Hold on — initialize?

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_1437":1438,"_1439":1440},"routes/_app.x.$handle.$name",{"_97":96,"_32":46,"_105":87,"_27":106,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":59,"_123":-5,"_124":-5,"_125":126},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":-5,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":25},"version",249,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","src/hosted/server.ts","latestPath","fileId","d2f92186-ad13-11f1-b27a-1607ee4eb77e","name","server.ts","fileType","script","content","/**\n * Hosted conformance server — direct-mount, no loopback proxy.\n *\n * One run exercises the whole matrix: every client scenario at every\n * specification revision that ships a requirement set (see ./matrix.ts).\n *\n * GET / Landing page: the static matrix\n * GET /scenarios JSON rows with per-revision cells\n * GET /s Mint a run id → 303 /s/\n * GET /s/ Config for every startable cell\n * GET /s// … for one revision (a column)\n * GET /s/// … for one cell\n * ALL /s///[/]\n * The cell's server. Its MCP\n * endpoint is the cell URL plus\n * /mcp, whatever the scenario's\n * own mcpPath (see MCP_PATH).\n * GET /results/[/[/]]\n * Results, mirroring /s\n * DELETE /results/ Tear down every cell of the run\n *\n * Config and results answer HTML when the request prefers text/html and JSON\n * otherwise; `?format=html|json` overrides. At a cell URL a GET that accepts\n * text/html (and not text/event-stream) or carries `?format=` is a page\n * request; every other request is dispatched to the scenario.\n *\n * Scenarios are mounted via Scenario.handler() — the same RequestListener the\n * CLI runner wraps in http.createServer — so there is no loopback port and\n * this works on serverless hosts. Each cell gets a fresh Scenario instance,\n * created lazily on first hit, built for the column's wire version.\n */\n\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { timingSafeEqual } from 'node:crypto';\nimport {\n SessionManager,\n HostedRun,\n CellRef,\n RunResults,\n RUN_ID_RE,\n UnknownScenarioError,\n NotHostableError,\n cellId,\n mintRunId\n} from './session.ts';\nimport {\n buildMatrix,\n MCP_PATH,\n type HostedMatrix,\n type MatrixCell\n} from './matrix.ts';\nimport {\n renderLanding,\n renderConfig,\n renderReport,\n renderResults\n} from './html.ts';\nimport { bodyFitsBuffer, onBodySettled, tapJsonBody } from './body.ts';\nimport { identityFrom } from './identity.ts';\nimport { isStatefulVersion } from '../connection/select.ts';\nimport {\n describeRequest,\n getOnMcpCheck,\n GET_ON_MCP_REPLY,\n isLegacyProbe,\n isNegotiation,\n legacyInitializeReply,\n legacyProbeCheck,\n tapResponse,\n wireRejectedCheck,\n wireRejection,\n wrongRevision,\n wrongRevisionCheck,\n type CapturedResponse,\n type RequestInfo\n} from './wire.ts';\nimport {\n buildReport,\n incompleteNote,\n summarize,\n verdictFor,\n type Verdict\n} from './report.ts';\nimport { parseComposite } from './composite.ts';\nimport { createCompositeRoute } from './composite-route.ts';\nimport type { RunStore } from './store.ts';\nimport { scenarios } from '../scenarios/index.ts';\nimport { ConformanceCheck, AuxOriginRole, SpecVersion } from '../types.ts';\n\nexport interface HostedServerOptions {\n publicOrigin?: string;\n ttlMs?: number;\n /**\n * Public origins of the AS/IdP relay deployments. When set, scenarios that\n * implement `authHandlers()` become startable; their per-cell AS issuer is\n * `/r///`. See\n * examples/hosted/valtown-relay.ts.\n */\n auxOrigins?: Partial>;\n /**\n * Shared secret the relay sends in `x-relay-secret`. `/__aux/*` rejects\n * requests without it so the aux backchannel can't be hit directly. Set\n * the same value in the relay's env.\n */\n relaySecret?: string;\n /**\n * Persist runs so a deployment that load-balances one run's requests\n * across processes (serverless isolates) still serves complete results.\n * See ./store.ts. Omit for a single long-lived process.\n */\n store?: RunStore;\n /**\n * Scenarios this deployment refuses to mount, with the reason shown in\n * the matrix (e.g. scenarios that need one process's memory across\n * requests on a host that has none).\n */\n exclude?: Record;\n}\n\nconst AUX_ROLES: readonly AuxOriginRole[] = ['as', 'as2', 'idp'];\n\n/** Cell config as served under /s/[/[/]]. */\nexport interface CellConfig {\n scenario: string;\n revision: SpecVersion;\n /** The MCP endpoint URL — what the client under test connects to. */\n url: string;\n resultsUrl: string;\n scoring: MatrixCell['scoring'];\n reason?: string;\n steps?: MatrixCell['steps'];\n env: {\n MCP_CONFORMANCE_SCENARIO: string;\n MCP_CONFORMANCE_PROTOCOL_VERSION: string;\n MCP_CONFORMANCE_CONTEXT?: string;\n };\n}\n\nexport interface RunConfig {\n runId: string;\n revision?: SpecVersion;\n scenario?: string;\n resultsUrl: string;\n mcpServers: Record;\n cells: CellConfig[];\n}\n\nexport function createHostedApp(opts: HostedServerOptions = {}): {\n app: express.Application;\n sessions: SessionManager;\n matrix: HostedMatrix;\n} {\n const auxOrigins = opts.auxOrigins ?? {};\n const haveAux = AUX_ROLES.filter((r) => auxOrigins[r]);\n const sessions = new SessionManager({\n ttlMs: opts.ttlMs,\n auxOrigins,\n store: opts.store\n });\n const matrix = buildMatrix({ auxOrigins, exclude: opts.exclude });\n const revisions: readonly string[] = matrix.revisions;\n const app = express();\n // Copy JSON POST bodies as they flow so the report can name the client\n // (initialize params / per-request _meta) without consuming the stream\n // the scenario is about to read.\n app.use(tapJsonBody());\n\n function origin(req: Request): string {\n if (opts.publicOrigin) return opts.publicOrigin;\n const proto = (req.header('x-forwarded-proto') ?? req.protocol) || 'http';\n const host = req.header('x-forwarded-host') ?? req.header('host');\n return `${proto}://${host}`;\n }\n\n const cellBaseUrl = (req: Request, ref: CellRef) =>\n `${origin(req)}/s/${cellId(ref)}`;\n const resultsUrlFor = (req: Request, ...parts: string[]) =>\n `${origin(req)}/results/${parts.join('/')}`;\n\n /**\n * Path segments of a captured route tail. A trailing slash (`/s//`,\n * `/results///`) is not a segment: without this it would read\n * as an empty revision or scenario name and 404.\n */\n function segmentsOf(tail: string): string[] {\n // A loop, not /\\/+$/: that regex backtracks polynomially on\n // request-controlled input (CodeQL js/polynomial-redos).\n while (tail.endsWith('/')) tail = tail.slice(0, -1);\n return tail.split('/');\n }\n\n /**\n * Longest registered scenario name that prefixes `segments` (names may\n * contain '/'), plus whatever follows it as a path suffix ('' if nothing).\n * Matches every registered client scenario, not only startable ones, so a\n * cell that cannot start still answers with its reason.\n */\n function resolveScenario(\n segments: string[]\n ): { scenarioName: string; suffix: string } | undefined {\n for (let i = segments.length; i >= 1; i--) {\n const candidate = segments.slice(0, i).join('/');\n if (scenarios.has(candidate)) {\n return {\n scenarioName: candidate,\n suffix: i < segments.length ? '/' + segments.slice(i).join('/') : ''\n };\n }\n }\n return undefined;\n }\n\n interface ResolvedCell {\n ref: CellRef;\n cell: MatrixCell;\n suffix: string;\n }\n\n /**\n * Resolve `[, , , ]` to a startable\n * cell, or answer the request with why it isn't one and return undefined.\n */\n function resolveCell(\n segments: string[],\n res: Response\n ): ResolvedCell | undefined {\n const [runId, revision, ...rest] = segments;\n if (!RUN_ID_RE.test(runId ?? '')) {\n res.status(400).json({ error: 'invalid run-id' });\n return undefined;\n }\n if (!revisions.includes(revision ?? '')) {\n res\n .status(404)\n .json({ error: `unknown revision '${revision ?? ''}'`, revisions });\n return undefined;\n }\n const resolved = resolveScenario(rest);\n if (!resolved) {\n res.status(404).json({ error: `unknown scenario '${rest.join('/')}'` });\n return undefined;\n }\n const cell = matrix.cell(resolved.scenarioName, revision)!;\n if (!checkStartable(cell, res)) return undefined;\n return {\n ref: {\n runId,\n revision: revision as SpecVersion,\n scenarioName: resolved.scenarioName\n },\n cell,\n suffix: resolved.suffix\n };\n }\n\n /** 404 for n/a cells, 501 for cells this deployment cannot start. */\n function checkStartable(cell: MatrixCell, res: Response): boolean {\n if (cell.scoring === 'n/a') {\n res.status(404).json({\n error: `scenario '${cell.scenario}' does not apply to ${cell.revision}: ${cell.reason}`,\n scenario: cell.scenario,\n revision: cell.revision,\n scoring: cell.scoring,\n reason: cell.reason\n });\n return false;\n }\n if (!cell.startable) {\n res.status(501).json({\n error: `scenario '${cell.scenario}' at ${cell.revision} cannot be started here: ${cell.startReason}`,\n scenario: cell.scenario,\n revision: cell.revision,\n scoring: cell.scoring,\n reason: cell.startReason\n });\n return false;\n }\n return true;\n }\n\n /**\n * The cell, hydrated from the store when this process has never seen it\n * (see SessionManager.acquire) — a request must not be dispatched before\n * the scenario knows the run's history.\n */\n async function createRun(\n req: Request,\n ref: CellRef,\n res: Response\n ): Promise {\n try {\n return await sessions.acquire(ref, (r) => cellBaseUrl(req, r));\n } catch (e) {\n if (e instanceof UnknownScenarioError) {\n res.status(404).json({ error: e.message });\n return undefined;\n }\n if (e instanceof NotHostableError) {\n res.status(501).json({ error: e.message });\n return undefined;\n }\n throw e;\n }\n }\n\n /**\n * The path the scenario sees for a request at ``: the\n * suffix, except that `/mcp` on a scenario serving MCP at its root is the\n * root — every cell is reachable at `/mcp` (see MCP_PATH).\n */\n function scenarioPath(run: HostedRun, suffix: string): string {\n if (suffix === MCP_PATH && !run.mcpPath) return '';\n return suffix;\n }\n\n /** Whether `rewrittenUrl` (path, maybe a query) is the cell's MCP endpoint. */\n function isMcpEndpoint(run: HostedRun, rewrittenUrl: string): boolean {\n const q = rewrittenUrl.indexOf('?');\n const path = q === -1 ? rewrittenUrl : rewrittenUrl.slice(0, q);\n return path === (run.mcpPath || '/');\n }\n\n /**\n * Dispatch (req, res) to `listener` after rewriting `req.url` so the\n * scenario sees the path it would have under start()/stop() — i.e. with\n * the cell prefix stripped and (for well-known dispatch) the well-known\n * prefix re-prepended.\n *\n * `mcp` says the request is to the cell's MCP endpoint (not a PRM,\n * canary or aux path): only those are judged for wire rejections and\n * revision discipline (see ./wire.ts).\n */\n function dispatch(\n run: HostedRun,\n listener: (req: Request, res: Response) => void,\n req: Request,\n res: Response,\n rewrittenUrl: string,\n mcp = false\n ) {\n res.setHeader(\n 'link',\n `<${resultsUrlFor(req, run.id)}>; rel=\"conformance-results\"`\n );\n req.url = rewrittenUrl;\n run.touched = true;\n\n // The headers as the client sent them: a scenario may rewrite them\n // before handing the request on (json-schema-ref-deref maps the draft\n // header to the SDK's), and identity is what the client said.\n const headers = { ...req.headers };\n const headerVersion = req.header('mcp-protocol-version');\n let request: RequestInfo | undefined;\n let body: Buffer | undefined;\n let response: CapturedResponse | undefined;\n let judged = false;\n\n // Write this process's view through once the scenario has answered\n // (hosted scenarios record their checks before calling end()).\n // Serverless entry points should await sessions.flush() before\n // returning the response so this write isn't abandoned.\n const persist = () => {\n if (sessions.store) void sessions.persist(run);\n };\n\n /** Once the request is parsed and the response is out, judge both. */\n const judge = (): boolean => {\n if (judged || !request || !response) return false;\n judged = true;\n // A foreign-revision request a dated cell turned away is the client\n // negotiating (it falls back to `initialize`): neither judgement.\n if (mcp && !isNegotiation(run.revision, headerVersion, response)) {\n const rejection = wireRejection(response, run.revision, headerVersion);\n // One mistake, one check: a wrong-revision request the wire also\n // turned away records the revision, with the rejection folded in.\n let explained = false;\n for (const method of request.methods) {\n // An initialize on the stateless wire is era detection (see\n // isLegacyProbe()): noted, never failed, and it explains the\n // rejection it may have drawn.\n if (isLegacyProbe(run.revision, method)) {\n explained = true;\n // Looked up without the header: a -32022 to an initialize that\n // happened to name the cell's revision is still the answer.\n sessions.recordHostedCheck(\n run,\n `probe:${headerVersion ?? ''}`,\n legacyProbeCheck(\n run.revision,\n headerVersion,\n wireRejection(response, run.revision, undefined),\n request.bodyVersion\n )\n );\n continue;\n }\n const reason = wrongRevision(run.revision, method, headerVersion);\n if (!reason) continue;\n explained = explained || rejection !== undefined;\n sessions.recordHostedCheck(\n run,\n `revision:${method}:${headerVersion ?? ''}`,\n wrongRevisionCheck(\n run.revision,\n method,\n headerVersion,\n reason,\n rejection\n )\n );\n }\n if (rejection && !explained) {\n sessions.recordHostedCheck(\n run,\n `rejected:${rejection.code}:${rejection.message}`,\n wireRejectedCheck(rejection, request, headerVersion)\n );\n }\n }\n // Who the client is, from accepted exchanges only.\n const identity = identityFrom(headers, body, response);\n if (identity) sessions.recordIdentity(run, identity);\n return true;\n };\n\n onBodySettled(req, (captured) => {\n body = captured;\n request = describeRequest(captured);\n // The response is already out: what judge() recorded needs its own\n // write-through.\n if (judge() && response) persist();\n });\n tapResponse(res, (captured) => {\n response = captured;\n judge();\n persist();\n });\n\n // Every cell on the stateless wire answers a legacy initialize the same\n // way, before the scenario sees it (see legacyInitializeReply()). Not an\n // auth cell: its resource server must answer 401 before it looks at the\n // protocol, and after sign-in it gives the same -32022 itself\n // (auth/helpers/createServer.ts). Raw node calls: a composite's replayed\n // request has no express helpers.\n const sendJson = (status: number, body: unknown) => {\n res.statusCode = status;\n res.setHeader('content-type', 'application/json');\n res.end(JSON.stringify(body));\n };\n // An express scenario with no route for the request calls this instead\n // of answering with Express's HTML 404 (a raw listener ignores it). On\n // the MCP endpoint that is a GET the scenario serves no stream for —\n // VS Code sends one after a 400, as its old HTTP+SSE fallback — so it\n // gets the SDK transport's 405, and the cell notes it.\n const fallthrough = (err?: unknown) => {\n if (res.headersSent) return;\n if (err) {\n sendJson(500, {\n jsonrpc: '2.0',\n id: null,\n error: { code: -32603, message: 'Internal error' }\n });\n return;\n }\n if (mcp && req.method === 'GET') {\n sessions.recordHostedCheck(\n run,\n 'get-on-mcp',\n getOnMcpCheck(run.revision)\n );\n res.setHeader('allow', 'POST');\n sendJson(405, GET_ON_MCP_REPLY);\n return;\n }\n sendJson(404, { error: `Cannot ${req.method} ${req.url}` });\n };\n const handOn = () =>\n (\n listener as (\n req: Request,\n res: Response,\n next: (err?: unknown) => void\n ) => void\n )(req, res, fallthrough);\n\n if (\n mcp &&\n req.method === 'POST' &&\n !isStatefulVersion(run.revision) &&\n !run.auxListeners &&\n bodyFitsBuffer(req)\n ) {\n onBodySettled(req, (captured) => {\n const reply = legacyInitializeReply(\n run.revision,\n captured,\n headerVersion\n );\n if (reply) sendJson(reply.status, reply.body);\n else handOn();\n });\n return;\n }\n handOn();\n }\n\n // ---------- representation ----------\n\n /** `?format=` wins; otherwise the Accept header decides (JSON by default). */\n function wantsHtml(req: Request): boolean {\n const format = req.query.format;\n if (format === 'html') return true;\n if (format === 'json') return false;\n return req.accepts(['json', 'html']) === 'html';\n }\n\n /**\n * A GET at a cell URL is a page/config request when it accepts text/html\n * (and not the MCP SSE stream) or spells out `?format=`; anything else is\n * the client under test talking to the scenario.\n */\n function isPageRequest(req: Request): boolean {\n if (req.method !== 'GET') return false;\n if (typeof req.query.format === 'string') return true;\n const accept = req.header('accept') ?? '';\n return (\n accept.includes('text/html') && !accept.includes('text/event-stream')\n );\n }\n\n // ---------- config ----------\n\n function cellConfig(\n req: Request,\n run: HostedRun,\n cell: MatrixCell\n ): CellConfig {\n const context = run.context\n ? JSON.stringify({ name: run.scenarioName, ...run.context })\n : undefined;\n return {\n scenario: run.scenarioName,\n revision: run.revision,\n url: `${cellBaseUrl(req, run)}${run.mcpPath || MCP_PATH}`,\n resultsUrl: resultsUrlFor(req, run.id),\n scoring: cell.scoring,\n ...(cell.reason !== undefined && { reason: cell.reason }),\n ...(cell.steps && { steps: cell.steps }),\n env: {\n MCP_CONFORMANCE_SCENARIO: run.scenarioName,\n MCP_CONFORMANCE_PROTOCOL_VERSION: run.revision,\n ...(context !