MCP: Agree the supported protocol and authentication policy #2624

Tracking issue: #2408.

Tracking correspondence: G1 and the policy governing L1/L2. Contract decisions only. Shared requirement IDs remain stable across the delivery plan and #2408.

Decision

The launch policy is MCP 2026-07-28 minimum, with newer revisions added only after implementation and qualification. Reject older revisions and remove session-based flows. MCP is OAuth-only at launch. Do not accept manually supplied AstraCS tokens or fall back to Token/token/X-Cassandra-Token at the MCP endpoint. The ordinary Data API HTTP authentication policy is a separate surface.

The initial supported-version set is 2026-07-28. Do not accept arbitrary future dates through a >= comparison. A newer client can use this revision when it actually supports it. Keep admission, server/discover and published support policy consistent.

The removed MCP initialize handshake is distinct from the OAuth authorization handshake required for launch. No client vendor is the primary target. Qualify conforming clients independently, including IBM Bob, and publish exact tested builds rather than claiming universal support from one SDK.

Work

• Agree the supported protocol set and qualification matrix fields, including OAuth registration and redirect modes. MCP: Test OAuth sign-in with supported clients #2633 supplies actual client evidence.
• Specify no legacy initialize/session requirement, no legacy transport route, GET/DELETE returning 405, and no missing-version fallback to an old revision. Ignore obsolete session/replay headers on an otherwise valid modern request without minting state.
• Require OAuth access tokens for protected discovery, listing and calls. Keep protected-resource metadata reachable so authorization can begin. Preserve the separate HTTP API policy.
• Record MCP-disabled behavior so discovery and lists cannot expose protected data. Record the approved browser Origins and native-client behavior when Origin is absent.
• Agree migration requirements for client upgrades, OAuth reconnect/consent and removal of manually configured MCP tokens. MCP: Publish connection and migration instructions #2643 publishes the user guide.

Done when

• The version set, OAuth-only boundary, capability inventory and disabled-MCP behavior are agreed and linked here.
• Required Origin/registration modes, migration requirements and qualification criteria are recorded with the decision owner.

Close on the agreed contract. Implementation is #2625/#2642, raw HTTP verification is #2626, client qualification is #2633 and deployment is #2634. This ticket does not wait for those downstream tickets to close.

Changelog traceability

• M1 Remove protocol sessions, lines 12 — Required.
• M2 Remove initialization, lines 14 — Required.
• D2 Retire the old HTTP plus SSE transport, lines 82–85 — Required.
• G1 Track feature lifecycle, lines 107–112 — Process.

Normative detail: Streamable HTTP, authorization, caching.