When using HTTP transports, the connection is typically stateless. However, MCP requires a stateful session to keep track of capabilities, roots, and subscriptions.
To solve this, the server assigns a unique Session Identifier upon initialization. In the 2025 HTTP transport spec, this is often implemented as a sessionId query parameter or HTTP header.
Upon connection, the Client and Server perform a handshake:
capabilities (e.g., "I support roots and sampling").capabilities (e.g., "I support tools and prompts").MCP Apps extend the protocol to allow servers to return interactive user interfaces — forms, dashboards, and visualisations rendered in sandboxed iframes — directly within host applications like Claude, ChatGPT, and VS Code. This transforms MCP from a data-only protocol into a full interactive experience layer.
Tool annotations provide metadata about tool behaviour — marking tools as read-only or destructive. Clients use these annotations to make informed decisions about approval workflows, enabling auto-approval of safe read-only tools while requiring explicit confirmation for destructive operations like file deletion or database writes.