== undefined && { MCP_CONFORMANCE_CONTEXT: context })\n }\n };\n }\n\n /** Config for every startable cell in scope; creates the cells. */\n function runConfig(\n req: Request,\n runId: string,\n scope: { revision?: SpecVersion; scenario?: string }\n ): RunConfig {\n const cells = matrix\n .cells()\n .filter(\n (c) =>\n c.startable &&\n (scope.revision === undefined || c.revision === scope.revision) &&\n (scope.scenario === undefined || c.scenario === scope.scenario)\n )\n .map((c) => {\n const run = sessions.getOrCreate(\n { runId, revision: c.revision, scenarioName: c.scenario },\n (r) => cellBaseUrl(req, r)\n );\n return cellConfig(req, run, c);\n });\n const parts = [runId];\n if (scope.revision) parts.push(scope.revision);\n if (scope.revision && scope.scenario) parts.push(scope.scenario);\n return {\n runId,\n ...(scope.revision && { revision: scope.revision }),\n ...(scope.scenario && { scenario: scope.scenario }),\n resultsUrl: resultsUrlFor(req, ...parts),\n mcpServers: Object.fromEntries(\n cells.map((c) => [\n `${c.revision}/${c.scenario}`,\n { type: 'http' as const, url: c.url }\n ])\n ),\n cells\n };\n }\n\n function sendConfig(req: Request, res: Response, config: RunConfig): void {\n if (wantsHtml(req)) {\n res.type('html').send(renderConfig(origin(req), matrix, config));\n } else {\n res.json(config);\n }\n }\n\n // ---------- discovery ----------\n\n app.get('/', (req, res) => {\n res.type('html').send(renderLanding(origin(req), matrix));\n });\n\n app.get('/scenarios', (_req, res) => {\n res.json(\n matrix.rows.map((row) => ({\n name: row.scenario,\n description: row.description,\n source: row.source,\n mcpPath: row.cells[0]?.mcpPath ?? MCP_PATH,\n ...(row.cells[0]?.steps && { steps: row.cells[0].steps }),\n cells: row.cells.map(\n ({ revision, scoring, reason, startable, startReason }) => ({\n revision,\n scoring,\n ...(reason !== undefined && { reason }),\n startable,\n ...(startReason !== undefined && { startReason })\n })\n )\n }))\n );\n });\n\n // ---------- runs ----------\n\n app.get('/s', (_req, res) => {\n res.redirect(303, `/s/${mintRunId()}`);\n });\n\n // We can't pre-register an express route per cell because run-ids are\n // open-ended and scenario names contain '/'. A single catch-all resolves\n // the cell, rewrites req.url to strip the /s///\n // prefix, and hands off to the cell's listener — exactly what\n // app.use(prefix, fn) would do, but with a dynamic prefix.\n const composite = createCompositeRoute({\n matrix,\n createRun,\n dispatch,\n cellBaseUrl,\n resultsUrlFor,\n isPageRequest,\n wantsHtml\n });\n\n app.all(/^\\/s\\/(.+)$/, async (req, res) => {\n const segments = segmentsOf(req.params[0]);\n const [runId, revision] = segments;\n\n // Several scenarios' cells behind one URL, `+` (see ./composite.ts).\n const tail = segments.slice(2).join('/');\n const spec = tail.endsWith(MCP_PATH)\n ? tail.slice(0, -MCP_PATH.length)\n : tail;\n const children = segments.length > 2 ? parseComposite(spec) : undefined;\n if (children) {\n if (!RUN_ID_RE.test(runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n if (!revisions.includes(revision)) {\n res\n .status(404)\n .json({ error: `unknown revision '${revision}'`, revisions });\n return;\n }\n await composite(\n req,\n res,\n runId,\n revision as SpecVersion,\n children,\n spec === tail ? '' : MCP_PATH\n );\n return;\n }\n\n if (segments.length <= 2) {\n // Run or column scope: config only.\n if (!RUN_ID_RE.test(runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n if (segments.length === 2 && !revisions.includes(revision)) {\n res\n .status(404)\n .json({ error: `unknown revision '${revision}'`, revisions });\n return;\n }\n if (req.method !== 'GET') {\n res.status(405).json({\n error:\n 'MCP endpoints live at /s///; GET here for the config.'\n });\n return;\n }\n sendConfig(\n req,\n res,\n runConfig(req, runId, {\n revision:\n segments.length === 2 ? (revision as SpecVersion) : undefined\n })\n );\n return;\n }\n\n const resolved = resolveCell(segments, res);\n if (!resolved) return;\n const { ref, suffix } = resolved;\n\n // A browser opening the MCP URL itself is sent to the cell's page.\n if (suffix === MCP_PATH && isPageRequest(req)) {\n const q = req.originalUrl.indexOf('?');\n const page = cellBaseUrl(req, ref);\n res.redirect(303, q === -1 ? page : page + req.originalUrl.slice(q));\n return;\n }\n\n if (suffix === '' && isPageRequest(req)) {\n sendConfig(\n req,\n res,\n runConfig(req, ref.runId, {\n revision: ref.revision,\n scenario: ref.scenarioName\n })\n );\n return;\n }\n\n const run = await createRun(req, ref, res);\n if (!run) return;\n // Rewrite to the path the scenario expects (it thinks it's at root).\n // The query string is preserved because we keep the express req object.\n const rewritten = scenarioPath(run, suffix) || run.mcpPath || '/';\n dispatch(\n run,\n run.listener,\n req,\n res,\n rewritten,\n isMcpEndpoint(run, rewritten)\n );\n });\n\n // ---------- root well-known dispatch (RS side) ----------\n //\n // RFC 9728: a client given MCP URL /s//mcp derives the PRM\n // URL as /.well-known/oauth-protected-resource/s//mcp — i.e.\n // at the *origin root*, not under the cell prefix. We catch that here,\n // recover the cell from the path suffix, and re-dispatch to its RS handler\n // with the path it would have seen on its own origin.\n //\n // Requests that arrive *under* the cell prefix (because the WWW-Authenticate\n // header points there) already work via the /s/* mount above.\n\n app.get(\n /^\\/\\.well-known\\/oauth-protected-resource\\/s\\/(.+)$/,\n async (req, res) => {\n const resolved = resolveCell(req.params[0].split('/'), res);\n if (!resolved) return;\n const run = await createRun(req, resolved.ref, res);\n if (!run) return;\n // Scenario expects e.g. '/.well-known/oauth-protected-resource/mcp'\n // (or the bare well-known path when its MCP endpoint is its root).\n dispatch(\n run,\n run.listener,\n req,\n res,\n '/.well-known/oauth-protected-resource' +\n scenarioPath(run, resolved.suffix)\n );\n }\n );\n\n // ---------- aux-origin backchannel (relay target) ----------\n //\n // The AS relay (examples/hosted/valtown-relay.ts) forwards every request it\n // receives to /__aux/. The per-cell AS issuer is\n // /r///, so every path the client hits\n // — endpoints (/r//authorize) and RFC 8414 well-known\n // (/.well-known/oauth-authorization-server/r/[/tenant]) — carries\n // `/r/` somewhere in it. We locate it, strip it, and dispatch to the\n // cell's aux handler so it sees exactly the path createAuthServer\n // registered.\n //\n // Guarded by a shared secret so this internal mount can't be hit directly\n // to forge checks into someone else's run.\n\n if (haveAux.length) {\n const secret = opts.relaySecret ?? process.env.CONFORMANCE_RELAY_SECRET;\n const guard = (req: Request, res: Response): boolean => {\n const got = req.header('x-relay-secret') ?? '';\n // Constant-time compare; mismatch length → fast 403 is fine.\n const ok =\n !!secret &&\n got.length === secret.length &&\n timingSafeEqual(Buffer.from(got), Buffer.from(secret));\n if (!ok) {\n res\n .status(403)\n .json({ error: 'forbidden: /__aux is the relay backchannel' });\n }\n return ok;\n };\n\n /**\n * Find the first `/r///` in `segments` (plain\n * segment scan — a regex over the whole path would backtrack\n * polynomially on adversarial input) and split the path around it.\n */\n function locateCell(\n segments: string[]\n ): { prefix: string; ref: CellRef; suffix: string } | undefined {\n for (let i = 1; i < segments.length - 2; i++) {\n if (\n segments[i] !== 'r' ||\n !RUN_ID_RE.test(segments[i + 1]) ||\n !revisions.includes(segments[i + 2])\n ) {\n continue;\n }\n const resolved = resolveScenario(segments.slice(i + 3));\n if (!resolved) continue;\n return {\n prefix: segments.slice(0, i).join('/'),\n ref: {\n runId: segments[i + 1],\n revision: segments[i + 2] as SpecVersion,\n scenarioName: resolved.scenarioName\n },\n suffix: resolved.suffix\n };\n }\n return undefined;\n }\n\n app.all(/^\\/__aux\\/([a-z0-9]+)(\\/.*)$/, async (req, res) => {\n if (!guard(req, res)) return;\n const role = req.params[0] as AuxOriginRole;\n const path = req.params[1];\n if (!AUX_ROLES.includes(role)) {\n res.status(404).json({ error: `unknown aux role '${role}'` });\n return;\n }\n\n const located = locateCell(path.split('/')); // path starts with '/', so [0] === ''\n if (!located) {\n res.status(404).json({\n error:\n 'aux request path missing /r/// segment'\n });\n return;\n }\n const { prefix, ref, suffix } = located;\n const cell = matrix.cell(ref.scenarioName, ref.revision)!;\n if (!checkStartable(cell, res)) return;\n const search = req.url.includes('?')\n ? req.url.slice(req.url.indexOf('?'))\n : '';\n\n // On a multi-process host this may be the first request this process\n // sees for the cell; the id carries everything needed to rebuild it.\n const run = sessions.ensure(cellId(ref), (r) => cellBaseUrl(req, r));\n const listener = run?.auxListeners?.[role];\n if (!run || !listener) {\n res.status(404).json({ error: `no aux '${role}' handler for cell` });\n return;\n }\n await sessions.hydrate(run);\n dispatch(run, listener, req, res, (prefix + suffix || '/') + search);\n });\n }\n\n // ---------- results ----------\n\n app.get(/^\\/results\\/(.+)$/, async (req, res) => {\n const segments = segmentsOf(req.params[0]);\n const [runId, revision, ...rest] = segments;\n if (!RUN_ID_RE.test(runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n if (segments.length >= 2 && !revisions.includes(revision)) {\n res\n .status(404)\n .json({ error: `unknown revision '${revision}'`, revisions });\n return;\n }\n\n if (segments.length >= 3) {\n const resolved = resolveScenario(rest);\n if (!resolved || resolved.suffix !== '') {\n res.status(404).json({ error: `unknown scenario '${rest.join('/')}'` });\n return;\n }\n const ref: CellRef = {\n runId,\n revision: revision as SpecVersion,\n scenarioName: resolved.scenarioName\n };\n const cell = matrix.cell(resolved.scenarioName, ref.revision)!;\n // A cell nobody has hit yet is a valid, incomplete cell — not an\n // unknown run: the config page links here before any traffic.\n const r =\n cell.scoring === 'n/a'\n ? undefined\n : await sessions.results(cellId(ref));\n const status = cellStatus(cell, r);\n if (wantsHtml(req)) {\n res.type('html').send(renderResults(ref, r?.checks ?? [], status));\n } else {\n res.json({ ...summarise(ref, r?.checks ?? []), ...status });\n }\n return;\n }\n\n // Run or column scope: a verdict per cell of the matrix.\n const scope = segments.length === 2 ? (revision as SpecVersion) : undefined;\n const report = await buildReport(matrix, runId, scope, {\n listCells: (id) => sessions.listCells(id),\n results: (id) => sessions.results(id),\n resultsUrl: (ref) => resultsUrlFor(req, cellId(ref))\n });\n if (wantsHtml(req)) {\n res.type('html').send(renderReport(origin(req), matrix, report));\n } else {\n res.json(report);\n }\n });\n\n app.delete('/results/:runId', async (req, res) => {\n if (!RUN_ID_RE.test(req.params.runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n await sessions.destroyRun(req.params.runId);\n res.status(204).end();\n });\n\n return { app, sessions, matrix };\n}\n\nexport function summarise(ref: CellRef, checks: ConformanceCheck[]) {\n return {\n runId: ref.runId,\n revision: ref.revision,\n scenario: ref.scenarioName,\n summary: summarize(checks),\n checks\n };\n}\n\n/** What a cell's results say about the cell itself, next to its checks. */\nexport interface CellStatus {\n scoring: MatrixCell['scoring'];\n verdict: Verdict;\n /**\n * On a startable incomplete cell: why, in plain words — nothing recorded\n * yet, or the checks listed are only what the scenario still expects.\n */\n note?: string;\n /** For n/a (why the scenario does not apply) and not_scored/unlisted. */\n reason?: string;\n /** Present, false, when this deployment cannot start the cell. */\n startable?: false;\n startReason?: string;\n}\n\nexport function cellStatus(\n cell: MatrixCell,\n results: Pick | undefined\n): CellStatus {\n const verdict = verdictFor(cell, results?.checks, results?.recorded);\n return {\n scoring: cell.scoring,\n verdict,\n ...(verdict === 'incomplete' &&\n cell.startable && { note: incompleteNote(results?.checks ?? []) }),\n ...(cell.reason !== undefined && { reason: cell.reason }),\n ...(!cell.startable &&\n cell.scoring !== 'n/a' && {\n startable: false as const,\n ...(cell.startReason !== undefined && { startReason: cell.startReason })\n })\n };\n}\n","/**\n * Hosted conformance server — direct-mount, no loopback proxy.\n *\n * One run exercises the whole matrix: every client scenario at every\n * specification revision that ships a requirement set (see ./matrix.ts).\n *\n * GET / Landing page: the static matrix\n * GET /scenarios JSON rows with per-revision cells\n * GET /s Mint a run id → 303 /s/\n * GET /s/ Config for every startable cell\n * GET /s// … for one revision (a column)\n * GET /s/// … for one cell\n * ALL /s///[/]\n * The cell's server. Its MCP\n * endpoint is the cell URL plus\n * /mcp, whatever the scenario's\n * own mcpPath (see MCP_PATH).\n * GET /results/[/[/]]\n * Results, mirroring /s; a run or\n * column also as `?format=md`\n * POST /results//freeze Freeze the run's report → its\n * snapshot (303 for a browser)\n * GET /results//snapshot/ A frozen report (html/json/md)\n * DELETE /results/ Tear down every cell of the run,\n * and its snapshots\n *\n * Config and results answer HTML when the request prefers text/html and JSON\n * otherwise; `?format=html|json` overrides. At a cell URL a GET that accepts\n * text/html (and not text/event-stream) or carries `?format=` is a page\n * request; every other request is dispatched to the scenario.\n *\n * Scenarios are mounted via Scenario.handler() — the same RequestListener the\n * CLI runner wraps in http.createServer — so there is no loopback port and\n * this works on serverless hosts. Each cell gets a fresh Scenario instance,\n * created lazily on first hit, built for the column's wire version.\n */\n\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { timingSafeEqual } from 'node:crypto';\nimport {\n SessionManager,\n HostedRun,\n CellRef,\n RunResults,\n RUN_ID_RE,\n UnknownScenarioError,\n NotHostableError,\n cellId,\n mintId,\n mintRunId\n} from './session.ts';\nimport {\n buildMatrix,\n MCP_PATH,\n type HostedMatrix,\n type MatrixCell\n} from './matrix.ts';\nimport {\n renderLanding,\n renderConfig,\n renderReport,\n renderResults\n} from './html.ts';\nimport { bodyFitsBuffer, onBodySettled, tapJsonBody } from './body.ts';\nimport { identityFrom } from './identity.ts';\nimport { isStatefulVersion } from '../connection/select.ts';\nimport {\n answeredVersion,\n describeRequest,\n getOnMcpCheck,\n GET_ON_MCP_REPLY,\n isAcceptedInitialize,\n isLegacyProbe,\n isModernProbe,\n legacyInitializeReply,\n legacyProbeCheck,\n modernProbeCheck,\n pinInitializeVersion,\n refusalOf,\n tapResponse,\n versionAnswer,\n versionOfferedCheck,\n wireRejectedCheck,\n wireRejection,\n wrongRevision,\n wrongRevisionCheck,\n type CapturedResponse,\n type RequestInfo\n} from './wire.ts';\nimport {\n buildReport,\n incompleteNote,\n stateOf,\n summarize,\n verdictFor,\n type CellState,\n type ReportSources,\n type RunReport,\n type Verdict\n} from './report.ts';\nimport { parseComposite } from './composite.ts';\nimport { createCompositeRoute } from './composite-route.ts';\nimport { MemoryRunStore, type RunStore, type SnapshotInfo } from './store.ts';\nimport { reportMarkdown } from './markdown.ts';\nimport { scenarios } from '../scenarios/index.ts';\nimport { ConformanceCheck, AuxOriginRole, SpecVersion } from '../types.ts';\n\nexport interface HostedServerOptions {\n publicOrigin?: string;\n ttlMs?: number;\n /**\n * Public origins of the AS/IdP relay deployments. When set, scenarios that\n * implement `authHandlers()` become startable; their per-cell AS issuer is\n * `/r///`. See\n * examples/hosted/valtown-relay.ts.\n */\n auxOrigins?: Partial>;\n /**\n * Shared secret the relay sends in `x-relay-secret`. `/__aux/*` rejects\n * requests without it so the aux backchannel can't be hit directly. Set\n * the same value in the relay's env.\n */\n relaySecret?: string;\n /**\n * Persist runs so a deployment that load-balances one run's requests\n * across processes (serverless isolates) still serves complete results.\n * See ./store.ts. Omit for a single long-lived process.\n */\n store?: RunStore;\n /**\n * Scenarios this deployment refuses to mount, with the reason shown in\n * the matrix (e.g. scenarios that need one process's memory across\n * requests on a host that has none).\n */\n exclude?: Record;\n}\n\nconst AUX_ROLES: readonly AuxOriginRole[] = ['as', 'as2', 'idp'];\n\n/** Snapshot ids are minted like run ids (see mintId()), shorter. */\nconst SNAPSHOT_ID_RE = /^[0-9a-z]{1,32}$/;\n\n/** Cell config as served under /s/[/[/]]. */\nexport interface CellConfig {\n scenario: string;\n revision: SpecVersion;\n /** The MCP endpoint URL — what the client under test connects to. */\n url: string;\n resultsUrl: string;\n scoring: MatrixCell['scoring'];\n reason?: string;\n steps?: MatrixCell['steps'];\n env: {\n MCP_CONFORMANCE_SCENARIO: string;\n MCP_CONFORMANCE_PROTOCOL_VERSION: string;\n MCP_CONFORMANCE_CONTEXT?: string;\n };\n}\n\nexport interface RunConfig {\n runId: string;\n revision?: SpecVersion;\n scenario?: string;\n resultsUrl: string;\n mcpServers: Record;\n cells: CellConfig[];\n}\n\nexport function createHostedApp(opts: HostedServerOptions = {}): {\n app: express.Application;\n sessions: SessionManager;\n matrix: HostedMatrix;\n} {\n const auxOrigins = opts.auxOrigins ?? {};\n const haveAux = AUX_ROLES.filter((r) => auxOrigins[r]);\n const sessions = new SessionManager({\n ttlMs: opts.ttlMs,\n auxOrigins,\n store: opts.store\n });\n const matrix = buildMatrix({ auxOrigins, exclude: opts.exclude });\n // Frozen reports live in the run store, so any isolate can serve a\n // permalink; a single process without one keeps them in memory.\n const snapshots: RunStore = opts.store ?? new MemoryRunStore();\n const revisions: readonly string[] = matrix.revisions;\n const app = express();\n // Copy JSON POST bodies as they flow so the report can name the client\n // (initialize params / per-request _meta) without consuming the stream\n // the scenario is about to read.\n app.use(tapJsonBody());\n\n function origin(req: Request): string {\n if (opts.publicOrigin) return opts.publicOrigin;\n const proto = (req.header('x-forwarded-proto') ?? req.protocol) || 'http';\n const host = req.header('x-forwarded-host') ?? req.header('host');\n return `${proto}://${host}`;\n }\n\n const cellBaseUrl = (req: Request, ref: CellRef) =>\n `${origin(req)}/s/${cellId(ref)}`;\n const resultsUrlFor = (req: Request, ...parts: string[]) =>\n `${origin(req)}/results/${parts.join('/')}`;\n\n /**\n * Path segments of a captured route tail. A trailing slash (`/s//`,\n * `/results///`) is not a segment: without this it would read\n * as an empty revision or scenario name and 404.\n */\n function segmentsOf(tail: string): string[] {\n // A loop, not /\\/+$/: that regex backtracks polynomially on\n // request-controlled input (CodeQL js/polynomial-redos).\n while (tail.endsWith('/')) tail = tail.slice(0, -1);\n return tail.split('/');\n }\n\n /**\n * Longest registered scenario name that prefixes `segments` (names may\n * contain '/'), plus whatever follows it as a path suffix ('' if nothing).\n * Matches every registered client scenario, not only startable ones, so a\n * cell that cannot start still answers with its reason.\n */\n function resolveScenario(\n segments: string[]\n ): { scenarioName: string; suffix: string } | undefined {\n for (let i = segments.length; i >= 1; i--) {\n const candidate = segments.slice(0, i).join('/');\n if (scenarios.has(candidate)) {\n return {\n scenarioName: candidate,\n suffix: i < segments.length ? '/' + segments.slice(i).join('/') : ''\n };\n }\n }\n return undefined;\n }\n\n interface ResolvedCell {\n ref: CellRef;\n cell: MatrixCell;\n suffix: string;\n }\n\n /**\n * Resolve `[, , , ]` to a startable\n * cell, or answer the request with why it isn't one and return undefined.\n */\n function resolveCell(\n segments: string[],\n res: Response\n ): ResolvedCell | undefined {\n const [runId, revision, ...rest] = segments;\n if (!RUN_ID_RE.test(runId ?? '')) {\n res.status(400).json({ error: 'invalid run-id' });\n return undefined;\n }\n if (!revisions.includes(revision ?? '')) {\n res\n .status(404)\n .json({ error: `unknown revision '${revision ?? ''}'`, revisions });\n return undefined;\n }\n const resolved = resolveScenario(rest);\n if (!resolved) {\n res.status(404).json({ error: `unknown scenario '${rest.join('/')}'` });\n return undefined;\n }\n const cell = matrix.cell(resolved.scenarioName, revision)!;\n if (!checkStartable(cell, res)) return undefined;\n return {\n ref: {\n runId,\n revision: revision as SpecVersion,\n scenarioName: resolved.scenarioName\n },\n cell,\n suffix: resolved.suffix\n };\n }\n\n /** 404 for n/a cells, 501 for cells this deployment cannot start. */\n function checkStartable(cell: MatrixCell, res: Response): boolean {\n if (cell.scoring === 'n/a') {\n res.status(404).json({\n error: `scenario '${cell.scenario}' does not apply to ${cell.revision}: ${cell.reason}`,\n scenario: cell.scenario,\n revision: cell.revision,\n scoring: cell.scoring,\n reason: cell.reason\n });\n return false;\n }\n if (!cell.startable) {\n res.status(501).json({\n error: `scenario '${cell.scenario}' at ${cell.revision} cannot be started here: ${cell.startReason}`,\n scenario: cell.scenario,\n revision: cell.revision,\n scoring: cell.scoring,\n reason: cell.startReason\n });\n return false;\n }\n return true;\n }\n\n /**\n * The cell, hydrated from the store when this process has never seen it\n * (see SessionManager.acquire) — a request must not be dispatched before\n * the scenario knows the run's history.\n */\n async function createRun(\n req: Request,\n ref: CellRef,\n res: Response\n ): Promise {\n try {\n return await sessions.acquire(ref, (r) => cellBaseUrl(req, r));\n } catch (e) {\n if (e instanceof UnknownScenarioError) {\n res.status(404).json({ error: e.message });\n return undefined;\n }\n if (e instanceof NotHostableError) {\n res.status(501).json({ error: e.message });\n return undefined;\n }\n throw e;\n }\n }\n\n /**\n * The path the scenario sees for a request at ``: the\n * suffix, except that `/mcp` on a scenario serving MCP at its root is the\n * root — every cell is reachable at `/mcp` (see MCP_PATH).\n */\n function scenarioPath(run: HostedRun, suffix: string): string {\n if (suffix === MCP_PATH && !run.mcpPath) return '';\n return suffix;\n }\n\n /** Whether `rewrittenUrl` (path, maybe a query) is the cell's MCP endpoint. */\n function isMcpEndpoint(run: HostedRun, rewrittenUrl: string): boolean {\n const q = rewrittenUrl.indexOf('?');\n const path = q === -1 ? rewrittenUrl : rewrittenUrl.slice(0, q);\n return path === (run.mcpPath || '/');\n }\n\n /**\n * What a dated cell has told its client about revisions, in arrival order:\n * `arrivals` numbers requests as they reach dispatch(), and an answer is\n * stamped with the number of the last request that had arrived when it went\n * out, so a request numbered above it was sent after the client had it\n * (parallel requests sent before the answer are still probes). Kept per\n * process: on a multi-process host a request that lands where the answer\n * was not seen is judged as a probe — noted, never failed.\n */\n interface RevisionAnswers {\n /** An `initialize` was accepted: every revision has had its answer. */\n initialized?: number;\n /** The cell's first version answer to each foreign revision. */\n refused: Map;\n /** The modern probe recorded per foreign revision. */\n probes: Map;\n }\n let arrivals = 0;\n const revisionAnswers = new WeakMap();\n function answersOf(run: HostedRun): RevisionAnswers {\n let told = revisionAnswers.get(run);\n if (!told) {\n told = { refused: new Map(), probes: new Map() };\n revisionAnswers.set(run, told);\n }\n return told;\n }\n\n /**\n * Note a modern probe (isModernProbe()) once per header version. A probe\n * an auth cell met with 401 is repeated after sign-in and then draws the\n * cell's version answer, which is what the note should report: the first\n * note is updated in place when that answer arrives.\n */\n function noteModernProbe(\n run: HostedRun,\n told: RevisionAnswers,\n method: string | undefined,\n headerVersion: string,\n response: CapturedResponse,\n respondedAt: number\n ): void {\n const answer = versionAnswer(run.revision, headerVersion, response);\n if (answer && !told.refused.has(headerVersion))\n told.refused.set(headerVersion, respondedAt);\n const check = modernProbeCheck(\n run.revision,\n method,\n headerVersion,\n answer ?? refusalOf(response)\n );\n const seen = told.probes.get(headerVersion);\n if (!seen) {\n told.probes.set(headerVersion, { check, answered: !!answer });\n sessions.recordHostedCheck(run, `modern-probe:${headerVersion}`, check);\n } else if (answer && !seen.answered) {\n seen.check.description = check.description;\n seen.check.details = check.details;\n seen.answered = true;\n }\n }\n\n /**\n * Dispatch (req, res) to `listener` after rewriting `req.url` so the\n * scenario sees the path it would have under start()/stop() — i.e. with\n * the cell prefix stripped and (for well-known dispatch) the well-known\n * prefix re-prepended.\n *\n * `mcp` says the request is to the cell's MCP endpoint (not a PRM,\n * canary or aux path): only those are judged for wire rejections and\n * revision discipline (see ./wire.ts).\n */\n function dispatch(\n run: HostedRun,\n listener: (req: Request, res: Response) => void,\n req: Request,\n res: Response,\n rewrittenUrl: string,\n mcp = false\n ) {\n res.setHeader(\n 'link',\n `<${resultsUrlFor(req, run.id)}>; rel=\"conformance-results\"`\n );\n req.url = rewrittenUrl;\n run.touched = true;\n\n // The headers as the client sent them: a scenario may rewrite them\n // before handing the request on (json-schema-ref-deref maps the draft\n // header to the SDK's), and identity is what the client said.\n const headers = { ...req.headers };\n const headerVersion = req.header('mcp-protocol-version');\n const arrival = ++arrivals;\n let respondedAt = arrival;\n let request: RequestInfo | undefined;\n let body: Buffer | undefined;\n let response: CapturedResponse | undefined;\n let judged = false;\n\n // Write this process's view through once the scenario has answered\n // (hosted scenarios record their checks before calling end()).\n // Serverless entry points should await sessions.flush() before\n // returning the response so this write isn't abandoned.\n const persist = () => {\n if (sessions.store) void sessions.persist(run);\n };\n\n /** Once the request is parsed and the response is out, judge both. */\n const judge = (): boolean => {\n if (judged || !request || !response) return false;\n judged = true;\n const told = mcp ? answersOf(run) : undefined;\n // Whether the cell had already answered this request's header before\n // the client sent it (an accepted initialize, or a version answer to\n // the same foreign revision).\n const answeredAt = Math.min(\n told?.initialized ?? Infinity,\n (headerVersion === undefined\n ? undefined\n : told?.refused.get(headerVersion)) ?? Infinity\n );\n // A foreign-revision request a dated cell turned away before it had\n // answered is the client negotiating (it falls back to `initialize`):\n // noted, and neither judgement.\n if (\n told &&\n headerVersion !== undefined &&\n isModernProbe(\n run.revision,\n request,\n headerVersion,\n response,\n arrival > answeredAt\n )\n ) {\n noteModernProbe(\n run,\n told,\n request.methods[0],\n headerVersion,\n response,\n respondedAt\n );\n } else if (mcp) {\n const rejection = wireRejection(response, run.revision, headerVersion);\n // One mistake, one check: a wrong-revision request the wire also\n // turned away records the revision, with the rejection folded in.\n let explained = false;\n for (const method of request.methods) {\n // An initialize on the stateless wire is era detection (see\n // isLegacyProbe()): noted, never failed, and it explains the\n // rejection it may have drawn.\n if (isLegacyProbe(run.revision, method)) {\n explained = true;\n // Looked up without the header: a -32022 to an initialize that\n // happened to name the cell's revision is still the answer.\n sessions.recordHostedCheck(\n run,\n `probe:${headerVersion ?? ''}`,\n legacyProbeCheck(\n run.revision,\n headerVersion,\n wireRejection(response, run.revision, undefined),\n request.bodyVersion\n )\n );\n continue;\n }\n const reason = wrongRevision(run.revision, method, headerVersion);\n if (!reason) continue;\n explained = explained || rejection !== undefined;\n sessions.recordHostedCheck(\n run,\n `revision:${method}:${headerVersion ?? ''}`,\n wrongRevisionCheck(\n run.revision,\n method,\n headerVersion,\n reason,\n rejection\n )\n );\n }\n if (rejection && !explained) {\n sessions.recordHostedCheck(\n run,\n `rejected:${rejection.code}:${rejection.message}`,\n wireRejectedCheck(rejection, request, headerVersion)\n );\n }\n }\n if (told && isAcceptedInitialize(request, response)) {\n told.initialized ??= respondedAt;\n // Asked for another revision, told the cell's (pinInitializeVersion()).\n const asked = request.bodyVersion;\n if (isStatefulVersion(run.revision) && asked && asked !== run.revision)\n sessions.recordHostedCheck(\n run,\n `offered:${asked}`,\n versionOfferedCheck(run.revision, asked, answeredVersion(response))\n );\n }\n // Who the client is, from accepted exchanges only.\n const identity = identityFrom(headers, body, response);\n if (identity) sessions.recordIdentity(run, identity);\n return true;\n };\n\n onBodySettled(req, (captured) => {\n body = captured;\n request = describeRequest(captured);\n // The response is already out: what judge() recorded needs its own\n // write-through.\n if (judge() && response) persist();\n });\n tapResponse(res, (captured) => {\n response = captured;\n respondedAt = arrivals;\n judge();\n persist();\n });\n // Outside the tap, so what is judged is what the client was told.\n if (mcp && req.method === 'POST' && isStatefulVersion(run.revision)) {\n pinInitializeVersion(\n res,\n run.revision,\n () => request?.methods.includes('initialize') ?? false\n );\n }\n\n // Every cell on the stateless wire answers a legacy initialize the same\n // way, before the scenario sees it (see legacyInitializeReply()). Not an\n // auth cell: its resource server must answer 401 before it looks at the\n // protocol, and after sign-in it gives the same -32022 itself\n // (auth/helpers/createServer.ts). Raw node calls: a composite's replayed\n // request has no express helpers.\n const sendJson = (status: number, body: unknown) => {\n res.statusCode = status;\n res.setHeader('content-type', 'application/json');\n res.end(JSON.stringify(body));\n };\n // An express scenario with no route for the request calls this instead\n // of answering with Express's HTML 404 (a raw listener ignores it). On\n // the MCP endpoint that is a GET the scenario serves no stream for —\n // VS Code sends one after a 400, as its old HTTP+SSE fallback — so it\n // gets the SDK transport's 405, and the cell notes it.\n const fallthrough = (err?: unknown) => {\n if (res.headersSent) return;\n if (err) {\n sendJson(500, {\n jsonrpc: '2.0',\n id: null,\n error: { code: -32603, message: 'Internal error' }\n });\n return;\n }\n if (mcp && req.method === 'GET') {\n sessions.recordHostedCheck(\n run,\n 'get-on-mcp',\n getOnMcpCheck(run.revision)\n );\n res.setHeader('allow', 'POST');\n sendJson(405, GET_ON_MCP_REPLY);\n return;\n }\n sendJson(404, { error: `Cannot ${req.method} ${req.url}` });\n };\n const handOn = () =>\n (\n listener as (\n req: Request,\n res: Response,\n next: (err?: unknown) => void\n ) => void\n )(req, res, fallthrough);\n\n if (\n mcp &&\n req.method === 'POST' &&\n !isStatefulVersion(run.revision) &&\n !run.auxListeners &&\n bodyFitsBuffer(req)\n ) {\n onBodySettled(req, (captured) => {\n const reply = legacyInitializeReply(\n run.revision,\n captured,\n headerVersion\n );\n if (reply) sendJson(reply.status, reply.body);\n else handOn();\n });\n return;\n }\n handOn();\n }\n\n // ---------- representation ----------\n\n /** `?format=` wins; otherwise the Accept header decides (JSON by default). */\n function wantsHtml(req: Request): boolean {\n const format = req.query.format;\n if (format === 'html') return true;\n if (format === 'json') return false;\n return req.accepts(['json', 'html']) === 'html';\n }\n\n /**\n * A GET at a cell URL is a page/config request when it accepts text/html\n * (and not the MCP SSE stream) or spells out `?format=`; anything else is\n * the client under test talking to the scenario.\n */\n function isPageRequest(req: Request): boolean {\n if (req.method !== 'GET') return false;\n if (typeof req.query.format === 'string') return true;\n const accept = req.header('accept') ?? '';\n return (\n accept.includes('text/html') && !accept.includes('text/event-stream')\n );\n }\n\n // ---------- config ----------\n\n function cellConfig(\n req: Request,\n run: HostedRun,\n cell: MatrixCell\n ): CellConfig {\n const context = run.context\n ? JSON.stringify({ name: run.scenarioName, ...run.context })\n : undefined;\n return {\n scenario: run.scenarioName,\n revision: run.revision,\n url: `${cellBaseUrl(req, run)}${run.mcpPath || MCP_PATH}`,\n resultsUrl: resultsUrlFor(req, run.id),\n scoring: cell.scoring,\n ...(cell.reason !== undefined && { reason: cell.reason }),\n ...(cell.steps && { steps: cell.steps }),\n env: {\n MCP_CONFORMANCE_SCENARIO: run.scenarioName,\n MCP_CONFORMANCE_PROTOCOL_VERSION: run.revision,\n ...(context !== undefined && { MCP_CONFORMANCE_CONTEXT: context })\n }\n };\n }\n\n /** Config for every startable cell in scope; creates the cells. */\n function runConfig(\n req: Request,\n runId: string,\n scope: { revision?: SpecVersion; scenario?: string }\n ): RunConfig {\n const cells = matrix\n .cells()\n .filter(\n (c) =>\n c.startable &&\n (scope.revision === undefined || c.revision === scope.revision) &&\n (scope.scenario === undefined || c.scenario === scope.scenario)\n )\n .map((c) => {\n const run = sessions.getOrCreate(\n { runId, revision: c.revision, scenarioName: c.scenario },\n (r) => cellBaseUrl(req, r)\n );\n return cellConfig(req, run, c);\n });\n const parts = [runId];\n if (scope.revision) parts.push(scope.revision);\n if (scope.revision && scope.scenario) parts.push(scope.scenario);\n return {\n runId,\n ...(scope.revision && { revision: scope.revision }),\n ...(scope.scenario && { scenario: scope.scenario }),\n resultsUrl: resultsUrlFor(req, ...parts),\n mcpServers: Object.fromEntries(\n cells.map((c) => [\n `${c.revision}/${c.scenario}`,\n { type: 'http' as const, url: c.url }\n ])\n ),\n cells\n };\n }\n\n function sendConfig(req: Request, res: Response, config: RunConfig): void {\n if (wantsHtml(req)) {\n res.type('html').send(renderConfig(origin(req), matrix, config));\n } else {\n res.json(config);\n }\n }\n\n // ---------- discovery ----------\n\n app.get('/', (req, res) => {\n res.type('html').send(renderLanding(origin(req), matrix));\n });\n\n app.get('/scenarios', (_req, res) => {\n res.json(\n matrix.rows.map((row) => ({\n name: row.scenario,\n description: row.description,\n source: row.source,\n mcpPath: row.cells[0]?.mcpPath ?? MCP_PATH,\n ...(row.cells[0]?.steps && { steps: row.cells[0].steps }),\n cells: row.cells.map(\n ({ revision, scoring, reason, startable, startReason }) => ({\n revision,\n scoring,\n ...(reason !== undefined && { reason }),\n startable,\n ...(startReason !== undefined && { startReason })\n })\n )\n }))\n );\n });\n\n // ---------- runs ----------\n\n app.get('/s', (_req, res) => {\n res.redirect(303, `/s/${mintRunId()}`);\n });\n\n // We can't pre-register an express route per cell because run-ids are\n // open-ended and scenario names contain '/'. A single catch-all resolves\n // the cell, rewrites req.url to strip the /s///\n // prefix, and hands off to the cell's listener — exactly what\n // app.use(prefix, fn) would do, but with a dynamic prefix.\n const composite = createCompositeRoute({\n matrix,\n createRun,\n dispatch,\n cellBaseUrl,\n resultsUrlFor,\n isPageRequest,\n wantsHtml\n });\n\n app.all(/^\\/s\\/(.+)$/, async (req, res) => {\n const segments = segmentsOf(req.params[0]);\n const [runId, revision] = segments;\n\n // Several scenarios' cells behind one URL, `+` (see ./composite.ts).\n const tail = segments.slice(2).join('/');\n const spec = tail.endsWith(MCP_PATH)\n ? tail.slice(0, -MCP_PATH.length)\n : tail;\n const children = segments.length > 2 ? parseComposite(spec) : undefined;\n if (children) {\n if (!RUN_ID_RE.test(runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n if (!revisions.includes(revision)) {\n res\n .status(404)\n .json({ error: `unknown revision '${revision}'`, revisions });\n return;\n }\n await composite(\n req,\n res,\n runId,\n revision as SpecVersion,\n children,\n spec === tail ? '' : MCP_PATH\n );\n return;\n }\n\n if (segments.length <= 2) {\n // Run or column scope: config only.\n if (!RUN_ID_RE.test(runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n if (segments.length === 2 && !revisions.includes(revision)) {\n res\n .status(404)\n .json({ error: `unknown revision '${revision}'`, revisions });\n return;\n }\n if (req.method !== 'GET') {\n res.status(405).json({\n error:\n 'MCP endpoints live at /s///; GET here for the config.'\n });\n return;\n }\n sendConfig(\n req,\n res,\n runConfig(req, runId, {\n revision:\n segments.length === 2 ? (revision as SpecVersion) : undefined\n })\n );\n return;\n }\n\n const resolved = resolveCell(segments, res);\n if (!resolved) return;\n const { ref, suffix } = resolved;\n\n // A browser opening the MCP URL itself is sent to the cell's page.\n if (suffix === MCP_PATH && isPageRequest(req)) {\n const q = req.originalUrl.indexOf('?');\n const page = cellBaseUrl(req, ref);\n res.redirect(303, q === -1 ? page : page + req.originalUrl.slice(q));\n return;\n }\n\n if (suffix === '' && isPageRequest(req)) {\n sendConfig(\n req,\n res,\n runConfig(req, ref.runId, {\n revision: ref.revision,\n scenario: ref.scenarioName\n })\n );\n return;\n }\n\n const run = await createRun(req, ref, res);\n if (!run) return;\n // Rewrite to the path the scenario expects (it thinks it's at root).\n // The query string is preserved because we keep the express req object.\n const rewritten = scenarioPath(run, suffix) || run.mcpPath || '/';\n dispatch(\n run,\n run.listener,\n req,\n res,\n rewritten,\n isMcpEndpoint(run, rewritten)\n );\n });\n\n // ---------- root well-known dispatch (RS side) ----------\n //\n // RFC 9728: a client given MCP URL /s//mcp derives the PRM\n // URL as /.well-known/oauth-protected-resource/s//mcp — i.e.\n // at the *origin root*, not under the cell prefix. We catch that here,\n // recover the cell from the path suffix, and re-dispatch to its RS handler\n // with the path it would have seen on its own origin.\n //\n // Requests that arrive *under* the cell prefix (because the WWW-Authenticate\n // header points there) already work via the /s/* mount above.\n\n app.get(\n /^\\/\\.well-known\\/oauth-protected-resource\\/s\\/(.+)$/,\n async (req, res) => {\n const resolved = resolveCell(req.params[0].split('/'), res);\n if (!resolved) return;\n const run = await createRun(req, resolved.ref, res);\n if (!run) return;\n // Scenario expects e.g. '/.well-known/oauth-protected-resource/mcp'\n // (or the bare well-known path when its MCP endpoint is its root).\n dispatch(\n run,\n run.listener,\n req,\n res,\n '/.well-known/oauth-protected-resource' +\n scenarioPath(run, resolved.suffix)\n );\n }\n );\n\n // ---------- aux-origin backchannel (relay target) ----------\n //\n // The AS relay (examples/hosted/valtown-relay.ts) forwards every request it\n // receives to /__aux/. The per-cell AS issuer is\n // /r///, so every path the client hits\n // — endpoints (/r//authorize) and RFC 8414 well-known\n // (/.well-known/oauth-authorization-server/r/[/tenant]) — carries\n // `/r/` somewhere in it. We locate it, strip it, and dispatch to the\n // cell's aux handler so it sees exactly the path createAuthServer\n // registered.\n //\n // Guarded by a shared secret so this internal mount can't be hit directly\n // to forge checks into someone else's run.\n\n if (haveAux.length) {\n const secret = opts.relaySecret ?? process.env.CONFORMANCE_RELAY_SECRET;\n const guard = (req: Request, res: Response): boolean => {\n const got = req.header('x-relay-secret') ?? '';\n // Constant-time compare; mismatch length → fast 403 is fine.\n const ok =\n !!secret &&\n got.length === secret.length &&\n timingSafeEqual(Buffer.from(got), Buffer.from(secret));\n if (!ok) {\n res\n .status(403)\n .json({ error: 'forbidden: /__aux is the relay backchannel' });\n }\n return ok;\n };\n\n /**\n * Find the first `/r///` in `segments` (plain\n * segment scan — a regex over the whole path would backtrack\n * polynomially on adversarial input) and split the path around it.\n */\n function locateCell(\n segments: string[]\n ): { prefix: string; ref: CellRef; suffix: string } | undefined {\n for (let i = 1; i < segments.length - 2; i++) {\n if (\n segments[i] !== 'r' ||\n !RUN_ID_RE.test(segments[i + 1]) ||\n !revisions.includes(segments[i + 2])\n ) {\n continue;\n }\n const resolved = resolveScenario(segments.slice(i + 3));\n if (!resolved) continue;\n return {\n prefix: segments.slice(0, i).join('/'),\n ref: {\n runId: segments[i + 1],\n revision: segments[i + 2] as SpecVersion,\n scenarioName: resolved.scenarioName\n },\n suffix: resolved.suffix\n };\n }\n return undefined;\n }\n\n app.all(/^\\/__aux\\/([a-z0-9]+)(\\/.*)$/, async (req, res) => {\n if (!guard(req, res)) return;\n const role = req.params[0] as AuxOriginRole;\n const path = req.params[1];\n if (!AUX_ROLES.includes(role)) {\n res.status(404).json({ error: `unknown aux role '${role}'` });\n return;\n }\n\n const located = locateCell(path.split('/')); // path starts with '/', so [0] === ''\n if (!located) {\n res.status(404).json({\n error:\n 'aux request path missing /r/// segment'\n });\n return;\n }\n const { prefix, ref, suffix } = located;\n const cell = matrix.cell(ref.scenarioName, ref.revision)!;\n if (!checkStartable(cell, res)) return;\n const search = req.url.includes('?')\n ? req.url.slice(req.url.indexOf('?'))\n : '';\n\n // On a multi-process host this may be the first request this process\n // sees for the cell; the id carries everything needed to rebuild it.\n const run = sessions.ensure(cellId(ref), (r) => cellBaseUrl(req, r));\n const listener = run?.auxListeners?.[role];\n if (!run || !listener) {\n res.status(404).json({ error: `no aux '${role}' handler for cell` });\n return;\n }\n await sessions.hydrate(run);\n dispatch(run, listener, req, res, (prefix + suffix || '/') + search);\n });\n }\n\n // ---------- results ----------\n\n app.get(/^\\/results\\/(.+)$/, async (req, res) => {\n const segments = segmentsOf(req.params[0]);\n const [runId, revision, ...rest] = segments;\n if (!RUN_ID_RE.test(runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n // A frozen report: /results//snapshot/.\n if (revision === 'snapshot') {\n const [snapshotId] = rest;\n let body: string | undefined;\n if (segments.length === 3 && SNAPSHOT_ID_RE.test(snapshotId)) {\n try {\n body = await snapshots.loadSnapshot(runId, snapshotId);\n } catch (e) {\n console.error(\n '[hosted] snapshot:',\n e instanceof Error ? e.message : e\n );\n res\n .status(503)\n .json({ error: 'could not read the snapshot; try again' });\n return;\n }\n }\n if (body === undefined) {\n res.status(404).json({\n error: `no snapshot '${rest.join('/')}' for run '${runId}'`\n });\n return;\n }\n sendReport(req, res, relink(req, JSON.parse(body) as RunReport));\n return;\n }\n\n if (segments.length >= 2 && !revisions.includes(revision)) {\n res\n .status(404)\n .json({ error: `unknown revision '${revision}'`, revisions });\n return;\n }\n\n if (segments.length >= 3) {\n const resolved = resolveScenario(rest);\n if (!resolved || resolved.suffix !== '') {\n res.status(404).json({ error: `unknown scenario '${rest.join('/')}'` });\n return;\n }\n const ref: CellRef = {\n runId,\n revision: revision as SpecVersion,\n scenarioName: resolved.scenarioName\n };\n const cell = matrix.cell(resolved.scenarioName, ref.revision)!;\n // A cell nobody has hit yet is a valid, incomplete cell — not an\n // unknown run: the config page links here before any traffic.\n const r =\n cell.scoring === 'n/a'\n ? undefined\n : await sessions.results(cellId(ref));\n const status = cellStatus(cell, r);\n if (wantsHtml(req)) {\n res.type('html').send(renderResults(ref, r?.checks ?? [], status));\n } else {\n res.json({ ...summarise(ref, r?.checks ?? []), ...status });\n }\n return;\n }\n\n // Run or column scope: a verdict per cell of the matrix.\n const scope = segments.length === 2 ? (revision as SpecVersion) : undefined;\n const report = await buildReport(matrix, runId, scope, reportSources(req));\n // The live page lists the run's frozen copies; nothing else needs them.\n const frozen =\n reportFormat(req) === 'html'\n ? await snapshots.listSnapshots(runId).catch(() => [])\n : undefined;\n sendReport(req, res, report, frozen);\n });\n\n // Freeze the run's report as it stands now: a permalink later traffic\n // cannot change, for an issue or a chat. The whole run, whichever page\n // asked. No protection beyond the run id itself, like the rest of a run.\n app.post('/results/:runId/freeze', async (req, res) => {\n const { runId } = req.params;\n if (!RUN_ID_RE.test(runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n const report = await buildReport(\n matrix,\n runId,\n undefined,\n reportSources(req)\n );\n const snapshotId = mintId(8);\n const frozen: RunReport = {\n ...report,\n snapshotId,\n frozenAt: report.generatedAt\n };\n try {\n await snapshots.saveSnapshot(runId, snapshotId, JSON.stringify(frozen));\n } catch (e) {\n console.error('[hosted] snapshot:', e instanceof Error ? e.message : e);\n res.status(503).json({ error: 'could not save the snapshot; try again' });\n return;\n }\n const url = resultsUrlFor(req, runId, 'snapshot', snapshotId);\n if (wantsHtml(req)) {\n res.redirect(303, `/results/${runId}/snapshot/${snapshotId}`);\n return;\n }\n res\n .status(201)\n .location(url)\n .json({\n runId,\n snapshotId,\n frozenAt: frozen.frozenAt,\n url,\n markdownUrl: `${url}?format=md`\n });\n });\n\n app.delete('/results/:runId', async (req, res) => {\n if (!RUN_ID_RE.test(req.params.runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n await sessions.destroyRun(req.params.runId);\n await snapshots.deleteSnapshots(req.params.runId).catch((e) => {\n console.error('[hosted] snapshot:', e instanceof Error ? e.message : e);\n });\n res.status(204).end();\n });\n\n function reportSources(req: Request): ReportSources {\n return {\n listCells: (id) => sessions.listCells(id),\n results: (id) => sessions.results(id),\n resultsUrl: (ref) => resultsUrlFor(req, cellId(ref))\n };\n }\n\n /** `?format=md` (or `markdown`) is the report as Markdown. */\n function reportFormat(req: Request): 'html' | 'json' | 'md' {\n const format = req.query.format;\n if (format === 'md' || format === 'markdown') return 'md';\n return wantsHtml(req) ? 'html' : 'json';\n }\n\n /**\n * A stored report's cell links, rebuilt for this request: a snapshot\n * keeps what the run said, not the host name it was frozen through.\n */\n function relink(req: Request, report: RunReport): RunReport {\n for (const col of report.columns) {\n for (const c of [...col.cells, ...col.notScored]) {\n c.resultsUrl = resultsUrlFor(req, report.runId, c.revision, c.scenario);\n }\n }\n return report;\n }\n\n function sendReport(\n req: Request,\n res: Response,\n report: RunReport,\n frozen?: SnapshotInfo[]\n ): void {\n const live = report.snapshotId\n ? resultsUrlFor(req, report.runId)\n : resultsUrlFor(\n req,\n report.runId,\n ...(report.revision ? [report.revision] : [])\n );\n const snapshot = report.snapshotId\n ? resultsUrlFor(req, report.runId, 'snapshot', report.snapshotId)\n : undefined;\n const markdown = reportMarkdown(report, {\n live,\n ...(snapshot && { snapshot })\n });\n switch (reportFormat(req)) {\n case 'md':\n res.set('content-type', 'text/markdown; charset=utf-8').send(markdown);\n return;\n case 'html':\n res.type('html').send(\n renderReport(matrix, report, {\n markdown,\n liveUrl: live,\n ...(frozen && { snapshots: frozen })\n })\n );\n return;\n default:\n res.json(report);\n }\n }\n\n return { app, sessions, matrix };\n}\n\nexport function summarise(ref: CellRef, checks: ConformanceCheck[]) {\n return {\n runId: ref.runId,\n revision: ref.revision,\n scenario: ref.scenarioName,\n summary: summarize(checks),\n checks\n };\n}\n\n/** What a cell's results say about the cell itself, next to its checks. */\nexport interface CellStatus {\n scoring: MatrixCell['scoring'];\n verdict: Verdict;\n /** Where the cell stands, finer than the verdict (see CellState). */\n state: CellState;\n /**\n * On a startable incomplete cell: why, in plain words — nothing recorded\n * yet, or the checks listed are only what the scenario still expects.\n */\n note?: string;\n /** For n/a (why the scenario does not apply) and not_scored/unlisted. */\n reason?: string;\n /** Present, false, when this deployment cannot start the cell. */\n startable?: false;\n startReason?: string;\n}\n\nexport function cellStatus(\n cell: MatrixCell,\n results: Pick | undefined\n): CellStatus {\n const verdict = verdictFor(cell, results?.checks, results?.recorded);\n return {\n scoring: cell.scoring,\n verdict,\n state: stateOf(cell, verdict, results?.checks),\n ...(verdict === 'incomplete' &&\n cell.startable && { note: incompleteNote(results?.checks ?? []) }),\n ...(cell.reason !== undefined && { reason: cell.reason }),\n ...(!cell.startable &&\n cell.scoring !== 'n/a' && {\n startable: false as const,\n ...(cell.startReason !== undefined && { startReason: cell.startReason })\n })\n };\n}\n","createdAt",["D",1789336628400],"branchVersion","branchId","fdc11199-683b-41f1-a3c5-d5ac53972f86","id","7dcb6042-d92f-40c5-9cc8-0f661f96e58b","mcp-client-conformance",["D",1789043604380],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","e6dd13e2-ad13-11f1-a612-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a07c12-b73a-76de-b96a-421ce8582af6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_104":-5},"org",{"_97":96,"_98":99,"_100":-5,"_18":-5,"_101":102,"_103":25},"branch",{"_13":86,"_32":87,"_44":43,"_88":45,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":46,"_95":96},"isOwned",396,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","mcpconformance","handle","displayName","MCP Conformance","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_32":46,"_39":1433,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":-5,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":-5,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":1434,"_81":1435,"_83":1436,"_85":25},"tree",[165,171,312],"files",[165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312],"counts",{"_154":63,"_155":151,"_156":63,"_157":158,"_159":160},"contents",[127,128,129],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":148,"_32":149,"_30":150,"_132":-5,"_42":43,"_41":151,"_134":59,"_39":152,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_27":153},{"_44":141,"_32":142,"_30":143,"_132":-5,"_42":43,"_41":144,"_134":59,"_39":145,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_27":147},{"_44":130,"_32":131,"_30":57,"_132":-5,"_42":43,"_41":133,"_134":59,"_39":135,"_13":63,"_34":136,"_36":137,"_24":25,"_138":139,"_27":140},"64361614-7826-4a98-8614-decbe5274dec","http.ts","parentId",63,"latest",["D",1789043641384],"http","export { default } from './examples/hosted/valtown.ts';\n","label","mcp-c9e-v1",[131],"5cce0b27-033f-470a-b737-03d5f9e5ce82","src","8ad4b564-52ff-48ed-87b5-c87084c02333",4,["D",1789043608031],"directory",[142],"1d9db0bc-0dd8-4297-a685-a96b8a23c76f","examples","00fb2c2e-dc3c-4b18-bbc1-2fdd7ae726cf",1,["D",1789043605188],[149],"pulls","branches","forks","envVars",{"_161":163,"_164":63},"connections",{"_161":63,"_162":63},"count","unfilledCount",2,"emptyCount",{"_44":148,"_32":149,"_30":150,"_132":-5,"_42":43,"_41":151,"_134":59,"_39":1430,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1431,"_27":1432},{"_44":1426,"_32":1229,"_30":1396,"_132":150,"_42":43,"_41":151,"_134":59,"_39":1427,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1428,"_27":1429},{"_44":1418,"_32":1419,"_30":1420,"_132":1396,"_42":43,"_41":1421,"_134":25,"_39":1422,"_13":151,"_34":35,"_36":1423,"_24":25,"_138":-5,"_314":1424,"_27":1425},{"_44":1410,"_32":1411,"_30":1412,"_132":1396,"_42":43,"_41":1413,"_134":59,"_39":1414,"_13":63,"_34":35,"_36":1415,"_24":25,"_138":-5,"_314":1416,"_27":1417},{"_44":1402,"_32":1403,"_30":1404,"_132":1396,"_42":43,"_41":1405,"_134":25,"_39":1406,"_13":163,"_34":35,"_36":1407,"_24":25,"_138":-5,"_314":1408,"_27":1409},{"_44":1393,"_32":1394,"_30":1395,"_132":1396,"_42":43,"_41":1397,"_134":25,"_39":1398,"_13":163,"_34":35,"_36":1399,"_24":25,"_138":-5,"_314":1400,"_27":1401},{"_44":141,"_32":142,"_30":143,"_132":-5,"_42":43,"_41":144,"_134":59,"_39":1390,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1391,"_27":1392},{"_44":1386,"_32":1369,"_30":1363,"_132":143,"_42":43,"_41":1364,"_134":59,"_39":1387,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1388,"_27":1389},{"_44":1378,"_32":1379,"_30":1380,"_132":1363,"_42":43,"_41":1381,"_134":59,"_39":1382,"_13":63,"_34":35,"_36":1383,"_24":25,"_138":-5,"_314":1384,"_27":1385},{"_44":1370,"_32":1371,"_30":1372,"_132":1363,"_42":43,"_41":1373,"_134":25,"_39":1374,"_13":63,"_34":35,"_36":1375,"_24":25,"_138":-5,"_314":1376,"_27":1377},{"_44":1361,"_32":357,"_30":1362,"_132":1363,"_42":43,"_41":1364,"_134":59,"_39":1365,"_13":63,"_34":35,"_36":1366,"_24":25,"_138":-5,"_314":1367,"_27":1368},{"_44":1357,"_32":1327,"_30":1321,"_132":143,"_42":43,"_41":1352,"_134":59,"_39":1358,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1359,"_27":1360},{"_44":1350,"_32":357,"_30":1351,"_132":1321,"_42":43,"_41":1352,"_134":59,"_39":1353,"_13":63,"_34":35,"_36":1354,"_24":25,"_138":-5,"_314":1355,"_27":1356},{"_44":1342,"_32":1343,"_30":1344,"_132":1321,"_42":43,"_41":1345,"_134":59,"_39":1346,"_13":63,"_34":35,"_36":1347,"_24":25,"_138":-5,"_314":1348,"_27":1349},{"_44":1335,"_32":1202,"_30":1336,"_132":1321,"_42":43,"_41":1337,"_134":25,"_39":1338,"_13":63,"_34":35,"_36":1339,"_24":25,"_138":-5,"_314":1340,"_27":1341},{"_44":1328,"_32":1194,"_30":1329,"_132":1321,"_42":43,"_41":1330,"_134":59,"_39":1331,"_13":63,"_34":35,"_36":1332,"_24":25,"_138":-5,"_314":1333,"_27":1334},{"_44":1319,"_32":509,"_30":1320,"_132":1321,"_42":43,"_41":1322,"_134":59,"_39":1323,"_13":63,"_34":35,"_36":1324,"_24":25,"_138":-5,"_314":1325,"_27":1326},{"_44":1315,"_32":1229,"_30":1223,"_132":143,"_42":43,"_41":144,"_134":59,"_39":1316,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1317,"_27":1318},{"_44":1307,"_32":1308,"_30":1309,"_132":1223,"_42":43,"_41":1310,"_134":25,"_39":1311,"_13":163,"_34":35,"_36":1312,"_24":25,"_138":-5,"_314":1313,"_27":1314},{"_44":1299,"_32":1300,"_30":1301,"_132":1223,"_42":43,"_41":1302,"_134":25,"_39":1303,"_13":151,"_34":35,"_36":1304,"_24":25,"_138":-5,"_314":1305,"_27":1306},{"_44":1291,"_32":1292,"_30":1293,"_132":1223,"_42":43,"_41":1294,"_134":59,"_39":1295,"_13":151,"_34":35,"_36":1296,"_24":25,"_138":-5,"_314":1297,"_27":1298},{"_44":1283,"_32":1284,"_30":1285,"_132":1223,"_42":43,"_41":1286,"_134":25,"_39":1287,"_13":1104,"_34":35,"_36":1288,"_24":25,"_138":-5,"_314":1289,"_27":1290},{"_44":1275,"_32":1276,"_30":1277,"_132":1223,"_42":43,"_41":1278,"_134":25,"_39":1279,"_13":151,"_34":35,"_36":1280,"_24":25,"_138":-5,"_314":1281,"_27":1282},{"_44":1267,"_32":1268,"_30":1269,"_132":1223,"_42":43,"_41":1270,"_134":25,"_39":1271,"_13":163,"_34":35,"_36":1272,"_24":25,"_138":-5,"_314":1273,"_27":1274},{"_44":1259,"_32":1260,"_30":1261,"_132":1223,"_42":43,"_41":1262,"_134":59,"_39":1263,"_13":63,"_34":35,"_36":1264,"_24":25,"_138":-5,"_314":1265,"_27":1266},{"_44":1251,"_32":1252,"_30":1253,"_132":1223,"_42":43,"_41":1254,"_134":25,"_39":1255,"_13":163,"_34":35,"_36":1256,"_24":25,"_138":-5,"_314":1257,"_27":1258},{"_44":1247,"_32":33,"_30":31,"_132":1223,"_42":43,"_41":14,"_134":25,"_39":1248,"_13":367,"_34":35,"_36":38,"_24":25,"_138":-5,"_314":1249,"_27":1250},{"_44":1238,"_32":1239,"_30":1240,"_132":1223,"_42":43,"_41":1241,"_134":25,"_39":1242,"_13":1243,"_34":35,"_36":1244,"_24":25,"_138":-5,"_314":1245,"_27":1246},{"_44":1230,"_32":1231,"_30":1232,"_132":1223,"_42":43,"_41":1233,"_134":25,"_39":1234,"_13":151,"_34":35,"_36":1235,"_24":25,"_138":-5,"_314":1236,"_27":1237},{"_44":1220,"_32":1221,"_30":1222,"_132":1223,"_42":43,"_41":1224,"_134":25,"_39":1225,"_13":322,"_34":35,"_36":1226,"_24":25,"_138":-5,"_314":1227,"_27":1228},{"_44":1216,"_32":1192,"_30":1186,"_132":143,"_42":43,"_41":1211,"_134":59,"_39":1217,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1218,"_27":1219},{"_44":1209,"_32":357,"_30":1210,"_132":1186,"_42":43,"_41":1211,"_134":59,"_39":1212,"_13":63,"_34":35,"_36":1213,"_24":25,"_138":-5,"_314":1214,"_27":1215},{"_44":1201,"_32":1202,"_30":1203,"_132":1186,"_42":43,"_41":1204,"_134":25,"_39":1205,"_13":63,"_34":35,"_36":1206,"_24":25,"_138":-5,"_314":1207,"_27":1208},{"_44":1193,"_32":1194,"_30":1195,"_132":1186,"_42":43,"_41":1196,"_134":25,"_39":1197,"_13":63,"_34":35,"_36":1198,"_24":25,"_138":-5,"_314":1199,"_27":1200},{"_44":1184,"_32":509,"_30":1185,"_132":1186,"_42":43,"_41":1187,"_134":25,"_39":1188,"_13":151,"_34":35,"_36":1189,"_24":25,"_138":-5,"_314":1190,"_27":1191},{"_44":1179,"_32":474,"_30":468,"_132":143,"_42":43,"_41":1180,"_134":59,"_39":1181,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1182,"_27":1183},{"_44":1174,"_32":1140,"_30":1134,"_132":468,"_42":43,"_41":1175,"_134":59,"_39":1176,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1177,"_27":1178},{"_44":1170,"_32":929,"_30":1151,"_132":1134,"_42":43,"_41":1152,"_134":59,"_39":1171,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1172,"_27":1173},{"_44":1166,"_32":1058,"_30":1160,"_132":1151,"_42":43,"_41":1161,"_134":59,"_39":1167,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1168,"_27":1169},{"_44":1157,"_32":1158,"_30":1159,"_132":1160,"_42":43,"_41":1161,"_134":59,"_39":1162,"_13":63,"_34":35,"_36":1163,"_24":25,"_138":-5,"_314":1164,"_27":1165},{"_44":1149,"_32":939,"_30":1150,"_132":1151,"_42":43,"_41":1152,"_134":59,"_39":1153,"_13":63,"_34":35,"_36":1154,"_24":25,"_138":-5,"_314":1155,"_27":1156},{"_44":1141,"_32":1142,"_30":1143,"_132":1134,"_42":43,"_41":1144,"_134":59,"_39":1145,"_13":63,"_34":35,"_36":1146,"_24":25,"_138":-5,"_314":1147,"_27":1148},{"_44":1131,"_32":1132,"_30":1133,"_132":1134,"_42":43,"_41":1135,"_134":59,"_39":1136,"_13":151,"_34":35,"_36":1137,"_24":25,"_138":-5,"_314":1138,"_27":1139},{"_44":1126,"_32":796,"_30":790,"_132":468,"_42":43,"_41":1127,"_134":59,"_39":1128,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1129,"_27":1130},{"_44":1121,"_32":929,"_30":923,"_132":790,"_42":43,"_41":1122,"_134":59,"_39":1123,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1124,"_27":1125},{"_44":1116,"_32":1058,"_30":1052,"_132":923,"_42":43,"_41":1117,"_134":59,"_39":1118,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":1119,"_27":1120},{"_44":1108,"_32":1109,"_30":1110,"_132":1052,"_42":43,"_41":1111,"_134":25,"_39":1112,"_13":322,"_34":35,"_36":1113,"_24":25,"_138":-5,"_314":1114,"_27":1115},{"_44":1099,"_32":1100,"_30":1101,"_132":1052,"_42":43,"_41":1102,"_134":25,"_39":1103,"_13":1104,"_34":35,"_36":1105,"_24":25,"_138":-5,"_314":1106,"_27":1107},{"_44":1091,"_32":1092,"_30":1093,"_132":1052,"_42":43,"_41":1094,"_134":59,"_39":1095,"_13":63,"_34":35,"_36":1096,"_24":25,"_138":-5,"_314":1097,"_27":1098},{"_44":1083,"_32":1084,"_30":1085,"_132":1052,"_42":43,"_41":1086,"_134":59,"_39":1087,"_13":63,"_34":35,"_36":1088,"_24":25,"_138":-5,"_314":1089,"_27":1090},{"_44":1075,"_32":1076,"_30":1077,"_132":1052,"_42":43,"_41":1078,"_134":59,"_39":1079,"_13":63,"_34":35,"_36":1080,"_24":25,"_138":-5,"_314":1081,"_27":1082},{"_44":1067,"_32":1068,"_30":1069,"_132":1052,"_42":43,"_41":1070,"_134":25,"_39":1071,"_13":163,"_34":35,"_36":1072,"_24":25,"_138":-5,"_314":1073,"_27":1074},{"_44":1059,"_32":1060,"_30":1061,"_132":1052,"_42":43,"_41":1062,"_134":59,"_39":1063,"_13":151,"_34":35,"_36":1064,"_24":25,"_138":-5,"_314":1065,"_27":1066},{"_44":1049,"_32":1050,"_30":1051,"_132":1052,"_42":43,"_41":1053,"_134":59,"_39":1054,"_13":63,"_34":35,"_36":1055,"_24":25,"_138":-5,"_314":1056,"_27":1057},{"_44":1041,"_32":1042,"_30":1043,"_132":923,"_42":43,"_41":1044,"_134":25,"_39":1045,"_13":163,"_34":35,"_36":1046,"_24":25,"_138":-5,"_314":1047,"_27":1048},{"_44":1033,"_32":1034,"_30":1035,"_132":923,"_42":43,"_41":1036,"_134":25,"_39":1037,"_13":163,"_34":35,"_36":1038,"_24":25,"_138":-5,"_314":1039,"_27":1040},{"_44":1025,"_32":1026,"_30":1027,"_132":923,"_42":43,"_41":1028,"_134":59,"_39":1029,"_13":151,"_34":35,"_36":1030,"_24":25,"_138":-5,"_314":1031,"_27":1032},{"_44":1017,"_32":1018,"_30":1019,"_132":923,"_42":43,"_41":1020,"_134":25,"_39":1021,"_13":163,"_34":35,"_36":1022,"_24":25,"_138":-5,"_314":1023,"_27":1024},{"_44":1009,"_32":1010,"_30":1011,"_132":923,"_42":43,"_41":1012,"_134":59,"_39":1013,"_13":63,"_34":35,"_36":1014,"_24":25,"_138":-5,"_314":1015,"_27":1016},{"_44":1001,"_32":1002,"_30":1003,"_132":923,"_42":43,"_41":1004,"_134":59,"_39":1005,"_13":151,"_34":35,"_36":1006,"_24":25,"_138":-5,"_314":1007,"_27":1008},{"_44":994,"_32":357,"_30":995,"_132":923,"_42":43,"_41":996,"_134":59,"_39":997,"_13":151,"_34":35,"_36":998,"_24":25,"_138":-5,"_314":999,"_27":1000},{"_44":986,"_32":987,"_30":988,"_132":923,"_42":43,"_41":989,"_134":25,"_39":990,"_13":163,"_34":35,"_36":991,"_24":25,"_138":-5,"_314":992,"_27":993},{"_44":978,"_32":979,"_30":980,"_132":923,"_42":43,"_41":981,"_134":59,"_39":982,"_13":151,"_34":35,"_36":983,"_24":25,"_138":-5,"_314":984,"_27":985},{"_44":970,"_32":971,"_30":972,"_132":923,"_42":43,"_41":973,"_134":25,"_39":974,"_13":163,"_34":35,"_36":975,"_24":25,"_138":-5,"_314":976,"_27":977},{"_44":962,"_32":963,"_30":964,"_132":923,"_42":43,"_41":965,"_134":25,"_39":966,"_13":151,"_34":35,"_36":967,"_24":25,"_138":-5,"_314":968,"_27":969},{"_44":954,"_32":955,"_30":956,"_132":923,"_42":43,"_41":957,"_134":25,"_39":958,"_13":163,"_34":35,"_36":959,"_24":25,"_138":-5,"_314":960,"_27":961},{"_44":946,"_32":947,"_30":948,"_132":923,"_42":43,"_41":949,"_134":25,"_39":950,"_13":322,"_34":35,"_36":951,"_24":25,"_138":-5,"_314":952,"_27":953},{"_44":938,"_32":939,"_30":940,"_132":923,"_42":43,"_41":941,"_134":25,"_39":942,"_13":151,"_34":35,"_36":943,"_24":25,"_138":-5,"_314":944,"_27":945},{"_44":930,"_32":931,"_30":932,"_132":923,"_42":43,"_41":933,"_134":59,"_39":934,"_13":322,"_34":35,"_36":935,"_24":25,"_138":-5,"_314":936,"_27":937},{"_44":920,"_32":921,"_30":922,"_132":923,"_42":43,"_41":924,"_134":59,"_39":925,"_13":63,"_34":35,"_36":926,"_24":25,"_138":-5,"_314":927,"_27":928},{"_44":916,"_32":754,"_30":894,"_132":790,"_42":43,"_41":895,"_134":59,"_39":917,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":918,"_27":919},{"_44":908,"_32":909,"_30":910,"_132":894,"_42":43,"_41":911,"_134":25,"_39":912,"_13":63,"_34":35,"_36":913,"_24":25,"_138":-5,"_314":914,"_27":915},{"_44":900,"_32":901,"_30":902,"_132":894,"_42":43,"_41":903,"_134":59,"_39":904,"_13":63,"_34":35,"_36":905,"_24":25,"_138":-5,"_314":906,"_27":907},{"_44":891,"_32":892,"_30":893,"_132":894,"_42":43,"_41":895,"_134":59,"_39":896,"_13":63,"_34":35,"_36":897,"_24":25,"_138":-5,"_314":898,"_27":899},{"_44":883,"_32":884,"_30":885,"_132":790,"_42":43,"_41":886,"_134":59,"_39":887,"_13":63,"_34":35,"_36":888,"_24":25,"_138":-5,"_314":889,"_27":890},{"_44":876,"_32":613,"_30":877,"_132":790,"_42":43,"_41":878,"_134":59,"_39":879,"_13":151,"_34":35,"_36":880,"_24":25,"_138":-5,"_314":881,"_27":882},{"_44":868,"_32":869,"_30":870,"_132":790,"_42":43,"_41":871,"_134":25,"_39":872,"_13":163,"_34":35,"_36":873,"_24":25,"_138":-5,"_314":874,"_27":875},{"_44":860,"_32":861,"_30":862,"_132":790,"_42":43,"_41":863,"_134":25,"_39":864,"_13":322,"_34":35,"_36":865,"_24":25,"_138":-5,"_314":866,"_27":867},{"_44":853,"_32":597,"_30":854,"_132":790,"_42":43,"_41":855,"_134":25,"_39":856,"_13":144,"_34":35,"_36":857,"_24":25,"_138":-5,"_314":858,"_27":859},{"_44":845,"_32":846,"_30":847,"_132":790,"_42":43,"_41":848,"_134":25,"_39":849,"_13":163,"_34":35,"_36":850,"_24":25,"_138":-5,"_314":851,"_27":852},{"_44":837,"_32":838,"_30":839,"_132":790,"_42":43,"_41":840,"_134":25,"_39":841,"_13":63,"_34":35,"_36":842,"_24":25,"_138":-5,"_314":843,"_27":844},{"_44":829,"_32":830,"_30":831,"_132":790,"_42":43,"_41":832,"_134":25,"_39":833,"_13":163,"_34":35,"_36":834,"_24":25,"_138":-5,"_314":835,"_27":836},{"_44":821,"_32":822,"_30":823,"_132":790,"_42":43,"_41":824,"_134":25,"_39":825,"_13":163,"_34":35,"_36":826,"_24":25,"_138":-5,"_314":827,"_27":828},{"_44":813,"_32":814,"_30":815,"_132":790,"_42":43,"_41":816,"_134":25,"_39":817,"_13":322,"_34":35,"_36":818,"_24":25,"_138":-5,"_314":819,"_27":820},{"_44":805,"_32":806,"_30":807,"_132":790,"_42":43,"_41":808,"_134":25,"_39":809,"_13":151,"_34":35,"_36":810,"_24":25,"_138":-5,"_314":811,"_27":812},{"_44":797,"_32":798,"_30":799,"_132":790,"_42":43,"_41":800,"_134":59,"_39":801,"_13":151,"_34":35,"_36":802,"_24":25,"_138":-5,"_314":803,"_27":804},{"_44":787,"_32":788,"_30":789,"_132":790,"_42":43,"_41":791,"_134":25,"_39":792,"_13":163,"_34":35,"_36":793,"_24":25,"_138":-5,"_314":794,"_27":795},{"_44":782,"_32":499,"_30":493,"_132":468,"_42":43,"_41":783,"_134":59,"_39":784,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":785,"_27":786},{"_44":778,"_32":754,"_30":748,"_132":493,"_42":43,"_41":749,"_134":59,"_39":779,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":780,"_27":781},{"_44":770,"_32":771,"_30":772,"_132":748,"_42":43,"_41":773,"_134":59,"_39":774,"_13":63,"_34":35,"_36":775,"_24":25,"_138":-5,"_314":776,"_27":777},{"_44":762,"_32":763,"_30":764,"_132":748,"_42":43,"_41":765,"_134":59,"_39":766,"_13":63,"_34":35,"_36":767,"_24":25,"_138":-5,"_314":768,"_27":769},{"_44":755,"_32":702,"_30":756,"_132":748,"_42":43,"_41":757,"_134":59,"_39":758,"_13":63,"_34":35,"_36":759,"_24":25,"_138":-5,"_314":760,"_27":761},{"_44":745,"_32":746,"_30":747,"_132":748,"_42":43,"_41":749,"_134":59,"_39":750,"_13":63,"_34":35,"_36":751,"_24":25,"_138":-5,"_314":752,"_27":753},{"_44":741,"_32":653,"_30":647,"_132":493,"_42":43,"_41":728,"_134":59,"_39":742,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":743,"_27":744},{"_44":733,"_32":734,"_30":735,"_132":647,"_42":43,"_41":736,"_134":59,"_39":737,"_13":63,"_34":35,"_36":738,"_24":25,"_138":-5,"_314":739,"_27":740},{"_44":725,"_32":726,"_30":727,"_132":647,"_42":43,"_41":728,"_134":59,"_39":729,"_13":63,"_34":35,"_36":730,"_24":25,"_138":-5,"_314":731,"_27":732},{"_44":717,"_32":718,"_30":719,"_132":647,"_42":43,"_41":720,"_134":59,"_39":721,"_13":63,"_34":35,"_36":722,"_24":25,"_138":-5,"_314":723,"_27":724},{"_44":709,"_32":710,"_30":711,"_132":647,"_42":43,"_41":712,"_134":59,"_39":713,"_13":63,"_34":35,"_36":714,"_24":25,"_138":-5,"_314":715,"_27":716},{"_44":701,"_32":702,"_30":703,"_132":647,"_42":43,"_41":704,"_134":59,"_39":705,"_13":63,"_34":35,"_36":706,"_24":25,"_138":-5,"_314":707,"_27":708},{"_44":694,"_32":565,"_30":695,"_132":647,"_42":43,"_41":696,"_134":59,"_39":697,"_13":63,"_34":35,"_36":698,"_24":25,"_138":-5,"_314":699,"_27":700},{"_44":686,"_32":687,"_30":688,"_132":647,"_42":43,"_41":689,"_134":59,"_39":690,"_13":63,"_34":35,"_36":691,"_24":25,"_138":-5,"_314":692,"_27":693},{"_44":678,"_32":679,"_30":680,"_132":647,"_42":43,"_41":681,"_134":59,"_39":682,"_13":63,"_34":35,"_36":683,"_24":25,"_138":-5,"_314":684,"_27":685},{"_44":670,"_32":671,"_30":672,"_132":647,"_42":43,"_41":673,"_134":59,"_39":674,"_13":63,"_34":35,"_36":675,"_24":25,"_138":-5,"_314":676,"_27":677},{"_44":662,"_32":663,"_30":664,"_132":647,"_42":43,"_41":665,"_134":59,"_39":666,"_13":63,"_34":35,"_36":667,"_24":25,"_138":-5,"_314":668,"_27":669},{"_44":654,"_32":655,"_30":656,"_132":647,"_42":43,"_41":657,"_134":59,"_39":658,"_13":63,"_34":35,"_36":659,"_24":25,"_138":-5,"_314":660,"_27":661},{"_44":644,"_32":645,"_30":646,"_132":647,"_42":43,"_41":648,"_134":59,"_39":649,"_13":63,"_34":35,"_36":650,"_24":25,"_138":-5,"_314":651,"_27":652},{"_44":636,"_32":637,"_30":638,"_132":493,"_42":43,"_41":639,"_134":59,"_39":640,"_13":151,"_34":35,"_36":641,"_24":25,"_138":-5,"_314":642,"_27":643},{"_44":628,"_32":629,"_30":630,"_132":493,"_42":43,"_41":631,"_134":59,"_39":632,"_13":63,"_34":35,"_36":633,"_24":25,"_138":-5,"_314":634,"_27":635},{"_44":620,"_32":621,"_30":622,"_132":493,"_42":43,"_41":623,"_134":59,"_39":624,"_13":151,"_34":35,"_36":625,"_24":25,"_138":-5,"_314":626,"_27":627},{"_44":612,"_32":613,"_30":614,"_132":493,"_42":43,"_41":615,"_134":59,"_39":616,"_13":151,"_34":35,"_36":617,"_24":25,"_138":-5,"_314":618,"_27":619},{"_44":604,"_32":605,"_30":606,"_132":493,"_42":43,"_41":607,"_134":59,"_39":608,"_13":151,"_34":35,"_36":609,"_24":25,"_138":-5,"_314":610,"_27":611},{"_44":596,"_32":597,"_30":598,"_132":493,"_42":43,"_41":599,"_134":59,"_39":600,"_13":151,"_34":35,"_36":601,"_24":25,"_138":-5,"_314":602,"_27":603},{"_44":588,"_32":589,"_30":590,"_132":493,"_42":43,"_41":591,"_134":59,"_39":592,"_13":151,"_34":35,"_36":593,"_24":25,"_138":-5,"_314":594,"_27":595},{"_44":580,"_32":581,"_30":582,"_132":493,"_42":43,"_41":583,"_134":59,"_39":584,"_13":151,"_34":35,"_36":585,"_24":25,"_138":-5,"_314":586,"_27":587},{"_44":572,"_32":573,"_30":574,"_132":493,"_42":43,"_41":575,"_134":59,"_39":576,"_13":151,"_34":35,"_36":577,"_24":25,"_138":-5,"_314":578,"_27":579},{"_44":564,"_32":565,"_30":566,"_132":493,"_42":43,"_41":567,"_134":59,"_39":568,"_13":151,"_34":35,"_36":569,"_24":25,"_138":-5,"_314":570,"_27":571},{"_44":556,"_32":557,"_30":558,"_132":493,"_42":43,"_41":559,"_134":59,"_39":560,"_13":151,"_34":35,"_36":561,"_24":25,"_138":-5,"_314":562,"_27":563},{"_44":548,"_32":549,"_30":550,"_132":493,"_42":43,"_41":551,"_134":59,"_39":552,"_13":151,"_34":35,"_36":553,"_24":25,"_138":-5,"_314":554,"_27":555},{"_44":540,"_32":541,"_30":542,"_132":493,"_42":43,"_41":543,"_134":59,"_39":544,"_13":63,"_34":35,"_36":545,"_24":25,"_138":-5,"_314":546,"_27":547},{"_44":532,"_32":533,"_30":534,"_132":493,"_42":43,"_41":535,"_134":59,"_39":536,"_13":151,"_34":35,"_36":537,"_24":25,"_138":-5,"_314":538,"_27":539},{"_44":524,"_32":525,"_30":526,"_132":493,"_42":43,"_41":527,"_134":59,"_39":528,"_13":151,"_34":35,"_36":529,"_24":25,"_138":-5,"_314":530,"_27":531},{"_44":516,"_32":517,"_30":518,"_132":493,"_42":43,"_41":519,"_134":59,"_39":520,"_13":63,"_34":35,"_36":521,"_24":25,"_138":-5,"_314":522,"_27":523},{"_44":508,"_32":509,"_30":510,"_132":493,"_42":43,"_41":511,"_134":59,"_39":512,"_13":151,"_34":35,"_36":513,"_24":25,"_138":-5,"_314":514,"_27":515},{"_44":500,"_32":501,"_30":502,"_132":493,"_42":43,"_41":503,"_134":59,"_39":504,"_13":151,"_34":35,"_36":505,"_24":25,"_138":-5,"_314":506,"_27":507},{"_44":490,"_32":491,"_30":492,"_132":493,"_42":43,"_41":494,"_134":59,"_39":495,"_13":151,"_34":35,"_36":496,"_24":25,"_138":-5,"_314":497,"_27":498},{"_44":483,"_32":357,"_30":484,"_132":468,"_42":43,"_41":485,"_134":25,"_39":486,"_13":163,"_34":35,"_36":487,"_24":25,"_138":-5,"_314":488,"_27":489},{"_44":475,"_32":476,"_30":477,"_132":468,"_42":43,"_41":478,"_134":59,"_39":479,"_13":63,"_34":35,"_36":480,"_24":25,"_138":-5,"_314":481,"_27":482},{"_44":465,"_32":466,"_30":467,"_132":468,"_42":43,"_41":469,"_134":59,"_39":470,"_13":63,"_34":35,"_36":471,"_24":25,"_138":-5,"_314":472,"_27":473},{"_44":461,"_32":380,"_30":374,"_132":143,"_42":43,"_41":408,"_134":59,"_39":462,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":463,"_27":464},{"_44":453,"_32":454,"_30":455,"_132":374,"_42":43,"_41":456,"_134":59,"_39":457,"_13":63,"_34":35,"_36":458,"_24":25,"_138":-5,"_314":459,"_27":460},{"_44":445,"_32":446,"_30":447,"_132":374,"_42":43,"_41":448,"_134":59,"_39":449,"_13":63,"_34":35,"_36":450,"_24":25,"_138":-5,"_314":451,"_27":452},{"_44":437,"_32":438,"_30":439,"_132":374,"_42":43,"_41":440,"_134":59,"_39":441,"_13":63,"_34":35,"_36":442,"_24":25,"_138":-5,"_314":443,"_27":444},{"_44":429,"_32":430,"_30":431,"_132":374,"_42":43,"_41":432,"_134":59,"_39":433,"_13":63,"_34":35,"_36":434,"_24":25,"_138":-5,"_314":435,"_27":436},{"_44":421,"_32":422,"_30":423,"_132":374,"_42":43,"_41":424,"_134":59,"_39":425,"_13":63,"_34":35,"_36":426,"_24":25,"_138":-5,"_314":427,"_27":428},{"_44":413,"_32":414,"_30":415,"_132":374,"_42":43,"_41":416,"_134":59,"_39":417,"_13":63,"_34":35,"_36":418,"_24":25,"_138":-5,"_314":419,"_27":420},{"_44":405,"_32":406,"_30":407,"_132":374,"_42":43,"_41":408,"_134":59,"_39":409,"_13":63,"_34":35,"_36":410,"_24":25,"_138":-5,"_314":411,"_27":412},{"_44":397,"_32":398,"_30":399,"_132":374,"_42":43,"_41":400,"_134":59,"_39":401,"_13":63,"_34":35,"_36":402,"_24":25,"_138":-5,"_314":403,"_27":404},{"_44":389,"_32":390,"_30":391,"_132":374,"_42":43,"_41":392,"_134":59,"_39":393,"_13":63,"_34":35,"_36":394,"_24":25,"_138":-5,"_314":395,"_27":396},{"_44":381,"_32":382,"_30":383,"_132":374,"_42":43,"_41":384,"_134":59,"_39":385,"_13":63,"_34":35,"_36":386,"_24":25,"_138":-5,"_314":387,"_27":388},{"_44":371,"_32":372,"_30":373,"_132":374,"_42":43,"_41":375,"_134":59,"_39":376,"_13":63,"_34":35,"_36":377,"_24":25,"_138":-5,"_314":378,"_27":379},{"_44":366,"_32":365,"_30":359,"_132":143,"_42":43,"_41":367,"_134":59,"_39":368,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":369,"_27":370},{"_44":356,"_32":357,"_30":358,"_132":359,"_42":43,"_41":360,"_134":59,"_39":361,"_13":151,"_34":35,"_36":362,"_24":25,"_138":-5,"_314":363,"_27":364},{"_44":352,"_32":351,"_30":345,"_132":143,"_42":43,"_41":346,"_134":59,"_39":353,"_13":63,"_34":146,"_36":-5,"_24":25,"_138":-5,"_314":354,"_27":355},{"_44":342,"_32":343,"_30":344,"_132":345,"_42":43,"_41":346,"_134":25,"_39":347,"_13":63,"_34":35,"_36":348,"_24":25,"_138":-5,"_314":349,"_27":350},{"_44":334,"_32":335,"_30":336,"_132":143,"_42":43,"_41":337,"_134":25,"_39":338,"_13":63,"_34":35,"_36":339,"_24":25,"_138":-5,"_314":340,"_27":341},{"_44":326,"_32":327,"_30":328,"_132":143,"_42":43,"_41":329,"_134":59,"_39":330,"_13":63,"_34":35,"_36":331,"_24":25,"_138":-5,"_314":332,"_27":333},{"_44":317,"_32":318,"_30":319,"_132":143,"_42":43,"_41":320,"_134":25,"_39":321,"_13":322,"_34":35,"_36":323,"_24":25,"_138":-5,"_314":324,"_27":325},{"_44":130,"_32":131,"_30":57,"_132":-5,"_42":43,"_41":133,"_134":59,"_39":313,"_13":63,"_34":136,"_36":137,"_24":25,"_138":139,"_314":315,"_27":316},["D",1789043641384],"children",[],[131],"bd454f60-b0a8-4e6f-a038-fba893d89b90","types.ts","d3a406d2-ad13-11f1-b31d-1607ee4eb77e",213,["D",1789332087611],3,"import type { RunContext } from './connection/index.ts';\nimport type { ScenarioContext } from './mock-server/index.ts';\nimport type { AuthorizationServerOptions } from './schemas.ts';\nimport type { Step } from './steps/index.ts';\n\nexport type CheckStatus =\n | 'SUCCESS'\n | 'FAILURE'\n | 'WARNING'\n | 'SKIPPED'\n | 'INFO';\n\nexport interface SpecReference {\n id: string;\n url?: string;\n}\n\nexport interface ConformanceCheck {\n id: string;\n name: string;\n description: string;\n status: CheckStatus;\n timestamp: string;\n specReferences?: SpecReference[];\n /**\n * Optional spec-version range for this individual check. When set, runners\n * drop the check for `--spec-version` values outside the range.\n */\n source?: ScenarioSource;\n details?: Record;\n metadata?: Record;\n errorMessage?: string;\n logs?: string[];\n}\n\nexport const DATED_SPEC_VERSIONS = [\n '2025-03-26',\n '2025-06-18',\n '2025-11-25'\n] as const;\n\nexport type DatedSpecVersion = (typeof DATED_SPEC_VERSIONS)[number];\n\nexport const LATEST_SPEC_VERSION: DatedSpecVersion = '2025-11-25';\n\n/**\n * Wire `protocolVersion` for the in-progress spec. Mirrors\n * `LATEST_PROTOCOL_VERSION` in the spec repo's `schema/draft/schema.ts`;\n * bump when that constant changes.\n */\nexport const DRAFT_PROTOCOL_VERSION = '2026-07-28';\n\n// Wire protocolVersion strings the mock server will negotiate on initialize.\nexport const NEGOTIABLE_PROTOCOL_VERSIONS: readonly string[] = [\n '2025-06-18',\n LATEST_SPEC_VERSION,\n DRAFT_PROTOCOL_VERSION\n];\n\n/**\n * A spec revision the conformance suite can target via `--spec-version`.\n * Always a wire `protocolVersion` string. The CLI also accepts `'draft'` as\n * an alias for {@link DRAFT_PROTOCOL_VERSION}.\n */\nexport type SpecVersion = DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION;\n\n/** Spec versions in timeline order, dated revisions followed by the draft. */\nexport const SPEC_VERSION_TIMELINE: readonly SpecVersion[] = [\n ...DATED_SPEC_VERSIONS,\n DRAFT_PROTOCOL_VERSION\n];\n\n/** True when `v` names a known spec version (dated or draft). */\nexport function isSpecVersion(v: unknown): v is SpecVersion {\n return SPEC_VERSION_TIMELINE.includes(v as SpecVersion);\n}\n\n/**\n * True when `v` is at or after `threshold` on the spec timeline. Lets a check\n * gate itself to the version that introduced its requirement (e.g. a draft-only\n * requirement passes `DRAFT_PROTOCOL_VERSION` as the threshold).\n */\nexport function specVersionAtLeast(\n v: SpecVersion,\n threshold: SpecVersion\n): boolean {\n return (\n SPEC_VERSION_TIMELINE.indexOf(v) >= SPEC_VERSION_TIMELINE.indexOf(threshold)\n );\n}\n\n// Scenarios may also be tagged 'extension' to mark them as off-timeline\n// (selectable via --suite extensions, never via --spec-version). See #256.\nexport type ScenarioSpecTag = SpecVersion | 'extension';\n\n/**\n * Known protocol extensions that this suite has scenarios for.\n * Values are SEP-2133 extension identifiers (the keys used in\n * `capabilities.extensions`).\n */\nexport const EXTENSION_IDS = [\n 'io.modelcontextprotocol/oauth-client-credentials',\n 'io.modelcontextprotocol/enterprise-managed-authorization',\n 'io.modelcontextprotocol/auth/dpop',\n 'io.modelcontextprotocol/auth/wif',\n 'io.modelcontextprotocol/tasks',\n 'io.modelcontextprotocol/skills'\n] as const;\nexport type ExtensionId = (typeof EXTENSION_IDS)[number];\n\n/**\n * Where a scenario's requirement comes from. Either the dated spec timeline\n * (`introducedIn`/`removedIn`) or a named protocol extension that lives\n * outside the spec release cycle. Extensions never match `--spec-version`.\n */\nexport type ScenarioSource =\n | {\n introducedIn: DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION;\n removedIn?: DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION;\n }\n | { extensionId: ExtensionId };\n\nexport interface ScenarioUrls {\n serverUrl: string;\n authUrl?: string;\n /**\n * Optional context to pass to the client via MCP_CONFORMANCE_CONTEXT env var.\n * This is a JSON-serializable object containing scenario-specific data like credentials.\n */\n context?: Record;\n}\n\n/** A Node-style request handler — what `http.createServer` accepts. */\nexport type RequestListener = (\n req: import('http').IncomingMessage,\n res: import('http').ServerResponse\n) => void;\n\nexport interface Scenario {\n name: string;\n description: string;\n source: ScenarioSource;\n /**\n * If true, a non-zero client exit code is expected and will not cause the test to fail.\n * Use this for scenarios where the client is expected to error (e.g., rejecting invalid auth).\n */\n allowClientError?: boolean;\n /**\n * Sub-path of the MCP endpoint relative to the handler root. The CLI runner\n * appends this to the listen URL; the hosted runner appends it to the\n * mounted prefix. Default: '' (handler root is the MCP endpoint).\n */\n mcpPath?: string;\n /**\n * Return the request handler without binding a port. The hosted runner\n * mounts this directly under a path prefix so scenarios can run on\n * serverless hosts that don't allow loopback listeners.\n *\n * `getBaseUrl` returns the public URL this handler is reachable at (no\n * trailing slash) — use it for scenarios that embed self-referential\n * absolute URLs in responses. Called lazily so `start()` can resolve it\n * after the OS assigns a port.\n *\n * `ctx` is the same per-run context `start()` receives (resolved spec\n * version + version-aware mock factory); use `ctx.createHandler()` rather\n * than `ctx.createServer()` so the scenario stays port-free.\n *\n * Implementations should reset per-run state here, not in `start()`.\n * If omitted, the scenario only runs via `start()`/`stop()` (e.g. auth\n * scenarios that need a second origin).\n */\n handler?(getBaseUrl: () => string, ctx: ScenarioContext): RequestListener;\n /**\n * Return a new, unstarted instance configured like this one. The hosted\n * runner creates one scenario instance per run (and one to re-judge a\n * persisted log) from the registry entry; by default it calls the\n * constructor with no arguments, so a scenario whose constructor takes\n * parameters (e.g. one class registered under several names) must\n * implement this to carry them over.\n */\n fresh?(): Scenario;\n /**\n * Called on a fresh instance before it judges a merged log (the hosted\n * server's re-judgement, src/hosted/session.ts), with the revision the\n * cell ran at: the one piece of the run's context such an instance cannot\n * read from the log. Scenarios whose verdicts depend on the revision\n * record it here.\n */\n judgeAt?(specVersion: SpecVersion): void;\n start(ctx: ScenarioContext): Promise;\n stop(): Promise;\n getChecks(): ConformanceCheck[];\n /**\n * Checks recorded so far WITHOUT end-of-flow finalization. Some scenarios'\n * `getChecks()` appends aggregate failures for flow steps never observed\n * (\"expected check missing\"); those judgments are only meaningful when one\n * instance saw the whole flow. The hosted server persists this view per\n * process and re-judges the merged log once (see src/hosted/session.ts),\n * so it reads this view when present.\n */\n rawChecks?(): ConformanceCheck[];\n /**\n * Client-side choreography as data (see src/steps). When present the\n * runner includes it in MCP_CONFORMANCE_CONTEXT as `steps`, so a client\n * with no bespoke handler for this scenario can still drive it.\n */\n readonly steps?: readonly Step[];\n}\n\n/**\n * Convenience: implement `handler()` + `mcpPath` and get `start()`/`stop()`\n * for free. Covers every scenario that just needs one HTTP origin.\n */\nexport abstract class HandlerScenario implements Scenario {\n abstract name: string;\n abstract description: string;\n abstract readonly source: ScenarioSource;\n allowClientError?: boolean;\n mcpPath = '';\n\n private _server: import('http').Server | null = null;\n private _baseUrl = '';\n\n abstract handler(\n getBaseUrl: () => string,\n ctx: ScenarioContext\n ): RequestListener;\n abstract getChecks(): ConformanceCheck[];\n\n async start(ctx: ScenarioContext): Promise {\n const http = await import('node:http');\n const listener = this.handler(() => this._baseUrl, ctx);\n return new Promise((resolve, reject) => {\n this._server = http.createServer(listener);\n this._server.on('error', reject);\n this._server.listen(0, () => {\n const addr = this._server!.address();\n if (!addr || typeof addr !== 'object') {\n return reject(new Error('Failed to get server address'));\n }\n this._baseUrl = `http://localhost:${addr.port}`;\n resolve({ serverUrl: `${this._baseUrl}${this.mcpPath}` });\n });\n });\n }\n\n async stop(): Promise {\n if (!this._server) return;\n await new Promise((resolve) => {\n // closeAllConnections so hung SSE streams don't keep the process alive\n this._server!.closeAllConnections?.();\n this._server!.close(() => resolve());\n });\n this._server = null;\n }\n}\n\n/**\n * Named extra origins a multi-origin scenario needs beyond the resource\n * server. `as` is the OAuth authorization server; `as2`/`idp` cover the\n * three-origin scenarios (authorization-server-migration, EMA).\n */\nexport type AuxOriginRole = 'as' | 'as2' | 'idp';\n\n/**\n * What `authHandlers()` receives: the per-run `ScenarioContext` (spec\n * version, mock factories) plus the public URLs of each origin.\n */\nexport interface AuthHandlerContext extends ScenarioContext {\n /** Public URL of the resource-server mount (no trailing slash). */\n getRsBaseUrl: () => string;\n /**\n * Public URL of an aux origin for this run (no trailing slash). When\n * hosted, this is `/r/` so the run-id is recoverable\n * from any path the client constructs from it (RFC 8414 well-known\n * insertion, endpoint paths, etc.).\n */\n getAuxBaseUrl: (role: AuxOriginRole) => string;\n}\n\nexport interface AuthHandlers {\n /** Resource-server handler — serves /mcp and PRM. */\n rs: RequestListener;\n /** Aux-origin handlers keyed by role. */\n aux: Partial>;\n}\n\n/**\n * Convenience: implement `authHandlers()` and get `start()`/`stop()` for\n * free. `start()` binds one ephemeral localhost port per origin, exactly as\n * the auth scenarios did with `ServerLifecycle` before; the hosted runner\n * mounts the same handlers behind path prefixes + an AS relay instead.\n */\nexport abstract class AuthHandlerScenario implements Scenario {\n abstract name: string;\n abstract description: string;\n abstract readonly source: ScenarioSource;\n allowClientError?: boolean;\n mcpPath = '/mcp';\n\n /** Aux origins this scenario needs. Override for 3-origin scenarios. */\n readonly auxRoles: readonly AuxOriginRole[] = ['as'];\n\n private _servers: import('http').Server[] = [];\n private _urls: { rs: string; aux: Partial> } = {\n rs: '',\n aux: {}\n };\n\n abstract authHandlers(ctx: AuthHandlerContext): AuthHandlers;\n abstract getChecks(): ConformanceCheck[];\n\n /** Optional context to pass to the client (credentials etc). */\n protected scenarioContext?(): Record;\n\n async start(ctx: ScenarioContext): Promise {\n const http = await import('node:http');\n const handlers = this.authHandlers({\n ...ctx,\n getRsBaseUrl: () => this._urls.rs,\n getAuxBaseUrl: (role) => {\n const u = this._urls.aux[role];\n if (!u) throw new Error(`aux role '${role}' not started`);\n return u;\n }\n });\n\n const listen = (h: RequestListener): Promise =>\n new Promise((resolve, reject) => {\n const srv = http.createServer(h);\n srv.on('error', reject);\n srv.listen(0, () => {\n const addr = srv.address();\n if (!addr || typeof addr !== 'object') {\n return reject(new Error('Failed to get server address'));\n }\n this._servers.push(srv);\n resolve(`http://localhost:${addr.port}`);\n });\n });\n\n // Aux origins must come up first — RS handlers reference their URLs.\n for (const role of this.auxRoles) {\n const h = handlers.aux[role];\n if (!h) throw new Error(`authHandlers() missing aux role '${role}'`);\n this._urls.aux[role] = await listen(h);\n }\n this._urls.rs = await listen(handlers.rs);\n\n return {\n serverUrl: `${this._urls.rs}${this.mcpPath}`,\n ...(this.scenarioContext && { context: this.scenarioContext() })\n };\n }\n\n async stop(): Promise {\n await Promise.all(\n this._servers.map(\n (s) =>\n new Promise((resolve) => {\n s.closeAllConnections?.();\n s.close(() => resolve());\n })\n )\n );\n this._servers = [];\n this._urls = { rs: '', aux: {} };\n }\n}\n\nexport interface ClientScenario {\n name: string;\n description: string;\n source: ScenarioSource;\n run(ctx: RunContext): Promise;\n}\n\nexport interface ClientScenarioForAuthorizationServer {\n name: string;\n description: string;\n source: ScenarioSource;\n run(\n options: AuthorizationServerOptions,\n details: Record\n ): Promise;\n}\n",[],[142,318],"036cbff1-ca63-4ae7-ac85-d16bbfbed49a","schemas.ts","5e719778-ad1b-11f1-89e2-1607ee4eb77e",69,["D",1789046848523],"import { z } from 'npm:zod@^4.3.6';\nimport {\n getScenario,\n getClientScenario,\n getClientScenarioForAuthorizationServer\n} from './scenarios/index.ts';\n\n// Client command options schema\nexport const ClientOptionsSchema = z.object({\n command: z.string().min(1, 'Command cannot be empty').optional(),\n scenario: z\n .string()\n .min(1, 'Scenario cannot be empty')\n .refine((scenario) => getScenario(scenario) !== undefined, {\n error: (iss) => `Unknown scenario '${iss.input}'`\n }),\n timeout: z\n .string()\n .transform((val) => parseInt(val, 10))\n .pipe(\n z\n .number()\n .positive('Timeout must be a positive number')\n .int('Timeout must be an integer')\n )\n .optional(),\n verbose: z.boolean().optional()\n});\n\nexport type ClientOptions = z.infer;\n\n// Server command options schema\nexport const ServerOptionsSchema = z.object({\n url: z.string().url('Invalid server URL'),\n scenario: z\n .string()\n .refine((scenario) => getClientScenario(scenario) !== undefined, {\n error: (iss) => `Unknown scenario '${iss.input}'`\n })\n .optional()\n});\n\nexport type ServerOptions = z.infer;\n\n// Authorization server command options schema\nexport const AuthorizationServerOptionsSchema = z.object({\n url: z.string().url('Invalid authorization server URL'),\n scenario: z\n .string()\n .refine(\n (scenario) =>\n getClientScenarioForAuthorizationServer(scenario) !== undefined,\n {\n error: (iss) => `Unknown scenario '${iss.input}'`\n }\n )\n .optional(),\n clientId: z.string().min(1, 'Client id cannot be empty').optional(),\n clientSecret: z.string().min(1, 'Client secret cannot be empty').optional(),\n // RFC 8707 §2: the resource value is an absolute URI with no fragment.\n resource: z\n .string()\n .refine((value) => URL.canParse(value), 'Resource must be an absolute URI')\n .refine(\n (value) => !URL.canParse(value) || !new URL(value).hash,\n 'Resource must not include a fragment'\n )\n .optional(),\n port: z\n .number()\n .int('Port must be an integer')\n .min(1, 'Port must be >= 1')\n .max(65535, 'Port must be <= 65535')\n .default(3000)\n});\n\nexport type AuthorizationServerOptions = z.infer<\n typeof AuthorizationServerOptionsSchema\n>;\n\n// Interactive command options schema\nexport const InteractiveOptionsSchema = z.object({\n scenario: z\n .string()\n .min(1, 'Scenario cannot be empty')\n .refine((scenario) => getScenario(scenario) !== undefined, {\n error: (iss) => `Unknown scenario '${iss.input}'`\n })\n});\n\nexport type InteractiveOptions = z.infer;\n",[],[142,327],"5f7e4d7c-8b09-4a79-93e9-1191105a3ced","requirements.ts","b06bba46-ae14-11f1-8269-1607ee4eb77e",168,["D",1789153930727],"import { existsSync, readdirSync, readFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { parse as parseYaml } from 'npm:yaml@^2.8.2';\nimport { ALL_SPEC_VERSIONS } from './scenarios/index.ts';\nimport { SPEC_VERSION_TIMELINE, type SpecVersion } from './types.ts';\n\n/**\n * A frozen requirement set for one specification revision: the scenarios an\n * implementation must pass to conform to that revision, fixed when it shipped.\n *\n * This is the project's contract, not an implementation's configuration. It is\n * the opposite of an expected-failures baseline, which lives in an\n * implementation's own repository and records what that implementation knows it\n * fails. A baselined failure is still a failure against a requirement set.\n */\nexport interface RequirementSet {\n /** Revision this set belongs to, e.g. `2026-07-28`. */\n revision: string;\n /** Scenarios `conformance server` runs against a server implementation. */\n server: string[];\n /** Scenarios `conformance client` runs against a client implementation. */\n client: string[];\n /**\n * Scenarios run and reported alongside the required ones but never counted\n * toward a pass rate. Three reasons qualify, and the report names which:\n * an extension is optional by definition, a scenario added after the\n * revision shipped is one no implementation could have been passing, and a\n * pending scenario is one the suite's own reference fixture cannot pass yet\n * — the implementation under test still might, so it runs for visibility.\n */\n notScored: NotScored[];\n}\n\nexport type NotScoredReason = 'extension' | 'added-after-release' | 'pending';\n\nexport interface NotScored {\n scenario: string;\n leg: Leg;\n reason: NotScoredReason;\n note?: string;\n}\n\n/**\n * Roles a requirement set covers. The MCP specification defines two: an MCP\n * server acting as an OAuth resource server, and an MCP client acting as an\n * OAuth client. Authorization-server implementation is explicitly beyond the\n * specification's scope, so those scenarios are not a conformance requirement\n * for anything the spec defines and have no place in a requirement set.\n */\nexport type Leg = 'client' | 'server';\n\nconst LEGS: Leg[] = ['client', 'server'];\nexport const REASONS: NotScoredReason[] = [\n 'extension',\n 'added-after-release',\n 'pending'\n];\n\n/** Requirement sets ship with the package; see the `files` entry in package.json. */\nfunction requirementsDir(): string {\n return join(dirname(fileURLToPath(import.meta.url)), '..', 'requirements');\n}\n\n/**\n * Requirement sets supplied as text, keyed by revision. A deployment that has\n * no `requirements/` directory next to it (a serverless bundle of the import\n * closure, say) registers the yaml texts up front; see\n * examples/hosted/bundle-requirements.ts. Registered text wins over a file of\n * the same revision and goes through exactly the same validation.\n */\nconst registeredSources = new Map();\n\nexport function registerRequirementSources(\n sources: Record\n): void {\n for (const [revision, text] of Object.entries(sources)) {\n registeredSources.set(revision, text);\n }\n}\n\n/** Revisions with a yaml on disk; empty when the directory is unreadable. */\nfunction revisionsOnDisk(): string[] {\n try {\n const dir = requirementsDir();\n if (!existsSync(dir)) return [];\n return readdirSync(dir)\n .filter((f) => f.endsWith('.yaml'))\n .map((f) => f.replace(/\\.yaml$/, ''));\n } catch {\n return [];\n }\n}\n\n/**\n * Revisions that ship a requirement set — registered or on disk — in\n * spec-timeline order. A yaml whose name is not a protocol version this build\n * knows is ignored: it could not be loaded anyway (see loadRequirements).\n */\nexport function listRequirementRevisions(): SpecVersion[] {\n const present = new Set([...registeredSources.keys(), ...revisionsOnDisk()]);\n return SPEC_VERSION_TIMELINE.filter((v) => present.has(v));\n}\n\n/** The yaml text for a revision: registered first, then the bundled file. */\nfunction requirementSource(revision: string): string | undefined {\n const registered = registeredSources.get(revision);\n if (registered !== undefined) return registered;\n try {\n const path = join(requirementsDir(), `${revision}.yaml`);\n return existsSync(path) ? readFileSync(path, 'utf-8') : undefined;\n } catch {\n return undefined;\n }\n}\n\nfunction asNameList(value: unknown, field: string, revision: string): string[] {\n if (value === undefined) return [];\n if (!Array.isArray(value) || value.some((v) => typeof v !== 'string')) {\n throw new Error(\n `requirements/${revision}.yaml: \"${field}\" must be a list of scenario names`\n );\n }\n return value as string[];\n}\n\nexport function loadRequirements(revision: string): RequirementSet {\n // A revision names a bundled file. Arbitrary paths are deliberately not\n // accepted: a requirement set is the project's contract, so an implementation\n // under test must not be able to supply its own.\n if (!/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/.test(revision)) {\n // A run has one exit code and one expected-failures baseline, so it targets\n // one revision. tier-check is the aggregator and takes several at once.\n throw new Error(\n revision.includes(',')\n ? `A run targets one revision at a time, because it has one exit code and one baseline. Run each of \"${revision}\" separately, or pass them together to \\`tier-check --requirements\\`.`\n : `Invalid requirements revision: ${revision}. Expected a date such as 2026-07-28.`\n );\n }\n\n // The revision is also the wire version its scenarios run at, so it has to be\n // a protocol version this build knows, not merely a date-shaped string.\n if (!(ALL_SPEC_VERSIONS as readonly string[]).includes(revision)) {\n throw new Error(\n `Unknown spec revision: ${revision}. Known revisions: ${ALL_SPEC_VERSIONS.join(', ')}`\n );\n }\n\n const source = requirementSource(revision);\n if (source === undefined) {\n const known = listRequirementRevisions();\n throw new Error(\n `No requirement set for ${revision}.` +\n (known.length\n ? ` Available: ${known.join(', ')}`\n : ' No requirement sets are bundled with this release.')\n );\n }\n\n const parsed = parseYaml(source) ?? {};\n\n // A frozen contract must fail loudly on anything it does not recognise: a\n // typo'd key (\"sever:\") would otherwise silently empty a leg and the gate\n // would pass having required nothing.\n const KNOWN_KEYS = new Set(['server', 'client', 'not_scored']);\n for (const key of Object.keys(parsed)) {\n if (key === 'authorization') continue; // rejected below with its own reason\n if (!KNOWN_KEYS.has(key)) {\n throw new Error(\n `requirements/${revision}.yaml: unknown key \"${key}\" (expected server, client, not_scored)`\n );\n }\n }\n const notScoredRaw = parsed.not_scored ?? [];\n if (!Array.isArray(notScoredRaw)) {\n throw new Error(\n `requirements/${revision}.yaml: \"not_scored\" must be a list`\n );\n }\n\n if (parsed.authorization !== undefined) {\n throw new Error(\n `requirements/${revision}.yaml: requirement sets cover the client and server roles only. ` +\n 'Authorization-server implementation is beyond the scope of the MCP specification, so it is not a conformance requirement.'\n );\n }\n\n const server = asNameList(parsed.server, 'server', revision);\n const client = asNameList(parsed.client, 'client', revision);\n for (const [leg, names] of [\n ['server', server],\n ['client', client]\n ] as const) {\n const dupes = names.filter((n, i) => names.indexOf(n) !== i);\n if (dupes.length > 0) {\n throw new Error(\n `requirements/${revision}.yaml: duplicate ${leg} scenario(s): ${[...new Set(dupes)].join(', ')}`\n );\n }\n }\n\n return {\n revision,\n server,\n client,\n notScored: notScoredRaw.map((entry: unknown) => {\n const e = entry as NotScored;\n if (!e || typeof e.scenario !== 'string') {\n throw new Error(\n `requirements/${revision}.yaml: each not_scored entry needs a \"scenario\" name`\n );\n }\n if (!LEGS.includes(e.leg)) {\n throw new Error(\n `requirements/${revision}.yaml: ${e.scenario} needs a \"leg\" of ${LEGS.join(', ')}`\n );\n }\n if (!REASONS.includes(e.reason)) {\n throw new Error(\n `requirements/${revision}.yaml: ${e.scenario} needs a \"reason\" of ${REASONS.join(', ')}`\n );\n }\n // A half-finished promotion (a scenario both scored and not_scored)\n // would run twice and be counted inconsistently across code paths.\n const scoredNames = e.leg === 'server' ? server : client;\n if (scoredNames.includes(e.scenario)) {\n throw new Error(\n `requirements/${revision}.yaml: ${e.scenario} is both scored (${e.leg}) and not_scored — finish the promotion by removing one entry`\n );\n }\n return {\n scenario: e.scenario,\n leg: e.leg,\n reason: e.reason,\n note: e.note\n };\n })\n };\n}\n\n/** Scenarios that count toward the pass rate for a leg. */\nexport function scoredScenarios(\n requirements: RequirementSet,\n leg: Leg\n): string[] {\n return requirements[leg];\n}\n\n/** Scenarios run and reported for a leg but excluded from the pass rate. */\nexport function notScoredScenarios(\n requirements: RequirementSet,\n leg: Leg\n): NotScored[] {\n return requirements.notScored.filter((entry) => entry.leg === leg);\n}\n\n/** Everything a leg runs: what it scores, plus what it only reports. */\nexport function scenariosToRun(\n requirements: RequirementSet,\n leg: Leg\n): string[] {\n return [\n ...scoredScenarios(requirements, leg),\n ...notScoredScenarios(requirements, leg).map((e) => e.scenario)\n ];\n}\n\n/**\n * Narrow a scenario list to the revision's requirements.\n *\n * Names the requirement set asks for that this build does not have are an\n * error: the set is frozen, so a missing name means the suite renamed or\n * removed a scenario out from under it, and silently scoring a smaller set\n * would understate what conformance means.\n */\nexport function filterScenariosByRequirements(\n allScenarios: string[],\n requirements: RequirementSet,\n leg: Leg\n): string[] {\n const scored = new Set(scoredScenarios(requirements, leg));\n const available = new Set(allScenarios);\n const wanted = scenariosToRun(requirements, leg);\n // Only the scored names are a contract violation when absent. A not-scored\n // entry can legitimately postdate the build being run, which is the whole\n // reason it is listed separately.\n const missing = wanted.filter(\n (name) => !available.has(name) && scored.has(name)\n );\n if (missing.length > 0) {\n throw new Error(\n `requirements/${requirements.revision}.yaml lists ${leg} scenarios that this build does not provide: ${missing.join(', ')}`\n );\n }\n return wanted.filter((name) => available.has(name));\n}\n",[],[142,335],"bcd0dc0d-8536-4463-b9a2-ed274eacf8f2","wire-schema.ts","5780340a-ad1c-11f1-9ee5-1607ee4eb77e","6dc85620-eb35-4dba-918f-1b64fb950561",147,["D",1789047266375],"// Validates wire JSON-RPC messages against the vendored per-version spec schema\n// (src/spec-types/*.schema.json): envelope, then typed defs via method/error.code consts and\n// request→result pairs. Known gap: the client-auth scenarios' express mock is not instrumented.\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { Ajv, type ValidateFunction, type ErrorObject } from 'npm:ajv@^8.20.0';\nimport { Ajv2020 } from 'npm:ajv@^8.20.0/dist/2020.js';\nimport { default as addFormats } from 'npm:ajv-formats@^3.0.1';\nimport {\n DRAFT_PROTOCOL_VERSION,\n type ConformanceCheck,\n type SpecVersion\n} from '../types.ts';\nimport schema2025_03_26 from '../spec-types/2025-03-26.schema.json.ts';\nimport schema2025_06_18 from '../spec-types/2025-06-18.schema.json.ts';\nimport schema2025_11_25 from '../spec-types/2025-11-25.schema.json.ts';\nimport schemaDraft from '../spec-types/draft.schema.json.ts';\n\nexport type WireOrigin = 'harness' | 'implementation';\n\nexport interface WireMessageInfo {\n /** Who authored the message: the harness or the implementation-under-test. */\n origin: WireOrigin;\n /** Human-readable location, e.g. `stateless request 'tools/call'`. */\n context: string;\n /** For responses: the answered request's method, so the result is validated\n * against its typed result definition. */\n requestMethod?: string;\n}\n\nexport interface WireSchemaViolation {\n origin: WireOrigin;\n specVersion: SpecVersion;\n context: string;\n errors: string[];\n message: unknown;\n}\n\nconst SCHEMAS: Record> = {\n '2025-03-26': schema2025_03_26,\n '2025-06-18': schema2025_06_18,\n '2025-11-25': schema2025_11_25,\n [DRAFT_PROTOCOL_VERSION]: schemaDraft\n};\n\n/** Spec-repo directory name for a version (the draft is pinned unversioned). */\nexport function schemaDirFor(specVersion: SpecVersion): string {\n return specVersion === DRAFT_PROTOCOL_VERSION ? 'draft' : specVersion;\n}\n\n/** Union definitions that alias a single concrete type (and so carry a\n * `method` const) but are not the canonical definition for that method. */\nconst NON_CANONICAL_DEFS = new Set([\n 'ClientRequest',\n 'ClientNotification',\n 'ClientResult',\n 'ClientMessage',\n 'ServerRequest',\n 'ServerNotification',\n 'ServerResult',\n 'ServerMessage'\n]);\n\n/** resultType values defined by the core schema (SEP-2322). */\nconst CORE_RESULT_TYPES: ReadonlySet = new Set([\n 'complete',\n 'input_required'\n]);\n/**\n * resultType values defined by known protocol extensions whose result schema\n * is not vendored here yet; validated against the generic result envelope.\n * - 'task': io.modelcontextprotocol/tasks CreateTaskResult (SEP-2663).\n */\nconst EXTENSION_RESULT_TYPES: ReadonlySet = new Set(['task']);\n\ninterface CompiledSpec {\n defsKey: '$defs' | 'definitions';\n defs: Record>;\n /** JSON-RPC method → canonical request/notification definition name. */\n methodDefs: Map;\n /** `error.code` const → typed error-response definition name. */\n errorDefs: Map;\n /** JSON-RPC method → typed result definition name. */\n resultDefs: Map;\n validatorFor(defName: string): ValidateFunction;\n}\n\nconst compiledSpecs = new Map();\n\n/** Patch known generator bugs in released spec schema.json files at load time\n * so validation matches the schema.ts source of truth; delete each branch (a\n * test trips) once the dated schema is fixed upstream and re-vendored. */\nfunction applySchemaErrata(\n specVersion: SpecVersion,\n schema: Record\n): Record {\n if (specVersion !== '2025-11-25' && specVersion !