Dynamic Client Registration remains available but is deprecated under MCP 2026-07-28.

The upgrade guide should be read before changing the package. Teams need to locate removed session symbols, move context into explicit identifiers, audit third-party OAuth metadata, choose which tools belong in the connection-time catalog, and test both protocol eras. Treating the change as a routine Composer update can leave every `tools/call` request failing with `-32020`.