# Fix: header-routed tools/list (2026-07-28) returns tools without initialize

> Web-audit fix skill for the `mcp-modern-tools-list` check (MCP, MUST).

## Goal

Answer a modern header-routed tools/list without requiring an initialize handshake.

## Fix

Serve the modern MCP era (protocol revision `2026-07-28`): answer a `POST` whose headers
carry `MCP-Protocol-Version: 2026-07-28` and `Mcp-Method: tools/list` with a `result.tools`
array, with no prior `initialize` or `notifications/initialized`. Modern requests are
per-request enveloped: `params._meta` carries `io.modelcontextprotocol/protocolVersion`,
`io.modelcontextprotocol/clientInfo`, and `io.modelcontextprotocol/clientCapabilities`.
The `clientCapabilities` key is mandatory on every modern request; reject a request that
omits it with a well-formed `-32602`. `Mcp-Name` rides only `tools/call` (the tool name)
and `resources/read` (the resource URI), never `tools/list`.

## Resources

- [MCP lifecycle (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/basic/lifecycle)
- [MCP tools (2026-07-28)](https://modelcontextprotocol.io/specification/2026-07-28/server/tools)

## Copy-paste prompt

Paste this into your coding agent. [Your audit](https://anc.dev/audit) adds what it observed for this check:

```text
Goal: Answer a modern header-routed tools/list without requiring an initialize handshake
Fix: Serve the modern MCP era (protocol revision `2026-07-28`): answer a `POST` whose headers carry `MCP-Protocol-Version: 2026-07-28` and `Mcp-Method: tools/list` with a `result.tools` array, with no prior `initialize` or `notifications/initialized`. Modern requests are per-request enveloped: `params._meta` carries `io.modelcontextprotocol/protocolVersion`, `io.modelcontextprotocol/clientInfo`, and `io.modelcontextprotocol/clientCapabilities`. The `clientCapabilities` key is mandatory on every modern request; reject a request that omits it with a well-formed `-32602`. `Mcp-Name` rides only `tools/call` (the tool name) and `resources/read` (the resource URI), never `tools/list`.
Skill: https://anc.dev/fix/mcp-modern-tools-list
Docs: https://modelcontextprotocol.io/specification/2026-07-28/basic/lifecycle, https://modelcontextprotocol.io/specification/2026-07-28/server/tools
```

## Verify

Re-run the audit at [https://anc.dev/audit](https://anc.dev/audit) or call the `audit_website` MCP tool; the `mcp-modern-tools-list` check should report `pass`.