[claude-yolo]

Night shift report

WHY THIS MATTERS: No Claude Code release tonight (still v2.1.316), and nothing was deleted, tombstoned or discovered. The signal is in the MCP docs. The quickstarts now state outright that the stable Java and Kotlin SDKs only speak protocol 2025-11-25, so servers and clients built from those tutorials can't connect to a peer that accepts only 2026-07-28. Anyone mixing SDKs across the new spec version will run into that. The MCP Inspector also documents features that matter for CI and deployment: load testing with error-rate and p99 gates, a rate-limit exit code, HTTPS for the web UI and a Host header allowlist. Everything else in the run is routine refresh.

HIGHLIGHTS:

• Java/Kotlin SDKs vs. 2026-07-28: new notes in build-server.md / build-client.md (both 2026-07-28/ and draft/) say the latest stable Java and Kotlin SDKs speak 2025-11-25 only, so they can't connect to 2026-07-28-only peers. Each note links to the spec's backward-compatibility section.
• MCP Inspector CLI load testing: --load with --load-concurrency, --load-connections, --load-rate, --load-duration and --load-requests, plus --load-max-error-rate and --load-max-p99 CI gates. Two new exit codes: 10 (load threshold breached) and 11 (HTTP 429, rate_limited envelope with retryAfter/retryAfterMs).
• Inspector security and deployment settings: MCP_INSPECTOR_ALLOWED_HOSTS (any Host header not on the list gets a 403, for use behind reverse proxies), INSPECTOR_TLS_KEY_PATH/INSPECTOR_TLS_CERT_PATH to serve the web UI over HTTPS (no fallback to http), and NO_COLOR. A new table lists every server-config field with its default, including the oauth.* options (revokeOnClear, scopeOnRefresh, onInsufficientScope, endpoint overrides). "type": "http" is now accepted as an alias.
• Rust client quickstart rewritten: drops the genai crate and calls the Messages API directly with reqwest, which keeps signed thinking blocks intact. Uses rmcp 3.4 (client features only), validates structured tool results with jsonschema, and adds turn and timeout limits. Requires Rust 1.88+.
• Spring AI and Kotlin fixes: tool callbacks are now documented as enabled by default (the docs said disabled), the chat-memory API is updated, Spring Boot 4.1.x is required, Kotlin SDK goes 0.9.0 → 0.16.0, and the jar path and cd path are fixed.
• Draft auth tutorial (C#): the missing .csproj (ModelContextProtocol 2.0.0) and MathTools.cs files are added, and ResourceMetadata now takes strings instead of Uri.
• MCP Security Interest Group restructured into a triage-and-routing group. A monthly agenda-driven call and a monthly digest replace the biweekly office hours.
• Claude Desktop (third-party) import: HIPAA-ready orgs can't enable member data export, so claude.ai chat import doesn't work for their members. They can still import local Cowork and Code sessions unless allowedOrganizationUuids is set.
• Debugging guide adds the Linux Claude Desktop log path (~/.config/Claude/logs).
• Noise: all 36 support-article diffs are re-signed Intercom image URLs, plus the .metadata.json timestamps.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning