MCP conformance matrix
Generated by internal/conformance (MCPX_UPDATE_MATRIX=1 go test ./internal/conformance -run TestMatrix); do not edit.
Generated from inputs 247a9508b4eda6e7 (sha256 of docs/spec/requirements.md, internal/conformance/overrides/.json, internal/conformance/coverage.go, internal/conformance/authsplit.json). TestMatrix regenerates this file and fails when it differs, so it describes the tree it is committed in.
Every normative requirement of every revision (catalogue: docs/spec/requirements.md), for mcpx as a server and as a client. A requirement is tested when a named test verifies it in that revision, n/a when it does not bind mcpx in that role, and a gap when it binds mcpx and mcpx does not meet it yet, with the issue that tracks it. Run exactly the covering tests with go run ./internal/conformance/cmd/covering.
Summary
| revision | side | level | applies | tested | gap | missing | n/a |
|---|---|---|---|---|---|---|---|
| 2024-11-05 | server | MUST | 32 | 31 | 1 | 0 | 22 |
| 2024-11-05 | server | MUST NOT | 6 | 6 | 0 | 0 | 4 |
| 2024-11-05 | server | SHOULD | 36 | 35 | 1 | 0 | 45 |
| 2024-11-05 | server | SHOULD NOT | 1 | 1 | 0 | 0 | 1 |
| 2024-11-05 | server | MAY | 9 | 9 | 0 | 0 | 15 |
| 2024-11-05 | server | other | 11 | 11 | 0 | 0 | 1 |
| 2024-11-05 | client | MUST | 26 | 25 | 1 | 0 | 28 |
| 2024-11-05 | client | MUST NOT | 9 | 9 | 0 | 0 | 1 |
| 2024-11-05 | client | SHOULD | 31 | 26 | 5 | 0 | 50 |
| 2024-11-05 | client | SHOULD NOT | 1 | 1 | 0 | 0 | 1 |
| 2024-11-05 | client | MAY | 9 | 9 | 0 | 0 | 15 |
| 2024-11-05 | client | other | 7 | 7 | 0 | 0 | 5 |
| 2025-03-26 | server | MUST | 44 | 43 | 1 | 0 | 37 |
| 2025-03-26 | server | MUST NOT | 7 | 7 | 0 | 0 | 8 |
| 2025-03-26 | server | SHOULD | 45 | 44 | 1 | 0 | 58 |
| 2025-03-26 | server | SHOULD NOT | 4 | 3 | 1 | 0 | 1 |
| 2025-03-26 | server | MAY | 16 | 16 | 0 | 0 | 21 |
| 2025-03-26 | server | other | 11 | 11 | 0 | 0 | 1 |
| 2025-03-26 | client | MUST | 35 | 31 | 4 | 0 | 46 |
| 2025-03-26 | client | MUST NOT | 12 | 11 | 1 | 0 | 3 |
| 2025-03-26 | client | SHOULD | 39 | 33 | 6 | 0 | 64 |
| 2025-03-26 | client | SHOULD NOT | 2 | 1 | 1 | 0 | 3 |
| 2025-03-26 | client | MAY | 15 | 15 | 0 | 0 | 22 |
| 2025-03-26 | client | other | 7 | 7 | 0 | 0 | 5 |
| 2025-06-18 | server | MUST | 52 | 51 | 1 | 0 | 49 |
| 2025-06-18 | server | MUST NOT | 10 | 9 | 1 | 0 | 8 |
| 2025-06-18 | server | SHOULD | 48 | 47 | 1 | 0 | 67 |
| 2025-06-18 | server | SHOULD NOT | 4 | 3 | 1 | 0 | 1 |
| 2025-06-18 | server | MAY | 15 | 15 | 0 | 0 | 20 |
| 2025-06-18 | server | other | 15 | 15 | 0 | 0 | 3 |
| 2025-06-18 | client | MUST | 42 | 37 | 5 | 0 | 59 |
| 2025-06-18 | client | MUST NOT | 13 | 11 | 2 | 0 | 5 |
| 2025-06-18 | client | SHOULD | 48 | 40 | 8 | 0 | 67 |
| 2025-06-18 | client | SHOULD NOT | 2 | 1 | 1 | 0 | 3 |
| 2025-06-18 | client | MAY | 13 | 13 | 0 | 0 | 22 |
| 2025-06-18 | client | other | 10 | 8 | 2 | 0 | 8 |
| 2025-11-25 | server | MUST | 102 | 98 | 4 | 0 | 78 |
| 2025-11-25 | server | MUST NOT | 22 | 19 | 3 | 0 | 13 |
| 2025-11-25 | server | SHOULD | 73 | 65 | 8 | 0 | 86 |
| 2025-11-25 | server | SHOULD NOT | 11 | 10 | 1 | 0 | 3 |
| 2025-11-25 | server | MAY | 25 | 25 | 0 | 0 | 30 |
| 2025-11-25 | server | other | 19 | 19 | 0 | 0 | 2 |
| 2025-11-25 | client | MUST | 65 | 57 | 8 | 0 | 115 |
| 2025-11-25 | client | MUST NOT | 16 | 14 | 2 | 0 | 19 |
| 2025-11-25 | client | SHOULD | 58 | 48 | 10 | 0 | 101 |
| 2025-11-25 | client | SHOULD NOT | 5 | 4 | 1 | 0 | 9 |
| 2025-11-25 | client | MAY | 17 | 17 | 0 | 0 | 38 |
| 2025-11-25 | client | other | 13 | 11 | 2 | 0 | 8 |
| 2026-07-28 | server | MUST | 113 | 109 | 4 | 0 | 111 |
| 2026-07-28 | server | MUST NOT | 44 | 42 | 2 | 0 | 20 |
| 2026-07-28 | server | SHOULD | 69 | 65 | 4 | 0 | 91 |
| 2026-07-28 | server | SHOULD NOT | 11 | 10 | 1 | 0 | 9 |
| 2026-07-28 | server | MAY | 29 | 29 | 0 | 0 | 32 |
| 2026-07-28 | server | other | 23 | 22 | 1 | 0 | 4 |
| 2026-07-28 | client | MUST | 73 | 65 | 8 | 0 | 151 |
| 2026-07-28 | client | MUST NOT | 25 | 23 | 2 | 0 | 39 |
| 2026-07-28 | client | SHOULD | 66 | 57 | 9 | 0 | 94 |
| 2026-07-28 | client | SHOULD NOT | 13 | 11 | 2 | 0 | 7 |
| 2026-07-28 | client | MAY | 11 | 11 | 0 | 0 | 50 |
| 2026-07-28 | client | other | 13 | 11 | 2 | 0 | 14 |
2024-11-05
(security; not in area list)
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| security-implementors-guidelines | SHOULD | both | tested: conformance.TestMessagesServer/2024-11-05/security/security-implementors-guidelines | n/a: catalogue marks it n/a |
authorization
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| authorization-custom-auth-may | MAY | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
cancellation
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| cancellation-ref-same-direction-in-progress | MUST | both | tested: conformance.TestUtilitiesServer/2024-11-05/cancellation/cancellation-ref-same-direction-in-progress | tested: conformance.TestUtilitiesClient/2024-11-05/cancellation/cancellation-ref-same-direction-in-progress |
| cancellation-client-must-not-cancel-initialize | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2024-11-05/cancellation/cancellation-client-must-not-cancel-initialize |
| cancellation-receiver-should-stop-free-no-response | SHOULD | both | tested: conformance.TestUtilitiesServer/2024-11-05/cancellation/cancellation-receiver-should-stop-free-no-response | tested: conformance.TestUtilitiesClient/2024-11-05/cancellation/cancellation-receiver-should-stop-free-no-response |
| cancellation-receiver-may-ignore | MAY | both | tested: conformance.TestUtilitiesServer/2024-11-05/cancellation/cancellation-receiver-may-ignore | tested: conformance.TestUtilitiesClient/2024-11-05/cancellation/cancellation-receiver-may-ignore |
| cancellation-sender-ignore-late-response | SHOULD | both | tested: conformance.TestUtilitiesServer/2024-11-05/cancellation/cancellation-sender-ignore-late-response | tested: conformance.TestUtilitiesClient/2024-11-05/cancellation/cancellation-sender-ignore-late-response |
| cancellation-handle-races | MUST | both | tested: conformance.TestUtilitiesServer/2024-11-05/cancellation/cancellation-handle-races | tested: conformance.TestUtilitiesClient/2024-11-05/cancellation/cancellation-handle-races |
| cancellation-log-reasons | SHOULD | both | gap #77: a cancellation reason reaches Server.OnCancel, which nothing outside tests sets; it is never logged | tested: conformance.TestUtilitiesClient/2024-11-05/cancellation/cancellation-log-reasons |
| cancellation-ui-indicate | SHOULD | both | n/a: no UI | n/a: no UI |
| cancellation-ignore-invalid | SHOULD | both | tested: conformance.TestUtilitiesServer/2024-11-05/cancellation/cancellation-ignore-invalid | tested: conformance.TestUtilitiesClient/2024-11-05/cancellation/cancellation-ignore-invalid |
| cancellation-processing-should-cease | SHOULD | both (receiver) | tested: conformance.TestUtilitiesServer/2024-11-05/cancellation/cancellation-processing-should-cease | tested: conformance.TestUtilitiesClient/2024-11-05/cancellation/cancellation-processing-should-cease |
completion
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| completion-max-100 | descr. + schema | server | tested: conformance.TestUtilitiesServer/2024-11-05/completion/completion-max-100 | n/a: addresses the other side |
| completion-server-should | SHOULD | server | tested: daemon.TestHandleCompleteRateLimitHotChangeAndZeroDisables@alldaemon.TestHandleCompleteRateLimitRefusesBeforePool@alldaemon.TestHandleCompleteServerWindowBindsAcrossCallers@alldaemon.TestLocalCompletionCapAfterRanking@alldaemon.TestLocalCompletionTiersPrompts@alldaemon.TestLocalCompletionTiersResources@all | n/a: addresses the other side |
| completion-client-should | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2024-11-05/completion/completion-client-should |
| completion-security | MUST | both | gap #1968: partial: completion inputs are validated and completion/complete is rate limited per caller (completion.perMinute) and per server (completion.serverPerMinute) since #2387, but there is no per-caller access control for sensitive suggestions and no completion-specific information-disclosure control; waiting on principals #1968 / permissive-auth #1972 | n/a: catalogue marks it n/a |
errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| errors-error-has-code-and-message | MUST | both | tested: conformance.TestMessagesServer/2024-11-05/errors/errors-error-has-code-and-message | tested: conformance.TestMessagesClient/2024-11-05/errors/errors-error-has-code-and-message |
| errors-codes-integers | MUST | both | tested: conformance.TestMessagesServer/2024-11-05/errors/errors-codes-integers | tested: conformance.TestMessagesClient/2024-11-05/errors/errors-codes-integers |
| errors-message-concise-single-sentence | SHOULD | both | tested: conformance.TestMessagesServer/2024-11-05/errors/errors-message-concise-single-sentence | n/a: sends no errors except to server requests |
lifecycle
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| lifecycle-implementations-support-base-and-lifecycle | MUST | both | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-implementations-support-base-and-lifecycle | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-implementations-support-base-and-lifecycle |
| lifecycle-initialization-first-interaction | MUST | both | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-initialization-first-interaction | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-initialization-first-interaction |
| lifecycle-client-sends-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-client-sends-initialize |
| lifecycle-server-responds-caps-and-info | MUST | server | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-server-responds-caps-and-info | n/a: addresses the other side |
| lifecycle-client-sends-initialized-after-init | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-client-sends-initialized-after-init |
| lifecycle-client-no-requests-before-init-response | SHOULD NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-client-no-requests-before-init-response |
| lifecycle-server-no-requests-before-initialized | SHOULD NOT | server | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-server-no-requests-before-initialized | n/a: addresses the other side |
| lifecycle-capabilities-establish-session-features | (definitional) | both | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-capabilities-establish-session-features | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-capabilities-establish-session-features |
| lifecycle-respect-negotiated-version-and-capabilities-should | SHOULD | both | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-respect-negotiated-version-and-capabilities-should | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-respect-negotiated-version-and-capabilities-should |
| lifecycle-stdio-client-shutdown-sequence | SHOULD | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-stdio-client-shutdown-sequence |
| lifecycle-stdio-server-may-exit | MAY | server | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-stdio-server-may-exit | n/a: addresses the other side |
| lifecycle-http-shutdown-closing-connection | (definitional) | both | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-http-shutdown-closing-connection | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-http-shutdown-closing-connection |
| lifecycle-prepared-for-error-cases | SHOULD | both | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-prepared-for-error-cases | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-prepared-for-error-cases |
| lifecycle-timeouts-all-requests-2024 | SHOULD | both | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-timeouts-all-requests-2024 | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-timeouts-all-requests-2024 |
| lifecycle-cancel-not-initialize | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-cancel-not-initialize |
| lifecycle-instructions-may-go-in-system-prompt | MAY | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-instructions-may-go-in-system-prompt |
| lifecycle-capability-sets-open | (definitional) | both | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-capability-sets-open | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-capability-sets-open |
| lifecycle-implementation-name-version-required | REQUIRED (schema field) | both | tested: conformance.TestLifecycleServer/2024-11-05/lifecycle/lifecycle-implementation-name-version-required | tested: conformance.TestLifecycleClient/2024-11-05/lifecycle/lifecycle-implementation-name-version-required |
logging
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| logging-declare-capability | MUST | server | tested: conformance.TestUtilitiesServer/2024-11-05/logging/logging-declare-capability | n/a: addresses the other side |
| logging-client-may-setlevel | MAY | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2024-11-05/logging/logging-client-may-setlevel |
| logging-setlevel-at-or-above | should (schema) | server | tested: conformance.TestUtilitiesServer/2024-11-05/logging/logging-setlevel-at-or-above | n/a: addresses the other side |
| logging-unset-server-chooses | MAY | server | tested: conformance.TestUtilitiesServer/2024-11-05/logging/logging-unset-server-chooses | n/a: addresses the other side |
| logging-errors-setlevel | SHOULD | server | tested: conformance.TestUtilitiesServer/2024-11-05/logging/logging-errors-setlevel | n/a: addresses the other side |
| logging-server-hygiene | SHOULD | server | tested: conformance.TestUtilitiesServer/2024-11-05/logging/logging-server-hygiene | n/a: addresses the other side |
| logging-no-secrets-pii | MUST NOT | both (emitter) | tested: conformance.TestUtilitiesServer/2024-11-05/logging/logging-no-secrets-pii | tested: conformance.TestUtilitiesClient/2024-11-05/logging/logging-no-secrets-pii |
| logging-impl-validate-control | SHOULD | both | tested: conformance.TestUtilitiesServer/2024-11-05/logging/logging-impl-validate-control | tested: conformance.TestUtilitiesClient/2024-11-05/logging/logging-impl-validate-control |
messages
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| messages-all-messages-follow-jsonrpc-2 | MUST | both | tested: conformance.TestJSONRPCFramesEveryRevision/2024-11-05/messages/all-messages-follow-jsonrpc-2-server-httpconformance.TestJSONRPCFramesEveryRevision/2024-11-05/messages/all-messages-follow-jsonrpc-2-server-stdioconformance.TestMessagesServer/2024-11-05/messages/messages-all-messages-follow-jsonrpc-2 | tested: conformance.TestJSONRPCFramesEveryRevision/2024-11-05/messages/all-messages-follow-jsonrpc-2-client |
| messages-other-components-may | MAY | both | tested: conformance.TestMessagesServer/2024-11-05/messages/messages-other-components-may | tested: conformance.TestMessagesClient/2024-11-05/messages/messages-other-components-may |
| messages-request-id-string-or-integer | MUST | both | tested: conformance.TestMessagesServer/2024-11-05/messages/messages-request-id-string-or-integer | tested: conformance.TestMessagesClient/2024-11-05/messages/messages-request-id-string-or-integer |
| messages-request-id-not-null | MUST NOT | both | tested: conformance.TestMessagesServer/2024-11-05/messages/messages-request-id-not-null | tested: conformance.TestMessagesClient/2024-11-05/messages/messages-request-id-not-null |
| messages-request-id-unique-per-session | MUST NOT | both | tested: conformance.TestMessagesServer/2024-11-05/messages/messages-request-id-unique-per-session | tested: conformance.TestMessagesClient/2024-11-05/messages/messages-request-id-unique-per-session |
| messages-response-same-id | MUST | both | tested: conformance.TestMessagesServer/2024-11-05/messages/messages-response-same-id | tested: conformance.TestMessagesClient/2024-11-05/messages/messages-response-same-id |
| messages-response-result-xor-error | MUST / MUST NOT | both | tested: conformance.TestMessagesServer/2024-11-05/messages/messages-response-result-xor-error | tested: conformance.TestMessagesClient/2024-11-05/messages/messages-response-result-xor-error |
| messages-notification-no-id | MUST NOT | both | tested: conformance.TestMessagesServer/2024-11-05/messages/messages-notification-no-id | tested: conformance.TestMessagesClient/2024-11-05/messages/messages-notification-no-id |
meta
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
[meta-reserved-for-mcp](https://modelcontextprotocol.io/specification/GH(2025-03-26) Result._meta) | (definitional) | both | tested: conformance.TestMessagesServer/2024-11-05/meta/meta-reserved-for-mcp | tested: conformance.TestMessagesClient/2024-11-05/meta/meta-reserved-for-mcp |
| meta-progress-token-receiver-not-obligated | (definitional) | both | tested: conformance.TestMessagesServer/2024-11-05/meta/meta-progress-token-receiver-not-obligated | tested: conformance.TestMessagesClient/2024-11-05/meta/meta-progress-token-receiver-not-obligated |
pagination
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| pagination-no-fixed-page-size | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2024-11-05/pagination/pagination-no-fixed-page-size |
| pagination-stable-cursors | SHOULD | server | tested: conformance.TestUtilitiesServer/2024-11-05/pagination/pagination-stable-cursors | n/a: addresses the other side |
| pagination-invalid-cursor-graceful | SHOULD | server | tested: conformance.TestUtilitiesServer/2024-11-05/pagination/pagination-invalid-cursor-graceful | n/a: addresses the other side |
| pagination-missing-nextcursor-end | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2024-11-05/pagination/pagination-missing-nextcursor-end |
| pagination-support-both-flows | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2024-11-05/pagination/pagination-support-both-flows |
| pagination-cursor-opaque | MUST | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2024-11-05/pagination/pagination-cursor-opaque |
| pagination-no-persist-across-sessions | MUST | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2024-11-05/pagination/pagination-no-persist-across-sessions |
| pagination-invalid-cursor-32602 | SHOULD | server | tested: conformance.TestUtilitiesServer/2024-11-05/pagination/pagination-invalid-cursor-32602 | n/a: addresses the other side |
ping
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| ping-receiver-responds-promptly-empty | MUST | both | tested: conformance.TestLifecycleServer/2024-11-05/ping/ping-receiver-responds-promptly-empty | tested: conformance.TestLifecycleClient/2024-11-05/ping/ping-receiver-responds-promptly-empty |
| ping-either-party-may-initiate | (definitional) | both | tested: conformance.TestLifecycleServer/2024-11-05/ping/ping-either-party-may-initiate | tested: conformance.TestLifecycleClient/2024-11-05/ping/ping-either-party-may-initiate |
| ping-sender-may-consider-stale | MAY | both | n/a: catalogue marks it n/a | n/a: does not ping |
| ping-periodic-pings | SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| ping-frequency-configurable | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-timeouts-appropriate | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-avoid-excessive | SHOULD | both | tested: conformance.TestLifecycleServer/2024-11-05/ping/ping-avoid-excessive | tested: conformance.TestLifecycleClient/2024-11-05/ping/ping-avoid-excessive |
| ping-timeout-is-connection-failure | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-multiple-failures-may-reset | MAY | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-log-failures | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-schema-receiver-must-respond | must (lowercase) | both | tested: conformance.TestLifecycleServer/2024-11-05/ping/ping-schema-receiver-must-respond | tested: conformance.TestLifecycleClient/2024-11-05/ping/ping-schema-receiver-must-respond |
progress
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| progress-token-string-or-int | MUST | both (requester) | n/a: as a server mcpx never requests progress; a host’s token is relayed back verbatim | tested: conformance.TestUtilitiesClient/2024-11-05/progress/progress-token-string-or-int |
| progress-token-unique-sender | MUST | both | tested: conformance.TestUtilitiesServer/2024-11-05/progress/progress-token-unique-sender | tested: conformance.TestUtilitiesClient/2024-11-05/progress/progress-token-unique-sender |
| progress-receiver-may-send | MAY | both | n/a: optional feature mcpx does not implement | n/a: never receives requests with tokens |
| progress-must-increase | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2024-11-05/progress/progress-must-increase | n/a: catalogue marks it n/a |
| progress-only-active-tokens | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2024-11-05/progress/progress-only-active-tokens | n/a: catalogue marks it n/a |
| progress-receiver-may-skip | MAY | both | tested: conformance.TestUtilitiesServer/2024-11-05/progress/progress-receiver-may-skip | tested: conformance.TestUtilitiesClient/2024-11-05/progress/progress-receiver-may-skip |
| progress-track-tokens | SHOULD | both | n/a: catalogue marks it n/a | tested: conformance.TestUtilitiesClient/2024-11-05/progress/progress-track-tokens |
| progress-rate-limit | SHOULD | both | tested: conformance.TestUtilitiesServer/2024-11-05/progress/progress-rate-limit | tested: conformance.TestUtilitiesClient/2024-11-05/progress/progress-rate-limit |
| progress-stop-after-completion | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2024-11-05/progress/progress-stop-after-completion | n/a: catalogue marks it n/a |
prompts
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2024-11-05/prompts/prompts-declare-capability | n/a: addresses the other side |
| prompts-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2024-11-05/prompts/prompts-list-changed-notify | n/a: addresses the other side |
| prompts-image-base64-mime | MUST | server | tested: conformance.TestFeaturesServer/2024-11-05/prompts/prompts-image-base64-mime | n/a: addresses the other side |
| prompts-embedded-must-include | MUST | server | tested: conformance.TestFeaturesServer/2024-11-05/prompts/prompts-embedded-must-include | n/a: addresses the other side |
| prompts-validate-args | SHOULD | server | tested: conformance.TestFeaturesServer/2024-11-05/prompts/prompts-validate-args | n/a: addresses the other side |
| prompts-respect-capability-negotiation | SHOULD | both | tested: conformance.TestFeaturesServer/2024-11-05/prompts/prompts-respect-capability-negotiation | tested: conformance.TestFeaturesClient/2024-11-05/prompts/prompts-respect-capability-negotiation |
| prompts-validate-io | MUST | both | tested: conformance.TestFeaturesServer/2024-11-05/prompts/prompts-validate-io; mcpclient.TestValidatePromptResult | covered |
prompts / errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-errors-32602-32603 | SHOULD | server | tested: conformance.TestFeaturesServer/2024-11-05/prompts/prompts-errors-32602-32603 | n/a: addresses the other side |
prompts / pagination
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-client-paginate | SHOULD | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2024-11-05/prompts/prompts-client-paginate |
resources
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2024-11-05/resources/resources-declare-capability | n/a: addresses the other side |
| resources-subscribe-cap-meaning-legacy | (definition) | server | tested: e2e.TestResourceSubscriptionsReachUpstream/2025-11-25/resources/stdio-subscribe-delivers-upstream-updates-under-the-mcpx-uri@2024-11-05,2025-03-26,2025-06-18,2025-11-25 | n/a: addresses the other side |
| resources-cap-features-independent | MAY | server | tested: conformance.TestFeaturesServer/2024-11-05/resources/resources-cap-features-independent | n/a: addresses the other side |
| resources-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2024-11-05/resources/resources-list-changed-notify | n/a: addresses the other side |
| resources-updated-may-be-subresource | (note, schema) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2024-11-05/resources/resources-updated-may-be-subresource |
| resources-https-only-if-client-fetchable | SHOULD | server | tested: conformance.TestFeaturesServer/2024-11-05/resources/resources-https-only-if-client-fetchable | n/a: addresses the other side |
| resources-https-else-other-scheme | SHOULD | server | tested: conformance.TestFeaturesServer/2024-11-05/resources/resources-https-else-other-scheme | n/a: addresses the other side |
| resources-file-xdg-mime-may | MAY | server | tested: conformance.TestFeaturesServer/2024-11-05/resources/resources-file-xdg-mime-may | n/a: addresses the other side |
| resources-sec-validate-uris | MUST | server | tested: conformance.TestFeaturesServer/2024-11-05/resources/resources-sec-validate-uris | n/a: addresses the other side |
| resources-sec-access-control | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| resources-sec-binary-encoded | MUST | server | tested: conformance.TestFeaturesServer/2024-11-05/resources/resources-sec-binary-encoded | n/a: addresses the other side |
| resources-sec-permissions | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
resources / errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-not-found-32002 | SHOULD | server | tested: conformance.TestFeaturesServer/2024-11-05/resources/resources-not-found-32002 | n/a: addresses the other side |
| resources-internal-32603 | SHOULD | server | tested: conformance.TestFeaturesServer/2024-11-05/resources/resources-internal-32603 | n/a: addresses the other side |
resources / subscriptions
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-subscribe-rpc | (optional) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2024-11-05/resources/resources-subscribe-rpc |
| resources-unsubscribe-follows-subscribe | should (lowercase, schema) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2024-11-05/resources/resources-unsubscribe-follows-subscribe |
roots
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| roots-client-declare-capability-at-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2024-11-05/roots/roots-client-declare-capability-at-initialize |
| roots-client-listchanged-must-notify | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2024-11-05/roots/roots-client-listchanged-must-notify |
| roots-uri-must-be-file-scheme | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-only-expose-permitted-roots | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-validate-uris-path-traversal | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-implement-access-controls | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-monitor-accessibility | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-server-handle-unavailable-roots | SHOULD | server | n/a: mcpx does not consume roots | n/a: addresses the other side |
| roots-server-respect-boundaries | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-validate-paths-against-roots | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-client-prompt-consent-before-exposing | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-provide-root-management-ui | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-validate-accessibility-before-exposing | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-monitor-root-changes | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-server-check-capability-before-use | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-handle-list-changes | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-cache-root-information | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-client-return-jsonrpc-errors | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2024-11-05/roots/roots-client-return-jsonrpc-errors |
sampling
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| sampling-human-in-loop-can-deny | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2024-11-05/sampling/sampling-human-in-loop-can-deny |
| sampling-app-review-ui | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-app-view-edit-prompts | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-app-review-responses | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-client-declare-capability-at-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2024-11-05/sampling/sampling-client-declare-capability-at-initialize |
| sampling-client-may-sample-fewer-tokens | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-ignore-model-preferences | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-modify-system-prompt | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-ignore-includecontext | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hints-evaluated-in-order | MUST | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hints-over-priorities | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hint-name-substring | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hint-may-map-provider | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-stopreason-custom-values | MAY | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2024-11-05/sampling/sampling-stopreason-custom-values |
| sampling-client-errors-user-rejected | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2024-11-05/sampling/sampling-client-errors-user-rejected |
| sampling-client-user-approval-controls | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-both-validate-message-content | SHOULD | both | tested: conformance.TestSamplingValidation/2024-11-05/sampling/sampling-both-validate-message-content | tested: conformance.TestSamplingValidation/2024-11-05/sampling/sampling-both-validate-message-content |
| sampling-client-respect-hints | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-rate-limit | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2024-11-05/sampling/sampling-client-rate-limit |
| sampling-both-handle-sensitive-data | MUST | both | tested: daemon.TestElicitEventsAreSummaryOnly@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28elicit.TestOpenPrunesTerminalRowsPastTheAgeBound@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28 | tested: daemon.TestElicitEventsAreSummaryOnly@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28elicit.TestOpenPrunesTerminalRowsPastTheAgeBound@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28 |
subscriptions
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| subscriptions-list-changed-should-notify | SHOULD | server | tested: conformance.TestStatefulServer/2024-11-05/subscriptions/subscriptions-list-changed-should-notify | n/a: addresses the other side |
| subscriptions-resources-updated-only-if-subscribed | should (schema) | server | tested: conformance.TestStatefulServer/2024-11-05/subscriptions/subscriptions-resources-updated-only-if-subscribed | n/a: addresses the other side |
tools
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tools-human-in-loop-deny | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-ui-expose-indicate-confirm | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2024-11-05/tools/tools-declare-capability | n/a: addresses the other side |
| tools-list-changed-means-emit | (definition) | server | tested: conformance.TestFeaturesServer/2024-11-05/tools/tools-list-changed-means-emit | n/a: addresses the other side |
| tools-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2024-11-05/tools/tools-list-changed-notify | n/a: addresses the other side |
| tools-result-iserror-for-tool-errors | SHOULD | server | tested: conformance.TestFeaturesServer/2024-11-05/tools/tools-result-iserror-for-tool-errors | n/a: addresses the other side |
| tools-result-lookup-errors-protocol | should (lowercase) | server | tested: conformance.TestFeaturesServer/2024-11-05/tools/tools-result-lookup-errors-protocol | n/a: addresses the other side |
| tools-error-unknown-tool-protocol | (classification) | server | tested: conformance.TestFeaturesServer/2024-11-05/tools/tools-error-unknown-tool-protocol | n/a: addresses the other side |
| tools-error-invalid-args-protocol | (classification) | server | tested: conformance.TestFeaturesServer/2024-11-05/tools/tools-error-invalid-args-protocol | n/a: addresses the other side |
| tools-embedded-resource-may | MAY | server | tested: conformance.TestFeaturesServer/2024-11-05/tools/tools-embedded-resource-may | n/a: addresses the other side |
| tools-server-sec-validate-inputs | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| tools-client-sec | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
tools / json-schema
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tools-inputschema-type-object-root | REQUIRED (schema) | server | tested: conformance.TestFeaturesServer/2024-11-05/tools/tools-inputschema-type-object-root | n/a: addresses the other side |
transport-http-sse
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| http-sse-server-validate-origin | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| http-sse-server-bind-localhost | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| http-sse-server-authenticate | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| http-sse-server-two-endpoints | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| http-sse-server-endpoint-event | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| http-sse-client-post-to-endpoint | MUST | client | n/a: addresses the other side | tested: mcpclient.TestHTTPSSETransport/2024-11-05/transport-http-sse/client-posts-to-endpoint-and-reads-stream |
| http-sse-server-messages-as-sse-events | MUST (implied) | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
transport-stdio
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| transport-client-should-support-stdio | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2024-11-05/transport-stdio/transport-client-should-support-stdio |
| transport-custom-preserve-jsonrpc-and-lifecycle | MUST | both | n/a: mcpx serves MCP only over stdio and Streamable HTTP; its /v1 REST surface is not an MCP transport | n/a: catalogue marks it n/a |
| transport-custom-document-patterns | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| stdio-no-embedded-newlines | MUST NOT | both | tested: conformance.TestTransportServer/2024-11-05/transport-stdio/stdio-no-embedded-newlines | tested: conformance.TestTransportClient/2024-11-05/transport-stdio/stdio-no-embedded-newlines |
| stdio-server-may-log-to-stderr | MAY | server | tested: conformance.TestTransportServer/2024-11-05/transport-stdio/stdio-server-may-log-to-stderr | n/a: addresses the other side |
| stdio-client-may-capture-stderr | MAY | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2024-11-05/transport-stdio/stdio-client-may-capture-stderr |
| stdio-server-stdout-only-mcp | MUST NOT | server | tested: conformance.TestTransportServer/2024-11-05/transport-stdio/stdio-server-stdout-only-mcp | n/a: addresses the other side |
| stdio-client-stdin-only-mcp | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2024-11-05/transport-stdio/stdio-client-stdin-only-mcp |
versioning
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| lifecycle-client-sends-supported-version | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2024-11-05/versioning/lifecycle-client-sends-supported-version |
| lifecycle-client-sends-latest-version | SHOULD | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2024-11-05/versioning/lifecycle-client-sends-latest-version |
| lifecycle-client-may-support-older | MAY | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2024-11-05/versioning/lifecycle-client-may-support-older |
| lifecycle-server-echoes-supported-version | MUST | server | tested: conformance.TestLifecycleServer/2024-11-05/versioning/lifecycle-server-echoes-supported-version | n/a: addresses the other side |
| lifecycle-server-counteroffers-version | MUST | server | tested: conformance.TestLifecycleServer/2024-11-05/versioning/lifecycle-server-counteroffers-version | n/a: addresses the other side |
| lifecycle-server-counteroffers-latest | SHOULD | server | tested: conformance.TestLifecycleServer/2024-11-05/versioning/lifecycle-server-counteroffers-latest | n/a: addresses the other side |
| lifecycle-client-disconnects-on-unsupported-version | SHOULD (prose) / MUST (schema) | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2024-11-05/versioning/lifecycle-client-disconnects-on-unsupported-version |
2025-03-26
(security; not in area list)
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| security-implementors-guidelines | SHOULD | both | tested: conformance.TestMessagesServer/2025-03-26/security/security-implementors-guidelines | n/a: catalogue marks it n/a |
authorization
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| authorization-http-should-conform-stdio-should-not | SHOULD / SHOULD NOT | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authorization-custom-auth-may | MAY | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| streamable-http-auth-discovery-version-header | SHOULD | client | n/a: addresses the other side | n/a: no OAuth |
| authz-optional | OPTIONAL | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-http-should-conform | SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-stdio-use-environment | SHOULD NOT | both | gap not implemented: #1975 | gap not implemented: #1950 |
| authz-alt-transport-best-practice | MUST | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-implement-oauth21 | MUST | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-dcr-should | SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-rfc8414-server-should-client-must | SHOULD / MUST | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-grant-types | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-401-when-unauthorized | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-base-url-discards-path | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-default-endpoints-fallback | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-bearer-header | MUST | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-token-every-request | MUST | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-no-token-in-query | MUST NOT | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-server-validates-token | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-error-status-codes | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-2025-03-26-security-list | MUST / SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-2025-03-26-implementation-reqs | MUST / REQUIRED / SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-third-party-session-binding | MAY / MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
cancellation
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| cancellation-ref-same-direction-in-progress | MUST | both | tested: conformance.TestUtilitiesServer/2025-03-26/cancellation/cancellation-ref-same-direction-in-progress | tested: conformance.TestUtilitiesClient/2025-03-26/cancellation/cancellation-ref-same-direction-in-progress |
| cancellation-client-must-not-cancel-initialize | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-03-26/cancellation/cancellation-client-must-not-cancel-initialize |
| cancellation-receiver-should-stop-free-no-response | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-03-26/cancellation/cancellation-receiver-should-stop-free-no-response | tested: conformance.TestUtilitiesClient/2025-03-26/cancellation/cancellation-receiver-should-stop-free-no-response |
| cancellation-receiver-may-ignore | MAY | both | tested: conformance.TestUtilitiesServer/2025-03-26/cancellation/cancellation-receiver-may-ignore | tested: conformance.TestUtilitiesClient/2025-03-26/cancellation/cancellation-receiver-may-ignore |
| cancellation-sender-ignore-late-response | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-03-26/cancellation/cancellation-sender-ignore-late-response | tested: conformance.TestUtilitiesClient/2025-03-26/cancellation/cancellation-sender-ignore-late-response |
| cancellation-handle-races | MUST | both | tested: conformance.TestUtilitiesServer/2025-03-26/cancellation/cancellation-handle-races | tested: conformance.TestUtilitiesClient/2025-03-26/cancellation/cancellation-handle-races |
| cancellation-log-reasons | SHOULD | both | gap #77: a cancellation reason reaches Server.OnCancel, which nothing outside tests sets; it is never logged | tested: conformance.TestUtilitiesClient/2025-03-26/cancellation/cancellation-log-reasons |
| cancellation-ui-indicate | SHOULD | both | n/a: no UI | n/a: no UI |
| cancellation-ignore-invalid | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-03-26/cancellation/cancellation-ignore-invalid | tested: conformance.TestUtilitiesClient/2025-03-26/cancellation/cancellation-ignore-invalid |
| cancellation-processing-should-cease | SHOULD | both (receiver) | tested: conformance.TestUtilitiesServer/2025-03-26/cancellation/cancellation-processing-should-cease | tested: conformance.TestUtilitiesClient/2025-03-26/cancellation/cancellation-processing-should-cease |
completion
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| completion-declare-capability | MUST | server | tested: conformance.TestUtilitiesServer/2025-03-26/completion/completion-declare-capability | n/a: addresses the other side |
| completion-max-100 | descr. + schema | server | tested: conformance.TestUtilitiesServer/2025-03-26/completion/completion-max-100 | n/a: addresses the other side |
| completion-server-should | SHOULD | server | tested: daemon.TestHandleCompleteRateLimitHotChangeAndZeroDisables@alldaemon.TestHandleCompleteRateLimitRefusesBeforePool@alldaemon.TestHandleCompleteServerWindowBindsAcrossCallers@alldaemon.TestLocalCompletionCapAfterRanking@alldaemon.TestLocalCompletionTiersPrompts@alldaemon.TestLocalCompletionTiersResources@all | n/a: addresses the other side |
| completion-client-should | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-03-26/completion/completion-client-should |
| completion-security | MUST | both | gap #1968: partial: completion inputs are validated and completion/complete is rate limited per caller (completion.perMinute) and per server (completion.serverPerMinute) since #2387, but there is no per-caller access control for sensitive suggestions and no completion-specific information-disclosure control; waiting on principals #1968 / permissive-auth #1972 | n/a: catalogue marks it n/a |
| completion-errors | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-03-26/completion/completion-errors | n/a: addresses the other side |
errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| errors-error-has-code-and-message | MUST | both | tested: conformance.TestMessagesServer/2025-03-26/errors/errors-error-has-code-and-message | tested: conformance.TestMessagesClient/2025-03-26/errors/errors-error-has-code-and-message |
| errors-codes-integers | MUST | both | tested: conformance.TestMessagesServer/2025-03-26/errors/errors-codes-integers | tested: conformance.TestMessagesClient/2025-03-26/errors/errors-codes-integers |
| errors-message-concise-single-sentence | SHOULD | both | tested: conformance.TestMessagesServer/2025-03-26/errors/errors-message-concise-single-sentence | n/a: sends no errors except to server requests |
lifecycle
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| lifecycle-implementations-support-base-and-lifecycle | MUST | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-implementations-support-base-and-lifecycle | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-implementations-support-base-and-lifecycle |
| lifecycle-initialize-not-in-batch | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-initialize-not-in-batch |
| lifecycle-initialization-first-interaction | MUST | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-initialization-first-interaction | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-initialization-first-interaction |
| lifecycle-client-sends-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-client-sends-initialize |
| lifecycle-server-responds-caps-and-info | MUST | server | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-server-responds-caps-and-info | n/a: addresses the other side |
| lifecycle-client-sends-initialized-after-init | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-client-sends-initialized-after-init |
| lifecycle-client-no-requests-before-init-response | SHOULD NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-client-no-requests-before-init-response |
| lifecycle-server-no-requests-before-initialized | SHOULD NOT | server | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-server-no-requests-before-initialized | n/a: addresses the other side |
| lifecycle-capabilities-establish-session-features | (definitional) | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-capabilities-establish-session-features | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-capabilities-establish-session-features |
| lifecycle-respect-negotiated-version-and-capabilities-should | SHOULD | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-respect-negotiated-version-and-capabilities-should | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-respect-negotiated-version-and-capabilities-should |
| lifecycle-stdio-client-shutdown-sequence | SHOULD | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-stdio-client-shutdown-sequence |
| lifecycle-stdio-server-may-exit | MAY | server | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-stdio-server-may-exit | n/a: addresses the other side |
| lifecycle-http-shutdown-closing-connection | (definitional) | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-http-shutdown-closing-connection | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-http-shutdown-closing-connection |
| lifecycle-prepared-for-error-cases | SHOULD | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-prepared-for-error-cases | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-prepared-for-error-cases |
| lifecycle-timeouts-establish | SHOULD | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-timeouts-establish | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-timeouts-establish |
| lifecycle-timeouts-cancel-on-expiry | SHOULD | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-timeouts-cancel-on-expiry | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-timeouts-cancel-on-expiry |
| lifecycle-timeouts-per-request-configurable | SHOULD | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-timeouts-per-request-configurable | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-timeouts-per-request-configurable |
| lifecycle-timeouts-may-reset-on-progress | MAY | both | n/a: catalogue marks it n/a | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-timeouts-may-reset-on-progress |
| lifecycle-timeouts-max-regardless-of-progress | SHOULD | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-timeouts-max-regardless-of-progress | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-timeouts-max-regardless-of-progress |
| lifecycle-cancel-not-initialize | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-cancel-not-initialize |
| lifecycle-instructions-may-go-in-system-prompt | MAY | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-instructions-may-go-in-system-prompt |
| lifecycle-capability-sets-open | (definitional) | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-capability-sets-open | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-capability-sets-open |
| lifecycle-implementation-name-version-required | REQUIRED (schema field) | both | tested: conformance.TestLifecycleServer/2025-03-26/lifecycle/lifecycle-implementation-name-version-required | tested: conformance.TestLifecycleClient/2025-03-26/lifecycle/lifecycle-implementation-name-version-required |
logging
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| logging-declare-capability | MUST | server | tested: conformance.TestUtilitiesServer/2025-03-26/logging/logging-declare-capability | n/a: addresses the other side |
| logging-client-may-setlevel | MAY | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-03-26/logging/logging-client-may-setlevel |
| logging-setlevel-at-or-above | should (schema) | server | tested: conformance.TestUtilitiesServer/2025-03-26/logging/logging-setlevel-at-or-above | n/a: addresses the other side |
| logging-unset-server-chooses | MAY | server | tested: conformance.TestUtilitiesServer/2025-03-26/logging/logging-unset-server-chooses | n/a: addresses the other side |
| logging-errors-setlevel | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-03-26/logging/logging-errors-setlevel | n/a: addresses the other side |
| logging-server-hygiene | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-03-26/logging/logging-server-hygiene | n/a: addresses the other side |
| logging-no-secrets-pii | MUST NOT | both (emitter) | tested: conformance.TestUtilitiesServer/2025-03-26/logging/logging-no-secrets-pii | tested: conformance.TestUtilitiesClient/2025-03-26/logging/logging-no-secrets-pii |
| logging-impl-validate-control | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-03-26/logging/logging-impl-validate-control | tested: conformance.TestUtilitiesClient/2025-03-26/logging/logging-impl-validate-control |
messages
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| messages-all-messages-follow-jsonrpc-2 | MUST | both | tested: conformance.TestJSONRPCFramesEveryRevision/2025-03-26/messages/all-messages-follow-jsonrpc-2-server-httpconformance.TestJSONRPCFramesEveryRevision/2025-03-26/messages/all-messages-follow-jsonrpc-2-server-stdioconformance.TestMessagesServer/2025-03-26/messages/messages-all-messages-follow-jsonrpc-2 | tested: conformance.TestJSONRPCFramesEveryRevision/2025-03-26/messages/all-messages-follow-jsonrpc-2-client |
| messages-other-components-may | MAY | both | tested: conformance.TestMessagesServer/2025-03-26/messages/messages-other-components-may | tested: conformance.TestMessagesClient/2025-03-26/messages/messages-other-components-may |
| messages-request-id-string-or-integer | MUST | both | tested: conformance.TestMessagesServer/2025-03-26/messages/messages-request-id-string-or-integer | tested: conformance.TestMessagesClient/2025-03-26/messages/messages-request-id-string-or-integer |
| messages-request-id-not-null | MUST NOT | both | tested: conformance.TestMessagesServer/2025-03-26/messages/messages-request-id-not-null | tested: conformance.TestMessagesClient/2025-03-26/messages/messages-request-id-not-null |
| messages-request-id-unique-per-session | MUST NOT | both | tested: conformance.TestMessagesServer/2025-03-26/messages/messages-request-id-unique-per-session | tested: conformance.TestMessagesClient/2025-03-26/messages/messages-request-id-unique-per-session |
| messages-response-same-id | MUST | both | tested: conformance.TestMessagesServer/2025-03-26/messages/messages-response-same-id | tested: conformance.TestMessagesClient/2025-03-26/messages/messages-response-same-id |
| messages-response-result-xor-error | MUST / MUST NOT | both | tested: conformance.TestMessagesServer/2025-03-26/messages/messages-response-result-xor-error | tested: conformance.TestMessagesClient/2025-03-26/messages/messages-response-result-xor-error |
| messages-result-any-object | MAY | both | tested: conformance.TestMessagesServer/2025-03-26/messages/messages-result-any-object | tested: conformance.TestMessagesClient/2025-03-26/messages/messages-result-any-object |
| messages-notification-no-response | MUST NOT | both | tested: conformance.TestMessagesServer/2025-03-26/messages/messages-notification-no-response | tested: conformance.TestMessagesClient/2025-03-26/messages/messages-notification-no-response |
| messages-notification-no-id | MUST NOT | both | tested: conformance.TestMessagesServer/2025-03-26/messages/messages-notification-no-id | tested: conformance.TestMessagesClient/2025-03-26/messages/messages-notification-no-id |
| messages-batch-may-send-must-receive | MAY / MUST | both | tested: conformance.TestMessagesServer/2025-03-26/messages/messages-batch-may-send-must-receive | tested: conformance.TestMessagesClient/2025-03-26/messages/messages-batch-may-send-must-receive |
| transport-jsonrpc-utf8 | MUST | both | tested: conformance.TestMessagesServer/2025-03-26/messages/transport-jsonrpc-utf8 | tested: conformance.TestMessagesClient/2025-03-26/messages/transport-jsonrpc-utf8 |
meta
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
[meta-reserved-for-mcp](https://modelcontextprotocol.io/specification/GH(2025-03-26) Result._meta) | (definitional) | both | tested: conformance.TestMessagesServer/2025-03-26/meta/meta-reserved-for-mcp | tested: conformance.TestMessagesClient/2025-03-26/meta/meta-reserved-for-mcp |
| meta-progress-token-receiver-not-obligated | (definitional) | both | tested: conformance.TestMessagesServer/2025-03-26/meta/meta-progress-token-receiver-not-obligated | tested: conformance.TestMessagesClient/2025-03-26/meta/meta-progress-token-receiver-not-obligated |
pagination
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| pagination-no-fixed-page-size | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-03-26/pagination/pagination-no-fixed-page-size |
| pagination-stable-cursors | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-03-26/pagination/pagination-stable-cursors | n/a: addresses the other side |
| pagination-invalid-cursor-graceful | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-03-26/pagination/pagination-invalid-cursor-graceful | n/a: addresses the other side |
| pagination-missing-nextcursor-end | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-03-26/pagination/pagination-missing-nextcursor-end |
| pagination-support-both-flows | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-03-26/pagination/pagination-support-both-flows |
| pagination-cursor-opaque | MUST | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-03-26/pagination/pagination-cursor-opaque |
| pagination-no-persist-across-sessions | MUST | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-03-26/pagination/pagination-no-persist-across-sessions |
| pagination-invalid-cursor-32602 | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-03-26/pagination/pagination-invalid-cursor-32602 | n/a: addresses the other side |
ping
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| ping-receiver-responds-promptly-empty | MUST | both | tested: conformance.TestLifecycleServer/2025-03-26/ping/ping-receiver-responds-promptly-empty | tested: conformance.TestLifecycleClient/2025-03-26/ping/ping-receiver-responds-promptly-empty |
| ping-either-party-may-initiate | (definitional) | both | tested: conformance.TestLifecycleServer/2025-03-26/ping/ping-either-party-may-initiate | tested: conformance.TestLifecycleClient/2025-03-26/ping/ping-either-party-may-initiate |
| ping-sender-may-consider-stale | MAY | both | n/a: catalogue marks it n/a | n/a: does not ping |
| ping-periodic-pings | SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| ping-frequency-configurable | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-timeouts-appropriate | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-avoid-excessive | SHOULD | both | tested: conformance.TestLifecycleServer/2025-03-26/ping/ping-avoid-excessive | tested: conformance.TestLifecycleClient/2025-03-26/ping/ping-avoid-excessive |
| ping-timeout-is-connection-failure | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-multiple-failures-may-reset | MAY | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-log-failures | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-schema-receiver-must-respond | must (lowercase) | both | tested: conformance.TestLifecycleServer/2025-03-26/ping/ping-schema-receiver-must-respond | tested: conformance.TestLifecycleClient/2025-03-26/ping/ping-schema-receiver-must-respond |
progress
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| progress-token-string-or-int | MUST | both (requester) | n/a: as a server mcpx never requests progress; a host’s token is relayed back verbatim | tested: conformance.TestUtilitiesClient/2025-03-26/progress/progress-token-string-or-int |
| progress-token-unique-sender | MUST | both | tested: conformance.TestUtilitiesServer/2025-03-26/progress/progress-token-unique-sender | tested: conformance.TestUtilitiesClient/2025-03-26/progress/progress-token-unique-sender |
| progress-receiver-may-send | MAY | both | n/a: optional feature mcpx does not implement | n/a: never receives requests with tokens |
| progress-must-increase | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2025-03-26/progress/progress-must-increase | n/a: catalogue marks it n/a |
| progress-message-human-readable | SHOULD | both (notifier) | tested: conformance.TestUtilitiesServer/2025-03-26/progress/progress-message-human-readable | n/a: catalogue marks it n/a |
| progress-only-active-tokens | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2025-03-26/progress/progress-only-active-tokens | n/a: catalogue marks it n/a |
| progress-receiver-may-skip | MAY | both | tested: conformance.TestUtilitiesServer/2025-03-26/progress/progress-receiver-may-skip | tested: conformance.TestUtilitiesClient/2025-03-26/progress/progress-receiver-may-skip |
| progress-track-tokens | SHOULD | both | n/a: catalogue marks it n/a | tested: conformance.TestUtilitiesClient/2025-03-26/progress/progress-track-tokens |
| progress-rate-limit | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-03-26/progress/progress-rate-limit | tested: conformance.TestUtilitiesClient/2025-03-26/progress/progress-rate-limit |
| progress-stop-after-completion | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2025-03-26/progress/progress-stop-after-completion | n/a: catalogue marks it n/a |
prompts
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2025-03-26/prompts/prompts-declare-capability | n/a: addresses the other side |
| prompts-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2025-03-26/prompts/prompts-list-changed-notify | n/a: addresses the other side |
| prompts-image-base64-mime | MUST | server | tested: conformance.TestFeaturesServer/2025-03-26/prompts/prompts-image-base64-mime | n/a: addresses the other side |
| prompts-audio-base64-mime | MUST (not bolded) | server | tested: conformance.TestFeaturesServer/2025-03-26/prompts/prompts-audio-base64-mime | n/a: addresses the other side |
| prompts-embedded-must-include | MUST | server | tested: conformance.TestFeaturesServer/2025-03-26/prompts/prompts-embedded-must-include | n/a: addresses the other side |
| prompts-validate-args | SHOULD | server | tested: conformance.TestFeaturesServer/2025-03-26/prompts/prompts-validate-args | n/a: addresses the other side |
| prompts-respect-capability-negotiation | SHOULD | both | tested: conformance.TestFeaturesServer/2025-03-26/prompts/prompts-respect-capability-negotiation | tested: conformance.TestFeaturesClient/2025-03-26/prompts/prompts-respect-capability-negotiation |
| prompts-validate-io | MUST | both | tested: conformance.TestFeaturesServer/2025-03-26/prompts/prompts-validate-io; mcpclient.TestValidatePromptResult | covered |
prompts / errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-errors-32602-32603 | SHOULD | server | tested: conformance.TestFeaturesServer/2025-03-26/prompts/prompts-errors-32602-32603 | n/a: addresses the other side |
prompts / pagination
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-client-paginate | SHOULD | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-03-26/prompts/prompts-client-paginate |
resources
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2025-03-26/resources/resources-declare-capability | n/a: addresses the other side |
| resources-subscribe-cap-meaning-legacy | (definition) | server | tested: e2e.TestResourceSubscriptionsReachUpstream/2025-11-25/resources/http-subscribe-delivers-upstream-updates-on-the-get-stream@2025-03-26,2025-06-18,2025-11-25e2e.TestResourceSubscriptionsReachUpstream/2025-11-25/resources/stdio-subscribe-delivers-upstream-updates-under-the-mcpx-uri@2024-11-05,2025-03-26,2025-06-18,2025-11-25 | n/a: addresses the other side |
| resources-cap-features-independent | MAY | server | tested: conformance.TestFeaturesServer/2025-03-26/resources/resources-cap-features-independent | n/a: addresses the other side |
| resources-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2025-03-26/resources/resources-list-changed-notify | n/a: addresses the other side |
| resources-updated-may-be-subresource | (note, schema) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-03-26/resources/resources-updated-may-be-subresource |
| resources-https-only-if-client-fetchable | SHOULD | server | tested: conformance.TestFeaturesServer/2025-03-26/resources/resources-https-only-if-client-fetchable | n/a: addresses the other side |
| resources-https-else-other-scheme | SHOULD | server | tested: conformance.TestFeaturesServer/2025-03-26/resources/resources-https-else-other-scheme | n/a: addresses the other side |
| resources-file-xdg-mime-may | MAY | server | tested: conformance.TestFeaturesServer/2025-03-26/resources/resources-file-xdg-mime-may | n/a: addresses the other side |
| resources-sec-validate-uris | MUST | server | tested: conformance.TestFeaturesServer/2025-03-26/resources/resources-sec-validate-uris | n/a: addresses the other side |
| resources-sec-access-control | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| resources-sec-binary-encoded | MUST | server | tested: conformance.TestFeaturesServer/2025-03-26/resources/resources-sec-binary-encoded | n/a: addresses the other side |
| resources-sec-permissions | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
resources / errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-not-found-32002 | SHOULD | server | tested: conformance.TestFeaturesServer/2025-03-26/resources/resources-not-found-32002 | n/a: addresses the other side |
| resources-internal-32603 | SHOULD | server | tested: conformance.TestFeaturesServer/2025-03-26/resources/resources-internal-32603 | n/a: addresses the other side |
resources / subscriptions
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-subscribe-rpc | (optional) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-03-26/resources/resources-subscribe-rpc |
| resources-unsubscribe-follows-subscribe | should (lowercase, schema) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-03-26/resources/resources-unsubscribe-follows-subscribe |
roots
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| roots-client-declare-capability-at-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-03-26/roots/roots-client-declare-capability-at-initialize |
| roots-client-listchanged-must-notify | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-03-26/roots/roots-client-listchanged-must-notify |
| roots-uri-must-be-file-scheme | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-only-expose-permitted-roots | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-validate-uris-path-traversal | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-implement-access-controls | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-monitor-accessibility | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-server-handle-unavailable-roots | SHOULD | server | n/a: mcpx does not consume roots | n/a: addresses the other side |
| roots-server-respect-boundaries | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-validate-paths-against-roots | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-client-prompt-consent-before-exposing | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-provide-root-management-ui | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-validate-accessibility-before-exposing | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-monitor-root-changes | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-server-check-capability-before-use | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-handle-list-changes | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-cache-root-information | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-client-return-jsonrpc-errors | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-03-26/roots/roots-client-return-jsonrpc-errors |
sampling
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| sampling-human-in-loop-can-deny | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-03-26/sampling/sampling-human-in-loop-can-deny |
| sampling-app-review-ui | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-app-view-edit-prompts | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-app-review-responses | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-client-declare-capability-at-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-03-26/sampling/sampling-client-declare-capability-at-initialize |
| sampling-client-may-sample-fewer-tokens | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-ignore-model-preferences | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-modify-system-prompt | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-ignore-includecontext | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hints-evaluated-in-order | MUST | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hints-over-priorities | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hint-name-substring | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hint-may-map-provider | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-stopreason-custom-values | MAY | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-03-26/sampling/sampling-stopreason-custom-values |
| sampling-client-errors-user-rejected | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-03-26/sampling/sampling-client-errors-user-rejected |
| sampling-client-user-approval-controls | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-both-validate-message-content | SHOULD | both | tested: conformance.TestSamplingValidation/2025-03-26/sampling/sampling-both-validate-message-content | tested: conformance.TestSamplingValidation/2025-03-26/sampling/sampling-both-validate-message-content |
| sampling-client-respect-hints | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-rate-limit | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-03-26/sampling/sampling-client-rate-limit |
| sampling-both-handle-sensitive-data | MUST | both | tested: daemon.TestElicitEventsAreSummaryOnly@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28elicit.TestOpenPrunesTerminalRowsPastTheAgeBound@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28 | tested: daemon.TestElicitEventsAreSummaryOnly@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28elicit.TestOpenPrunesTerminalRowsPastTheAgeBound@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28 |
subscriptions
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| subscriptions-list-changed-should-notify | SHOULD | server | tested: conformance.TestStatefulServer/2025-03-26/subscriptions/subscriptions-list-changed-should-notify | n/a: addresses the other side |
| subscriptions-resources-updated-only-if-subscribed | should (schema) | server | tested: conformance.TestStatefulServer/2025-03-26/subscriptions/subscriptions-resources-updated-only-if-subscribed | n/a: addresses the other side |
tools
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tools-human-in-loop-deny | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-ui-expose-indicate-confirm | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2025-03-26/tools/tools-declare-capability | n/a: addresses the other side |
| tools-list-changed-means-emit | (definition) | server | tested: conformance.TestFeaturesServer/2025-03-26/tools/tools-list-changed-means-emit | n/a: addresses the other side |
| tools-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2025-03-26/tools/tools-list-changed-notify | n/a: addresses the other side |
| tools-annotations-untrusted | MUST | client | n/a: addresses the other side | tested: daemon.TestAnnotationClearsCallOnlyForLocallyDeclaredServers@2026-07-28 |
| tools-annotations-hints-no-decisions | should (lowercase, schema) | client | n/a: addresses the other side | tested: daemon.TestAnnotationClearsCallOnlyForLocallyDeclaredServers@2026-07-28 |
| tools-result-iserror-for-tool-errors | SHOULD | server | tested: conformance.TestFeaturesServer/2025-03-26/tools/tools-result-iserror-for-tool-errors | n/a: addresses the other side |
| tools-result-lookup-errors-protocol | should (lowercase) | server | tested: conformance.TestFeaturesServer/2025-03-26/tools/tools-result-lookup-errors-protocol | n/a: addresses the other side |
| tools-error-unknown-tool-protocol | (classification) | server | tested: conformance.TestFeaturesServer/2025-03-26/tools/tools-error-unknown-tool-protocol | n/a: addresses the other side |
| tools-error-invalid-args-protocol | (classification) | server | tested: conformance.TestFeaturesServer/2025-03-26/tools/tools-error-invalid-args-protocol | n/a: addresses the other side |
| tools-embedded-resource-may | MAY | server | tested: conformance.TestFeaturesServer/2025-03-26/tools/tools-embedded-resource-may | n/a: addresses the other side |
| tools-server-sec-validate-inputs | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| tools-client-sec | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
tools / json-schema
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tools-inputschema-type-object-root | REQUIRED (schema) | server | tested: conformance.TestFeaturesServer/2025-03-26/tools/tools-inputschema-type-object-root | n/a: addresses the other side |
transport-http-sse
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| http-sse-server-backcompat-host-both | should (lowercase) | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| http-sse-client-backcompat-probe-any-4xx | should (lowercase) | client | n/a: addresses the other side | tested: pool.TestHTTPSSEFallback/2025-11-25/transport-http-sse/client-falls-back-to-get-endpoint-and-caches-it@2025-03-26,2025-06-18 |
transport-stdio
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| transport-client-should-support-stdio | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-03-26/transport-stdio/transport-client-should-support-stdio |
| transport-custom-preserve-jsonrpc-and-lifecycle | MUST | both | n/a: mcpx serves MCP only over stdio and Streamable HTTP; its /v1 REST surface is not an MCP transport | n/a: catalogue marks it n/a |
| transport-custom-document-patterns | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| stdio-no-embedded-newlines | MUST NOT | both | tested: conformance.TestTransportServer/2025-03-26/transport-stdio/stdio-no-embedded-newlines | tested: conformance.TestTransportClient/2025-03-26/transport-stdio/stdio-no-embedded-newlines |
| stdio-message-may-be-batch | MAY (implied) | both | tested: conformance.TestTransportServer/2025-03-26/transport-stdio/stdio-message-may-be-batch | tested: mcpclient.TestReceivedBatchesAreSplit/2025-03-26/messages/client-accepts-batched-server-messages |
| stdio-server-may-log-to-stderr | MAY | server | tested: conformance.TestTransportServer/2025-03-26/transport-stdio/stdio-server-may-log-to-stderr | n/a: addresses the other side |
| stdio-client-may-capture-stderr | MAY | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-03-26/transport-stdio/stdio-client-may-capture-stderr |
| stdio-server-stdout-only-mcp | MUST NOT | server | tested: conformance.TestTransportServer/2025-03-26/transport-stdio/stdio-server-stdout-only-mcp | n/a: addresses the other side |
| stdio-client-stdin-only-mcp | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-03-26/transport-stdio/stdio-client-stdin-only-mcp |
transport-streamable-http
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| streamable-http-server-single-endpoint-post-get | MUST | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-server-single-endpoint-post-get | n/a: addresses the other side |
| streamable-http-server-validate-origin | MUST | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-server-validate-origin | n/a: addresses the other side |
| streamable-http-server-bind-localhost | SHOULD | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-server-bind-localhost | n/a: addresses the other side |
| streamable-http-server-authenticate | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| streamable-http-client-post-every-message | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-03-26/transport-streamable-http/streamable-http-client-post-every-message |
| streamable-http-client-accept-both | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-03-26/transport-streamable-http/streamable-http-client-accept-both |
| streamable-http-post-body-may-batch | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-03-26/transport-streamable-http/streamable-http-post-body-may-batch |
| streamable-http-server-202-for-non-request | MUST | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-server-202-for-non-request | n/a: addresses the other side |
| streamable-http-server-error-status-if-rejected | MUST | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-server-error-status-if-rejected | n/a: addresses the other side |
| streamable-http-server-json-or-sse-for-request | MUST | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-server-json-or-sse-for-request | n/a: addresses the other side |
| streamable-http-client-supports-json-and-sse | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-03-26/transport-streamable-http/streamable-http-client-supports-json-and-sse |
| streamable-http-sse-includes-response | SHOULD | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-sse-includes-response | n/a: addresses the other side |
| streamable-http-post-sse-may-carry-requests | MAY | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-post-sse-may-carry-requests | n/a: addresses the other side |
| streamable-http-sse-not-closed-before-response | SHOULD NOT | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-sse-not-closed-before-response | n/a: addresses the other side |
| streamable-http-server-terminates-sse-after-response | SHOULD | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-server-terminates-sse-after-response | n/a: addresses the other side |
| streamable-http-disconnect-not-cancel | SHOULD NOT | both | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-disconnect-not-cancel | n/a: catalogue marks it n/a |
| streamable-http-client-cancel-by-notification | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-03-26/transport-streamable-http/streamable-http-client-cancel-by-notification |
| streamable-http-server-may-resume | MAY | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| streamable-http-client-may-get | MAY | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| streamable-http-get-accept-sse | MUST | client | n/a: addresses the other side | n/a: no GET |
| streamable-http-get-sse-or-405 | MUST | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-get-sse-or-405 | n/a: addresses the other side |
| streamable-http-get-stream-unrelated | SHOULD | server | n/a: 405 | n/a: addresses the other side |
| streamable-http-get-no-responses | MUST NOT | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| streamable-http-get-close-any-time | MAY | both | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-get-close-any-time | tested: conformance.TestTransportClient/2025-03-26/transport-streamable-http/streamable-http-get-close-any-time |
| streamable-http-multiple-streams | MAY | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-03-26/transport-streamable-http/streamable-http-multiple-streams |
| streamable-http-no-broadcast | MUST / MUST NOT | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-no-broadcast | n/a: addresses the other side |
| streamable-http-event-id-unique | MUST | server | n/a: no ids | n/a: addresses the other side |
| streamable-http-client-resume-with-last-event-id | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestLegacyHTTPStreamResumption/2025-11-25/transport/client-resumes-closed-stream-with-last-event-id-after-retry@2025-03-26,2025-06-18,2025-11-25 |
| streamable-http-server-no-cross-stream-replay | MUST NOT | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| streamable-http-server-may-assign-session | MAY | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-server-may-assign-session | n/a: addresses the other side |
| streamable-http-session-id-secure | SHOULD | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-session-id-secure | n/a: addresses the other side |
| streamable-http-session-id-visible-ascii | MUST | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-session-id-visible-ascii | n/a: addresses the other side |
| streamable-http-client-echoes-session | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-03-26/transport-streamable-http/streamable-http-client-echoes-session |
| streamable-http-server-400-missing-session | SHOULD | server | n/a: mcpx does not require one (stateless fallback | n/a: addresses the other side |
| streamable-http-server-404-terminated-session | MUST | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-server-404-terminated-session | n/a: addresses the other side |
| streamable-http-client-reinit-on-404 | MUST | client | n/a: addresses the other side | tested: mcpclient.TestLegacySession404Recovery/2025-11-25/transport/client-reinitializes-on-session-404-and-retries-once@2025-03-26,2025-06-18,2025-11-25 |
| streamable-http-client-delete-session | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-03-26/transport-streamable-http/streamable-http-client-delete-session |
| streamable-http-server-may-405-delete | MAY | server | tested: conformance.TestTransportServer/2025-03-26/transport-streamable-http/streamable-http-server-may-405-delete | n/a: addresses the other side |
versioning
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| lifecycle-client-sends-supported-version | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-03-26/versioning/lifecycle-client-sends-supported-version |
| lifecycle-client-sends-latest-version | SHOULD | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-03-26/versioning/lifecycle-client-sends-latest-version |
| lifecycle-client-may-support-older | MAY | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-03-26/versioning/lifecycle-client-may-support-older |
| lifecycle-server-echoes-supported-version | MUST | server | tested: conformance.TestLifecycleServer/2025-03-26/versioning/lifecycle-server-echoes-supported-version | n/a: addresses the other side |
| lifecycle-server-counteroffers-version | MUST | server | tested: conformance.TestLifecycleServer/2025-03-26/versioning/lifecycle-server-counteroffers-version | n/a: addresses the other side |
| lifecycle-server-counteroffers-latest | SHOULD | server | tested: conformance.TestLifecycleServer/2025-03-26/versioning/lifecycle-server-counteroffers-latest | n/a: addresses the other side |
| lifecycle-client-disconnects-on-unsupported-version | SHOULD (prose) / MUST (schema) | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-03-26/versioning/lifecycle-client-disconnects-on-unsupported-version |
2025-06-18
(security; not in area list)
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| security-implementors-guidelines | SHOULD | both | tested: conformance.TestMessagesServer/2025-06-18/security/security-implementors-guidelines | n/a: catalogue marks it n/a |
authorization
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| authorization-http-should-conform-stdio-should-not | SHOULD / SHOULD NOT | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authorization-custom-auth-may | MAY | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-optional | OPTIONAL | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-http-should-conform | SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-stdio-use-environment | SHOULD NOT | both | gap not implemented: #1975 | gap not implemented: #1950 |
| authz-alt-transport-best-practice | MUST | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-as-implements-oauth21 | MUST | auth-server | n/a: addresses the other side | n/a: addresses the other side |
| authz-dcr-should | SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-bearer-header | MUST | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-token-every-request | MUST | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-no-token-in-query | MUST NOT | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-server-validates-token | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-server-validates-audience | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-client-sends-only-own-as-tokens | MUST NOT | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-accept-only-own-tokens | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-no-token-passthrough | MUST NOT | server | gap not implemented: #1975 | n/a: addresses the other side |
| authz-error-status-codes | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-server-prm-rfc9728 | MUST | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-prm-lists-authorization-servers | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-as-metadata-rfc8414 | MUST | both | n/a: catalogue marks it n/a | n/a: optional feature mcpx does not implement |
| authz-401-www-authenticate | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-client-parses-www-authenticate | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-client-rfc8414-discovery | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-resource-indicator | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-canonical-uri-guidance | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-secure-token-storage | MUST | both | n/a: catalogue marks it n/a | gap not implemented: #1950 |
| authz-as-short-lived-and-rotate | SHOULD / MUST | auth-server | n/a: addresses the other side | n/a: addresses the other side |
| authz-https-and-redirect-uris | MUST | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-pkce | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-open-redirection | MUST / SHOULD | client, auth-server | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-proxy-consent-per-client | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-follow-security-considerations | MUST | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
cancellation
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| cancellation-ref-same-direction-in-progress | MUST | both | tested: conformance.TestUtilitiesServer/2025-06-18/cancellation/cancellation-ref-same-direction-in-progress | tested: conformance.TestUtilitiesClient/2025-06-18/cancellation/cancellation-ref-same-direction-in-progress |
| cancellation-client-must-not-cancel-initialize | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-06-18/cancellation/cancellation-client-must-not-cancel-initialize |
| cancellation-receiver-should-stop-free-no-response | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-06-18/cancellation/cancellation-receiver-should-stop-free-no-response | tested: conformance.TestUtilitiesClient/2025-06-18/cancellation/cancellation-receiver-should-stop-free-no-response |
| cancellation-receiver-may-ignore | MAY | both | tested: conformance.TestUtilitiesServer/2025-06-18/cancellation/cancellation-receiver-may-ignore | tested: conformance.TestUtilitiesClient/2025-06-18/cancellation/cancellation-receiver-may-ignore |
| cancellation-sender-ignore-late-response | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-06-18/cancellation/cancellation-sender-ignore-late-response | tested: conformance.TestUtilitiesClient/2025-06-18/cancellation/cancellation-sender-ignore-late-response |
| cancellation-handle-races | MUST | both | tested: conformance.TestUtilitiesServer/2025-06-18/cancellation/cancellation-handle-races | tested: conformance.TestUtilitiesClient/2025-06-18/cancellation/cancellation-handle-races |
| cancellation-log-reasons | SHOULD | both | gap #77: a cancellation reason reaches Server.OnCancel, which nothing outside tests sets; it is never logged | tested: conformance.TestUtilitiesClient/2025-06-18/cancellation/cancellation-log-reasons |
| cancellation-ui-indicate | SHOULD | both | n/a: no UI | n/a: no UI |
| cancellation-ignore-invalid | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-06-18/cancellation/cancellation-ignore-invalid | tested: conformance.TestUtilitiesClient/2025-06-18/cancellation/cancellation-ignore-invalid |
| cancellation-processing-should-cease | SHOULD | both (receiver) | tested: conformance.TestUtilitiesServer/2025-06-18/cancellation/cancellation-processing-should-cease | tested: conformance.TestUtilitiesClient/2025-06-18/cancellation/cancellation-processing-should-cease |
completion
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| completion-declare-capability | MUST | server | tested: conformance.TestUtilitiesServer/2025-06-18/completion/completion-declare-capability | n/a: addresses the other side |
| completion-max-100 | descr. + schema | server | tested: conformance.TestUtilitiesServer/2025-06-18/completion/completion-max-100 | n/a: addresses the other side |
| completion-server-should | SHOULD | server | tested: daemon.TestHandleCompleteRateLimitHotChangeAndZeroDisables@alldaemon.TestHandleCompleteRateLimitRefusesBeforePool@alldaemon.TestHandleCompleteServerWindowBindsAcrossCallers@alldaemon.TestLocalCompletionCapAfterRanking@alldaemon.TestLocalCompletionTiersPrompts@alldaemon.TestLocalCompletionTiersResources@all | n/a: addresses the other side |
| completion-client-should | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-06-18/completion/completion-client-should |
| completion-security | MUST | both | gap #1968: partial: completion inputs are validated and completion/complete is rate limited per caller (completion.perMinute) and per server (completion.serverPerMinute) since #2387, but there is no per-caller access control for sensitive suggestions and no completion-specific information-disclosure control; waiting on principals #1968 / permissive-auth #1972 | n/a: catalogue marks it n/a |
| completion-errors | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-06-18/completion/completion-errors | n/a: addresses the other side |
| completion-context-arguments | should (lowercase) | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-06-18/completion/completion-context-arguments |
elicitation
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| elicitation-server-no-sensitive-info | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2025-06-18/elicitation/elicitation-server-no-sensitive-info | n/a: addresses the other side |
| elicitation-app-show-requesting-server | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/elicitation/elicitation-app-show-requesting-server |
| elicitation-app-review-modify-responses | SHOULD | client | n/a: addresses the other side | tested: cli.TestRenderAnswerReviewMasksSensitiveFields@2025-06-18cli.TestRenderQuestionFormShowsSchemaDefaults@2025-06-18 |
| elicitation-app-decline-cancel-options | SHOULD | client | n/a: addresses the other side | tested: elicit.TestAnExpiredQuestionBecomesCancelNotDecline@2025-06-18,2025-11-25,2026-07-28elicit.TestAnsweringAfterTheProcessDiedStillWorks@2025-06-18,2025-11-25,2026-07-28 |
| elicitation-client-declare-capability-at-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/elicitation/elicitation-client-declare-capability-at-initialize |
| elicitation-form-schema-flat-primitives | MUST (schema-structural) | server | tested: conformance.TestClientFeaturesServer/2025-06-18/elicitation/elicitation-form-schema-flat-primitives | n/a: addresses the other side |
| elicitation-client-user-approval-controls | SHOULD | client | n/a: addresses the other side | tested: elicit.TestRoutingSendsCredentialsToAHumanAndTheRestToTheAgent@2025-06-18,2025-11-25,2026-07-28 |
| elicitation-client-allow-decline-any-time | SHOULD | client | n/a: addresses the other side | tested: elicit.TestAnsweringAfterTheProcessDiedStillWorks@2025-06-18,2025-11-25,2026-07-28 |
| elicitation-client-rate-limit | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/elicitation/elicitation-client-rate-limit |
| elicitation-client-clear-what-and-why | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/elicitation/elicitation-client-clear-what-and-why |
| elicitation-both-validate-against-schema | SHOULD | both | tested: mcpclient.TestElicitationAnswersValidatedAgainstRequestedSchema@2025-06-18 | tested: mcpclient.TestElicitationAnswersValidatedAgainstRequestedSchema@2025-06-18 |
errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| errors-error-has-code-and-message | MUST | both | tested: conformance.TestMessagesServer/2025-06-18/errors/errors-error-has-code-and-message | tested: conformance.TestMessagesClient/2025-06-18/errors/errors-error-has-code-and-message |
| errors-codes-integers | MUST | both | tested: conformance.TestMessagesServer/2025-06-18/errors/errors-codes-integers | tested: conformance.TestMessagesClient/2025-06-18/errors/errors-codes-integers |
| errors-message-concise-single-sentence | SHOULD | both | tested: conformance.TestMessagesServer/2025-06-18/errors/errors-message-concise-single-sentence | n/a: sends no errors except to server requests |
lifecycle
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| lifecycle-implementations-support-base-and-lifecycle | MUST | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-implementations-support-base-and-lifecycle | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-implementations-support-base-and-lifecycle |
| lifecycle-initialization-first-interaction | MUST | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-initialization-first-interaction | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-initialization-first-interaction |
| lifecycle-client-sends-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-client-sends-initialize |
| lifecycle-server-responds-caps-and-info | MUST | server | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-server-responds-caps-and-info | n/a: addresses the other side |
| lifecycle-client-sends-initialized-after-init | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-client-sends-initialized-after-init |
| lifecycle-client-no-requests-before-init-response | SHOULD NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-client-no-requests-before-init-response |
| lifecycle-server-no-requests-before-initialized | SHOULD NOT | server | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-server-no-requests-before-initialized | n/a: addresses the other side |
| lifecycle-capabilities-establish-session-features | (definitional) | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-capabilities-establish-session-features | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-capabilities-establish-session-features |
| lifecycle-respect-negotiated-version-and-capabilities-must | MUST | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-respect-negotiated-version-and-capabilities-must | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-respect-negotiated-version-and-capabilities-must |
| lifecycle-stdio-client-shutdown-sequence | SHOULD | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-stdio-client-shutdown-sequence |
| lifecycle-stdio-server-may-exit | MAY | server | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-stdio-server-may-exit | n/a: addresses the other side |
| lifecycle-http-shutdown-closing-connection | (definitional) | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-http-shutdown-closing-connection | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-http-shutdown-closing-connection |
| lifecycle-prepared-for-error-cases | SHOULD | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-prepared-for-error-cases | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-prepared-for-error-cases |
| lifecycle-timeouts-establish | SHOULD | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-timeouts-establish | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-timeouts-establish |
| lifecycle-timeouts-cancel-on-expiry | SHOULD | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-timeouts-cancel-on-expiry | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-timeouts-cancel-on-expiry |
| lifecycle-timeouts-per-request-configurable | SHOULD | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-timeouts-per-request-configurable | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-timeouts-per-request-configurable |
| lifecycle-timeouts-may-reset-on-progress | MAY | both | n/a: catalogue marks it n/a | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-timeouts-may-reset-on-progress |
| lifecycle-timeouts-max-regardless-of-progress | SHOULD | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-timeouts-max-regardless-of-progress | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-timeouts-max-regardless-of-progress |
| lifecycle-cancel-not-initialize | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-cancel-not-initialize |
| lifecycle-instructions-may-go-in-system-prompt | MAY | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-instructions-may-go-in-system-prompt |
| lifecycle-capability-sets-open | (definitional) | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-capability-sets-open | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-capability-sets-open |
| lifecycle-implementation-name-version-required | REQUIRED (schema field) | both | tested: conformance.TestLifecycleServer/2025-06-18/lifecycle/lifecycle-implementation-name-version-required | tested: conformance.TestLifecycleClient/2025-06-18/lifecycle/lifecycle-implementation-name-version-required |
logging
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| logging-declare-capability | MUST | server | tested: conformance.TestUtilitiesServer/2025-06-18/logging/logging-declare-capability | n/a: addresses the other side |
| logging-client-may-setlevel | MAY | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-06-18/logging/logging-client-may-setlevel |
| logging-setlevel-at-or-above | should (schema) | server | tested: conformance.TestUtilitiesServer/2025-06-18/logging/logging-setlevel-at-or-above | n/a: addresses the other side |
| logging-unset-server-chooses | MAY | server | tested: conformance.TestUtilitiesServer/2025-06-18/logging/logging-unset-server-chooses | n/a: addresses the other side |
| logging-errors-setlevel | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-06-18/logging/logging-errors-setlevel | n/a: addresses the other side |
| logging-server-hygiene | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-06-18/logging/logging-server-hygiene | n/a: addresses the other side |
| logging-no-secrets-pii | MUST NOT | both (emitter) | tested: conformance.TestUtilitiesServer/2025-06-18/logging/logging-no-secrets-pii | tested: conformance.TestUtilitiesClient/2025-06-18/logging/logging-no-secrets-pii |
| logging-impl-validate-control | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-06-18/logging/logging-impl-validate-control | tested: conformance.TestUtilitiesClient/2025-06-18/logging/logging-impl-validate-control |
messages
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| messages-all-messages-follow-jsonrpc-2 | MUST | both | tested: conformance.TestJSONRPCFramesEveryRevision/2025-06-18/messages/all-messages-follow-jsonrpc-2-server-httpconformance.TestJSONRPCFramesEveryRevision/2025-06-18/messages/all-messages-follow-jsonrpc-2-server-stdioconformance.TestMessagesServer/2025-06-18/messages/messages-all-messages-follow-jsonrpc-2 | tested: conformance.TestJSONRPCFramesEveryRevision/2025-06-18/messages/all-messages-follow-jsonrpc-2-client |
| messages-other-components-may | MAY | both | tested: conformance.TestMessagesServer/2025-06-18/messages/messages-other-components-may | tested: conformance.TestMessagesClient/2025-06-18/messages/messages-other-components-may |
| messages-request-id-string-or-integer | MUST | both | tested: conformance.TestMessagesServer/2025-06-18/messages/messages-request-id-string-or-integer | tested: conformance.TestMessagesClient/2025-06-18/messages/messages-request-id-string-or-integer |
| messages-request-id-not-null | MUST NOT | both | tested: conformance.TestMessagesServer/2025-06-18/messages/messages-request-id-not-null | tested: conformance.TestMessagesClient/2025-06-18/messages/messages-request-id-not-null |
| messages-request-id-unique-per-session | MUST NOT | both | tested: conformance.TestMessagesServer/2025-06-18/messages/messages-request-id-unique-per-session | tested: conformance.TestMessagesClient/2025-06-18/messages/messages-request-id-unique-per-session |
| messages-response-same-id | MUST | both | tested: conformance.TestMessagesServer/2025-06-18/messages/messages-response-same-id | tested: conformance.TestMessagesClient/2025-06-18/messages/messages-response-same-id |
| messages-response-result-xor-error | MUST / MUST NOT | both | tested: conformance.TestMessagesServer/2025-06-18/messages/messages-response-result-xor-error | tested: conformance.TestMessagesClient/2025-06-18/messages/messages-response-result-xor-error |
| messages-result-any-object | MAY | both | tested: conformance.TestMessagesServer/2025-06-18/messages/messages-result-any-object | tested: conformance.TestMessagesClient/2025-06-18/messages/messages-result-any-object |
| messages-notification-no-response | MUST NOT | both | tested: conformance.TestMessagesServer/2025-06-18/messages/messages-notification-no-response | tested: conformance.TestMessagesClient/2025-06-18/messages/messages-notification-no-response |
| messages-notification-no-id | MUST NOT | both | tested: conformance.TestMessagesServer/2025-06-18/messages/messages-notification-no-id | tested: conformance.TestMessagesClient/2025-06-18/messages/messages-notification-no-id |
| transport-jsonrpc-utf8 | MUST | both | tested: conformance.TestMessagesServer/2025-06-18/messages/transport-jsonrpc-utf8 | tested: conformance.TestMessagesClient/2025-06-18/messages/transport-jsonrpc-utf8 |
meta
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| meta-no-assumptions-on-reserved-keys | MUST NOT | both | tested: conformance.TestMessagesServer/2025-06-18/meta/meta-no-assumptions-on-reserved-keys | tested: conformance.TestMessagesClient/2025-06-18/meta/meta-no-assumptions-on-reserved-keys |
| meta-prefix-label-format | MUST | both | tested: conformance.TestMessagesServer/2025-06-18/meta/meta-prefix-label-format | tested: conformance.TestMessagesClient/2025-06-18/meta/meta-prefix-label-format |
| meta-reserved-prefix-2025-06-18 | (reservation) | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| meta-name-format | MUST / MAY | both | tested: conformance.TestMessagesServer/2025-06-18/meta/meta-name-format | tested: conformance.TestMessagesClient/2025-06-18/meta/meta-name-format |
| meta-schema-may-reserve-names | (reservation) | both | tested: conformance.TestMessagesServer/2025-06-18/meta/meta-schema-may-reserve-names | tested: conformance.TestMessagesClient/2025-06-18/meta/meta-schema-may-reserve-names |
| meta-progress-token-receiver-not-obligated | (definitional) | both | tested: conformance.TestMessagesServer/2025-06-18/meta/meta-progress-token-receiver-not-obligated | tested: conformance.TestMessagesClient/2025-06-18/meta/meta-progress-token-receiver-not-obligated |
pagination
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| pagination-no-fixed-page-size | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-06-18/pagination/pagination-no-fixed-page-size |
| pagination-stable-cursors | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-06-18/pagination/pagination-stable-cursors | n/a: addresses the other side |
| pagination-invalid-cursor-graceful | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-06-18/pagination/pagination-invalid-cursor-graceful | n/a: addresses the other side |
| pagination-missing-nextcursor-end | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-06-18/pagination/pagination-missing-nextcursor-end |
| pagination-support-both-flows | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-06-18/pagination/pagination-support-both-flows |
| pagination-cursor-opaque | MUST | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-06-18/pagination/pagination-cursor-opaque |
| pagination-no-persist-across-sessions | MUST | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-06-18/pagination/pagination-no-persist-across-sessions |
| pagination-invalid-cursor-32602 | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-06-18/pagination/pagination-invalid-cursor-32602 | n/a: addresses the other side |
ping
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| ping-receiver-responds-promptly-empty | MUST | both | tested: conformance.TestLifecycleServer/2025-06-18/ping/ping-receiver-responds-promptly-empty | tested: conformance.TestLifecycleClient/2025-06-18/ping/ping-receiver-responds-promptly-empty |
| ping-either-party-may-initiate | (definitional) | both | tested: conformance.TestLifecycleServer/2025-06-18/ping/ping-either-party-may-initiate | tested: conformance.TestLifecycleClient/2025-06-18/ping/ping-either-party-may-initiate |
| ping-sender-may-consider-stale | MAY | both | n/a: catalogue marks it n/a | n/a: does not ping |
| ping-periodic-pings | SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| ping-frequency-configurable | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-timeouts-appropriate | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-avoid-excessive | SHOULD | both | tested: conformance.TestLifecycleServer/2025-06-18/ping/ping-avoid-excessive | tested: conformance.TestLifecycleClient/2025-06-18/ping/ping-avoid-excessive |
| ping-timeout-is-connection-failure | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-multiple-failures-may-reset | MAY | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-log-failures | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-schema-receiver-must-respond | must (lowercase) | both | tested: conformance.TestLifecycleServer/2025-06-18/ping/ping-schema-receiver-must-respond | tested: conformance.TestLifecycleClient/2025-06-18/ping/ping-schema-receiver-must-respond |
progress
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| progress-token-string-or-int | MUST | both (requester) | n/a: as a server mcpx never requests progress; a host’s token is relayed back verbatim | tested: conformance.TestUtilitiesClient/2025-06-18/progress/progress-token-string-or-int |
| progress-token-unique-sender | MUST | both | tested: conformance.TestUtilitiesServer/2025-06-18/progress/progress-token-unique-sender | tested: conformance.TestUtilitiesClient/2025-06-18/progress/progress-token-unique-sender |
| progress-receiver-may-send | MAY | both | n/a: optional feature mcpx does not implement | n/a: never receives requests with tokens |
| progress-must-increase | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2025-06-18/progress/progress-must-increase | n/a: catalogue marks it n/a |
| progress-message-human-readable | SHOULD | both (notifier) | tested: conformance.TestUtilitiesServer/2025-06-18/progress/progress-message-human-readable | n/a: catalogue marks it n/a |
| progress-only-active-tokens | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2025-06-18/progress/progress-only-active-tokens | n/a: catalogue marks it n/a |
| progress-receiver-may-skip | MAY | both | tested: conformance.TestUtilitiesServer/2025-06-18/progress/progress-receiver-may-skip | tested: conformance.TestUtilitiesClient/2025-06-18/progress/progress-receiver-may-skip |
| progress-track-tokens | SHOULD | both | n/a: catalogue marks it n/a | tested: conformance.TestUtilitiesClient/2025-06-18/progress/progress-track-tokens |
| progress-rate-limit | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-06-18/progress/progress-rate-limit | tested: conformance.TestUtilitiesClient/2025-06-18/progress/progress-rate-limit |
| progress-stop-after-completion | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2025-06-18/progress/progress-stop-after-completion | n/a: catalogue marks it n/a |
prompts
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2025-06-18/prompts/prompts-declare-capability | n/a: addresses the other side |
| prompts-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/prompts/prompts-list-changed-notify | n/a: addresses the other side |
| prompts-image-base64-mime | MUST | server | tested: conformance.TestFeaturesServer/2025-06-18/prompts/prompts-image-base64-mime | n/a: addresses the other side |
| prompts-audio-base64-mime | MUST (not bolded) | server | tested: conformance.TestFeaturesServer/2025-06-18/prompts/prompts-audio-base64-mime | n/a: addresses the other side |
| prompts-embedded-must-include | MUST | server | tested: conformance.TestFeaturesServer/2025-06-18/prompts/prompts-embedded-must-include | n/a: addresses the other side |
| prompts-validate-args | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/prompts/prompts-validate-args | n/a: addresses the other side |
| prompts-respect-capability-negotiation | SHOULD | both | tested: conformance.TestFeaturesServer/2025-06-18/prompts/prompts-respect-capability-negotiation | tested: conformance.TestFeaturesClient/2025-06-18/prompts/prompts-respect-capability-negotiation |
| prompts-validate-io | MUST | both | tested: conformance.TestFeaturesServer/2025-06-18/prompts/prompts-validate-io; mcpclient.TestValidatePromptResult | covered |
prompts / errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-errors-32602-32603 | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/prompts/prompts-errors-32602-32603 | n/a: addresses the other side |
prompts / pagination
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-client-paginate | SHOULD | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-06-18/prompts/prompts-client-paginate |
resources
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2025-06-18/resources/resources-declare-capability | n/a: addresses the other side |
| resources-subscribe-cap-meaning-legacy | (definition) | server | tested: e2e.TestResourceSubscriptionsReachUpstream/2025-11-25/resources/http-subscribe-delivers-upstream-updates-on-the-get-stream@2025-03-26,2025-06-18,2025-11-25e2e.TestResourceSubscriptionsReachUpstream/2025-11-25/resources/stdio-subscribe-delivers-upstream-updates-under-the-mcpx-uri@2024-11-05,2025-03-26,2025-06-18,2025-11-25 | n/a: addresses the other side |
| resources-cap-features-independent | MAY | server | tested: conformance.TestFeaturesServer/2025-06-18/resources/resources-cap-features-independent | n/a: addresses the other side |
| resources-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/resources/resources-list-changed-notify | n/a: addresses the other side |
| resources-updated-may-be-subresource | (note, schema) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-06-18/resources/resources-updated-may-be-subresource |
| resources-https-only-if-client-fetchable | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/resources/resources-https-only-if-client-fetchable | n/a: addresses the other side |
| resources-https-else-other-scheme | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/resources/resources-https-else-other-scheme | n/a: addresses the other side |
| resources-file-xdg-mime-may | MAY | server | tested: conformance.TestFeaturesServer/2025-06-18/resources/resources-file-xdg-mime-may | n/a: addresses the other side |
| resources-custom-scheme-rfc3986 | MUST | server | tested: cli.TestMCPXResourceURIs/2025-06-18/resources/resources-custom-scheme-rfc3986 | n/a: addresses the other side |
| resources-sec-validate-uris | MUST | server | tested: conformance.TestFeaturesServer/2025-06-18/resources/resources-sec-validate-uris | n/a: addresses the other side |
| resources-sec-access-control | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| resources-sec-binary-encoded | MUST | server | tested: conformance.TestFeaturesServer/2025-06-18/resources/resources-sec-binary-encoded | n/a: addresses the other side |
| resources-sec-permissions | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| resources-annotations-defs | (definition) | both | tested: conformance.TestFeaturesServer/2025-06-18/resources/resources-annotations-defs | gap #207: mcpclient.Resource has no annotations field; they are dropped on parse |
resources / errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-not-found-32002 | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/resources/resources-not-found-32002 | n/a: addresses the other side |
| resources-internal-32603 | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/resources/resources-internal-32603 | n/a: addresses the other side |
resources / subscriptions
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-subscribe-rpc | (optional) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-06-18/resources/resources-subscribe-rpc |
| resources-unsubscribe-follows-subscribe | should (lowercase, schema) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-06-18/resources/resources-unsubscribe-follows-subscribe |
roots
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| roots-client-declare-capability-at-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/roots/roots-client-declare-capability-at-initialize |
| roots-client-listchanged-must-notify | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/roots/roots-client-listchanged-must-notify |
| roots-uri-must-be-file-scheme | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-only-expose-permitted-roots | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-validate-uris-path-traversal | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-implement-access-controls | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-monitor-accessibility | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-server-handle-unavailable-roots | SHOULD | server | n/a: mcpx does not consume roots | n/a: addresses the other side |
| roots-server-respect-boundaries | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-validate-paths-against-roots | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-client-prompt-consent-before-exposing | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-provide-root-management-ui | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-validate-accessibility-before-exposing | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-monitor-root-changes | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-server-check-capability-before-use | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-handle-list-changes | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-cache-root-information | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-client-return-jsonrpc-errors | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/roots/roots-client-return-jsonrpc-errors |
sampling
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| sampling-human-in-loop-can-deny | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/sampling/sampling-human-in-loop-can-deny |
| sampling-app-review-ui | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-app-view-edit-prompts | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-app-review-responses | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-client-declare-capability-at-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/sampling/sampling-client-declare-capability-at-initialize |
| sampling-client-may-sample-fewer-tokens | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-ignore-model-preferences | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-modify-system-prompt | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-ignore-includecontext | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hints-evaluated-in-order | MUST | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hints-over-priorities | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hint-name-substring | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hint-may-map-provider | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-stopreason-custom-values | MAY | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/sampling/sampling-stopreason-custom-values |
| sampling-client-errors-user-rejected | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/sampling/sampling-client-errors-user-rejected |
| sampling-client-user-approval-controls | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-both-validate-message-content | SHOULD | both | tested: conformance.TestSamplingValidation/2025-06-18/sampling/sampling-both-validate-message-content | tested: conformance.TestSamplingValidation/2025-06-18/sampling/sampling-both-validate-message-content |
| sampling-client-respect-hints | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-rate-limit | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-06-18/sampling/sampling-client-rate-limit |
| sampling-both-handle-sensitive-data | MUST | both | tested: daemon.TestElicitEventsAreSummaryOnly@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28elicit.TestOpenPrunesTerminalRowsPastTheAgeBound@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28 | tested: daemon.TestElicitEventsAreSummaryOnly@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28elicit.TestOpenPrunesTerminalRowsPastTheAgeBound@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28 |
subscriptions
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| subscriptions-list-changed-should-notify | SHOULD | server | tested: conformance.TestStatefulServer/2025-06-18/subscriptions/subscriptions-list-changed-should-notify | n/a: addresses the other side |
| subscriptions-resources-updated-only-if-subscribed | should (schema) | server | tested: conformance.TestStatefulServer/2025-06-18/subscriptions/subscriptions-resources-updated-only-if-subscribed | n/a: addresses the other side |
tools
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tools-human-in-loop-deny | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-ui-expose-indicate-confirm | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-declare-capability | n/a: addresses the other side |
| tools-list-changed-means-emit | (definition) | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-list-changed-means-emit | n/a: addresses the other side |
| tools-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-list-changed-notify | n/a: addresses the other side |
| tools-annotations-untrusted | MUST | client | n/a: addresses the other side | tested: daemon.TestAnnotationClearsCallOnlyForLocallyDeclaredServers@2026-07-28 |
| tools-annotations-hints-no-decisions | should (lowercase, schema) | client | n/a: addresses the other side | tested: daemon.TestAnnotationClearsCallOnlyForLocallyDeclaredServers@2026-07-28 |
| tools-result-iserror-for-tool-errors | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-result-iserror-for-tool-errors | n/a: addresses the other side |
| tools-result-lookup-errors-protocol | should (lowercase) | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-result-lookup-errors-protocol | n/a: addresses the other side |
| tools-error-unknown-tool-protocol | (classification) | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-error-unknown-tool-protocol | n/a: addresses the other side |
| tools-error-invalid-args-protocol | (classification) | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-error-invalid-args-protocol | n/a: addresses the other side |
| tools-embedded-resource-may | MAY | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-embedded-resource-may | n/a: addresses the other side |
| tools-embedded-implies-resources-cap | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-embedded-implies-resources-cap | n/a: addresses the other side |
| tools-resource-link-may | MAY | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-resource-link-may | n/a: addresses the other side |
| tools-resource-link-may-not-listed | (note) | both | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-resource-link-may-not-listed | tested: conformance.TestFeaturesClient/2025-06-18/tools/tools-resource-link-may-not-listed |
| tools-structured-also-text | SHOULD | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-structured-also-text | n/a: addresses the other side |
| tools-structured-object-only | (type, schema) | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-structured-object-only | n/a: addresses the other side |
| tools-output-schema-conform | MUST | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-output-schema-conform | n/a: addresses the other side |
| tools-output-schema-client-validate | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-output-schema-object-root | (type, schema) | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-output-schema-object-root | n/a: addresses the other side |
| tools-display-name-precedence | (rule) | client | n/a: addresses the other side | gap #207: tool title and annotations.title are carried but nothing that displays a tool uses them |
| tools-server-sec-validate-inputs | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| tools-client-sec | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
tools / json-schema
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tools-inputschema-type-object-root | REQUIRED (schema) | server | tested: conformance.TestFeaturesServer/2025-06-18/tools/tools-inputschema-type-object-root | n/a: addresses the other side |
transport-http-sse
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| http-sse-server-backcompat-host-both | should (lowercase) | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| http-sse-client-backcompat-probe-any-4xx | should (lowercase) | client | n/a: addresses the other side | tested: pool.TestHTTPSSEFallback/2025-11-25/transport-http-sse/client-falls-back-to-get-endpoint-and-caches-it@2025-03-26,2025-06-18 |
transport-stdio
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| transport-client-should-support-stdio | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-stdio/transport-client-should-support-stdio |
| transport-custom-preserve-jsonrpc-and-lifecycle | MUST | both | n/a: mcpx serves MCP only over stdio and Streamable HTTP; its /v1 REST surface is not an MCP transport | n/a: catalogue marks it n/a |
| transport-custom-document-patterns | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| stdio-no-embedded-newlines | MUST NOT | both | tested: conformance.TestTransportServer/2025-06-18/transport-stdio/stdio-no-embedded-newlines | tested: conformance.TestTransportClient/2025-06-18/transport-stdio/stdio-no-embedded-newlines |
| stdio-message-is-single | MUST (implied) | both | tested: conformance.TestTransportServer/2025-06-18/transport-stdio/stdio-message-is-single | tested: conformance.TestTransportClient/2025-06-18/transport-stdio/stdio-message-is-single |
| stdio-server-may-log-to-stderr | MAY | server | tested: conformance.TestTransportServer/2025-06-18/transport-stdio/stdio-server-may-log-to-stderr | n/a: addresses the other side |
| stdio-client-may-capture-stderr | MAY | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-stdio/stdio-client-may-capture-stderr |
| stdio-server-stdout-only-mcp | MUST NOT | server | tested: conformance.TestTransportServer/2025-06-18/transport-stdio/stdio-server-stdout-only-mcp | n/a: addresses the other side |
| stdio-client-stdin-only-mcp | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-stdio/stdio-client-stdin-only-mcp |
transport-streamable-http
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| streamable-http-server-single-endpoint-post-get | MUST | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-single-endpoint-post-get | n/a: addresses the other side |
| streamable-http-server-validate-origin | MUST | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-validate-origin | n/a: addresses the other side |
| streamable-http-server-bind-localhost | SHOULD | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-bind-localhost | n/a: addresses the other side |
| streamable-http-server-authenticate | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| streamable-http-client-post-every-message | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-streamable-http/streamable-http-client-post-every-message |
| streamable-http-client-accept-both | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-streamable-http/streamable-http-client-accept-both |
| streamable-http-post-body-single | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-streamable-http/streamable-http-post-body-single |
| streamable-http-server-202-for-non-request | MUST | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-202-for-non-request | n/a: addresses the other side |
| streamable-http-server-error-status-if-rejected | MUST | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-error-status-if-rejected | n/a: addresses the other side |
| streamable-http-server-json-or-sse-for-request | MUST | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-json-or-sse-for-request | n/a: addresses the other side |
| streamable-http-client-supports-json-and-sse | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-streamable-http/streamable-http-client-supports-json-and-sse |
| streamable-http-sse-includes-response | SHOULD | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-sse-includes-response | n/a: addresses the other side |
| streamable-http-post-sse-may-carry-requests | MAY | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-post-sse-may-carry-requests | n/a: addresses the other side |
| streamable-http-sse-not-closed-before-response | SHOULD NOT | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-sse-not-closed-before-response | n/a: addresses the other side |
| streamable-http-server-terminates-sse-after-response | SHOULD | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-terminates-sse-after-response | n/a: addresses the other side |
| streamable-http-disconnect-not-cancel | SHOULD NOT | both | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-disconnect-not-cancel | n/a: catalogue marks it n/a |
| streamable-http-client-cancel-by-notification | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-streamable-http/streamable-http-client-cancel-by-notification |
| streamable-http-server-may-resume | MAY | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| streamable-http-client-may-get | MAY | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| streamable-http-get-accept-sse | MUST | client | n/a: addresses the other side | n/a: no GET |
| streamable-http-get-sse-or-405 | MUST | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-get-sse-or-405 | n/a: addresses the other side |
| streamable-http-get-stream-unrelated | SHOULD | server | n/a: 405 | n/a: addresses the other side |
| streamable-http-get-no-responses | MUST NOT | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| streamable-http-get-close-any-time | MAY | both | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-get-close-any-time | tested: conformance.TestTransportClient/2025-06-18/transport-streamable-http/streamable-http-get-close-any-time |
| streamable-http-multiple-streams | MAY | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-streamable-http/streamable-http-multiple-streams |
| streamable-http-no-broadcast | MUST / MUST NOT | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-no-broadcast | n/a: addresses the other side |
| streamable-http-event-id-unique | MUST | server | n/a: no ids | n/a: addresses the other side |
| streamable-http-client-resume-with-last-event-id | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestLegacyHTTPStreamResumption/2025-11-25/transport/client-resumes-closed-stream-with-last-event-id-after-retry@2025-03-26,2025-06-18,2025-11-25 |
| streamable-http-server-no-cross-stream-replay | MUST NOT | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| streamable-http-server-may-assign-session | MAY | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-may-assign-session | n/a: addresses the other side |
| streamable-http-session-id-secure | SHOULD | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-session-id-secure | n/a: addresses the other side |
| streamable-http-session-id-visible-ascii | MUST | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-session-id-visible-ascii | n/a: addresses the other side |
| streamable-http-client-echoes-session | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-streamable-http/streamable-http-client-echoes-session |
| streamable-http-server-400-missing-session | SHOULD | server | n/a: mcpx does not require one (stateless fallback | n/a: addresses the other side |
| streamable-http-server-404-terminated-session | MUST | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-404-terminated-session | n/a: addresses the other side |
| streamable-http-client-reinit-on-404 | MUST | client | n/a: addresses the other side | tested: mcpclient.TestLegacySession404Recovery/2025-11-25/transport/client-reinitializes-on-session-404-and-retries-once@2025-03-26,2025-06-18,2025-11-25 |
| streamable-http-client-delete-session | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-streamable-http/streamable-http-client-delete-session |
| streamable-http-server-may-405-delete | MAY | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-may-405-delete | n/a: addresses the other side |
| streamable-http-protocol-version-header-is-negotiated | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-06-18/transport-streamable-http/streamable-http-protocol-version-header-is-negotiated |
| streamable-http-server-assumes-2025-03-26 | SHOULD | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-assumes-2025-03-26 | n/a: addresses the other side |
| streamable-http-server-400-unsupported-version-header | MUST | server | tested: conformance.TestTransportServer/2025-06-18/transport-streamable-http/streamable-http-server-400-unsupported-version-header | n/a: addresses the other side |
versioning
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| lifecycle-client-sends-supported-version | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-06-18/versioning/lifecycle-client-sends-supported-version |
| lifecycle-client-sends-latest-version | SHOULD | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-06-18/versioning/lifecycle-client-sends-latest-version |
| lifecycle-client-may-support-older | MAY | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-06-18/versioning/lifecycle-client-may-support-older |
| lifecycle-server-echoes-supported-version | MUST | server | tested: conformance.TestLifecycleServer/2025-06-18/versioning/lifecycle-server-echoes-supported-version | n/a: addresses the other side |
| lifecycle-server-counteroffers-version | MUST | server | tested: conformance.TestLifecycleServer/2025-06-18/versioning/lifecycle-server-counteroffers-version | n/a: addresses the other side |
| lifecycle-server-counteroffers-latest | SHOULD | server | tested: conformance.TestLifecycleServer/2025-06-18/versioning/lifecycle-server-counteroffers-latest | n/a: addresses the other side |
| lifecycle-client-disconnects-on-unsupported-version | SHOULD (prose) / MUST (schema) | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-06-18/versioning/lifecycle-client-disconnects-on-unsupported-version |
| lifecycle-http-protocol-version-header | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-06-18/versioning/lifecycle-http-protocol-version-header |
2025-11-25
(security; not in area list)
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| security-implementors-guidelines | SHOULD | both | tested: conformance.TestMessagesServer/2025-11-25/security/security-implementors-guidelines | n/a: catalogue marks it n/a |
authorization
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| authorization-http-should-conform-stdio-should-not | SHOULD / SHOULD NOT | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authorization-custom-auth-may | MAY | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-optional | OPTIONAL | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-http-should-conform | SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-stdio-use-environment | SHOULD NOT | both | gap not implemented: #1975 | gap not implemented: #1950 |
| authz-alt-transport-best-practice | MUST | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-as-implements-oauth21 | MUST | auth-server | n/a: addresses the other side | n/a: addresses the other side |
| authz-dcr-may-deprecated | MAY | client, auth-server | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-bearer-header | MUST | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-token-every-request | MUST | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-no-token-in-query | MUST NOT | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-server-validates-token | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-server-validates-audience | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-client-sends-only-own-as-tokens | MUST NOT | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-accept-only-own-tokens | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-no-token-passthrough | MUST NOT | server | gap not implemented: #1975 | n/a: addresses the other side |
| authz-error-status-codes | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-server-prm-rfc9728 | MUST | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-prm-lists-authorization-servers | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-as-metadata-rfc8414-or-oidc | MUST | both | n/a: catalogue marks it n/a | n/a: optional feature mcpx does not implement |
| authz-prm-discovery-header-or-well-known | MUST | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-client-parses-www-authenticate | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-client-as-discovery-order | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-resource-indicator | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-canonical-uri-guidance | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-secure-token-storage | MUST | both | n/a: catalogue marks it n/a | gap not implemented: #1950 |
| authz-as-short-lived-and-rotate | SHOULD / MUST | auth-server | n/a: addresses the other side | n/a: addresses the other side |
| authz-https-and-redirect-uris | MUST | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-pkce-verify-s256 | MUST | client, auth-server | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-open-redirection | MUST / SHOULD | client, auth-server | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-proxy-consent-per-client | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-registration-priority | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-cimd | SHOULD / MUST | client, auth-server | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-preregistration | SHOULD | client | n/a: addresses the other side | n/a: no OAuth client |
| authz-scope-in-challenge | SHOULD / MUST / MUST NOT | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-scope-selection-order | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-insufficient-scope-403 | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-step-up | SHOULD / MAY | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-cimd-as-security | MUST / SHOULD | auth-server | n/a: addresses the other side | n/a: addresses the other side |
| authz-follow-security-considerations | MUST | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
cancellation
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| cancellation-ref-same-direction-in-progress | MUST | both | tested: conformance.TestUtilitiesServer/2025-11-25/cancellation/cancellation-ref-same-direction-in-progress | tested: conformance.TestUtilitiesClient/2025-11-25/cancellation/cancellation-ref-same-direction-in-progress |
| cancellation-client-must-not-cancel-initialize | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-11-25/cancellation/cancellation-client-must-not-cancel-initialize |
| cancellation-task-use-tasks-cancel | MUST | both | tested: conformance.TestUtilitiesServer/2025-11-25/cancellation/cancellation-task-use-tasks-cancel | tested: conformance.TestUtilitiesClient/2025-11-25/cancellation/cancellation-task-use-tasks-cancel |
| cancellation-requestid-required-non-task-forbidden-task | MUST / MUST NOT | both | tested: conformance.TestUtilitiesServer/2025-11-25/cancellation/cancellation-requestid-required-non-task-forbidden-task | tested: conformance.TestUtilitiesClient/2025-11-25/cancellation/cancellation-requestid-required-non-task-forbidden-task |
| cancellation-receiver-should-stop-free-no-response | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-11-25/cancellation/cancellation-receiver-should-stop-free-no-response | tested: conformance.TestUtilitiesClient/2025-11-25/cancellation/cancellation-receiver-should-stop-free-no-response |
| cancellation-receiver-may-ignore | MAY | both | tested: conformance.TestUtilitiesServer/2025-11-25/cancellation/cancellation-receiver-may-ignore | tested: conformance.TestUtilitiesClient/2025-11-25/cancellation/cancellation-receiver-may-ignore |
| cancellation-sender-ignore-late-response | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-11-25/cancellation/cancellation-sender-ignore-late-response | tested: conformance.TestUtilitiesClient/2025-11-25/cancellation/cancellation-sender-ignore-late-response |
| cancellation-handle-races | MUST | both | tested: conformance.TestUtilitiesServer/2025-11-25/cancellation/cancellation-handle-races | tested: conformance.TestUtilitiesClient/2025-11-25/cancellation/cancellation-handle-races |
| cancellation-log-reasons | SHOULD | both | gap #77: a cancellation reason reaches Server.OnCancel, which nothing outside tests sets; it is never logged | tested: conformance.TestUtilitiesClient/2025-11-25/cancellation/cancellation-log-reasons |
| cancellation-ui-indicate | SHOULD | both | n/a: no UI | n/a: no UI |
| cancellation-ignore-invalid | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-11-25/cancellation/cancellation-ignore-invalid | tested: conformance.TestUtilitiesClient/2025-11-25/cancellation/cancellation-ignore-invalid |
| cancellation-processing-should-cease | SHOULD | both (receiver) | tested: conformance.TestUtilitiesServer/2025-11-25/cancellation/cancellation-processing-should-cease | tested: conformance.TestUtilitiesClient/2025-11-25/cancellation/cancellation-processing-should-cease |
completion
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| completion-declare-capability | MUST | server | tested: conformance.TestUtilitiesServer/2025-11-25/completion/completion-declare-capability | n/a: addresses the other side |
| completion-max-100 | descr. + schema | server | tested: conformance.TestUtilitiesServer/2025-11-25/completion/completion-max-100 | n/a: addresses the other side |
| completion-server-should | SHOULD | server | tested: daemon.TestHandleCompleteRateLimitHotChangeAndZeroDisables@alldaemon.TestHandleCompleteRateLimitRefusesBeforePool@alldaemon.TestHandleCompleteServerWindowBindsAcrossCallers@alldaemon.TestLocalCompletionCapAfterRanking@alldaemon.TestLocalCompletionTiersPrompts@alldaemon.TestLocalCompletionTiersResources@all | n/a: addresses the other side |
| completion-client-should | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-11-25/completion/completion-client-should |
| completion-security | MUST | both | gap #1968: partial: completion inputs are validated and completion/complete is rate limited per caller (completion.perMinute) and per server (completion.serverPerMinute) since #2387, but there is no per-caller access control for sensitive suggestions and no completion-specific information-disclosure control; waiting on principals #1968 / permissive-auth #1972 | n/a: catalogue marks it n/a |
| completion-errors | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-11-25/completion/completion-errors | n/a: addresses the other side |
| completion-context-arguments | should (lowercase) | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-11-25/completion/completion-context-arguments |
elicitation
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| elicitation-server-no-sensitive-info-in-form-mode | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-server-no-sensitive-info-in-form-mode | n/a: addresses the other side |
| elicitation-server-sensitive-via-url-mode | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-server-sensitive-via-url-mode | n/a: addresses the other side |
| elicitation-client-show-requesting-server | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-show-requesting-server |
| elicitation-client-form-review-modify-responses | MUST | client | n/a: addresses the other side | tested: cli.TestRenderAnswerReviewMasksSensitiveFields@2025-11-25,2026-07-28cli.TestRenderQuestionFormShowsSchemaDefaults@2025-11-25,2026-07-28 |
| elicitation-client-decline-cancel-options | MUST | client | n/a: addresses the other side | tested: elicit.TestAnExpiredQuestionBecomesCancelNotDecline@2025-06-18,2025-11-25,2026-07-28elicit.TestAnsweringAfterTheProcessDiedStillWorks@2025-06-18,2025-11-25,2026-07-28 |
| elicitation-client-url-show-domain-and-consent | MUST | client | n/a: addresses the other side | tested: cli.TestRenderQuestionURLShowsRegistrableDomain@2025-11-25,2026-07-28cli.TestRenderQuestionURLWarnsOnPunycodeHost@2025-11-25,2026-07-28 |
| elicitation-client-declare-capability-at-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-declare-capability-at-initialize |
| elicitation-empty-capability-means-form-only | (definition) | both | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-empty-capability-means-form-only | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-empty-capability-means-form-only |
| elicitation-client-support-at-least-one-mode | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-support-at-least-one-mode |
| elicitation-server-no-undeclared-modes | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-server-no-undeclared-modes | n/a: addresses the other side |
| elicitation-request-must-include-mode-and-message | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-request-must-include-mode-and-message | n/a: addresses the other side |
| elicitation-server-may-omit-mode-for-form | MAY | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-server-may-omit-mode-for-form | n/a: addresses the other side |
| elicitation-client-missing-mode-is-form | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-missing-mode-is-form |
| elicitation-form-request-shape | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-form-request-shape | n/a: addresses the other side |
| elicitation-form-schema-flat-primitives | MUST (schema-structural) | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-form-schema-flat-primitives | n/a: addresses the other side |
| elicitation-client-prepopulate-defaults | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestElicitationDeclarations/2025-11-25/elicitation/client-applies-schema-defaults |
| elicitation-url-request-shape-with-id | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-url-request-shape-with-id | n/a: addresses the other side |
| elicitation-url-must-be-valid | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-url-must-be-valid | n/a: addresses the other side |
| elicitation-client-elicitationid-opaque | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-elicitationid-opaque |
| elicitation-server-may-send-complete-notification | MAY | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-server-may-send-complete-notification | n/a: addresses the other side |
| elicitation-complete-only-to-initiating-client | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-complete-only-to-initiating-client | n/a: addresses the other side |
| elicitation-complete-must-carry-id | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-complete-must-carry-id | n/a: addresses the other side |
| elicitation-client-ignore-unknown-complete | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-ignore-unknown-complete |
| elicitation-client-may-auto-retry-on-complete | MAY | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-may-auto-retry-on-complete |
| elicitation-client-manual-retry-cancel-controls | SHOULD | client | n/a: addresses the other side | tested: e2e.TestElicitationsCanBeListedAndAnsweredFromTheCommandLine@2025-11-25,2026-07-28 |
| elicitation-server-may-return-url-required-error | MAY | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-server-may-return-url-required-error | n/a: addresses the other side |
| elicitation-url-required-error-only-when-required | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-url-required-error-only-when-required | n/a: addresses the other side |
| elicitation-url-required-error-lists-elicitations | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-url-required-error-lists-elicitations | n/a: addresses the other side |
| elicitation-url-required-error-url-mode-with-id | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-url-required-error-url-mode-with-id | n/a: addresses the other side |
| elicitation-server-must-return-32042 | MUST | server | gap #214: a url question for a client that cannot take it stays with the broker; -32042 is never returned | n/a: addresses the other side |
| elicitation-client-32602-on-undeclared-mode | MUST | client | n/a: addresses the other side | tested: mcpclient.TestElicitationDeclarations/2025-11-25/elicitation/undeclared-mode-is-32602 |
| elicitation-server-state-bound-to-user | MUST | server | gap #257: mcpx has no authenticated user: state is bound to the request, the session id is whatever the caller sends | n/a: addresses the other side |
| elicitation-state-not-session-id-alone | MUST NOT | server | gap #257: state is bound to the request, not a user; there is no user to bind to | n/a: addresses the other side |
| elicitation-state-storage-protected | MUST | server | tested: elicit.TestOpenAtCreatesOwnerOnlyStore@2025-11-25,2026-07-28elicit.TestOpenAtMigratesLegacyStore@2025-11-25,2026-07-28 | n/a: addresses the other side |
| elicitation-remote-user-id-from-authorization | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| elicitation-server-must-not-self-authorize-via-url | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-server-must-not-self-authorize-via-url | n/a: addresses the other side |
| elicitation-third-party-creds-not-via-client | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-third-party-creds-not-via-client | n/a: addresses the other side |
| elicitation-no-token-passthrough | MUST NOT | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| elicitation-user-authorizes-server-directly | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-user-authorizes-server-directly | n/a: addresses the other side |
| elicitation-server-not-transmit-url-creds-to-client | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-server-not-transmit-url-creds-to-client | n/a: addresses the other side |
| elicitation-server-bind-to-client-and-user | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-server-bind-to-client-and-user | n/a: addresses the other side |
| elicitation-client-user-approval-controls | SHOULD | client | n/a: addresses the other side | tested: elicit.TestRoutingSendsCredentialsToAHumanAndTheRestToTheAgent@2025-06-18,2025-11-25,2026-07-28 |
| elicitation-client-allow-decline-any-time | SHOULD | client | n/a: addresses the other side | tested: elicit.TestAnsweringAfterTheProcessDiedStillWorks@2025-06-18,2025-11-25,2026-07-28 |
| elicitation-client-rate-limit | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-rate-limit |
| elicitation-client-clear-what-and-why | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-clear-what-and-why |
| elicitation-client-validate-responses | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestElicitationAnswersValidatedAgainstRequestedSchema/2025-11-25/elicitation/wrong-typed-answer-is-32602-not-relayed |
| elicitation-server-validate-received-data | SHOULD | server | tested: mcpclient.TestElicitationAnswersValidatedAgainstRequestedSchema/2025-11-25/elicitation/wrong-typed-answer-is-32602-not-relayed | n/a: addresses the other side |
| elicitation-url-no-sensitive-user-info | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-url-no-sensitive-user-info | n/a: addresses the other side |
| elicitation-url-not-pre-authenticated | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-url-not-pre-authenticated | n/a: addresses the other side |
| elicitation-no-clickable-urls-in-form | SHOULD NOT | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-no-clickable-urls-in-form | n/a: addresses the other side |
| elicitation-url-https-outside-dev | SHOULD | server | tested: conformance.TestClientFeaturesServer/2025-11-25/elicitation/elicitation-url-https-outside-dev | n/a: addresses the other side |
| elicitation-client-handle-urls-carefully | MUST | client | n/a: addresses the other side | tested: cli.TestRenderQuestionURLShowsRegistrableDomain@2025-11-25,2026-07-28cli.TestRenderQuestionURLWarnsOnPunycodeHost@2025-11-25,2026-07-28 |
| elicitation-client-no-url-prefetch | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-no-url-prefetch |
| elicitation-client-no-open-without-consent | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-no-open-without-consent |
| elicitation-client-show-full-url | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-show-full-url |
| elicitation-client-open-url-securely | MUST | client | n/a: addresses the other side | tested: elicit.TestRoutingSendsCredentialsToAHumanAndTheRestToTheAgent@2025-06-18,2025-11-25,2026-07-28 |
| elicitation-client-highlight-domain | SHOULD | client | n/a: addresses the other side | tested: cli.TestRenderQuestionURLShowsRegistrableDomain@2025-11-25,2026-07-28 |
| elicitation-client-warn-punycode | SHOULD | client | n/a: addresses the other side | tested: cli.TestRenderQuestionURLWarnsOnPunycodeHost@2025-11-25,2026-07-28 |
| elicitation-client-no-clickable-except-url-field | SHOULD NOT | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/elicitation/elicitation-client-no-clickable-except-url-field |
| elicitation-server-no-trust-client-user-id | MUST NOT | server | gap #257: mcpx has no authenticated user: state is bound to the request, the session id is whatever the caller sends | n/a: addresses the other side |
| elicitation-server-follow-best-practices | SHOULD | server | gap #255: requestState signing is sound and question storage is owner-only (0700/0600, #1676); there is no user identity | n/a: addresses the other side |
| elicitation-url-verify-opening-user | MUST | server | n/a: mcpx issues no URL; the upstream that does sees mcpx’s identity, not the end user’s | n/a: addresses the other side |
| elicitation-url-same-user-start-and-complete | MUST | server | n/a: see Implied: shared pooled upstream | n/a: addresses the other side |
| elicitation-url-identity-resilient-to-url-tampering | MUST | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| elicitation-task-related-id-shared | MUST | server | tested: conformance.TestStatefulServer/2025-11-25/elicitation/elicitation-task-related-id-shared | n/a: addresses the other side |
errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| messages-error-response-same-id-unless-unreadable | MUST | both | tested: conformance.TestMessagesServer/2025-11-25/errors/messages-error-response-same-id-unless-unreadable | tested: conformance.TestMessagesClient/2025-11-25/errors/messages-error-response-same-id-unless-unreadable |
| errors-error-has-code-and-message | MUST | both | tested: conformance.TestMessagesServer/2025-11-25/errors/errors-error-has-code-and-message | tested: conformance.TestMessagesClient/2025-11-25/errors/errors-error-has-code-and-message |
| errors-codes-integers | MUST | both | tested: conformance.TestMessagesServer/2025-11-25/errors/errors-codes-integers | tested: conformance.TestMessagesClient/2025-11-25/errors/errors-codes-integers |
| errors-message-concise-single-sentence | SHOULD | both | tested: conformance.TestMessagesServer/2025-11-25/errors/errors-message-concise-single-sentence | n/a: sends no errors except to server requests |
json-schema
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| json-schema-default-2020-12 | (definitional) | both | tested: conformance.TestMessagesServer/2025-11-25/json-schema/json-schema-default-2020-12 | n/a: catalogue marks it n/a |
| json-schema-may-declare-dialect | MAY | both | tested: conformance.TestMessagesServer/2025-11-25/json-schema/json-schema-may-declare-dialect | tested: conformance.TestMessagesClient/2025-11-25/json-schema/json-schema-may-declare-dialect |
| json-schema-support-2020-12 | MUST | both | tested: mcpclient.TestCallToolRejectsInvalidArgumentsBeforeTheTransport@all | n/a: passes through |
| json-schema-validate-per-dialect-and-error-on-unsupported | MUST | both | tested: mcpclient.TestListToolsExcludesUncompilableSchemasWithWarning@allschemaval.TestDeclaredDialectsCompile@allschemaval.TestUnsupportedDialect@all | tested: mcpclient.TestListToolsExcludesUncompilableSchemasWithWarning@allschemaval.TestDeclaredDialectsCompile@allschemaval.TestUnsupportedDialect@all |
| json-schema-document-dialects | SHOULD | both | tested: schemaval.TestDeclaredDialectsCompile@allschemaval.TestUnsupportedDialect@all | tested: schemaval.TestDeclaredDialectsCompile@allschemaval.TestUnsupportedDialect@all |
| json-schema-recommend-2020-12 | RECOMMENDED | both | tested: conformance.TestMessagesServer/2025-11-25/json-schema/json-schema-recommend-2020-12 | n/a: catalogue marks it n/a |
| json-schema-schemas-valid | MUST | both | tested: conformance.TestMessagesServer/2025-11-25/json-schema/json-schema-schemas-valid | n/a: catalogue marks it n/a |
| tools-schema-default-2020-12 | (definition) | both | tested: conformance.TestMessagesServer/2025-11-25/json-schema/tools-schema-default-2020-12 | tested: conformance.TestMessagesClient/2025-11-25/json-schema/tools-schema-default-2020-12 |
lifecycle
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| lifecycle-implementations-support-base-and-lifecycle | MUST | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-implementations-support-base-and-lifecycle | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-implementations-support-base-and-lifecycle |
| lifecycle-initialization-first-interaction | MUST | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-initialization-first-interaction | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-initialization-first-interaction |
| lifecycle-client-sends-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-client-sends-initialize |
| lifecycle-server-responds-caps-and-info | MUST | server | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-server-responds-caps-and-info | n/a: addresses the other side |
| lifecycle-client-sends-initialized-after-init | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-client-sends-initialized-after-init |
| lifecycle-client-no-requests-before-init-response | SHOULD NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-client-no-requests-before-init-response |
| lifecycle-server-no-requests-before-initialized | SHOULD NOT | server | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-server-no-requests-before-initialized | n/a: addresses the other side |
| lifecycle-capabilities-establish-session-features | (definitional) | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-capabilities-establish-session-features | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-capabilities-establish-session-features |
| lifecycle-respect-negotiated-version-and-capabilities-must | MUST | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-respect-negotiated-version-and-capabilities-must | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-respect-negotiated-version-and-capabilities-must |
| lifecycle-stdio-client-shutdown-sequence | SHOULD | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-stdio-client-shutdown-sequence |
| lifecycle-stdio-server-may-exit | MAY | server | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-stdio-server-may-exit | n/a: addresses the other side |
| lifecycle-http-shutdown-closing-connection | (definitional) | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-http-shutdown-closing-connection | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-http-shutdown-closing-connection |
| lifecycle-prepared-for-error-cases | SHOULD | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-prepared-for-error-cases | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-prepared-for-error-cases |
| lifecycle-timeouts-establish | SHOULD | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-timeouts-establish | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-timeouts-establish |
| lifecycle-timeouts-cancel-on-expiry | SHOULD | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-timeouts-cancel-on-expiry | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-timeouts-cancel-on-expiry |
| lifecycle-timeouts-per-request-configurable | SHOULD | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-timeouts-per-request-configurable | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-timeouts-per-request-configurable |
| lifecycle-timeouts-may-reset-on-progress | MAY | both | n/a: catalogue marks it n/a | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-timeouts-may-reset-on-progress |
| lifecycle-timeouts-max-regardless-of-progress | SHOULD | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-timeouts-max-regardless-of-progress | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-timeouts-max-regardless-of-progress |
| lifecycle-cancel-not-initialize | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-cancel-not-initialize |
| lifecycle-instructions-may-go-in-system-prompt | MAY | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-instructions-may-go-in-system-prompt |
| lifecycle-capability-sets-open | (definitional) | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-capability-sets-open | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-capability-sets-open |
| lifecycle-implementation-name-version-required | REQUIRED (schema field) | both | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-implementation-name-version-required | tested: conformance.TestLifecycleClient/2025-11-25/lifecycle/lifecycle-implementation-name-version-required |
| lifecycle-include-context-only-if-declared | SHOULD | server | tested: conformance.TestLifecycleServer/2025-11-25/lifecycle/lifecycle-include-context-only-if-declared | n/a: addresses the other side |
logging
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| logging-declare-capability | MUST | server | tested: conformance.TestUtilitiesServer/2025-11-25/logging/logging-declare-capability | n/a: addresses the other side |
| logging-client-may-setlevel | MAY | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-11-25/logging/logging-client-may-setlevel |
| logging-setlevel-at-or-above | should (schema) | server | tested: conformance.TestUtilitiesServer/2025-11-25/logging/logging-setlevel-at-or-above | n/a: addresses the other side |
| logging-unset-server-chooses | MAY | server | tested: conformance.TestUtilitiesServer/2025-11-25/logging/logging-unset-server-chooses | n/a: addresses the other side |
| logging-errors-setlevel | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-11-25/logging/logging-errors-setlevel | n/a: addresses the other side |
| logging-server-hygiene | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-11-25/logging/logging-server-hygiene | n/a: addresses the other side |
| logging-no-secrets-pii | MUST NOT | both (emitter) | tested: conformance.TestUtilitiesServer/2025-11-25/logging/logging-no-secrets-pii | tested: conformance.TestUtilitiesClient/2025-11-25/logging/logging-no-secrets-pii |
| logging-impl-validate-control | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-11-25/logging/logging-impl-validate-control | tested: conformance.TestUtilitiesClient/2025-11-25/logging/logging-impl-validate-control |
messages
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| messages-all-messages-follow-jsonrpc-2 | MUST | both | tested: conformance.TestJSONRPCFramesEveryRevision/2025-11-25/messages/all-messages-follow-jsonrpc-2-server-httpconformance.TestJSONRPCFramesEveryRevision/2025-11-25/messages/all-messages-follow-jsonrpc-2-server-stdioconformance.TestMessagesServer/2025-11-25/messages/messages-all-messages-follow-jsonrpc-2 | tested: conformance.TestJSONRPCFramesEveryRevision/2025-11-25/messages/all-messages-follow-jsonrpc-2-client |
| messages-other-components-may | MAY | both | tested: conformance.TestMessagesServer/2025-11-25/messages/messages-other-components-may | tested: conformance.TestMessagesClient/2025-11-25/messages/messages-other-components-may |
| messages-request-id-string-or-integer | MUST | both | tested: conformance.TestMessagesServer/2025-11-25/messages/messages-request-id-string-or-integer | tested: conformance.TestMessagesClient/2025-11-25/messages/messages-request-id-string-or-integer |
| messages-request-id-not-null | MUST NOT | both | tested: conformance.TestMessagesServer/2025-11-25/messages/messages-request-id-not-null | tested: conformance.TestMessagesClient/2025-11-25/messages/messages-request-id-not-null |
| messages-request-id-unique-per-session | MUST NOT | both | tested: conformance.TestMessagesServer/2025-11-25/messages/messages-request-id-unique-per-session | tested: conformance.TestMessagesClient/2025-11-25/messages/messages-request-id-unique-per-session |
| messages-result-response-same-id | MUST | both | tested: conformance.TestMessagesServer/2025-11-25/messages/messages-result-response-same-id | tested: conformance.TestMessagesClient/2025-11-25/messages/messages-result-response-same-id |
| messages-result-response-has-result | MUST | both | tested: conformance.TestMessagesServer/2025-11-25/messages/messages-result-response-has-result | tested: conformance.TestMessagesClient/2025-11-25/messages/messages-result-response-has-result |
| messages-result-any-object | MAY | both | tested: conformance.TestMessagesServer/2025-11-25/messages/messages-result-any-object | tested: conformance.TestMessagesClient/2025-11-25/messages/messages-result-any-object |
| messages-notification-no-response | MUST NOT | both | tested: conformance.TestMessagesServer/2025-11-25/messages/messages-notification-no-response | tested: conformance.TestMessagesClient/2025-11-25/messages/messages-notification-no-response |
| messages-notification-no-id | MUST NOT | both | tested: conformance.TestMessagesServer/2025-11-25/messages/messages-notification-no-id | tested: conformance.TestMessagesClient/2025-11-25/messages/messages-notification-no-id |
| transport-jsonrpc-utf8 | MUST | both | tested: conformance.TestMessagesServer/2025-11-25/messages/transport-jsonrpc-utf8 | tested: conformance.TestMessagesClient/2025-11-25/messages/transport-jsonrpc-utf8 |
meta
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| meta-no-assumptions-on-reserved-keys | MUST NOT | both | tested: conformance.TestMessagesServer/2025-11-25/meta/meta-no-assumptions-on-reserved-keys | tested: conformance.TestMessagesClient/2025-11-25/meta/meta-no-assumptions-on-reserved-keys |
| meta-prefix-label-format | MUST | both | tested: conformance.TestMessagesServer/2025-11-25/meta/meta-prefix-label-format | tested: conformance.TestMessagesClient/2025-11-25/meta/meta-prefix-label-format |
| meta-reverse-dns-should | SHOULD | both | tested: conformance.TestMessagesServer/2025-11-25/meta/meta-reverse-dns-should | tested: conformance.TestMessagesClient/2025-11-25/meta/meta-reverse-dns-should |
| meta-reserved-prefix-second-label | (reservation) | both | tested: conformance.TestMessagesServer/2025-11-25/meta/meta-reserved-prefix-second-label | tested: conformance.TestMessagesClient/2025-11-25/meta/meta-reserved-prefix-second-label |
| meta-name-format | MUST / MAY | both | tested: conformance.TestMessagesServer/2025-11-25/meta/meta-name-format | tested: conformance.TestMessagesClient/2025-11-25/meta/meta-name-format |
| meta-schema-may-reserve-names | (reservation) | both | tested: conformance.TestMessagesServer/2025-11-25/meta/meta-schema-may-reserve-names | tested: conformance.TestMessagesClient/2025-11-25/meta/meta-schema-may-reserve-names |
| meta-progress-token-receiver-not-obligated | (definitional) | both | tested: conformance.TestMessagesServer/2025-11-25/meta/meta-progress-token-receiver-not-obligated | tested: conformance.TestMessagesClient/2025-11-25/meta/meta-progress-token-receiver-not-obligated |
| meta-icons-client-mime-support | MUST / SHOULD | client | n/a: addresses the other side | n/a: renders no icons |
| meta-icons-consumer-security | MUST | client | n/a: addresses the other side | n/a: never fetches icons; passes metadata through |
| meta-icons-reject-unsafe-schemes | MUST | client | n/a: addresses the other side | n/a: does not dereference). Downstream host must do it |
| meta-icons-may-limit-size | MAY | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| meta-icons-same-origin | SHOULD | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
pagination
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| pagination-no-fixed-page-size | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-11-25/pagination/pagination-no-fixed-page-size |
| pagination-stable-cursors | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-11-25/pagination/pagination-stable-cursors | n/a: addresses the other side |
| pagination-invalid-cursor-graceful | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-11-25/pagination/pagination-invalid-cursor-graceful | n/a: addresses the other side |
| pagination-missing-nextcursor-end | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-11-25/pagination/pagination-missing-nextcursor-end |
| pagination-support-both-flows | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-11-25/pagination/pagination-support-both-flows |
| pagination-cursor-opaque | MUST | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-11-25/pagination/pagination-cursor-opaque |
| pagination-no-persist-across-sessions | MUST | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2025-11-25/pagination/pagination-no-persist-across-sessions |
| pagination-invalid-cursor-32602 | SHOULD | server | tested: conformance.TestUtilitiesServer/2025-11-25/pagination/pagination-invalid-cursor-32602 | n/a: addresses the other side |
ping
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| ping-receiver-responds-promptly-empty | MUST | both | tested: conformance.TestLifecycleServer/2025-11-25/ping/ping-receiver-responds-promptly-empty | tested: conformance.TestLifecycleClient/2025-11-25/ping/ping-receiver-responds-promptly-empty |
| ping-either-party-may-initiate | (definitional) | both | tested: conformance.TestLifecycleServer/2025-11-25/ping/ping-either-party-may-initiate | tested: conformance.TestLifecycleClient/2025-11-25/ping/ping-either-party-may-initiate |
| ping-sender-may-consider-stale | MAY | both | n/a: catalogue marks it n/a | n/a: does not ping |
| ping-periodic-pings | SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| ping-frequency-configurable | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-timeouts-appropriate | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-avoid-excessive | SHOULD | both | tested: conformance.TestLifecycleServer/2025-11-25/ping/ping-avoid-excessive | tested: conformance.TestLifecycleClient/2025-11-25/ping/ping-avoid-excessive |
| ping-timeout-is-connection-failure | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-multiple-failures-may-reset | MAY | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-log-failures | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| ping-schema-receiver-must-respond | must (lowercase) | both | tested: conformance.TestLifecycleServer/2025-11-25/ping/ping-schema-receiver-must-respond | tested: conformance.TestLifecycleClient/2025-11-25/ping/ping-schema-receiver-must-respond |
progress
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| progress-token-string-or-int | MUST | both (requester) | n/a: as a server mcpx never requests progress; a host’s token is relayed back verbatim | tested: conformance.TestUtilitiesClient/2025-11-25/progress/progress-token-string-or-int |
| progress-token-unique-sender | MUST | both | tested: conformance.TestUtilitiesServer/2025-11-25/progress/progress-token-unique-sender | tested: conformance.TestUtilitiesClient/2025-11-25/progress/progress-token-unique-sender |
| progress-receiver-may-send | MAY | both | n/a: optional feature mcpx does not implement | n/a: never receives requests with tokens |
| progress-must-increase | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2025-11-25/progress/progress-must-increase | n/a: catalogue marks it n/a |
| progress-message-human-readable | SHOULD | both (notifier) | tested: conformance.TestUtilitiesServer/2025-11-25/progress/progress-message-human-readable | n/a: catalogue marks it n/a |
| progress-only-active-tokens | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2025-11-25/progress/progress-only-active-tokens | n/a: catalogue marks it n/a |
| progress-receiver-may-skip | MAY | both | tested: conformance.TestUtilitiesServer/2025-11-25/progress/progress-receiver-may-skip | tested: conformance.TestUtilitiesClient/2025-11-25/progress/progress-receiver-may-skip |
| progress-task-token-lives-with-task | MUST | both (receiver) | tested: conformance.TestUtilitiesServer/2025-11-25/progress/progress-task-token-lives-with-task | n/a: catalogue marks it n/a |
| progress-task-same-token | MUST | both (receiver) | tested: conformance.TestUtilitiesServer/2025-11-25/progress/progress-task-same-token | n/a: catalogue marks it n/a |
| progress-task-stop-at-terminal | MUST | both (receiver) | tested: conformance.TestUtilitiesServer/2025-11-25/progress/progress-task-stop-at-terminal | n/a: catalogue marks it n/a |
| progress-track-tokens | SHOULD | both | n/a: catalogue marks it n/a | tested: conformance.TestUtilitiesClient/2025-11-25/progress/progress-track-tokens |
| progress-rate-limit | SHOULD | both | tested: conformance.TestUtilitiesServer/2025-11-25/progress/progress-rate-limit | tested: conformance.TestUtilitiesClient/2025-11-25/progress/progress-rate-limit |
| progress-stop-after-completion | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2025-11-25/progress/progress-stop-after-completion | n/a: catalogue marks it n/a |
prompts
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2025-11-25/prompts/prompts-declare-capability | n/a: addresses the other side |
| prompts-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/prompts/prompts-list-changed-notify | n/a: addresses the other side |
| prompts-image-base64-mime | MUST | server | tested: conformance.TestFeaturesServer/2025-11-25/prompts/prompts-image-base64-mime | n/a: addresses the other side |
| prompts-audio-base64-mime | MUST (not bolded) | server | tested: conformance.TestFeaturesServer/2025-11-25/prompts/prompts-audio-base64-mime | n/a: addresses the other side |
| prompts-embedded-must-include | MUST | server | tested: conformance.TestFeaturesServer/2025-11-25/prompts/prompts-embedded-must-include | n/a: addresses the other side |
| prompts-validate-args | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/prompts/prompts-validate-args | n/a: addresses the other side |
| prompts-respect-capability-negotiation | SHOULD | both | tested: conformance.TestFeaturesServer/2025-11-25/prompts/prompts-respect-capability-negotiation | tested: conformance.TestFeaturesClient/2025-11-25/prompts/prompts-respect-capability-negotiation |
| prompts-validate-io | MUST | both | tested: conformance.TestFeaturesServer/2025-11-25/prompts/prompts-validate-io; mcpclient.TestValidatePromptResult | covered |
prompts / errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-errors-32602-32603 | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/prompts/prompts-errors-32602-32603 | n/a: addresses the other side |
prompts / pagination
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-client-paginate | SHOULD | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-11-25/prompts/prompts-client-paginate |
resources
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2025-11-25/resources/resources-declare-capability | n/a: addresses the other side |
| resources-subscribe-cap-meaning-legacy | (definition) | server | tested: e2e.TestResourceSubscriptionsReachUpstream/2025-11-25/resources/http-subscribe-delivers-upstream-updates-on-the-get-stream@2025-03-26,2025-06-18,2025-11-25e2e.TestResourceSubscriptionsReachUpstream/2025-11-25/resources/stdio-subscribe-delivers-upstream-updates-under-the-mcpx-uri@2024-11-05,2025-03-26,2025-06-18,2025-11-25 | n/a: addresses the other side |
| resources-cap-features-independent | MAY | server | tested: conformance.TestFeaturesServer/2025-11-25/resources/resources-cap-features-independent | n/a: addresses the other side |
| resources-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/resources/resources-list-changed-notify | n/a: addresses the other side |
| resources-updated-may-be-subresource | (note, schema) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-11-25/resources/resources-updated-may-be-subresource |
| resources-https-only-if-client-fetchable | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/resources/resources-https-only-if-client-fetchable | n/a: addresses the other side |
| resources-https-else-other-scheme | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/resources/resources-https-else-other-scheme | n/a: addresses the other side |
| resources-file-xdg-mime-may | MAY | server | tested: conformance.TestFeaturesServer/2025-11-25/resources/resources-file-xdg-mime-may | n/a: addresses the other side |
| resources-custom-scheme-rfc3986 | MUST | server | tested: cli.TestMCPXResourceURIs/2025-11-25/resources/resources-custom-scheme-rfc3986 | n/a: addresses the other side |
| resources-sec-validate-uris | MUST | server | tested: conformance.TestFeaturesServer/2025-11-25/resources/resources-sec-validate-uris | n/a: addresses the other side |
| resources-sec-access-control | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| resources-sec-binary-encoded | MUST | server | tested: conformance.TestFeaturesServer/2025-11-25/resources/resources-sec-binary-encoded | n/a: addresses the other side |
| resources-sec-permissions | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| resources-annotations-defs | (definition) | both | tested: conformance.TestFeaturesServer/2025-11-25/resources/resources-annotations-defs | gap #207: mcpclient.Resource has no annotations field; they are dropped on parse |
resources / errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-not-found-32002 | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/resources/resources-not-found-32002 | n/a: addresses the other side |
| resources-internal-32603 | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/resources/resources-internal-32603 | n/a: addresses the other side |
resources / subscriptions
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-subscribe-rpc | (optional) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-11-25/resources/resources-subscribe-rpc |
| resources-unsubscribe-follows-subscribe | should (lowercase, schema) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-11-25/resources/resources-unsubscribe-follows-subscribe |
roots
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| roots-client-declare-capability-at-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/roots/roots-client-declare-capability-at-initialize |
| roots-client-listchanged-must-notify | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/roots/roots-client-listchanged-must-notify |
| roots-uri-must-be-file-scheme | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-only-expose-permitted-roots | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-validate-uris-path-traversal | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-implement-access-controls | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-monitor-accessibility | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-server-handle-unavailable-roots | SHOULD | server | n/a: mcpx does not consume roots | n/a: addresses the other side |
| roots-server-respect-boundaries | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-validate-paths-against-roots | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-client-prompt-consent-before-exposing | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-provide-root-management-ui | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-validate-accessibility-before-exposing | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-monitor-root-changes | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-server-check-capability-before-use | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-handle-list-changes | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-cache-root-information | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-client-return-jsonrpc-errors | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/roots/roots-client-return-jsonrpc-errors |
sampling
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| sampling-human-in-loop-can-deny | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/sampling/sampling-human-in-loop-can-deny |
| sampling-app-review-ui | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-app-view-edit-prompts | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-app-review-responses | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-client-declare-capability-at-initialize | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/sampling/sampling-client-declare-capability-at-initialize |
| sampling-client-declare-tools-capability | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/sampling/sampling-client-declare-tools-capability |
| sampling-server-no-tools-without-capability | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2025-11-25/sampling/sampling-server-no-tools-without-capability | n/a: addresses the other side |
| sampling-client-error-on-tools-without-capability | MUST | client | n/a: addresses the other side | tested: mcpclient.TestSamplingDeclarations/2025-11-25/sampling/tools-without-capability-is-32602 |
| sampling-server-includecontext-only-with-context-capability | SHOULD NOT | server | tested: conformance.TestClientFeaturesServer/2025-11-25/sampling/sampling-server-includecontext-only-with-context-capability | n/a: addresses the other side |
| sampling-server-avoid-includecontext-values | SHOULD | server | gap #210: an upstream sampling request is relayed as-is: tools and includeContext reach a client that did not declare sampling.tools or sampling.context | n/a: addresses the other side |
| sampling-tool-result-message-only-tool-results | MUST | both | tested: conformance.TestClientFeaturesServer/2025-11-25/sampling/sampling-tool-result-message-only-tool-results | tested: conformance.TestClientFeaturesClient/2025-11-25/sampling/sampling-tool-result-message-only-tool-results |
| sampling-tool-use-result-balance | MUST | both | tested: conformance.TestClientFeaturesServer/2025-11-25/sampling/sampling-tool-use-result-balance | tested: conformance.TestClientFeaturesClient/2025-11-25/sampling/sampling-tool-use-result-balance |
| sampling-server-answer-every-tooluse | MUST | server | tested: conformance.TestClientFeaturesServer/2025-11-25/sampling/sampling-server-answer-every-tooluse | n/a: addresses the other side |
| sampling-toolresult-id-must-match-tooluse | MUST | both | tested: conformance.TestClientFeaturesServer/2025-11-25/sampling/sampling-toolresult-id-must-match-tooluse | tested: conformance.TestClientFeaturesClient/2025-11-25/sampling/sampling-toolresult-id-must-match-tooluse |
| sampling-toolchoice-required-model-must-use-tool | MUST | client | n/a: addresses the other side | n/a: mcpx never declares tools |
| sampling-toolchoice-none-model-must-not-use-tools | MUST NOT | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| sampling-parallel-tool-toggle-extension-only | MAY | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| sampling-tooluse-meta-preserve | SHOULD | client (text says “Clients”; see Conflicts) | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/sampling/sampling-tooluse-meta-preserve |
| sampling-toolresult-structured-conform-outputschema | SHOULD | both | tested: conformance.TestClientFeaturesServer/2025-11-25/sampling/sampling-toolresult-structured-conform-outputschema | tested: conformance.TestClientFeaturesClient/2025-11-25/sampling/sampling-toolresult-structured-conform-outputschema |
| sampling-client-may-sample-fewer-tokens | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-ignore-model-preferences | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-modify-system-prompt | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-ignore-includecontext | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hints-evaluated-in-order | MUST | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hints-over-priorities | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hint-name-substring | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hint-may-map-provider | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-stopreason-custom-values | MAY | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/sampling/sampling-stopreason-custom-values |
| sampling-client-errors-user-rejected-and-tool-shape | SHOULD | client | n/a: addresses the other side | gap #1836: only the -32602 content half remains: sampling messages/results are not yet checked for a missing tool result or tool results mixed with other content (Phase 2 of #1834); the -1 half is covered – a refusal reaches the upstream as -1 (typed CodedError, #1835) |
| sampling-client-user-approval-controls | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-both-validate-message-content | SHOULD | both | tested: conformance.TestSamplingValidation/2025-11-25/sampling/sampling-both-validate-message-content | tested: conformance.TestSamplingValidation/2025-11-25/sampling/sampling-both-validate-message-content |
| sampling-client-respect-hints | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-rate-limit | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2025-11-25/sampling/sampling-client-rate-limit |
| sampling-both-handle-sensitive-data | MUST | both | tested: daemon.TestElicitEventsAreSummaryOnly@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28elicit.TestOpenPrunesTerminalRowsPastTheAgeBound@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28 | tested: daemon.TestElicitEventsAreSummaryOnly@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28elicit.TestOpenPrunesTerminalRowsPastTheAgeBound@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28 |
| sampling-both-iteration-limits-tool-loops | SHOULD | both | tested: conformance.TestClientFeaturesServer/2025-11-25/sampling/sampling-both-iteration-limits-tool-loops | tested: conformance.TestClientFeaturesClient/2025-11-25/sampling/sampling-both-iteration-limits-tool-loops |
subscriptions
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| subscriptions-list-changed-should-notify | SHOULD | server | tested: conformance.TestStatefulServer/2025-11-25/subscriptions/subscriptions-list-changed-should-notify | n/a: addresses the other side |
| subscriptions-resources-updated-only-if-subscribed | should (schema) | server | tested: conformance.TestStatefulServer/2025-11-25/subscriptions/subscriptions-resources-updated-only-if-subscribed | n/a: addresses the other side |
tasks
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tasks-declare-capability | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-declare-capability | n/a: optional feature mcpx does not implement |
| tasks-augment-only-if-declared | SHOULD | both (requestor) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-augment-only-if-declared | tested: conformance.TestStatefulClient/2025-11-25/tasks/tasks-augment-only-if-declared |
| tasks-no-capability-no-tasks | SHOULD NOT | both (requestor) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-no-capability-no-tasks | tested: conformance.TestStatefulClient/2025-11-25/tasks/tasks-no-capability-no-tasks |
| tasks-tool-no-cap-no-augment | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestStatefulClient/2025-11-25/tasks/tasks-tool-no-cap-no-augment |
| tasks-tool-forbidden-default | MUST NOT / SHOULD | both | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-tool-forbidden-default | n/a: catalogue marks it n/a |
| tasks-tool-optional | MAY | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| tasks-tool-required | MUST | both | n/a: never required | n/a: mcpx reads upstream execution.taskSupport to serve its own clients, but never task-augments the upstream call; a required upstream tool that enforces it would fail |
| tasks-requestor-may-ttl | MAY | both (requestor) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-requestor-may-ttl | n/a: catalogue marks it n/a |
| tasks-poll-respect-interval | SHOULD | both (requestor) | n/a: catalogue marks it n/a | n/a: no upstream tasks |
| tasks-poll-until-terminal | SHOULD | both (requestor) | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| tasks-sse-client-may-disconnect | MAY / MUST | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| tasks-status-notification-optional | MAY / MUST NOT | both | n/a: optional feature mcpx does not implement | tested: conformance.TestStatefulClient/2025-11-25/tasks/tasks-status-notification-optional |
| tasks-status-notification-no-related-task | SHOULD NOT | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-status-notification-no-related-task | n/a: catalogue marks it n/a |
| tasks-receiver-without-cap-ignore | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-receiver-without-cap-ignore | n/a: mcpx declares no client task caps; unverified whether it strips task from an upstream sampling/createMessage |
| tasks-receiver-may-require | MAY | both (receiver) | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| tasks-id-string-receiver-unique | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-id-string-receiver-unique | n/a: catalogue marks it n/a |
| tasks-begin-working | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-begin-working | n/a: catalogue marks it n/a |
| tasks-valid-transitions | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-valid-transitions | n/a: catalogue marks it n/a |
| tasks-terminal-immutable | MUST NOT | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-terminal-immutable | n/a: catalogue marks it n/a |
| tasks-input-required-move | SHOULD | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-input-required-move | n/a: catalogue marks it n/a |
| tasks-input-request-related-task | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-input-request-related-task | n/a: catalogue marks it n/a |
| tasks-requestor-input-required-call-result | SHOULD | both (requestor) | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| tasks-leave-input-required | SHOULD | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-leave-input-required | n/a: catalogue marks it n/a |
| tasks-sse-any-stream | SHOULD | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| tasks-sse-no-upgrade-get | SHOULD NOT | server | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-sse-no-upgrade-get | n/a: addresses the other side |
| tasks-timestamps | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-timestamps | n/a: catalogue marks it n/a |
| tasks-ttl-override-report | MAY / MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-ttl-override-report | n/a: catalogue marks it n/a |
| tasks-delete-after-ttl | MAY | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-delete-after-ttl | n/a: catalogue marks it n/a |
| tasks-poll-interval | MAY / SHOULD | both | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-poll-interval | n/a: catalogue marks it n/a |
| tasks-return-createtaskresult | MUST / SHOULD | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-return-createtaskresult | n/a: catalogue marks it n/a |
| tasks-result-terminal-final | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-result-terminal-final | n/a: catalogue marks it n/a |
| tasks-result-blocks | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-result-blocks | n/a: catalogue marks it n/a |
| tasks-result-exact | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-result-exact | n/a: catalogue marks it n/a |
| tasks-related-task-all-messages | MUST | both | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-related-task-all-messages | n/a: catalogue marks it n/a |
| tasks-taskid-param-authoritative | MUST / SHOULD NOT | both | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-taskid-param-authoritative | n/a: catalogue marks it n/a |
| tasks-no-related-task-in-get-list-cancel-results | SHOULD NOT | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-no-related-task-in-get-list-cancel-results | n/a: catalogue marks it n/a |
| tasks-result-response-related-task | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-result-response-related-task | n/a: catalogue marks it n/a |
| tasks-list-paginate | SHOULD / MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-list-paginate | n/a: catalogue marks it n/a |
| tasks-list-cursor-opaque | MUST | both (requestor) | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| tasks-get-implies-list | MUST | both (receiver) | gap #209: a task started on a connection without an identity can be read by tasks/get and is never listed | n/a: catalogue marks it n/a |
| tasks-cancel-terminal-reject | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-cancel-terminal-reject | n/a: catalogue marks it n/a |
| tasks-cancel-transition-before-response | SHOULD / MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-cancel-transition-before-response | n/a: catalogue marks it n/a |
| tasks-cancelled-sticky | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-cancelled-sticky | n/a: catalogue marks it n/a |
| tasks-cancelled-may-delete | MAY / SHOULD NOT | both | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-cancelled-may-delete | n/a: catalogue marks it n/a |
| tasks-protocol-errors | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-protocol-errors | n/a: catalogue marks it n/a |
| tasks-informative-errors | SHOULD | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-informative-errors | n/a: catalogue marks it n/a |
| tasks-failed-status-message | SHOULD | both (receiver) | gap #209: a task failed by an isError tool result carries no statusMessage | n/a: catalogue marks it n/a |
| tasks-result-same-error | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-result-same-error | n/a: catalogue marks it n/a |
| tasks-bind-auth-context | MUST | both (receiver) | n/a: optional feature mcpx does not implement | n/a: catalogue marks it n/a |
| tasks-document-unbound | SHOULD | both (receiver) | gap #209: nothing user-facing documents that an unowned task is reachable by anyone holding its id | n/a: catalogue marks it n/a |
| tasks-unbound-secure-ids | MUST | both (receiver) | tested: conformance.TestStatefulServer/2025-11-25/tasks/tasks-unbound-secure-ids | n/a: catalogue marks it n/a |
| tasks-unidentified-no-list | SHOULD NOT | both (receiver) | tested: mcpserver.TestTasksPerEra/2025-11-25/tasks/another-connection-cannot-list-or-read-it | n/a: catalogue marks it n/a |
| tasks-bound-reject-foreign | MUST | both (receiver) | n/a: no context | n/a: catalogue marks it n/a |
| tasks-rate-limit | SHOULD | both (receiver) | gap #209: tasks/* has no rate limit | n/a: catalogue marks it n/a |
| tasks-resource-limits | SHOULD | both (receiver) | gap #209: no maximum ttl and no cap on concurrent tasks per requestor | n/a: catalogue marks it n/a |
| tasks-audit | SHOULD | both | gap #209: task creation, completion and retrieval are not logged | n/a: catalogue marks it n/a |
tools
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tools-human-in-loop-deny | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-ui-expose-indicate-confirm | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-declare-capability | n/a: addresses the other side |
| tools-list-changed-means-emit | (definition) | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-list-changed-means-emit | n/a: addresses the other side |
| tools-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-list-changed-notify | n/a: addresses the other side |
| tools-annotations-untrusted | MUST | client | n/a: addresses the other side | tested: daemon.TestAnnotationClearsCallOnlyForLocallyDeclaredServers@2026-07-28 |
| tools-annotations-hints-no-decisions | should (lowercase, schema) | client | n/a: addresses the other side | tested: daemon.TestAnnotationClearsCallOnlyForLocallyDeclaredServers@2026-07-28 |
| tools-inputschema-no-params-recommended | RECOMMENDED | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-inputschema-no-params-recommended | n/a: addresses the other side |
| tools-name-length | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-name-length | n/a: addresses the other side |
| tools-name-case-sensitive | SHOULD | both | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-name-case-sensitive | tested: conformance.TestFeaturesClient/2025-11-25/tools/tools-name-case-sensitive |
| tools-name-charset | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-name-charset | n/a: addresses the other side |
| tools-name-no-special | SHOULD NOT | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-name-no-special | n/a: addresses the other side |
| tools-name-unique-in-server | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-name-unique-in-server | n/a: addresses the other side |
| tools-result-iserror-for-tool-errors | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-result-iserror-for-tool-errors | n/a: addresses the other side |
| tools-result-lookup-errors-protocol | should (lowercase) | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-result-lookup-errors-protocol | n/a: addresses the other side |
| tools-error-unknown-tool-protocol | (classification) | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-error-unknown-tool-protocol | n/a: addresses the other side |
| tools-error-input-validation-execution | (classification) | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-error-input-validation-execution | n/a: addresses the other side |
| tools-client-exec-errors-to-llm | SHOULD | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-11-25/tools/tools-client-exec-errors-to-llm |
| tools-client-protocol-errors-to-llm-may | MAY | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2025-11-25/tools/tools-client-protocol-errors-to-llm-may |
| tools-embedded-resource-may | MAY | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-embedded-resource-may | n/a: addresses the other side |
| tools-embedded-implies-resources-cap | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-embedded-implies-resources-cap | n/a: addresses the other side |
| tools-resource-link-may | MAY | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-resource-link-may | n/a: addresses the other side |
| tools-resource-link-may-not-listed | (note) | both | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-resource-link-may-not-listed | tested: conformance.TestFeaturesClient/2025-11-25/tools/tools-resource-link-may-not-listed |
| tools-structured-also-text | SHOULD | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-structured-also-text | n/a: addresses the other side |
| tools-structured-object-only | (type, schema) | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-structured-object-only | n/a: addresses the other side |
| tools-output-schema-conform | MUST | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-output-schema-conform | n/a: addresses the other side |
| tools-output-schema-client-validate | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-output-schema-object-root | (type, schema) | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-output-schema-object-root | n/a: addresses the other side |
| tools-display-name-precedence | (rule) | client | n/a: addresses the other side | gap #207: tool title and annotations.title are carried but nothing that displays a tool uses them |
| tools-server-sec-validate-inputs | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| tools-client-sec | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
tools / json-schema
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tools-inputschema-valid-not-null | MUST | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-inputschema-valid-not-null | n/a: addresses the other side |
| tools-inputschema-type-object-root | REQUIRED (schema) | server | tested: conformance.TestFeaturesServer/2025-11-25/tools/tools-inputschema-type-object-root | n/a: addresses the other side |
transport-http-sse
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| http-sse-server-backcompat-host-both | should (lowercase) | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| http-sse-client-backcompat-probe-400-404-405 | should (lowercase) | client | n/a: addresses the other side | tested: mcpclient.TestHTTPSSETransport/2025-11-25/transport-http-sse/backcompat-probe-refusal-is-recognisedpool.TestHTTPSSEFallback/2025-11-25/transport-http-sse/client-falls-back-to-get-endpoint-and-caches-it |
transport-stdio
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| transport-client-should-support-stdio | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-stdio/transport-client-should-support-stdio |
| transport-custom-preserve-jsonrpc-and-lifecycle | MUST | both | n/a: mcpx serves MCP only over stdio and Streamable HTTP; its /v1 REST surface is not an MCP transport | n/a: catalogue marks it n/a |
| transport-custom-document-patterns | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| stdio-no-embedded-newlines | MUST NOT | both | tested: conformance.TestTransportServer/2025-11-25/transport-stdio/stdio-no-embedded-newlines | tested: conformance.TestTransportClient/2025-11-25/transport-stdio/stdio-no-embedded-newlines |
| stdio-message-is-single | MUST (implied) | both | tested: conformance.TestTransportServer/2025-11-25/transport-stdio/stdio-message-is-single | tested: conformance.TestTransportClient/2025-11-25/transport-stdio/stdio-message-is-single |
| stdio-server-may-log-to-stderr | MAY | server | tested: conformance.TestTransportServer/2025-11-25/transport-stdio/stdio-server-may-log-to-stderr | n/a: addresses the other side |
| stdio-client-may-capture-stderr | MAY | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-stdio/stdio-client-may-capture-stderr |
| stdio-client-stderr-not-error | SHOULD NOT | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-stdio/stdio-client-stderr-not-error |
| stdio-server-stdout-only-mcp | MUST NOT | server | tested: conformance.TestTransportServer/2025-11-25/transport-stdio/stdio-server-stdout-only-mcp | n/a: addresses the other side |
| stdio-client-stdin-only-mcp | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-stdio/stdio-client-stdin-only-mcp |
transport-streamable-http
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| streamable-http-server-single-endpoint-post-get | MUST | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-single-endpoint-post-get | n/a: addresses the other side |
| streamable-http-server-validate-origin | MUST | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-validate-origin | n/a: addresses the other side |
| streamable-http-server-403-invalid-origin | MUST | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-403-invalid-origin | n/a: addresses the other side |
| streamable-http-server-bind-localhost | SHOULD | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-bind-localhost | n/a: addresses the other side |
| streamable-http-server-authenticate | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| streamable-http-client-post-every-message | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-streamable-http/streamable-http-client-post-every-message |
| streamable-http-client-accept-both | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-streamable-http/streamable-http-client-accept-both |
| streamable-http-post-body-single | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-streamable-http/streamable-http-post-body-single |
| streamable-http-server-202-for-non-request | MUST | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-202-for-non-request | n/a: addresses the other side |
| streamable-http-server-error-status-if-rejected | MUST | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-error-status-if-rejected | n/a: addresses the other side |
| streamable-http-server-json-or-sse-for-request | MUST | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-json-or-sse-for-request | n/a: addresses the other side |
| streamable-http-client-supports-json-and-sse | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-streamable-http/streamable-http-client-supports-json-and-sse |
| streamable-http-sse-includes-response | SHOULD | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-sse-includes-response | n/a: addresses the other side |
| streamable-http-post-sse-may-carry-requests | MAY | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-post-sse-may-carry-requests | n/a: addresses the other side |
| streamable-http-server-may-terminate-on-session-expiry | MAY | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-may-terminate-on-session-expiry | n/a: addresses the other side |
| streamable-http-server-terminates-sse-after-response | SHOULD | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-terminates-sse-after-response | n/a: addresses the other side |
| streamable-http-sse-priming-event | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| streamable-http-server-may-close-connection-keep-stream | MAY | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| streamable-http-client-polls-after-close | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestLegacyHTTPStreamResumption/2025-11-25/transport/client-resumes-closed-stream-with-last-event-id-after-retry |
| streamable-http-server-sends-retry-before-close | SHOULD | server | n/a: never closes early | n/a: addresses the other side |
| streamable-http-client-respects-retry | MUST | client | n/a: addresses the other side | tested: mcpclient.TestLegacyHTTPStreamResumption/2025-11-25/transport/client-resumes-closed-stream-with-last-event-id-after-retry |
| streamable-http-disconnect-not-cancel | SHOULD NOT | both | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-disconnect-not-cancel | n/a: catalogue marks it n/a |
| streamable-http-client-cancel-by-notification | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-streamable-http/streamable-http-client-cancel-by-notification |
| streamable-http-server-may-resume | MAY | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| streamable-http-client-may-get | MAY | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| streamable-http-get-accept-sse | MUST | client | n/a: addresses the other side | n/a: no GET |
| streamable-http-get-sse-or-405 | MUST | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-get-sse-or-405 | n/a: addresses the other side |
| streamable-http-get-stream-unrelated | SHOULD | server | n/a: 405 | n/a: addresses the other side |
| streamable-http-get-no-responses | MUST NOT | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| streamable-http-get-close-any-time | MAY | both | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-get-close-any-time | tested: conformance.TestTransportClient/2025-11-25/transport-streamable-http/streamable-http-get-close-any-time |
| streamable-http-multiple-streams | MAY | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-streamable-http/streamable-http-multiple-streams |
| streamable-http-no-broadcast | MUST / MUST NOT | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-no-broadcast | n/a: addresses the other side |
| streamable-http-event-id-unique | MUST | server | n/a: no ids | n/a: addresses the other side |
| streamable-http-event-id-encodes-stream | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| streamable-http-client-resume-with-last-event-id | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestLegacyHTTPStreamResumption/2025-11-25/transport/client-resumes-closed-stream-with-last-event-id-after-retry@2025-03-26,2025-06-18,2025-11-25 |
| streamable-http-server-no-cross-stream-replay | MUST NOT | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| streamable-http-server-may-assign-session | MAY | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-may-assign-session | n/a: addresses the other side |
| streamable-http-session-id-secure | SHOULD | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-session-id-secure | n/a: addresses the other side |
| streamable-http-session-id-visible-ascii | MUST | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-session-id-visible-ascii | n/a: addresses the other side |
| streamable-http-client-handles-session-securely | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-streamable-http/streamable-http-client-handles-session-securely |
| streamable-http-client-echoes-session | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-streamable-http/streamable-http-client-echoes-session |
| streamable-http-server-400-missing-session | SHOULD | server | n/a: mcpx does not require one (stateless fallback | n/a: addresses the other side |
| streamable-http-server-404-terminated-session | MUST | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-404-terminated-session | n/a: addresses the other side |
| streamable-http-client-reinit-on-404 | MUST | client | n/a: addresses the other side | tested: mcpclient.TestLegacySession404Recovery/2025-11-25/transport/client-reinitializes-on-session-404-and-retries-once@2025-03-26,2025-06-18,2025-11-25 |
| streamable-http-client-delete-session | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-streamable-http/streamable-http-client-delete-session |
| streamable-http-server-may-405-delete | MAY | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-may-405-delete | n/a: addresses the other side |
| streamable-http-protocol-version-header-is-negotiated | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2025-11-25/transport-streamable-http/streamable-http-protocol-version-header-is-negotiated |
| streamable-http-server-assumes-2025-03-26 | SHOULD | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-assumes-2025-03-26 | n/a: addresses the other side |
| streamable-http-server-400-unsupported-version-header | MUST | server | tested: conformance.TestTransportServer/2025-11-25/transport-streamable-http/streamable-http-server-400-unsupported-version-header | n/a: addresses the other side |
versioning
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| lifecycle-client-sends-supported-version | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-11-25/versioning/lifecycle-client-sends-supported-version |
| lifecycle-client-sends-latest-version | SHOULD | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-11-25/versioning/lifecycle-client-sends-latest-version |
| lifecycle-client-may-support-older | MAY | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-11-25/versioning/lifecycle-client-may-support-older |
| lifecycle-server-echoes-supported-version | MUST | server | tested: conformance.TestLifecycleServer/2025-11-25/versioning/lifecycle-server-echoes-supported-version | n/a: addresses the other side |
| lifecycle-server-counteroffers-version | MUST | server | tested: conformance.TestLifecycleServer/2025-11-25/versioning/lifecycle-server-counteroffers-version | n/a: addresses the other side |
| lifecycle-server-counteroffers-latest | SHOULD | server | tested: conformance.TestLifecycleServer/2025-11-25/versioning/lifecycle-server-counteroffers-latest | n/a: addresses the other side |
| lifecycle-client-disconnects-on-unsupported-version | SHOULD (prose) / MUST (schema) | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-11-25/versioning/lifecycle-client-disconnects-on-unsupported-version |
| lifecycle-http-protocol-version-header | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2025-11-25/versioning/lifecycle-http-protocol-version-header |
2026-07-28
(security; not in area list)
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| security-implementors-guidelines | SHOULD | both | tested: conformance.TestMessagesServer/2026-07-28/security/security-implementors-guidelines | n/a: catalogue marks it n/a |
authorization
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| authorization-http-should-conform-stdio-should-not | SHOULD / SHOULD NOT | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authorization-custom-auth-may | MAY | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-optional | OPTIONAL | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-http-should-conform | SHOULD | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-stdio-use-environment | SHOULD NOT | both | gap not implemented: #1975 | gap not implemented: #1950 |
| authz-alt-transport-best-practice | MUST | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-as-implements-oauth21 | MUST | auth-server | n/a: addresses the other side | n/a: addresses the other side |
| authz-dcr-may-deprecated | MAY | client, auth-server | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-bearer-header | MUST | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-token-every-request | MUST | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-no-token-in-query | MUST NOT | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-server-validates-token | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-server-validates-audience | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-client-sends-only-own-as-tokens | MUST NOT | client | n/a: addresses the other side | gap not implemented: #1950 |
| authz-accept-only-own-tokens | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-no-token-passthrough | MUST NOT | server | gap not implemented: #1975 | n/a: addresses the other side |
| authz-error-status-codes | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-server-prm-rfc9728 | MUST | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-prm-lists-authorization-servers | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-as-metadata-rfc8414-or-oidc | MUST | both | n/a: catalogue marks it n/a | n/a: optional feature mcpx does not implement |
| authz-prm-discovery-header-or-well-known | MUST | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-client-parses-www-authenticate | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-client-as-discovery-order | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-client-validates-issuer-in-metadata | MUST / MUST NOT | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-client-per-as-registration-state | MUST / MUST NOT | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-resource-indicator | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-canonical-uri-guidance | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-secure-token-storage | MUST | both | n/a: catalogue marks it n/a | gap not implemented: #1950 |
| authz-as-short-lived-and-rotate | SHOULD / MUST | auth-server | n/a: addresses the other side | n/a: addresses the other side |
| authz-https-and-redirect-uris | MUST | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| authz-pkce-verify-s256 | MUST | client, auth-server | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-open-redirection | MUST / SHOULD | client, auth-server | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-proxy-consent-per-client | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-client-registration-required | MUST | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-registration-priority | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-cimd | SHOULD / MUST | client, auth-server | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-preregistration | SHOULD | client | n/a: addresses the other side | n/a: no OAuth client |
| authz-dcr-application-type | MUST / SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-credentials-bound-to-issuer | MUST / MUST NOT | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-scope-in-challenge | SHOULD / MUST / MUST NOT | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-scope-selection-order | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-insufficient-scope-403 | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-all-scopes-single-challenge | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-step-up | SHOULD / MAY | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-server-scope-hierarchy | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| authz-cimd-as-security | MUST / SHOULD | auth-server | n/a: addresses the other side | n/a: addresses the other side |
| authz-iss-validation | MUST / SHOULD / MUST NOT | client, auth-server | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| authz-refresh-tokens | MUST / SHOULD / MAY / MUST NOT / SHOULD NOT | client, server | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
| authz-follow-security-considerations | MUST | both | n/a: optional feature mcpx does not implement | n/a: optional feature mcpx does not implement |
caching
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| caching-server-must-hint | MUST* | server | tested: mcpserver.TestModernEnvelope/2026-07-28/caching/resources-read-has-ttlMs-and-cacheScopemcpserver.TestModernEnvelope/2026-07-28/caching/server-discover-has-ttlMs-and-cacheScopemcpserver.TestModernEnvelope/2026-07-28/caching/tools-list-has-ttlMs-and-cacheScope | n/a: addresses the other side |
| caching-input-required-no-hints | descr. | server | tested: mcpserver.TestMRTRServerRules/2026-07-28/mrtr/requestState-is-bound-to-the-originating-request | n/a: addresses the other side |
| caching-key-method-params | MUST NOT | client | n/a: addresses the other side | n/a: not applicable by construction – the pool catalogue cache is keyed by the configured server, not by method+params, and resources/read results are not cached by the pool (#1604) |
| caching-no-cache-mrtr-retries | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestStatefulClient/2026-07-28/caching/caching-no-cache-mrtr-retries |
| caching-ttl-zero-stale | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestListToolsWithHintsAggregatesPages@2026-07-28pool.TestPoolCacheTTLZeroStale@2026-07-28 |
| caching-ttl-positive-fresh | SHOULD | client | n/a: addresses the other side | tested: pool.TestPoolCacheTTLPositiveExpires@2026-07-28pool.TestPoolCacheTTLPositiveFresh@2026-07-28 |
| caching-ttl-absent-zero | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestListPromptsWithHintsAbsent@2026-07-28pool.TestPoolCacheTTLAbsentStale@2026-07-28 |
| caching-ttl-negative-zero | SHOULD | client | n/a: addresses the other side | tested: pool.TestPoolCacheTTLNegativeStale@2026-07-28 |
| caching-ttl-non-negative | MUST | server | tested: conformance.TestStatefulServer/2026-07-28/caching/caching-ttl-non-negative | n/a: addresses the other side |
| caching-stale-refetch | SHOULD | client | n/a: addresses the other side | tested: pool.TestPoolCacheConcurrentExpiredCollapse@2026-07-28pool.TestPoolCacheTTLZeroStale@2026-07-28 |
| caching-ttl-not-poll | SHOULD NOT / MUST | client | n/a: addresses the other side | tested: conformance.TestStatefulClient/2026-07-28/caching/caching-ttl-not-poll |
| caching-may-refetch-early-serve-stale | MAY | client | n/a: addresses the other side | n/a: a MAY mcpx does not take – refresh is synchronous on read (decision on #1601); stale is served only when a refetch of an expired entry fails (#1603) |
| caching-public-shareable | MAY | both | n/a: catalogue marks it n/a | n/a: informational – permits sharing a public result across users; imposes nothing |
| caching-private-no-cross-auth | MUST NOT | both (any cache) | n/a: catalogue marks it n/a | tested: daemon.TestLoadCacheNeverSeedsPrivateEntry@2026-07-28daemon.TestSaveCacheSkipsPrivatePools@2026-07-28pool.TestPoolCacheStaleServedOnRefetchError@2026-07-28 |
| caching-notification-invalidates | descr. (lowercase should) | client | n/a: addresses the other side | tested: daemon.TestListChangedInvalidatesPoolCache@2026-07-28 |
| caching-page-refetch | SHOULD | client | n/a: addresses the other side | n/a: not applicable by construction – the pool caches one aggregated catalogue per configured server, never per page; an expired catalogue is re-fetched whole (#1601, #1604) |
| caching-page-same-scope | MUST | server | tested: mcpserver.TestModernEnvelope/2026-07-28/caching/every-page-has-the-same-cacheScope | n/a: addresses the other side |
| caching-server-access-control | MUST* / MUST NOT* | server | n/a: until hints are emitted; mcpx has no per-primitive access control (see authorization area | n/a: addresses the other side |
| cache-ttl-scope-required | REQUIRED (schema) | server | tested: mcpserver.TestModernEnvelope/2026-07-28/caching/prompts-list-has-ttlMs-and-cacheScopemcpserver.TestModernEnvelope/2026-07-28/caching/resources-list-has-ttlMs-and-cacheScopemcpserver.TestModernEnvelope/2026-07-28/caching/resources-read-has-ttlMs-and-cacheScopemcpserver.TestModernEnvelope/2026-07-28/caching/resources-templates-list-has-ttlMs-and-cacheScopemcpserver.TestModernEnvelope/2026-07-28/caching/server-discover-has-ttlMs-and-cacheScopemcpserver.TestModernEnvelope/2026-07-28/caching/tools-list-has-ttlMs-and-cacheScope | n/a: addresses the other side |
cancellation
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| cancellation-ref-client-issued-in-progress | MUST | both | tested: mcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/server-teardown-sends-cancelled-then-result | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-ref-client-issued-in-progress |
| cancellation-server-should-stop-free-no-response | SHOULD | server | tested: conformance.TestUtilitiesServer/2026-07-28/cancellation/cancellation-server-should-stop-free-no-response | n/a: addresses the other side |
| cancellation-server-may-ignore | MAY | server | tested: conformance.TestUtilitiesServer/2026-07-28/cancellation/cancellation-server-may-ignore | n/a: addresses the other side |
| cancellation-client-ignore-late-response | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-client-ignore-late-response |
| cancellation-handle-races | MUST | both | tested: conformance.TestUtilitiesServer/2026-07-28/cancellation/cancellation-handle-races | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-handle-races |
| cancellation-log-reasons | SHOULD | both | gap #77: a cancellation reason reaches Server.OnCancel, which nothing outside tests sets; it is never logged | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-log-reasons |
| cancellation-ui-indicate | SHOULD | both | n/a: no UI | n/a: no UI |
| cancellation-ignore-invalid | SHOULD | both | tested: conformance.TestUtilitiesServer/2026-07-28/cancellation/cancellation-ignore-invalid | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-ignore-invalid |
| cancellation-processing-should-cease | SHOULD | both (receiver) | tested: conformance.TestUtilitiesServer/2026-07-28/cancellation/cancellation-processing-should-cease | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-processing-should-cease |
| cancellation-client-should-send | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-client-should-send |
| cancellation-server-must-send-cancelled-on-listen-teardown | MUST | server | tested: mcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/server-teardown-sends-cancelled-then-result | n/a: addresses the other side |
| cancellation-server-only-for-listen | MUST NOT / MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-stdio/stdio-server-cancelled-only-for-listenmcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/server-teardown-sends-cancelled-then-result | n/a: addresses the other side |
| cancellation-http-disconnect-is-cancel | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-close-is-cancel | n/a: addresses the other side |
| cancellation-http-no-messages-after-close | MUST NOT / SHOULD | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-close-is-cancelconformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-silent-after-cancel | n/a: addresses the other side |
| cancellation-stdio-client-must-send | MUST | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-stdio-client-must-send |
| cancellation-timeouts-establish | SHOULD | both | tested: conformance.TestUtilitiesServer/2026-07-28/cancellation/cancellation-timeouts-establish | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-timeouts-establish |
| cancellation-timeout-then-cancel | SHOULD | both | tested: conformance.TestUtilitiesServer/2026-07-28/cancellation/cancellation-timeout-then-cancel | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-timeout-then-cancel |
| cancellation-timeouts-per-request-configurable | SHOULD | both | tested: conformance.TestUtilitiesServer/2026-07-28/cancellation/cancellation-timeouts-per-request-configurable | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-timeouts-per-request-configurable |
| cancellation-max-timeout-despite-progress | SHOULD (+MAY) | both | tested: conformance.TestUtilitiesServer/2026-07-28/cancellation/cancellation-max-timeout-despite-progress | tested: conformance.TestUtilitiesClient/2026-07-28/cancellation/cancellation-max-timeout-despite-progress |
completion
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| completion-declare-capability | MUST | server | tested: conformance.TestUtilitiesServer/2026-07-28/completion/completion-declare-capability | n/a: addresses the other side |
| completion-max-100 | descr. + schema | server | tested: conformance.TestUtilitiesServer/2026-07-28/completion/completion-max-100 | n/a: addresses the other side |
| completion-server-should | SHOULD | server | tested: daemon.TestHandleCompleteRateLimitHotChangeAndZeroDisables@alldaemon.TestHandleCompleteRateLimitRefusesBeforePool@alldaemon.TestHandleCompleteServerWindowBindsAcrossCallers@alldaemon.TestLocalCompletionCapAfterRanking@alldaemon.TestLocalCompletionTiersPrompts@alldaemon.TestLocalCompletionTiersResources@all | n/a: addresses the other side |
| completion-client-should | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2026-07-28/completion/completion-client-should |
| completion-security | MUST | both | gap #1968: partial: completion inputs are validated and completion/complete is rate limited per caller (completion.perMinute) and per server (completion.serverPerMinute) since #2387, but there is no per-caller access control for sensitive suggestions and no completion-specific information-disclosure control; waiting on principals #1968 / permissive-auth #1972 | n/a: catalogue marks it n/a |
| completion-errors | SHOULD | server | tested: conformance.TestUtilitiesServer/2026-07-28/completion/completion-errors | n/a: addresses the other side |
| completion-context-arguments | should (lowercase) | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2026-07-28/completion/completion-context-arguments |
discover
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| discover-client-may-call | MAY | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2026-07-28/discover/discover-client-may-call |
| discover-supportedversions | REQUIRED (schema) | server | tested: conformance.TestLifecycleServer/2026-07-28/discover/discover-supportedversions | n/a: addresses the other side |
| discover-client-choose-from-list | should (lowercase) | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2026-07-28/discover/discover-client-choose-from-list |
| discover-capabilities | REQUIRED (schema) | server | tested: conformance.TestLifecycleServer/2026-07-28/discover/discover-capabilities | n/a: addresses the other side |
| discover-serverinfo-in-meta | SHOULD | server | tested: conformance.TestLifecycleServer/2026-07-28/discover/discover-serverinfo-in-meta | n/a: addresses the other side |
| discover-serverinfo-not-for-behavior | SHOULD NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2026-07-28/discover/discover-serverinfo-not-for-behavior |
| discover-instructions-optional | MAY | server | tested: conformance.TestLifecycleServer/2026-07-28/discover/discover-instructions-optional | n/a: addresses the other side |
discover / caching
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| discover-cacheable | REQUIRED (schema) | server | tested: conformance.TestLifecycleServer/2026-07-28/discover/discover-cacheable | n/a: addresses the other side |
discover / meta
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| discover-resulttype | MUST | server | tested: conformance.TestLifecycleServer/2026-07-28/discover/discover-resulttype | n/a: addresses the other side |
| discover-request-meta-required | MUST | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2026-07-28/discover/discover-request-meta-required |
elicitation
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| elicitation-server-no-sensitive-info-in-form-mode | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-server-no-sensitive-info-in-form-mode | n/a: addresses the other side |
| elicitation-server-sensitive-via-url-mode | MUST | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-server-sensitive-via-url-mode | n/a: addresses the other side |
| elicitation-client-show-requesting-server | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/elicitation/elicitation-client-show-requesting-server |
| elicitation-client-form-review-modify-responses | MUST | client | n/a: addresses the other side | tested: cli.TestRenderAnswerReviewMasksSensitiveFields@2025-11-25,2026-07-28cli.TestRenderQuestionFormShowsSchemaDefaults@2025-11-25,2026-07-28 |
| elicitation-client-decline-cancel-options | MUST | client | n/a: addresses the other side | tested: elicit.TestAnExpiredQuestionBecomesCancelNotDecline@2025-06-18,2025-11-25,2026-07-28elicit.TestAnsweringAfterTheProcessDiedStillWorks@2025-06-18,2025-11-25,2026-07-28 |
| elicitation-client-url-show-domain-and-consent | MUST | client | n/a: addresses the other side | tested: cli.TestRenderQuestionURLShowsRegistrableDomain@2025-11-25,2026-07-28cli.TestRenderQuestionURLWarnsOnPunycodeHost@2025-11-25,2026-07-28 |
| elicitation-client-declare-capability-per-request-meta | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/elicitation/elicitation-client-declare-capability-per-request-meta |
| elicitation-empty-capability-means-form-only | (definition) | both | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-empty-capability-means-form-only | tested: conformance.TestClientFeaturesClient/2026-07-28/elicitation/elicitation-empty-capability-means-form-only |
| elicitation-client-support-at-least-one-mode | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/elicitation/elicitation-client-support-at-least-one-mode |
| elicitation-server-no-undeclared-modes | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-server-no-undeclared-modes | n/a: addresses the other side |
| elicitation-server-may-request-during-client-request | MAY | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-server-may-request-during-client-request | n/a: addresses the other side |
| elicitation-request-must-include-mode-and-message | MUST | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-request-must-include-mode-and-message | n/a: addresses the other side |
| elicitation-server-may-omit-mode-for-form | MAY | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-server-may-omit-mode-for-form | n/a: addresses the other side |
| elicitation-client-missing-mode-is-form | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/elicitation/elicitation-client-missing-mode-is-form |
| elicitation-form-request-shape | MUST | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-form-request-shape | n/a: addresses the other side |
| elicitation-form-schema-flat-primitives | MUST (schema-structural) | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-form-schema-flat-primitives | n/a: addresses the other side |
| elicitation-client-prepopulate-defaults | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestModernElicitationAppliesSchemaDefaults/2026-07-28/elicitation/client-applies-schema-defaults |
| elicitation-url-request-shape | MUST | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-url-request-shape | n/a: addresses the other side |
| elicitation-url-must-be-valid | MUST | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-url-must-be-valid | n/a: addresses the other side |
| elicitation-client-manual-retry-cancel-controls | SHOULD | client | n/a: addresses the other side | tested: e2e.TestElicitationsCanBeListedAndAnsweredFromTheCommandLine@2025-11-25,2026-07-28 |
| elicitation-no-32042-in-2026 | MUST NOT | both | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-no-32042-in-2026 | tested: conformance.TestClientFeaturesClient/2026-07-28/elicitation/elicitation-no-32042-in-2026 |
| elicitation-server-stored-state-bound-to-user | MUST | server | gap #257: mcpx has no authenticated user: state is bound to the request, the session id is whatever the caller sends | n/a: addresses the other side |
| elicitation-state-storage-protected | MUST | server | tested: elicit.TestOpenAtCreatesOwnerOnlyStore@2025-11-25,2026-07-28elicit.TestOpenAtMigratesLegacyStore@2025-11-25,2026-07-28 | n/a: addresses the other side |
| elicitation-remote-user-id-from-authorization | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| elicitation-server-must-not-self-authorize-via-url | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-server-must-not-self-authorize-via-url | n/a: addresses the other side |
| elicitation-third-party-creds-not-via-client | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-third-party-creds-not-via-client | n/a: addresses the other side |
| elicitation-no-token-passthrough | MUST NOT | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| elicitation-user-authorizes-server-directly | MUST | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-user-authorizes-server-directly | n/a: addresses the other side |
| elicitation-server-not-transmit-url-creds-to-client | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-server-not-transmit-url-creds-to-client | n/a: addresses the other side |
| elicitation-server-handle-decline-cancel-failure | SHOULD NOT / MUST | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-server-handle-decline-cancel-failure | n/a: addresses the other side |
| elicitation-server-bind-to-client-and-user | MUST | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-server-bind-to-client-and-user | n/a: addresses the other side |
| elicitation-client-user-approval-controls | SHOULD | client | n/a: addresses the other side | tested: elicit.TestRoutingSendsCredentialsToAHumanAndTheRestToTheAgent@2025-06-18,2025-11-25,2026-07-28 |
| elicitation-client-allow-decline-any-time | SHOULD | client | n/a: addresses the other side | tested: elicit.TestAnsweringAfterTheProcessDiedStillWorks@2025-06-18,2025-11-25,2026-07-28 |
| elicitation-client-clear-what-and-why | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/elicitation/elicitation-client-clear-what-and-why |
| elicitation-client-validate-responses | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestElicitationAnswersValidatedAgainstRequestedSchema/2026-07-28/elicitation/input-required-wrong-typed-answer-is-rejected |
| elicitation-server-validate-received-data | SHOULD | server | tested: mcpclient.TestElicitationAnswersValidatedAgainstRequestedSchema/2026-07-28/elicitation/input-required-wrong-typed-answer-is-rejected | n/a: addresses the other side |
| elicitation-url-no-sensitive-user-info | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-url-no-sensitive-user-info | n/a: addresses the other side |
| elicitation-url-not-pre-authenticated | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-url-not-pre-authenticated | n/a: addresses the other side |
| elicitation-no-clickable-urls-in-form | SHOULD NOT | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-no-clickable-urls-in-form | n/a: addresses the other side |
| elicitation-url-https-outside-dev | SHOULD | server | tested: conformance.TestClientFeaturesServer/2026-07-28/elicitation/elicitation-url-https-outside-dev | n/a: addresses the other side |
| elicitation-client-handle-urls-carefully | MUST | client | n/a: addresses the other side | tested: cli.TestRenderQuestionURLShowsRegistrableDomain@2025-11-25,2026-07-28cli.TestRenderQuestionURLWarnsOnPunycodeHost@2025-11-25,2026-07-28 |
| elicitation-client-no-url-prefetch | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/elicitation/elicitation-client-no-url-prefetch |
| elicitation-client-no-open-without-consent | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/elicitation/elicitation-client-no-open-without-consent |
| elicitation-client-show-full-url | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/elicitation/elicitation-client-show-full-url |
| elicitation-client-open-url-securely | MUST | client | n/a: addresses the other side | tested: elicit.TestRoutingSendsCredentialsToAHumanAndTheRestToTheAgent@2025-06-18,2025-11-25,2026-07-28 |
| elicitation-client-highlight-domain | SHOULD | client | n/a: addresses the other side | tested: cli.TestRenderQuestionURLShowsRegistrableDomain@2025-11-25,2026-07-28 |
| elicitation-client-warn-punycode | SHOULD | client | n/a: addresses the other side | tested: cli.TestRenderQuestionURLWarnsOnPunycodeHost@2025-11-25,2026-07-28 |
| elicitation-client-no-clickable-except-url-field | SHOULD NOT | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/elicitation/elicitation-client-no-clickable-except-url-field |
| elicitation-server-no-trust-client-user-id | MUST NOT | server | gap #257: mcpx has no authenticated user: state is bound to the request, the session id is whatever the caller sends | n/a: addresses the other side |
| elicitation-server-follow-best-practices | SHOULD | server | gap #255: requestState signing is sound and question storage is owner-only (0700/0600, #1676); there is no user identity | n/a: addresses the other side |
| elicitation-url-verify-opening-user | MUST | server | n/a: mcpx issues no URL; the upstream that does sees mcpx’s identity, not the end user’s | n/a: addresses the other side |
| elicitation-url-same-user-start-and-complete | MUST | server | n/a: see Implied: shared pooled upstream | n/a: addresses the other side |
| elicitation-url-identity-resilient-to-url-tampering | MUST | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| messages-error-response-same-id-unless-unreadable | MUST | both | tested: conformance.TestMessagesServer/2026-07-28/errors/messages-error-response-same-id-unless-unreadable | tested: conformance.TestMessagesClient/2026-07-28/errors/messages-error-response-same-id-unless-unreadable |
| errors-error-has-code-and-message | MUST | both | tested: conformance.TestMessagesServer/2026-07-28/errors/errors-error-has-code-and-message | tested: conformance.TestMessagesClient/2026-07-28/errors/errors-error-has-code-and-message |
| errors-codes-integers | MUST | both | tested: conformance.TestMessagesServer/2026-07-28/errors/errors-codes-integers | tested: conformance.TestMessagesClient/2026-07-28/errors/errors-codes-integers |
| errors-message-concise-single-sentence | SHOULD | both | tested: conformance.TestMessagesServer/2026-07-28/errors/errors-message-concise-single-sentence | n/a: sends no errors except to server requests |
| errors-data-may | MAY | both | tested: conformance.TestMessagesServer/2026-07-28/errors/errors-data-may | n/a: catalogue marks it n/a |
| errors-standard-jsonrpc-codes | (definitional) | both | tested: conformance.TestMessagesServer/2026-07-28/errors/errors-standard-jsonrpc-codes | n/a: catalogue marks it n/a |
| errors-legacy-subrange-no-new-codes | MUST NOT / SHOULD NOT | both | tested: conformance.TestMessagesServer/2026-07-28/errors/errors-legacy-subrange-no-new-codes | tested: conformance.TestMessagesClient/2026-07-28/errors/errors-legacy-subrange-no-new-codes |
| errors-receivers-no-meaning-for-legacy-subrange | MUST NOT | both | tested: conformance.TestMessagesServer/2026-07-28/errors/errors-receivers-no-meaning-for-legacy-subrange | tested: conformance.TestMessagesClient/2026-07-28/errors/errors-receivers-no-meaning-for-legacy-subrange |
| errors-reserved-subrange-only-spec-codes | MUST NOT / MUST | both | tested: conformance.TestMessagesServer/2026-07-28/errors/errors-reserved-subrange-only-spec-codes | n/a: catalogue marks it n/a |
| errors-do-not-emit-32002-and-32042 | MUST NOT | both | tested: conformance.TestMessagesServer/2026-07-28/errors/errors-do-not-emit-32002-and-32042 | n/a: catalogue marks it n/a |
| errors-client-accept-32002-from-legacy | SHOULD | client | n/a: addresses the other side | tested: conformance.TestMessagesClient/2026-07-28/errors/errors-client-accept-32002-from-legacy |
| errors-local-errors-not-mistaken-for-peer | should (lowercase) | both | gap #206: an upstream server’s failure reaches the client as mcpx’s own isError text or -32603, indistinguishable from mcpx failing | n/a: catalogue marks it n/a |
| errors-new-codes-outside-jsonrpc-range | SHOULD | both | tested: conformance.TestMessagesServer/2026-07-28/errors/errors-new-codes-outside-jsonrpc-range | n/a: catalogue marks it n/a |
| errors-method-not-found-for-unadvertised-capability | (schema guidance) | server | gap #257: mcpx answers methods whatever was negotiated (accept liberally, revisions.go); the schema guidance asks for -32601 | n/a: addresses the other side |
| errors-missing-required-client-capability | MUST | server | n/a: in practice: mcpx never requires a client capability; questions a client cannot answer go to the broker | n/a: addresses the other side |
| versioning-unsupported-version-http-400 | MUST | server | tested: conformance.TestMessagesServer/2026-07-28/errors/versioning-unsupported-version-http-400 | n/a: addresses the other side |
| errors-header-mismatch-http-400 | MUST | server | tested: conformance.TestMessagesServer/2026-07-28/errors/errors-header-mismatch-http-400 | n/a: addresses the other side |
errors (roots/sampling/elicitation)
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| mrtr-missing-capability-error-32021 | MUST | server | gap #257: through the gateway (mcpx_call) a call that needs input from a client that declared none goes to the broker instead of failing with -32021; the specification contradicts itself here (docs/spec/revision-conflicts.md). In pass-through mode the client’s declaration is relayed and the upstream’s -32021 returned (mcpserver.TestAPassThroughUpstreamsMissingCapabilityIsRelayed) | n/a: addresses the other side |
json-schema
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| json-schema-default-2020-12 | (definitional) | both | tested: conformance.TestMessagesServer/2026-07-28/json-schema/json-schema-default-2020-12 | n/a: catalogue marks it n/a |
| json-schema-may-declare-dialect | MAY | both | tested: conformance.TestMessagesServer/2026-07-28/json-schema/json-schema-may-declare-dialect | tested: conformance.TestMessagesClient/2026-07-28/json-schema/json-schema-may-declare-dialect |
| json-schema-support-2020-12 | MUST | both | tested: mcpclient.TestCallToolRejectsInvalidArgumentsBeforeTheTransport@all | n/a: passes through |
| json-schema-validate-per-dialect-and-error-on-unsupported | MUST | both | tested: mcpclient.TestListToolsExcludesUncompilableSchemasWithWarning@allschemaval.TestDeclaredDialectsCompile@allschemaval.TestUnsupportedDialect@all | tested: mcpclient.TestListToolsExcludesUncompilableSchemasWithWarning@allschemaval.TestDeclaredDialectsCompile@allschemaval.TestUnsupportedDialect@all |
| json-schema-document-dialects | SHOULD | both | tested: schemaval.TestDeclaredDialectsCompile@allschemaval.TestUnsupportedDialect@all | tested: schemaval.TestDeclaredDialectsCompile@allschemaval.TestUnsupportedDialect@all |
| json-schema-recommend-2020-12 | RECOMMENDED | both | tested: conformance.TestMessagesServer/2026-07-28/json-schema/json-schema-recommend-2020-12 | n/a: catalogue marks it n/a |
| json-schema-schemas-valid | MUST | both | tested: conformance.TestMessagesServer/2026-07-28/json-schema/json-schema-schemas-valid | n/a: catalogue marks it n/a |
| json-schema-no-network-ref | MUST NOT | both | tested: conformance.TestMessagesServer/2026-07-28/json-schema/json-schema-no-network-ref | tested: conformance.TestMessagesClient/2026-07-28/json-schema/json-schema-no-network-ref |
| json-schema-remote-ref-opt-in-off-by-default | MAY / MUST / SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| json-schema-reject-unresolved-ref | SHOULD | both | tested: mcpclient.TestListToolsExcludesUncompilableSchemasWithWarning@allschemaval.TestRemoteRefMakesNoRequests@allschemaval.TestUnresolvedInternalRef@all | tested: mcpclient.TestListToolsExcludesUncompilableSchemasWithWarning@allschemaval.TestRemoteRefMakesNoRequests@allschemaval.TestUnresolvedInternalRef@all |
| json-schema-bound-composition-cost | SHOULD | both | tested: schemaval.TestSchemaTooLarge@all | tested: schemaval.TestSchemaTooLarge@all |
| tools-schema-default-2020-12 | (definition) | both | tested: conformance.TestMessagesServer/2026-07-28/json-schema/tools-schema-default-2020-12 | tested: conformance.TestMessagesClient/2026-07-28/json-schema/tools-schema-default-2020-12 |
lifecycle
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| lifecycle-capability-sets-open | (definitional) | both | tested: conformance.TestLifecycleServer/2026-07-28/lifecycle/lifecycle-capability-sets-open | tested: conformance.TestLifecycleClient/2026-07-28/lifecycle/lifecycle-capability-sets-open |
| lifecycle-implementation-name-version-required | REQUIRED (schema field) | both | tested: conformance.TestLifecycleServer/2026-07-28/lifecycle/lifecycle-implementation-name-version-required | tested: conformance.TestLifecycleClient/2026-07-28/lifecycle/lifecycle-implementation-name-version-required |
| lifecycle-include-context-only-if-declared | SHOULD | server | tested: conformance.TestLifecycleServer/2026-07-28/lifecycle/lifecycle-include-context-only-if-declared | n/a: addresses the other side |
| lifecycle-stateless-no-reliance-on-prior-requests | MUST NOT | server | tested: conformance.TestLifecycleServer/2026-07-28/lifecycle/lifecycle-stateless-no-reliance-on-prior-requests | n/a: addresses the other side |
| lifecycle-stateless-multiple-conversations | SHOULD | server | tested: conformance.TestLifecycleServer/2026-07-28/lifecycle/lifecycle-stateless-multiple-conversations | n/a: addresses the other side |
| lifecycle-stateless-no-connection-reuse-required | SHOULD NOT | server | tested: conformance.TestLifecycleServer/2026-07-28/lifecycle/lifecycle-stateless-no-connection-reuse-required | n/a: addresses the other side |
| lifecycle-stateless-client-process-lifetime | SHOULD NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2026-07-28/lifecycle/lifecycle-stateless-client-process-lifetime |
| lifecycle-stateless-explicit-handles | MUST | both | tested: conformance.TestLifecycleServer/2026-07-28/lifecycle/lifecycle-stateless-explicit-handles | n/a: catalogue marks it n/a |
logging
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| logging-declare-capability | MUST | server | tested: conformance.TestUtilitiesServer/2026-07-28/logging/logging-declare-capability | n/a: addresses the other side |
| logging-no-message-without-loglevel | MUST NOT | server | tested: conformance.TestUtilitiesServer/2026-07-28/logging/logging-no-message-without-loglevel | n/a: addresses the other side |
| logging-request-scoped-only | MUST NOT | server | tested: conformance.TestUtilitiesServer/2026-07-28/logging/logging-request-scoped-only | n/a: addresses the other side |
| logging-may-send-before-response | MAY | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| logging-invalid-loglevel-reject-request | SHOULD | server | tested: conformance.TestUtilitiesServer/2026-07-28/logging/logging-invalid-loglevel-reject-request | n/a: addresses the other side |
| logging-server-hygiene | SHOULD | server | tested: conformance.TestUtilitiesServer/2026-07-28/logging/logging-server-hygiene | n/a: addresses the other side |
| logging-no-secrets-pii | MUST NOT | both (emitter) | tested: conformance.TestUtilitiesServer/2026-07-28/logging/logging-no-secrets-pii | tested: conformance.TestUtilitiesClient/2026-07-28/logging/logging-no-secrets-pii |
| logging-impl-validate-control | SHOULD | both | tested: conformance.TestUtilitiesServer/2026-07-28/logging/logging-impl-validate-control | tested: conformance.TestUtilitiesClient/2026-07-28/logging/logging-impl-validate-control |
| logging-deprecated | SHOULD NOT / SHOULD | both | tested: conformance.TestUtilitiesServer/2026-07-28/logging/logging-deprecated | n/a: catalogue marks it n/a |
messages
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| messages-all-messages-follow-jsonrpc-2 | MUST | both | tested: conformance.TestJSONRPCFramesEveryRevision/2026-07-28/messages/all-messages-follow-jsonrpc-2-server-httpconformance.TestJSONRPCFramesEveryRevision/2026-07-28/messages/all-messages-follow-jsonrpc-2-server-stdioconformance.TestMessagesServer/2026-07-28/messages/messages-all-messages-follow-jsonrpc-2 | tested: conformance.TestJSONRPCFramesEveryRevision/2026-07-28/messages/all-messages-follow-jsonrpc-2-client |
| messages-other-components-may | MAY | both | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-other-components-may | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-other-components-may |
| messages-request-id-string-or-integer | MUST | both | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-request-id-string-or-integer | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-request-id-string-or-integer |
| messages-request-id-not-null | MUST NOT | both | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-request-id-not-null | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-request-id-not-null |
| messages-request-id-unique-among-in-flight | MUST NOT | both | n/a: modern server sends no requests | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-request-id-unique-among-in-flight |
| messages-requests-client-to-server-only | (definitional) | both | n/a: on modern path; on legacy path mcpx still sends elicitation/sampling requests (allowed there | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-requests-client-to-server-only |
| messages-servers-must-not-initiate-requests | MUST NOT | server | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-servers-must-not-initiate-requests | n/a: addresses the other side |
| messages-result-response-same-id | MUST | both | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-result-response-same-id | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-result-response-same-id |
| messages-result-response-has-result | MUST | both | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-result-response-has-result | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-result-response-has-result |
| messages-result-any-object | MAY | both | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-result-any-object | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-result-any-object |
| messages-notification-no-response | MUST NOT | both | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-notification-no-response | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-notification-no-response |
| messages-notification-no-id | MUST NOT | both | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-notification-no-id | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-notification-no-id |
| messages-patterns-notifications-scoped-to-request | MAY | server | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-patterns-notifications-scoped-to-request | n/a: addresses the other side |
| messages-resulttype-required | MUST | server | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-resulttype-required | n/a: addresses the other side |
| messages-resulttype-extension-values | MAY / MUST | both | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-resulttype-extension-values | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-resulttype-extension-values |
| messages-resulttype-unknown-invalid | MUST | client | n/a: addresses the other side | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-resulttype-unknown-invalid |
| messages-resulttype-absent-means-complete | MUST | client | n/a: addresses the other side | tested: conformance.TestMessagesClient/2026-07-28/messages/messages-resulttype-absent-means-complete |
| messages-resulttype-server-must-include | MUST | server | tested: conformance.TestMessagesServer/2026-07-28/messages/messages-resulttype-server-must-include | n/a: addresses the other side |
| transport-jsonrpc-utf8 | MUST | both | tested: conformance.TestMessagesServer/2026-07-28/messages/transport-jsonrpc-utf8 | tested: conformance.TestMessagesClient/2026-07-28/messages/transport-jsonrpc-utf8 |
| transport-binding-message-directions | MUST | both | tested: conformance.TestMessagesServer/2026-07-28/messages/transport-binding-message-directions | tested: conformance.TestMessagesClient/2026-07-28/messages/transport-binding-message-directions |
| transport-binding-may-mirror-metadata | MAY | both | tested: conformance.TestMessagesServer/2026-07-28/messages/transport-binding-may-mirror-metadata | tested: conformance.TestMessagesClient/2026-07-28/messages/transport-binding-may-mirror-metadata |
meta
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| meta-no-assumptions-on-reserved-keys | MUST NOT | both | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-no-assumptions-on-reserved-keys | tested: conformance.TestMessagesClient/2026-07-28/meta/meta-no-assumptions-on-reserved-keys |
| meta-prefix-label-format | MUST | both | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-prefix-label-format | tested: conformance.TestMessagesClient/2026-07-28/meta/meta-prefix-label-format |
| meta-reverse-dns-should | SHOULD | both | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-reverse-dns-should | tested: conformance.TestMessagesClient/2026-07-28/meta/meta-reverse-dns-should |
| meta-reserved-prefix-second-label | (reservation) | both | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-reserved-prefix-second-label | tested: conformance.TestMessagesClient/2026-07-28/meta/meta-reserved-prefix-second-label |
| meta-name-format | MUST / MAY | both | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-name-format | tested: conformance.TestMessagesClient/2026-07-28/meta/meta-name-format |
| meta-schema-may-reserve-names | (reservation) | both | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-schema-may-reserve-names | tested: conformance.TestMessagesClient/2026-07-28/meta/meta-schema-may-reserve-names |
| meta-progress-token-receiver-not-obligated | (definitional) | both | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-progress-token-receiver-not-obligated | tested: conformance.TestMessagesClient/2026-07-28/meta/meta-progress-token-receiver-not-obligated |
| meta-request-params-meta-required | MUST / REQUIRED | client | n/a: addresses the other side | tested: conformance.TestMessagesClient/2026-07-28/meta/meta-request-params-meta-required |
| meta-server-rejects-missing-required-field | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| meta-client-should-send-clientinfo | SHOULD | client | n/a: addresses the other side | tested: conformance.TestMessagesClient/2026-07-28/meta/meta-client-should-send-clientinfo |
| meta-server-no-undeclared-client-capabilities | MUST NOT | server | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-server-no-undeclared-client-capabilities | n/a: addresses the other side |
| meta-server-no-infer-caps-from-prior | MUST NOT | server | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-server-no-infer-caps-from-prior | n/a: addresses the other side |
| meta-server-should-send-serverinfo | SHOULD | server | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-server-should-send-serverinfo | n/a: addresses the other side |
| meta-info-not-for-behavior-or-security | SHOULD NOT | both | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-info-not-for-behavior-or-security | tested: conformance.TestMessagesClient/2026-07-28/meta/meta-info-not-for-behavior-or-security |
| meta-subscription-id-on-listen-notifications | MUST | server | tested: conformance.TestMessagesServer/2026-07-28/meta/meta-subscription-id-on-listen-notifications | n/a: addresses the other side |
| meta-otel-keys-w3c-format | MUST | both | n/a: does not emit); passes through? not verified | n/a: catalogue marks it n/a |
| meta-icons-client-mime-support | MUST / SHOULD | client | n/a: addresses the other side | n/a: renders no icons |
| meta-icons-consumer-security | MUST | client | n/a: addresses the other side | n/a: never fetches icons; passes metadata through |
| meta-icons-reject-unsafe-schemes | MUST | client | n/a: addresses the other side | n/a: does not dereference). Downstream host must do it |
| meta-icons-may-limit-size | MAY | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| meta-icons-same-origin | SHOULD | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| meta-request-required-fields | MUST | client | n/a: addresses the other side | tested: conformance.TestMessagesClient/2026-07-28/meta/meta-request-required-fields |
mrtr
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| mrtr-server-requests-via-mrtr | MUST | server | tested: mcpserver.TestElicitationPerEra/2026-07-28/elicitation/inputRequests-carry-no-elicitationId | n/a: addresses the other side |
| mrtr-requeststate-opaque-client | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestStatefulClient/2026-07-28/mrtr/mrtr-requeststate-opaque-client |
| mrtr-supported-requests-only | MAY / MUST NOT | server | tested: conformance.TestStatefulServer/2026-07-28/mrtr/mrtr-supported-requests-only | n/a: addresses the other side |
| mrtr-inputrequests-keys-values | MUST | server | tested: conformance.TestStatefulServer/2026-07-28/mrtr/mrtr-inputrequests-keys-values | n/a: addresses the other side |
| mrtr-requeststate-attacker-controlled | MUST | server | tested: mcpserver.TestMRTRServerRules/2026-07-28/mrtr/tampered-requestState-is-rejected | n/a: addresses the other side |
| mrtr-requeststate-replay-fields | SHOULD | server | tested: mcpserver.TestMRTRServerRules/2026-07-28/mrtr/requestState-is-bound-to-the-originating-request | n/a: addresses the other side |
| mrtr-single-use-enforced | MUST | server | n/a: binds only a server whose requestState must be consumed once; mcpx’s is re-minted every round and replaying it re-enters the same running call | n/a: addresses the other side |
| mrtr-at-least-one-field | MUST | server | tested: conformance.TestStatefulServer/2026-07-28/mrtr/mrtr-at-least-one-field | n/a: addresses the other side |
| mrtr-only-declared-capabilities | MUST NOT | server | tested: conformance.TestStatefulServer/2026-07-28/mrtr/mrtr-only-declared-capabilities | n/a: addresses the other side |
| mrtr-no-assume-retry | MUST NOT / MAY | server | tested: mcpserver.TestMRTRServerRules/2026-07-28/mrtr/missing-input-response-asks-again | n/a: addresses the other side |
| mrtr-client-fulfil-before-retry | MUST / MAY | client | n/a: addresses the other side | tested: conformance.TestStatefulClient/2026-07-28/mrtr/mrtr-client-fulfil-before-retry |
| mrtr-client-echo-state | MUST / MUST NOT | client | n/a: addresses the other side | tested: conformance.TestStatefulClient/2026-07-28/mrtr/mrtr-client-echo-state |
| mrtr-new-id-on-retry | MUST | client | n/a: addresses the other side | tested: conformance.TestStatefulClient/2026-07-28/mrtr/mrtr-new-id-on-retry |
| mrtr-no-cross-request-use | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestStatefulClient/2026-07-28/mrtr/mrtr-no-cross-request-use |
| mrtr-server-validate-responses | SHOULD | server | tested: conformance.TestStatefulServer/2026-07-28/mrtr/mrtr-server-validate-responses | n/a: addresses the other side |
| mrtr-input-request-type-restricted | MUST | server | tested: conformance.TestStatefulServer/2026-07-28/mrtr/mrtr-input-request-type-restricted | n/a: addresses the other side |
| mrtr-server-reask-missing-rather-than-error | SHOULD | server | tested: mcpserver.TestMRTRServerRules/2026-07-28/mrtr/missing-input-response-asks-again | n/a: addresses the other side |
pagination
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| pagination-no-fixed-page-size | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2026-07-28/pagination/pagination-no-fixed-page-size |
| pagination-stable-cursors | SHOULD | server | tested: conformance.TestUtilitiesServer/2026-07-28/pagination/pagination-stable-cursors | n/a: addresses the other side |
| pagination-invalid-cursor-graceful | SHOULD | server | tested: conformance.TestUtilitiesServer/2026-07-28/pagination/pagination-invalid-cursor-graceful | n/a: addresses the other side |
| pagination-missing-nextcursor-end | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2026-07-28/pagination/pagination-missing-nextcursor-end |
| pagination-support-both-flows | SHOULD | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2026-07-28/pagination/pagination-support-both-flows |
| pagination-cursor-opaque | MUST | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2026-07-28/pagination/pagination-cursor-opaque |
| pagination-empty-cursor-not-end | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2026-07-28/pagination/pagination-empty-cursor-not-end |
| pagination-invalid-cursor-32602 | SHOULD | server | tested: conformance.TestUtilitiesServer/2026-07-28/pagination/pagination-invalid-cursor-32602 | n/a: addresses the other side |
progress
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| progress-token-string-or-int | MUST | both (requester) | n/a: as a server mcpx never requests progress; a host’s token is relayed back verbatim | tested: conformance.TestUtilitiesClient/2026-07-28/progress/progress-token-string-or-int |
| progress-token-unique-client | MUST | client | n/a: addresses the other side | tested: conformance.TestUtilitiesClient/2026-07-28/progress/progress-token-unique-client |
| progress-server-may-send | MAY | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| progress-must-increase | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2026-07-28/progress/progress-must-increase | n/a: catalogue marks it n/a |
| progress-message-human-readable | SHOULD | both (notifier) | tested: conformance.TestUtilitiesServer/2026-07-28/progress/progress-message-human-readable | n/a: catalogue marks it n/a |
| progress-only-active-tokens | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2026-07-28/progress/progress-only-active-tokens | n/a: catalogue marks it n/a |
| progress-server-may-skip | MAY | server | tested: conformance.TestUtilitiesServer/2026-07-28/progress/progress-server-may-skip | n/a: addresses the other side |
| progress-track-tokens | SHOULD | both | n/a: catalogue marks it n/a | tested: conformance.TestUtilitiesClient/2026-07-28/progress/progress-track-tokens |
| progress-rate-limit | SHOULD | both | tested: conformance.TestUtilitiesServer/2026-07-28/progress/progress-rate-limit | tested: conformance.TestUtilitiesClient/2026-07-28/progress/progress-rate-limit |
| progress-stop-after-completion | MUST | both (notifier) | tested: conformance.TestUtilitiesServer/2026-07-28/progress/progress-stop-after-completion | n/a: catalogue marks it n/a |
| progress-http-notifications-relate-to-request | MUST | server | tested: conformance.TestUtilitiesServer/2026-07-28/progress/progress-http-notifications-relate-to-request | n/a: addresses the other side |
prompts
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-declare-capability-discover | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-declare-capability-discover | n/a: addresses the other side |
| prompts-list-must-respond-when-declared | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-list-must-respond-when-declared | n/a: addresses the other side |
| prompts-list-not-per-connection | MUST NOT | server | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-list-not-per-connection | n/a: addresses the other side |
| prompts-list-may-vary-by-auth | MAY | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| prompts-list-changed-notify-to-listeners | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-list-changed-notify-to-listeners | n/a: addresses the other side |
| prompts-image-base64-mime | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-image-base64-mime | n/a: addresses the other side |
| prompts-audio-base64-mime | MUST (not bolded) | server | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-audio-base64-mime | n/a: addresses the other side |
| prompts-resource-link-may | MAY | server | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-resource-link-may | n/a: addresses the other side |
| prompts-embedded-must-include | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-embedded-must-include | n/a: addresses the other side |
| prompts-validate-args | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-validate-args | n/a: addresses the other side |
| prompts-respect-capability-negotiation | SHOULD | both | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-respect-capability-negotiation | tested: conformance.TestFeaturesClient/2026-07-28/prompts/prompts-respect-capability-negotiation |
| prompts-validate-io | MUST | both | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-validate-io; mcpclient.TestValidatePromptResult | covered |
prompts / errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-errors-32602-32603 | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-errors-32602-32603 | n/a: addresses the other side |
prompts / mrtr
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-get-input-required-may | MAY | server | tested: conformance.TestFeaturesServer/2026-07-28/prompts/prompts-get-input-required-may | n/a: addresses the other side |
prompts / pagination
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| prompts-client-paginate | SHOULD | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2026-07-28/prompts/prompts-client-paginate |
resources
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-declare-capability | n/a: addresses the other side |
| resources-subscribe-cap-meaning-2026 | (definition) | server | tested: e2e.TestResourceSubscriptionsReachUpstream/2026-07-28/subscriptions/listen-delivers-upstream-updates-and-acks-only-what-it-can | n/a: addresses the other side |
| resources-cap-features-independent | MAY | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-cap-features-independent | n/a: addresses the other side |
| resources-list-must-respond-when-declared | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-list-must-respond-when-declared | n/a: addresses the other side |
| resources-list-not-per-connection | MUST NOT | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-list-not-per-connection | n/a: addresses the other side |
| resources-list-may-vary-by-auth | MAY | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| resources-list-changed-notify | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-list-changed-notify | n/a: addresses the other side |
| resources-read-multiple-may | MAY | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-read-multiple-may | n/a: addresses the other side |
| resources-read-https-direct-may | may (lowercase) | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| resources-updated-may-be-subresource | (note, schema) | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2026-07-28/resources/resources-updated-may-be-subresource |
| resources-https-only-if-client-fetchable | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-https-only-if-client-fetchable | n/a: addresses the other side |
| resources-https-else-other-scheme | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-https-else-other-scheme | n/a: addresses the other side |
| resources-file-xdg-mime-may | MAY | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-file-xdg-mime-may | n/a: addresses the other side |
| resources-custom-scheme-rfc3986 | MUST | server | tested: cli.TestMCPXResourceURIs/2026-07-28/resources/resources-custom-scheme-rfc3986 | n/a: addresses the other side |
| resources-no-empty-contents-for-missing | MUST NOT | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-no-empty-contents-for-missing | n/a: addresses the other side |
| resources-sec-validate-uris | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-sec-validate-uris | n/a: addresses the other side |
| resources-sec-access-control | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| resources-sec-binary-encoded | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-sec-binary-encoded | n/a: addresses the other side |
| resources-sec-permissions | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| resources-sec-file-traversal | MUST | server | n/a: mcpx serves no file:// resources of its own; artifacts are addressed by opaque ids | n/a: addresses the other side |
| resources-annotations-defs | (definition) | both | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-annotations-defs | gap #207: mcpclient.Resource has no annotations field; they are dropped on parse |
resources / errors
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-internal-32603 | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-internal-32603 | n/a: addresses the other side |
| resources-not-found-32602 | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-not-found-32602 | n/a: addresses the other side |
| resources-client-accept-32002 | SHOULD | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2026-07-28/resources/resources-client-accept-32002 |
resources / mrtr
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-read-input-required-may | MAY | server | tested: conformance.TestFeaturesServer/2026-07-28/resources/resources-read-input-required-may | n/a: addresses the other side |
resources / subscriptions
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| resources-subscribe-via-listen | (mechanism) | client | n/a: addresses the other side | tested: mcpclient.TestModernListenStream/2026-07-28/subscriptions/resource-subscription-reopens-listen |
roots
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| roots-client-declare-capability-per-request-meta | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/roots/roots-client-declare-capability-per-request-meta |
| roots-server-list-via-input-required | MUST (via MRTR note) | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| roots-uri-must-be-file-scheme | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-only-expose-permitted-roots | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-validate-uris-path-traversal | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-implement-access-controls | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-monitor-accessibility | MUST | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-server-handle-unavailable-roots | SHOULD | server | n/a: mcpx does not consume roots | n/a: addresses the other side |
| roots-server-respect-boundaries | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-validate-paths-against-roots | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-client-prompt-consent-before-exposing | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-provide-root-management-ui | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-validate-accessibility-before-exposing | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-client-monitor-root-changes | SHOULD | client | n/a: addresses the other side | n/a: mcpx exposes no roots – the daemon configures none, so roots/list is always empty and there is nothing to validate, monitor or consent to |
| roots-server-check-capability-before-use | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-server-cache-root-information | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| roots-deprecated-new-impls-should-not-adopt | SHOULD NOT | both | n/a: optional feature mcpx does not implement | tested: conformance.TestClientFeaturesClient/2026-07-28/roots/roots-deprecated-new-impls-should-not-adopt |
| roots-deprecated-existing-should-migrate | SHOULD | both | n/a: catalogue marks it n/a | tested: conformance.TestClientFeaturesClient/2026-07-28/roots/roots-deprecated-existing-should-migrate |
sampling
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| sampling-human-in-loop-can-deny | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-human-in-loop-can-deny |
| sampling-app-review-ui | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-app-view-edit-prompts | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-app-review-responses | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-client-declare-capability-per-request-meta | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-client-declare-capability-per-request-meta |
| sampling-client-declare-tools-capability | MUST | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-client-declare-tools-capability |
| sampling-server-no-tools-without-capability | MUST NOT | server | tested: conformance.TestClientFeaturesServer/2026-07-28/sampling/sampling-server-no-tools-without-capability | n/a: addresses the other side |
| sampling-client-error-on-tools-without-capability | MUST | client | n/a: addresses the other side | tested: mcpclient.TestModernSamplingShape/2026-07-28/sampling/tools-without-capability-is-32602 |
| sampling-server-includecontext-only-with-context-capability | SHOULD NOT | server | tested: conformance.TestClientFeaturesServer/2026-07-28/sampling/sampling-server-includecontext-only-with-context-capability | n/a: addresses the other side |
| sampling-server-avoid-includecontext-values | SHOULD | server | gap #210: an upstream sampling request is relayed as-is: tools and includeContext reach a client that did not declare sampling.tools or sampling.context | n/a: addresses the other side |
| sampling-deprecated-new-impls-should-not-adopt | SHOULD NOT | both | tested: conformance.TestClientFeaturesServer/2026-07-28/sampling/sampling-deprecated-new-impls-should-not-adopt | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-deprecated-new-impls-should-not-adopt |
| sampling-tool-result-message-only-tool-results | MUST | both | tested: conformance.TestClientFeaturesServer/2026-07-28/sampling/sampling-tool-result-message-only-tool-results | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-tool-result-message-only-tool-results |
| sampling-tool-use-result-balance | MUST | both | tested: conformance.TestClientFeaturesServer/2026-07-28/sampling/sampling-tool-use-result-balance | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-tool-use-result-balance |
| sampling-server-answer-every-tooluse | MUST | server | tested: conformance.TestClientFeaturesServer/2026-07-28/sampling/sampling-server-answer-every-tooluse | n/a: addresses the other side |
| sampling-toolresult-id-must-match-tooluse | MUST | both | tested: conformance.TestClientFeaturesServer/2026-07-28/sampling/sampling-toolresult-id-must-match-tooluse | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-toolresult-id-must-match-tooluse |
| sampling-toolchoice-required-model-must-use-tool | MUST | client | n/a: addresses the other side | n/a: mcpx never declares tools |
| sampling-toolchoice-none-model-must-not-use-tools | MUST NOT | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| sampling-parallel-tool-toggle-extension-only | MAY | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| sampling-tooluse-meta-preserve | SHOULD | client (text says “Clients”; see Conflicts) | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-tooluse-meta-preserve |
| sampling-toolresult-structured-conform-outputschema | SHOULD | both | tested: conformance.TestClientFeaturesServer/2026-07-28/sampling/sampling-toolresult-structured-conform-outputschema | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-toolresult-structured-conform-outputschema |
| sampling-message-must-have-role-and-content | MUST | both | tested: conformance.TestClientFeaturesServer/2026-07-28/sampling/sampling-message-must-have-role-and-content | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-message-must-have-role-and-content |
| sampling-messages-not-retained-between-requests | SHOULD NOT | client | n/a: addresses the other side | gap #255: terminal sampling rows are now pruned past the #1677 age bound, but a sampling request’s messages are still retained in elicit.db between separate requests until that bound; the SHOULD NOT is not met |
| sampling-client-must-respect-maxtokens | MUST | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-sample-fewer-tokens | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-ignore-temperature-stop-metadata | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-ignore-model-preferences | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-modify-system-prompt | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-may-ignore-includecontext | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hints-evaluated-in-order | MUST | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hints-over-priorities | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hint-name-substring | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-hint-may-map-provider | MAY | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-stopreason-custom-values | MAY | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-stopreason-custom-values |
| sampling-client-user-approval-controls | SHOULD | client | n/a: addresses the other side | gap #256: a sampling request is routed to the agent audience; nothing lets a person review or edit the prompt or the result |
| sampling-both-validate-message-content | SHOULD | both | tested: conformance.TestSamplingValidation/2026-07-28/sampling/sampling-both-validate-message-content | tested: conformance.TestSamplingValidation/2026-07-28/sampling/sampling-both-validate-message-content |
| sampling-client-respect-hints | SHOULD | client | n/a: addresses the other side | n/a: mcpx runs no model; it relays the request unchanged to whatever answers it (the pass-through tests), which is where model choice and generation happen |
| sampling-client-rate-limit | SHOULD | client | n/a: addresses the other side | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-client-rate-limit |
| sampling-both-handle-sensitive-data | MUST | both | tested: daemon.TestElicitEventsAreSummaryOnly@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28elicit.TestOpenPrunesTerminalRowsPastTheAgeBound@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28 | tested: daemon.TestElicitEventsAreSummaryOnly@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28elicit.TestOpenPrunesTerminalRowsPastTheAgeBound@2024-11-05,2025-03-26,2025-06-18,2025-11-25,2026-07-28 |
| sampling-both-iteration-limits-tool-loops | SHOULD | both | tested: conformance.TestClientFeaturesServer/2026-07-28/sampling/sampling-both-iteration-limits-tool-loops | tested: conformance.TestClientFeaturesClient/2026-07-28/sampling/sampling-both-iteration-limits-tool-loops |
subscriptions
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| subscriptions-list-changed-via-listen | SHOULD | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-sse-notifications-must-relatemcpserver.TestHTTPListenIsAStream/2026-07-28/subscriptions/http-listen-response-is-an-open-sse-stream | n/a: addresses the other side |
| subscriptions-only-requested-types | MUST NOT | server | tested: mcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/concurrent-listens-are-kept-apartmcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/unrequested-type-is-never-sent | n/a: addresses the other side |
| subscriptions-ack-first-with-id | MUST / MUST NOT | server | tested: mcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/acknowledged-first-with-subscriptionId-in-meta | n/a: addresses the other side |
| subscriptions-stdio-ack-order-per-id | MAY | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| subscriptions-ack-reports-agreed-subset | descr. (schema-required field) | server | tested: mcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/acknowledged-first-with-subscriptionId-in-meta | n/a: addresses the other side |
| subscriptions-client-check-ack | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestModernListenStream/2026-07-28/subscriptions/client-checks-acknowledged-subset |
| subscriptions-tag-every-notification | MUST | server | tested: mcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/concurrent-listens-are-kept-apartmcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/every-notification-carries-the-subscriptionId | n/a: addresses the other side |
| subscriptions-stdio-client-correlate | MUST | client | n/a: addresses the other side | tested: mcpclient.TestModernListenStream/2026-07-28/transport-stdio/client-correlates-subscription-id |
| subscriptions-multiple-concurrent | MAY | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| subscriptions-server-teardown-respond | SHOULD | server | tested: mcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/server-teardown-sends-cancelled-then-result | n/a: addresses the other side |
| subscriptions-listen-result-meta | schema-required | server | tested: mcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/server-teardown-sends-cancelled-then-result | n/a: addresses the other side |
| subscriptions-client-reconnect-on-drop | MAY | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| subscriptions-stdio-resubscribe | MUST | client | n/a: addresses the other side | n/a: catalogue marks it n/a |
| subscriptions-request-scoped-not-on-listen | descr. (bold “not”) | server | tested: mcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/unrequested-type-is-never-sent | n/a: addresses the other side |
tasks
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| ext-tasks-client-declare-per-request | must (informal) | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| ext-tasks-server-advertise-discover | must (informal) | server | tested: mcpserver.TestCapabilitiesPerRevision/2026-07-28/capabilities/tasks-only-as-extension | n/a: addresses the other side |
| ext-tasks-never-unsolicited | must (informal) | server | tested: mcpserver.TestTasksPerEra/2026-07-28/tasks/no-task-without-the-extension-task-param-ignored | n/a: addresses the other side |
| ext-tasks-server-decides | descr. | server | tested: mcpserver.TestAQuestionAskedUpFrontIsAnsweredBeforeTheTaskExists@2026-07-28mcpserver.TestATaskSupportingToolBecomesATaskWithoutWaitingTaskAfter@2026-07-28mcpserver.TestTasksPerEra/2026-07-28/tasks/fast-call-is-answered-directlymcpserver.TestTasksPerEra/2026-07-28/tasks/server-directed-CreateTaskResult-is-flat | n/a: addresses the other side |
| ext-tasks-durable-before-response | must (informal) | server | tested: mcpserver.TestInjectedStoreKeepsMCPTasksAcrossReopen@2026-07-28 | n/a: addresses the other side |
| ext-tasks-createtaskresult-shape | must (informal) | server | tested: mcpserver.TestTasksPerEra/2026-07-28/tasks/server-directed-CreateTaskResult-is-flat | n/a: addresses the other side |
| ext-tasks-get-carries-result | must (informal) | server | tested: mcpserver.TestTasksPerEra/2026-07-28/tasks/server-directed-CreateTaskResult-is-flatmcpserver.TestTasksPerEra/2026-07-28/tasks/tool-isError-is-completed-not-failed | n/a: addresses the other side |
| ext-tasks-get-input-requests | descr. | server | tested: conformance.TestStatefulServer/2026-07-28/tasks/ext-tasks-get-input-requests | n/a: addresses the other side |
| ext-tasks-update | must (informal) | server | tested: mcpserver.TestATaskAskingAQuestionIsInputRequiredAndTasksUpdateAnswersIt@2026-07-28mcpserver.TestTasksPerEra/2026-07-28/tasks/update-and-cancel-ack-empty-unknown-is-32602 | n/a: addresses the other side |
| ext-tasks-cancel-cooperative | must (informal) | server | gap #209: tasks/cancel forces the cancelled status rather than letting the work reach its own terminal status | n/a: addresses the other side |
| ext-tasks-client-polymorphic | must (informal) | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| ext-tasks-client-poll | must (informal) | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| ext-tasks-client-persist-ids | must (informal) | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| ext-tasks-notifications-via-listen | descr. (MAY) | both | tested: mcpserver.TestListenDeliversTaskStatusNotifications@2026-07-28mcpserver.TestListenReportsATaskThatAlreadyFinished@2026-07-28mcpserver.TestSubscriptionsListen/2026-07-28/subscriptions/taskIds-without-the-extension-is-32021 | n/a: a MAY mcpx does not take: it declares no tasks extension upstream |
tools
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tools-human-in-loop-deny | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-ui-expose-indicate-confirm | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-declare-capability | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-declare-capability | n/a: addresses the other side |
| tools-list-changed-means-emit | (definition) | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-list-changed-means-emit | n/a: addresses the other side |
| tools-list-changed-notify-to-listeners | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-list-changed-notify-to-listeners | n/a: addresses the other side |
| tools-list-must-respond-when-declared | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-list-must-respond-when-declared | n/a: addresses the other side |
| tools-list-not-per-connection | MUST NOT | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-list-not-per-connection | n/a: addresses the other side |
| tools-list-may-vary-by-auth | MAY | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| tools-list-may-be-empty-change | MAY | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-list-may-be-empty-change | n/a: addresses the other side |
| tools-list-deterministic-order | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-list-deterministic-order | n/a: addresses the other side |
| tools-annotations-untrusted | MUST | client | n/a: addresses the other side | tested: daemon.TestAnnotationClearsCallOnlyForLocallyDeclaredServers@2026-07-28 |
| tools-annotations-hints-no-decisions | should (lowercase, schema) | client | n/a: addresses the other side | tested: daemon.TestAnnotationClearsCallOnlyForLocallyDeclaredServers@2026-07-28 |
| tools-inputschema-no-params-recommended | RECOMMENDED | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-inputschema-no-params-recommended | n/a: addresses the other side |
| tools-x-mcp-header-may | MAY | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| tools-x-mcp-header-not-empty | MUST NOT | server | n/a: no tool mcpx serves declares an x-mcp-header parameter | n/a: addresses the other side |
| tools-x-mcp-header-tchar | MUST | server | n/a: no tool mcpx serves declares an x-mcp-header parameter | n/a: addresses the other side |
| tools-x-mcp-header-no-ctl | MUST NOT | server | n/a: no tool mcpx serves declares an x-mcp-header parameter | n/a: addresses the other side |
| tools-x-mcp-header-unique-ci | MUST | server | n/a: no tool mcpx serves declares an x-mcp-header parameter | n/a: addresses the other side |
| tools-x-mcp-header-primitive-only | MUST | server | n/a: no tool mcpx serves declares an x-mcp-header parameter | n/a: addresses the other side |
| tools-x-mcp-header-int-safe-range | MUST | server | n/a: no tool mcpx serves declares an x-mcp-header parameter | n/a: addresses the other side |
| tools-x-mcp-header-statically-reachable | MUST | server | n/a: no tool mcpx serves declares an x-mcp-header parameter | n/a: addresses the other side |
| tools-x-mcp-header-reject-excludes | MUST | client | n/a: addresses the other side | tested: mcpclient.TestModernHTTPHeaders/2026-07-28/transport/client-excludes-tool-with-invalid-x-mcp-header |
| tools-x-mcp-header-reject-log | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestModernHTTPHeaders/2026-07-28/transport/client-excludes-tool-with-invalid-x-mcp-header |
| tools-x-mcp-header-stdio-may-ignore | MAY | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2026-07-28/tools/tools-x-mcp-header-stdio-may-ignore |
| tools-x-mcp-header-no-secrets | SHOULD NOT | server | n/a: no tool mcpx serves declares an x-mcp-header parameter | n/a: addresses the other side |
| tools-name-length | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-name-length | n/a: addresses the other side |
| tools-name-case-sensitive | SHOULD | both | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-name-case-sensitive | tested: conformance.TestFeaturesClient/2026-07-28/tools/tools-name-case-sensitive |
| tools-name-charset | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-name-charset | n/a: addresses the other side |
| tools-name-no-special | SHOULD NOT | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-name-no-special | n/a: addresses the other side |
| tools-name-unique-in-server | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-name-unique-in-server | n/a: addresses the other side |
| tools-aggregator-disambiguate | SHOULD | client | n/a: addresses the other side | tested: e2e.TestAliasExposesASubsetOfTheSameServer@2026-07-28e2e.TestDuplicateNamespaceIsRejected@2026-07-28 |
| tools-aggregator-not-by-servername | SHOULD NOT | client | n/a: addresses the other side | tested: e2e.TestDuplicateNamespaceIsRejected@2026-07-28 |
| tools-result-iserror-for-tool-errors | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-result-iserror-for-tool-errors | n/a: addresses the other side |
| tools-result-lookup-errors-protocol | should (lowercase) | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-result-lookup-errors-protocol | n/a: addresses the other side |
| tools-error-unknown-tool-protocol | (classification) | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-error-unknown-tool-protocol | n/a: addresses the other side |
| tools-error-input-validation-execution | (classification) | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-error-input-validation-execution | n/a: addresses the other side |
| tools-client-exec-errors-to-llm | SHOULD | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2026-07-28/tools/tools-client-exec-errors-to-llm |
| tools-client-protocol-errors-to-llm-may | MAY | client | n/a: addresses the other side | tested: conformance.TestFeaturesClient/2026-07-28/tools/tools-client-protocol-errors-to-llm-may |
| tools-embedded-resource-may | MAY | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-embedded-resource-may | n/a: addresses the other side |
| tools-embedded-implies-resources-cap | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-embedded-implies-resources-cap | n/a: addresses the other side |
| tools-resource-link-may | MAY | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-resource-link-may | n/a: addresses the other side |
| tools-resource-link-may-not-listed | (note) | both | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-resource-link-may-not-listed | tested: conformance.TestFeaturesClient/2026-07-28/tools/tools-resource-link-may-not-listed |
| tools-structured-also-text | SHOULD | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-structured-also-text | n/a: addresses the other side |
| tools-structured-any-json | (type) | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-structured-any-json | n/a: addresses the other side |
| tools-output-schema-conform | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-output-schema-conform | n/a: addresses the other side |
| tools-output-schema-client-validate | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| tools-display-name-precedence | (rule) | client | n/a: addresses the other side | gap #207: tool title and annotations.title are carried but nothing that displays a tool uses them |
| tools-server-sec-validate-inputs | MUST | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
tools / json-schema
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tools-inputschema-valid-not-null | MUST | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-inputschema-valid-not-null | n/a: addresses the other side |
| tools-inputschema-type-object-root | REQUIRED (schema) | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-inputschema-type-object-root | n/a: addresses the other side |
| tools-client-sec-ref-resolution | SHOULD | client | n/a: addresses the other side | n/a: mcpx never validates arguments against an upstream inputSchema, so it resolves no $ref for validation |
tools / mrtr
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| tools-call-input-required-may | MAY | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-call-input-required-may | n/a: addresses the other side |
| tools-call-inputrequests-declared-only | MUST NOT | server | tested: conformance.TestFeaturesServer/2026-07-28/tools/tools-call-inputrequests-declared-only | n/a: addresses the other side |
transport-http-sse
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| http-sse-deprecated-no-new-adoption | SHOULD NOT | both | tested: conformance.TestTransportServer/2026-07-28/transport-http-sse/http-sse-deprecated-no-new-adoption | tested: conformance.TestTransportClient/2026-07-28/transport-http-sse/http-sse-deprecated-no-new-adoption |
| http-sse-server-backcompat-host-both | should (lowercase) | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| http-sse-client-backcompat-probe-non-modern-body | should (lowercase) | client | n/a: addresses the other side | tested: mcpclient.TestHTTPEraProbe/2026-07-28/http-compat/legacy-refused-too-is-typed-for-http-sse |
transport-stdio
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| transport-custom-preserve-patterns-and-metadata | MUST | both | n/a: no custom MCP transport | n/a: catalogue marks it n/a |
| transport-custom-document-patterns | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| transport-custom-byte-stream-reuses-stdio-framing | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| stdio-no-embedded-newlines | MUST NOT | both | tested: conformance.TestTransportServer/2026-07-28/transport-stdio/stdio-no-embedded-newlines | tested: conformance.TestTransportClient/2026-07-28/transport-stdio/stdio-no-embedded-newlines |
| stdio-message-is-single | MUST (implied) | both | tested: conformance.TestTransportServer/2026-07-28/transport-stdio/stdio-message-is-single | tested: conformance.TestTransportClient/2026-07-28/transport-stdio/stdio-message-is-single |
| stdio-server-may-log-to-stderr | MAY | server | tested: conformance.TestTransportServer/2026-07-28/transport-stdio/stdio-server-may-log-to-stderr | n/a: addresses the other side |
| stdio-client-may-capture-stderr | MAY | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-stdio/stdio-client-may-capture-stderr |
| stdio-client-stderr-not-error | SHOULD NOT | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-stdio/stdio-client-stderr-not-error |
| stdio-server-stdout-only-mcp | MUST NOT | server | tested: conformance.TestTransportServer/2026-07-28/transport-stdio/stdio-server-stdout-only-mcp | n/a: addresses the other side |
| stdio-client-stdin-only-mcp | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-stdio/stdio-client-stdin-only-mcp |
| stdio-client-no-responses | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-stdio/stdio-client-no-responses |
| stdio-server-no-requests | MUST NOT | server | tested: conformance.TestTransportServer/2026-07-28/transport-stdio/stdio-server-no-requests | n/a: addresses the other side |
| stdio-client-correlates-subscription-id | MUST | client | n/a: addresses the other side | tested: mcpclient.TestModernListenStream/2026-07-28/transport-stdio/client-correlates-subscription-id |
| stdio-client-cancel-by-notification | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-stdio/stdio-client-cancel-by-notification |
| stdio-server-stop-cancelled-work | SHOULD | server | tested: conformance.TestTransportServer/2026-07-28/transport-stdio/stdio-server-stop-cancelled-work | n/a: addresses the other side |
| stdio-server-silent-after-cancel | MUST NOT | server | tested: conformance.TestTransportServer/2026-07-28/transport-stdio/stdio-server-silent-after-cancel | n/a: addresses the other side |
| stdio-server-cancelled-only-for-listen | MUST NOT | server | tested: conformance.TestTransportServer/2026-07-28/transport-stdio/stdio-server-cancelled-only-for-listen | n/a: addresses the other side |
| stdio-client-shutdown-sequence | SHOULD | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-stdio/stdio-client-shutdown-sequence |
| stdio-server-exit-on-eof | SHOULD | server | tested: conformance.TestTransportServer/2026-07-28/transport-stdio/stdio-server-exit-on-eof | n/a: addresses the other side |
| stdio-server-may-close-stdout | MAY | server | tested: conformance.TestTransportServer/2026-07-28/transport-stdio/stdio-server-may-close-stdout | n/a: addresses the other side |
| stdio-client-restart-crashed-server | SHOULD | client | n/a: addresses the other side | gap #257: unverified: the in-flight call fails and the pool respawns only on the next acquire, subject to its start-failure cooldown |
| stdio-dual-era-client-probe-discover | SHOULD | client | n/a: addresses the other side | n/a: optional feature mcpx does not implement |
| stdio-no-fallback-on-modern-error | MUST NOT (informal “Do not”) | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-stdio/stdio-no-fallback-on-modern-error |
| stdio-modern-only-client-probe | RECOMMENDED | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-stdio/stdio-modern-only-client-probe |
transport-streamable-http
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| streamable-http-server-single-endpoint-post | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-server-single-endpoint-post | n/a: addresses the other side |
| streamable-http-server-validate-origin | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-server-validate-origin | n/a: addresses the other side |
| streamable-http-server-403-invalid-origin | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-server-403-invalid-origin | n/a: addresses the other side |
| streamable-http-server-bind-localhost | SHOULD | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-server-bind-localhost | n/a: addresses the other side |
| streamable-http-server-authenticate | SHOULD | server | n/a: optional feature mcpx does not implement | n/a: addresses the other side |
| streamable-http-client-post-every-message | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-streamable-http/streamable-http-client-post-every-message |
| streamable-http-client-accept-both | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-streamable-http/streamable-http-client-accept-both |
| streamable-http-post-body-request-or-notification | MUST / MUST NOT | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-streamable-http/streamable-http-post-body-request-or-notification |
| streamable-http-client-sends-metadata-headers | MUST | client | n/a: addresses the other side | tested: mcpclient.TestModernHTTPHeaders/2026-07-28/transport/client-sends-standard-and-param-headers |
| streamable-http-server-202-for-non-request | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-server-202-for-non-request | n/a: addresses the other side |
| streamable-http-server-error-status-if-rejected | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-server-error-status-if-rejected | n/a: addresses the other side |
| streamable-http-server-json-or-sse-for-request | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-server-json-or-sse-for-request | n/a: addresses the other side |
| streamable-http-client-supports-json-and-sse | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-streamable-http/streamable-http-client-supports-json-and-sse |
| streamable-http-sse-notifications-must-relate | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-sse-notifications-must-relate | n/a: addresses the other side |
| streamable-http-sse-no-requests | MUST NOT | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-sse-no-requests | n/a: addresses the other side |
| streamable-http-server-terminates-sse-after-response | SHOULD | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-server-terminates-sse-after-response | n/a: addresses the other side |
| streamable-http-close-is-cancel | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-close-is-cancel | n/a: addresses the other side |
| streamable-http-stop-cancelled-work | SHOULD | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-stop-cancelled-work | n/a: addresses the other side |
| streamable-http-silent-after-cancel | MUST NOT | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-silent-after-cancel | n/a: addresses the other side |
| streamable-http-no-resumability | — (statement) | both | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-no-resumability | tested: conformance.TestTransportClient/2026-07-28/transport-streamable-http/streamable-http-no-resumability |
| streamable-http-client-reissue-broken-request | MUST (changelog) | client | n/a: addresses the other side | tested: mcpclient.TestModernReissueBrokenRequest/2026-07-28/transport/client-reissues-broken-request-once |
| streamable-http-protocol-version-header-every-post | MUST | client | n/a: addresses the other side | tested: conformance.TestTransportClient/2026-07-28/transport-streamable-http/streamable-http-protocol-version-header-every-post |
| streamable-http-protocol-version-header-matches-meta | MUST | both | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-protocol-version-header-matches-meta | tested: conformance.TestTransportClient/2026-07-28/transport-streamable-http/streamable-http-protocol-version-header-matches-meta |
| streamable-http-unsupported-version-400 | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-unsupported-version-400 | n/a: addresses the other side |
| streamable-http-missing-capability-400 | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-missing-capability-400 | n/a: addresses the other side |
| streamable-http-unknown-method-404 | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-unknown-method-404 | n/a: addresses the other side |
| streamable-http-missing-version-header-legacy | MAY / MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-missing-version-header-legacy | n/a: addresses the other side |
| streamable-http-standard-headers-required | REQUIRED | client | n/a: addresses the other side | tested: mcpclient.TestTheVersionHeaderFollowsTheFrame/2026-07-28/transport/standard-headers-mcp-method-and-mcp-name |
| streamable-http-mcp-name-base64 | MUST | client | n/a: addresses the other side | tested: mcpclient.TestHeaderValueEncoding/2026-07-28/transport/value-encoding-examples |
| streamable-http-x-mcp-header-server-may | MAY | server | n/a: but mcpx re-exports upstream tool schemas — an upstream x-mcp-header passes through, obliging mcpx’s HTTP clients and mcpx’s own validation (see Implied | n/a: addresses the other side |
| streamable-http-x-mcp-header-client-must-mirror | MUST | client | n/a: addresses the other side | tested: mcpclient.TestParamHeaders/2026-07-28/transport/param-headers-mirror-and-omit-null |
| streamable-http-x-mcp-header-constraints | MUST / MUST NOT | server | n/a: unless passing through upstream annotations | n/a: addresses the other side |
| streamable-http-client-rejects-invalid-x-mcp-header | MUST | client | n/a: addresses the other side | tested: mcpclient.TestModernHTTPHeaders/2026-07-28/transport/client-excludes-tool-with-invalid-x-mcp-headermcpclient.TestToolHeaderAnnotations/2026-07-28/transport/client-rejects-invalid-x-mcp-header |
| streamable-http-param-value-encoding | MUST | client | n/a: addresses the other side | tested: mcpclient.TestHeaderValueEncoding/2026-07-28/transport/value-encoding-examples |
| streamable-http-server-decodes-before-compare | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-server-decodes-before-compare | n/a: addresses the other side |
| streamable-http-client-header-construction | MUST | client | n/a: addresses the other side | tested: mcpclient.TestParamHeaders/2026-07-28/transport/param-headers-mirror-and-omit-null |
| streamable-http-client-relist-on-header-mismatch | SHOULD | client | n/a: addresses the other side | tested: mcpclient.TestModernHTTPHeaders/2026-07-28/transport/client-relists-and-retries-on-header-mismatch |
| streamable-http-intermediary-forwards-unknown-param | MUST | intermediary | n/a: mcpx is not an HTTP intermediary; it terminates MCP and re-originates | n/a: catalogue marks it n/a |
| streamable-http-server-validates-param-headers | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-server-validates-param-headers | n/a: addresses the other side |
| streamable-http-header-names-case-insensitive | MUST | both | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-header-names-case-insensitive | tested: conformance.TestTransportClient/2026-07-28/transport-streamable-http/streamable-http-header-names-case-insensitive |
| streamable-http-server-rejects-header-body-mismatch | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-server-rejects-header-body-mismatch | n/a: addresses the other side |
| streamable-http-header-mismatch-400-jsonrpc | MUST | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-header-mismatch-400-jsonrpc | n/a: addresses the other side |
| streamable-http-numeric-compare | SHOULD | server | n/a: catalogue marks it n/a | n/a: addresses the other side |
| streamable-http-intermediary-http-error | MUST | intermediary | n/a: catalogue marks it n/a | tested: conformance.TestTransportClient/2026-07-28/transport-streamable-http/streamable-http-intermediary-http-error |
| streamable-http-intermediary-reject-unvalidated-version | SHOULD | intermediary | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| streamable-http-x-accel-buffering | SHOULD | server | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-x-accel-buffering | n/a: addresses the other side |
| streamable-http-sse-comment-keepalive | should/must (lowercase) | both | tested: conformance.TestTransportServer/2026-07-28/transport-streamable-http/streamable-http-sse-comment-keepalive | tested: conformance.TestTransportClient/2026-07-28/transport-streamable-http/streamable-http-sse-comment-keepalive |
| streamable-http-modern-only-server-legacy-traffic | SHOULD | server | n/a: as written (mcpx is dual-era, not modern-only) — but mcpx mints a session on server/discover for modern clients by choice (to bind requestState | n/a: addresses the other side |
versioning
| requirement | level | side | mcpx as server | mcpx as client |
|---|---|---|---|---|
| versioning-implementations-support-base-versioning-patterns | MUST | both | tested: conformance.TestLifecycleServer/2026-07-28/versioning/versioning-implementations-support-base-versioning-patterns | tested: conformance.TestLifecycleClient/2026-07-28/versioning/versioning-implementations-support-base-versioning-patterns |
| meta-extension-ids-follow-meta-rules | MUST | both | tested: conformance.TestLifecycleServer/2026-07-28/versioning/meta-extension-ids-follow-meta-rules | n/a: declares no extensions |
| versioning-server-unsupported-version-error | MUST | server | tested: conformance.TestLifecycleServer/2026-07-28/versioning/versioning-server-unsupported-version-error | n/a: addresses the other side |
| versioning-client-retry-with-supported | SHOULD | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2026-07-28/versioning/versioning-client-retry-with-supportedmcpclient.TestVersionRetry/2026-07-28/versioning/client-retries-with-supported-version |
| versioning-server-must-implement-discover | MUST | server | tested: conformance.TestLifecycleServer/2026-07-28/versioning/versioning-server-must-implement-discover | n/a: addresses the other side |
| versioning-client-may-discover-first | MAY | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2026-07-28/versioning/versioning-client-may-discover-first |
| versioning-extension-fallback-or-reject | MUST | both | tested: conformance.TestLifecycleServer/2026-07-28/versioning/versioning-extension-fallback-or-reject | n/a: catalogue marks it n/a |
| versioning-extensions-document-fallback | SHOULD | both | n/a: catalogue marks it n/a | n/a: catalogue marks it n/a |
| versioning-dual-era-server-may | MAY | server | tested: conformance.TestLifecycleServer/2026-07-28/versioning/versioning-dual-era-server-may | n/a: addresses the other side |
| versioning-era-cache | SHOULD / MAY | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2026-07-28/versioning/versioning-era-cache |
| versioning-modern-only-server-names-versions-to-initialize | SHOULD | server | n/a: dual-era); for an initialize naming an unsupported version it does name the legacy list | n/a: addresses the other side |
| versioning-modern-client-probe-legacy-stdio | SHOULD | client | n/a: addresses the other side | n/a: unless protocol: force-discover; then discover is first (yes |
| versioning-dual-era-client-probe-discover-first-stdio | SHOULD | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2026-07-28/versioning/versioning-dual-era-client-probe-discover-first-stdio |
| versioning-fallback-not-keyed-to-one-code | MUST NOT | client | n/a: addresses the other side | tested: conformance.TestLifecycleClient/2026-07-28/versioning/versioning-fallback-not-keyed-to-one-code |
| versioning-dual-era-http-detect | MAY / SHOULD | client | n/a: addresses the other side | n/a: legacy first |
| versioning-dual-era-server-selects-by-opening | (normative description) | server | tested: conformance.TestLifecycleServer/2026-07-28/versioning/versioning-dual-era-server-selects-by-opening | n/a: addresses the other side |
| versioning-dual-era-both-concurrently | MAY | server | tested: conformance.TestLifecycleServer/2026-07-28/versioning/versioning-dual-era-both-concurrently | n/a: addresses the other side |
| deprecated-should-not-adopt | SHOULD NOT / SHOULD | both | tested: conformance.TestLifecycleServer/2026-07-28/versioning/deprecated-should-not-adopt | tested: conformance.TestLifecycleClient/2026-07-28/versioning/deprecated-should-not-adopt |
Authorization rows: accepts, or requires refusal (#1972)
61 authorization rows are split per side of the wire into 82 bound row-sides: 69 permissive and 13 validation. A permissive row-side is satisfied by an interface that accepts every credential (#1950) — endpoint shape, discovery documents, registration, flows. A validation row-side cannot pass against such an interface: it needs a real check, named below, to refuse or challenge a credential (#1972).
Validation row-sides per check: invalid 6, expired 5, wrong-resource 3, scope 5. Input: internal/conformance/authsplit.json; edits belong there, never in this file.
| requirement | side | verdict |
|---|---|---|
| authorization-http-should-conform-stdio-should-not | server | permissive |
| authorization-http-should-conform-stdio-should-not | client | permissive |
| authorization-custom-auth-may | server | permissive |
| authorization-custom-auth-may | client | permissive |
| streamable-http-auth-discovery-version-header | client | permissive |
| authz-optional | server | permissive |
| authz-optional | client | permissive |
| authz-http-should-conform | server | permissive |
| authz-http-should-conform | client | permissive |
| authz-stdio-use-environment | server | permissive |
| authz-stdio-use-environment | client | permissive |
| authz-alt-transport-best-practice | server | permissive |
| authz-alt-transport-best-practice | client | permissive |
| authz-implement-oauth21 | server | permissive |
| authz-implement-oauth21 | client | permissive |
| authz-dcr-should | server | permissive |
| authz-dcr-should | client | permissive |
| authz-dcr-may-deprecated | client | permissive |
| authz-rfc8414-server-should-client-must | server | permissive |
| authz-rfc8414-server-should-client-must | client | permissive |
| authz-grant-types | server | permissive |
| authz-401-when-unauthorized | server | validation: invalid — an unproven or invalid credential must be refused with 401 |
| authz-base-url-discards-path | client | permissive |
| authz-default-endpoints-fallback | client | permissive |
| authz-bearer-header | client | permissive |
| authz-token-every-request | client | permissive |
| authz-no-token-in-query | client | permissive |
| authz-server-validates-token | server | validation: invalid, expired — tokens are validated; invalid or expired ones must get 401 |
| authz-server-validates-audience | server | validation: wrong-resource — the token must be issued for this server as audience |
| authz-client-sends-only-own-as-tokens | client | permissive |
| authz-accept-only-own-tokens | server | validation: wrong-resource — only tokens valid for this server’s resources may be accepted |
| authz-no-token-passthrough | server | permissive |
| authz-error-status-codes | server | validation: invalid, expired, wrong-resource, scope — the refusal status code (401/403/400) for every authorization error |
| authz-2025-03-26-security-list | server | validation: invalid, expired — servers enforce token expiration and validate redirect URIs |
| authz-2025-03-26-security-list | client | permissive |
| authz-2025-03-26-implementation-reqs | server | validation: expired — token rotation and limited lifetimes are enforced server-side |
| authz-2025-03-26-implementation-reqs | client | permissive |
| authz-third-party-session-binding | server | validation: invalid, expired — third-party token status validated and expiration handled |
| authz-server-prm-rfc9728 | server | permissive |
| authz-server-prm-rfc9728 | client | permissive |
| authz-prm-lists-authorization-servers | server | permissive |
| authz-as-metadata-rfc8414 | server | permissive |
| authz-as-metadata-rfc8414 | client | permissive |
| authz-as-metadata-rfc8414-or-oidc | server | permissive |
| authz-as-metadata-rfc8414-or-oidc | client | permissive |
| authz-401-www-authenticate | server | validation: invalid — the 401 refusal must carry the WWW-Authenticate metadata pointer |
| authz-prm-discovery-header-or-well-known | server | permissive |
| authz-prm-discovery-header-or-well-known | client | permissive |
| authz-client-parses-www-authenticate | client | permissive |
| authz-client-rfc8414-discovery | client | permissive |
| authz-client-as-discovery-order | client | permissive |
| authz-client-validates-issuer-in-metadata | client | permissive — metadata is checked deterministically; no credential is inspected |
| authz-client-per-as-registration-state | client | permissive |
| authz-resource-indicator | client | permissive |
| authz-canonical-uri-guidance | server | permissive |
| authz-canonical-uri-guidance | client | permissive |
| authz-secure-token-storage | server | permissive |
| authz-secure-token-storage | client | permissive |
| authz-https-and-redirect-uris | server | permissive |
| authz-https-and-redirect-uris | client | permissive |
| authz-pkce | client | permissive |
| authz-pkce-verify-s256 | client | permissive — the client refuses to proceed on AS capability, not on a presented credential |
| authz-open-redirection | client | permissive |
| authz-proxy-consent-per-client | server | permissive — user consent is a flow gate, not a credential check; no credential is inspected |
| authz-client-registration-required | client | permissive |
| authz-registration-priority | client | permissive |
| authz-cimd | client | permissive |
| authz-preregistration | client | permissive |
| authz-dcr-application-type | client | permissive |
| authz-credentials-bound-to-issuer | client | permissive |
| authz-scope-in-challenge | server | validation: scope — the refusal challenge must name the scope required |
| authz-scope-in-challenge | client | permissive |
| authz-scope-selection-order | client | permissive |
| authz-insufficient-scope-403 | server | validation: scope — insufficient scope must be refused with 403 insufficient_scope |
| authz-all-scopes-single-challenge | server | validation: scope — one refusal challenge listing every scope the operation needs |
| authz-step-up | client | permissive — the client reacts to a refusal it is given; it validates nothing itself |
| authz-server-scope-hierarchy | server | validation: scope — scope hierarchies must be accounted for when enforcing scope |
| authz-iss-validation | client | permissive — discovery/issuer metadata is checked deterministically; no credential is inspected |
| authz-refresh-tokens | server | permissive |
| authz-refresh-tokens | client | permissive |
| authz-follow-security-considerations | server | permissive |
| authz-follow-security-considerations | client | permissive |