== '2025-06-18') {\n return schema;\n }\n // NumberSchema minimum/maximum (plus default at 2025-11-25) are generated\n // as `integer`, contradicting schema.ts (`number`). Fixed for draft in\n // modelcontextprotocol#2710; dated fixes proposed in modelcontextprotocol#3139.\n const patched = structuredClone(schema);\n const defs = (patched.$defs ?? patched.definitions) as Record<\n string,\n { properties?: Record }\n >;\n for (const prop of ['minimum', 'maximum', 'default']) {\n const p = defs.NumberSchema?.properties?.[prop];\n if (p?.type === 'integer') p.type = 'number';\n }\n return patched;\n}\n\nfunction compileSpec(specVersion: SpecVersion): CompiledSpec {\n let compiled = compiledSpecs.get(specVersion);\n if (compiled) return compiled;\n\n const schema = applySchemaErrata(specVersion, SCHEMAS[specVersion]);\n const is2020 =\n typeof schema.$schema === 'string' && schema.$schema.includes('2020-12');\n // The spec schemas are not authored for ajv strict mode; validate them\n // as-is rather than editing vendored files.\n const options = { strict: false, allErrors: true } as const;\n const ajv = is2020 ? new Ajv2020(options) : new Ajv(options);\n addFormats(ajv);\n // \"byte\" (base64) is an OpenAPI format ajv-formats doesn't ship; the spec\n // uses it on blob contents. Accept any string rather than reimplementing it.\n ajv.addFormat('byte', true);\n\n const schemaId = `mcp://${schemaDirFor(specVersion)}/schema.json`;\n ajv.addSchema({ ...schema, $id: schemaId });\n\n const defsKey: '$defs' | 'definitions' =\n '$defs' in schema ? '$defs' : 'definitions';\n const defs = schema[defsKey] as Record>;\n\n const methodDefs = new Map();\n const errorDefs = new Map();\n const resultDefs = new Map();\n for (const [name, def] of Object.entries(defs)) {\n if (NON_CANONICAL_DEFS.has(name)) continue;\n const props = (def.properties ?? {}) as Record<\n string,\n Record\n >;\n const method = props.method?.const;\n if (typeof method === 'string') {\n methodDefs.set(method, name);\n if (name.endsWith('Request')) {\n const resultName = `${name.slice(0, -'Request'.length)}Result`;\n if (resultName in defs) resultDefs.set(method, resultName);\n }\n }\n const errorProp = props.error as\n | { allOf?: { properties?: { code?: { const?: unknown } } }[] }\n | undefined;\n for (const part of errorProp?.allOf ?? []) {\n const code = part.properties?.code?.const;\n if (typeof code === 'number') errorDefs.set(code, name);\n }\n }\n\n const validators = new Map();\n compiled = {\n defsKey,\n defs,\n methodDefs,\n errorDefs,\n resultDefs,\n validatorFor(defName: string): ValidateFunction {\n let v = validators.get(defName);\n if (!v) {\n v = ajv.compile({ $ref: `${schemaId}#/${defsKey}/${defName}` });\n validators.set(defName, v);\n }\n return v;\n }\n };\n compiledSpecs.set(specVersion, compiled);\n return compiled;\n}\n\n/** Dispatch maps extracted from a version's schema (method → request/notification def,\n * `error.code` const → error def). Exposed so a unit test can pin them: if a schema sync\n * restructures what the extraction walks, validation silently degrades to envelope-only. */\nexport function specDispatchMaps(specVersion: SpecVersion): {\n methodDefs: ReadonlyMap;\n errorDefs: ReadonlyMap;\n resultDefs: ReadonlyMap;\n} {\n const spec = compileSpec(specVersion);\n return {\n methodDefs: spec.methodDefs,\n errorDefs: spec.errorDefs,\n resultDefs: spec.resultDefs\n };\n}\n\nfunction formatErrors(\n defName: string,\n errors: ErrorObject[] | null | undefined\n): string[] {\n const MAX = 6;\n const formatted = (errors ?? []).map(\n (e) =>\n `${defName}${e.instancePath || ''}: ${e.message ?? 'invalid'}` +\n (e.keyword === 'const' || e.keyword === 'enum'\n ? ` (${JSON.stringify(e.params)})`\n : '')\n );\n if (formatted.length > MAX) {\n return [\n ...formatted.slice(0, MAX),\n `... ${formatted.length - MAX} more error(s)`\n ];\n }\n return formatted.length > 0 ? formatted : [`${defName}: invalid`];\n}\n\n/** Validate a single JSON-RPC message against the given spec version's schema.\n * Returns `[]` when the message is valid. Pure — does not touch the recorder. */\nexport function wireSchemaErrors(\n specVersion: SpecVersion,\n message: unknown,\n requestMethod?: string\n): string[] {\n const spec = compileSpec(specVersion);\n const validateAgainst = (defName: string, value: unknown): string[] => {\n const validate = spec.validatorFor(defName);\n return validate(value) ? [] : formatErrors(defName, validate.errors);\n };\n const firstDef = (...names: string[]): string =>\n names.find((n) => n in spec.defs) ?? names[names.length - 1];\n\n if (Array.isArray(message)) {\n // A batch: only legal where the envelope union admits arrays (2025-03-26).\n // Limitation: `requestMethod` is forwarded to every element, so batched responses all\n // validate against one result type — no caller sends batched requests today.\n const elementErrors = message.flatMap((m, i) =>\n wireSchemaErrors(specVersion, m, requestMethod).map((e) => `[${i}] ${e}`)\n );\n if (elementErrors.length > 0) return elementErrors;\n if (validateAgainst('JSONRPCMessage', message).length > 0) {\n return [\n 'JSONRPCMessage: batch arrays are not valid in this spec version'\n ];\n }\n return [];\n }\n\n const msg = (\n typeof message === 'object' && message !== null ? message : {}\n ) as Record;\n\n // Classify the message and validate against the most specific definition\n // the schema has for it. The typed definitions include the envelope\n // requirements (jsonrpc, id, method, ...), so they subsume the union check.\n if (typeof msg.method === 'string') {\n const defName =\n spec.methodDefs.get(msg.method) ??\n ('id' in msg ? 'JSONRPCRequest' : 'JSONRPCNotification');\n return validateAgainst(defName, message);\n }\n\n if (msg.error !== undefined && msg.error !== null) {\n const code = (msg.error as Record).code;\n const defName =\n (typeof code === 'number' ? spec.errorDefs.get(code) : undefined) ??\n firstDef('JSONRPCErrorResponse', 'JSONRPCError');\n return validateAgainst(defName, message);\n }\n\n if (msg.result !== undefined) {\n // SEP-2322 (MRTR): any request may be answered with an InputRequiredResult\n // instead of its method's result type; discriminate on resultType. Results\n // introduced by a known extension (e.g. the tasks extension's\n // CreateTaskResult, resultType \"task\") use the same open discriminator and\n // are checked against the generic result envelope until their schema is\n // vendored here. Any other resultType is validated as the method's own\n // result (the discriminator is open, so it may be a private extension),\n // and a failure names the unrecognised value so the cause is obvious.\n const resultType = (msg.result as Record | null)\n ?.resultType;\n const inputRequired =\n resultType === 'input_required' && 'InputRequiredResult' in spec.defs;\n const extensionResult =\n typeof resultType === 'string' && EXTENSION_RESULT_TYPES.has(resultType);\n const unrecognisedResultType =\n typeof resultType === 'string' &&\n !CORE_RESULT_TYPES.has(resultType) &&\n !extensionResult\n ? resultType\n : undefined;\n let resultDefName: string | undefined;\n if (inputRequired) {\n resultDefName = 'InputRequiredResult';\n } else if (!extensionResult && requestMethod !== undefined) {\n resultDefName = spec.resultDefs.get(requestMethod);\n }\n if (resultDefName) {\n const hint = unrecognisedResultType\n ? `; resultType '${unrecognisedResultType}' is not a core value or a known extension result (${[...EXTENSION_RESULT_TYPES].map((t) => `'${t}'`).join(', ')}), so it was validated as ${resultDefName}`\n : '';\n const typed = validateAgainst(resultDefName, msg.result).map(\n (e) => `${e} (result of '${requestMethod}')${hint}`\n );\n if (typed.length > 0) return typed;\n }\n return validateAgainst(\n firstDef('JSONRPCResultResponse', 'JSONRPCResponse'),\n message\n );\n }\n\n return [\n 'JSONRPCMessage: not a valid JSON-RPC request, notification, or response'\n ];\n}\n\n// Recorder: choke points record every message; runners (and the vitest hook)\n// drain the accumulated violations per scenario / test. Suite runs execute\n// scenarios concurrently, so each scenario gets its own recorder via\n// AsyncLocalStorage; code outside any scope falls back to the global recorder.\n\ninterface RecorderState {\n violations: WireSchemaViolation[];\n observed: number;\n}\n\nconst recorderStorage = new AsyncLocalStorage();\nconst globalRecorder: RecorderState = { violations: [], observed: 0 };\n\nfunction recorder(): RecorderState {\n return recorderStorage.getStore() ?? globalRecorder;\n}\n\n/** Run `fn` with its own isolated wire recorder. Async work started inside\n * `fn` (mock servers, transport hooks) records into that recorder, so\n * concurrent scenarios in a suite run cannot steal or wipe each other's\n * violations. */\nexport function withWireRecorder(fn: () => Promise): Promise {\n return recorderStorage.run({ violations: [], observed: 0 }, fn);\n}\n\n/** Validate a wire message and record any violation. Called by choke points. */\nexport function validateWireMessage(\n specVersion: SpecVersion,\n message: unknown,\n info: WireMessageInfo\n): void {\n const state = recorder();\n state.observed++;\n const errors = wireSchemaErrors(specVersion, message, info.requestMethod);\n if (errors.length > 0) {\n state.violations.push({\n origin: info.origin,\n specVersion,\n context: info.context,\n errors,\n message\n });\n }\n}\n\nexport function resetWireValidation(): void {\n const state = recorder();\n state.violations = [];\n state.observed = 0;\n}\n\n/** Return everything recorded since the last reset, and reset. */\nexport function takeWireViolations(): {\n violations: WireSchemaViolation[];\n observed: number;\n} {\n const state = recorder();\n const result = { violations: state.violations, observed: state.observed };\n resetWireValidation();\n return result;\n}\n\nfunction violationDetails(v: WireSchemaViolation): Record {\n return {\n origin: v.origin,\n specVersion: v.specVersion,\n context: v.context,\n errors: v.errors,\n message: v.message\n };\n}\n\nexport function formatWireViolation(v: WireSchemaViolation): string {\n return (\n `[${v.origin}] ${v.context} (spec ${v.specVersion}): ` +\n `${v.errors.join('; ')} — message: ${JSON.stringify(v.message)}`\n );\n}\n\n/** Drain the recorder and synthesize the per-scenario conformance checks. Returns `[]`\n * when no wire traffic was observed (e.g. a scenario asserting only on raw HTTP). */\nexport function wireSchemaChecks(specVersion: SpecVersion): ConformanceCheck[] {\n const { violations: all, observed: count } = takeWireViolations();\n if (count === 0 && all.length === 0) return [];\n\n const timestamp = new Date().toISOString();\n const specReferences = [\n {\n id: 'MCP-Schema',\n url: `https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/schema/${schemaDirFor(specVersion)}/schema.json`\n }\n ];\n const checks: ConformanceCheck[] = [];\n\n const implViolations = all.filter((v) => v.origin === 'implementation');\n checks.push({\n id: 'wire-schema-valid',\n name: 'WireSchemaValid',\n description:\n 'Every JSON-RPC message the implementation sent is valid per the spec JSON schema for the negotiated spec version',\n status: implViolations.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences,\n details: {\n messagesValidated: count,\n violations: implViolations.map(violationDetails)\n },\n errorMessage:\n implViolations.length > 0\n ? implViolations.map(formatWireViolation).join('\\n')\n : undefined\n });\n\n const harnessViolations = all.filter((v) => v.origin === 'harness');\n if (harnessViolations.length > 0) {\n checks.push({\n id: 'wire-schema-harness-error',\n name: 'WireSchemaHarnessError',\n description:\n 'HARNESS ERROR: the conformance harness itself sent a JSON-RPC message the spec JSON schema forbids. This is a bug in the harness or a scenario fixture, not in the implementation under test.',\n status: 'FAILURE',\n timestamp,\n specReferences,\n details: { violations: harnessViolations.map(violationDetails) },\n errorMessage:\n 'HARNESS ERROR: ' +\n harnessViolations.map(formatWireViolation).join('\\n')\n });\n }\n\n return checks;\n}\n",[],[142,351,343],"validation","350a5dd7-8482-47d3-9565-b48b78df0516",["D",1789047266375],[308],[142,351],"eaba7930-26ca-4c5c-a594-44c8d6e1ebc7","index.ts","d4e03f20-ad13-11f1-870b-1607ee4eb77e","3756052a-e25a-47bf-b974-d3fdb95d977f",219,["D",1789332091241],"/**\n * Client steering steps (\"generic steering\").\n *\n * Most client scenarios only need plumbing from the client under test:\n * connect, list tools, call a tool, hang around, disconnect. Instead of every\n * SDK's everything-client carrying a per-scenario dispatch table for that\n * choreography, a scenario can declare it as data. The runner ships the\n * steps to the client in MCP_CONFORMANCE_CONTEXT (`context.steps`); a client\n * with no bespoke handler for the scenario name runs a small interpreter over\n * them. Checks stay in the scenario — only the *instructions* become data.\n *\n * The op set is deliberately closed. Anything that needs judgement on the\n * client side (credential modes, MRTR) keeps a named handler.\n *\n * Standing defaults an interpreter should apply without being told:\n * - `initialize` is implicit (connect before the first step);\n * - if the server sends elicitation/create, accept with schema defaults\n * (empty content + `elicitation.applyDefaults` capability);\n * - disconnect after the last step unless a `disconnect` step says when.\n */\n\nimport { z } from 'npm:zod@^4.3.6';\n\n/**\n * `{ \"$from\": \"tools/list\", \"path\": \"tools[name=echo].inputSchema\" }` — a\n * value captured from the most recent result of a previous op. The only\n * dataflow form; two scenarios need it (\"call B with the schema you got for\n * A\"), nothing needs more.\n */\nexport const FromRefSchema = z.object({\n $from: z.enum(['tools/list', 'tools/call']),\n path: z.string()\n});\nexport type FromRef = z.infer;\n\nexport const StepSchema = z.discriminatedUnion('op', [\n z.object({ op: z.literal('tools/list') }),\n z.object({\n op: z.literal('tools/call'),\n name: z.string(),\n /** Argument values may be literals or `$from` captures. */\n arguments: z.record(z.string(), z.unknown()).optional()\n }),\n z.object({ op: z.literal('wait'), ms: z.number().int().nonnegative() }),\n z.object({ op: z.literal('disconnect') })\n]);\nexport type Step = z.infer;\n\nexport const StepsSchema = z.array(StepSchema);\n\n/** Results an interpreter has captured so far, keyed by op. */\nexport type Captures = Partial>;\n\nexport function isFromRef(v: unknown): v is FromRef {\n return (\n typeof v === 'object' &&\n v !== null &&\n '$from' in v &&\n FromRefSchema.safeParse(v).success\n );\n}\n\n/**\n * Resolve a `$from` path against a captured result. Path grammar:\n * dot-separated segments, each either a key (`inputSchema`), an index\n * (`tools[0]`) or a filter on an array of objects (`tools[name=echo]`,\n * first match). Returns undefined when anything along the way is missing —\n * the interpreter should pass that through and let the scenario judge.\n */\nexport function resolveFrom(captures: Captures, ref: FromRef): unknown {\n let cur: unknown = captures[ref.$from];\n for (const seg of ref.path.split('.').filter(Boolean)) {\n const m = seg.match(/^([^[\\]]*)(?:\\[(?:(\\d+)|([^=\\]]+)=([^\\]]*))\\])?$/);\n if (!m) return undefined;\n const [, key, index, fkey, fval] = m;\n if (key) cur = (cur as Record | undefined)?.[key];\n if (index !== undefined) cur = (cur as unknown[] | undefined)?.[+index];\n else if (fkey !== undefined) {\n cur = Array.isArray(cur)\n ? cur.find(\n (x) =>\n typeof x === 'object' &&\n x !== null &&\n String((x as Record)[fkey]) === fval\n )\n : undefined;\n }\n if (cur === undefined) return undefined;\n }\n return cur;\n}\n\n/**\n * One plain line per step, something a person could act on or paste into a\n * chat: \"call add_numbers with a=5 and b=3\". Values are JSON, so a string's\n * edge whitespace and control characters stay visible (`\"\\tindented\"`);\n * `$from` captures are named, not resolved.\n */\nexport function describeStep(step: Step): string {\n switch (step.op) {\n case 'tools/list':\n return 'list the tools';\n case 'tools/call': {\n const args = Object.entries(step.arguments ?? {}).map(\n ([k, v]) => `${k}=${describeValue(v)}`\n );\n return args.length\n ? `call ${step.name} with ${joinWithAnd(args)}`\n : `call ${step.name} with no arguments`;\n }\n case 'wait':\n return `wait ${step.ms} ms`;\n case 'disconnect':\n return 'disconnect';\n }\n}\n\nfunction describeValue(v: unknown): string {\n if (isFromRef(v)) return `(${v.path} from the last ${v.$from} result)`;\n return JSON.stringify(v) ?? String(v);\n}\n\n/** \"a\", \"a and b\", \"a, b and c\". */\nfunction joinWithAnd(items: string[]): string {\n if (items.length < 2) return items.join('');\n return `${items.slice(0, -1).join(', ')} and ${items[items.length - 1]}`;\n}\n\n/** Resolve every `$from` capture in a tools/call arguments object (shallow). */\nexport function resolveArguments(\n captures: Captures,\n args: Record | undefined\n): Record {\n const out: Record = {};\n for (const [k, v] of Object.entries(args ?? {})) {\n out[k] = isFromRef(v) ? resolveFrom(captures, v) : v;\n }\n return out;\n}\n",[],[142,365,357],"steps","f3f1c319-4cc9-46e7-a4c4-caed190ccf19",10,["D",1789043611216],[306],[142,365],"dea2d5fc-7b7d-4afb-93ad-d3939237c727","draft.ts","55057870-ad1c-11f1-855b-1607ee4eb77e","4369c08c-0ac3-4b7a-a420-e9642de938e3",141,["D",1789047262206],"export type JSONValue = string | number | boolean | null | JSONObject | JSONArray;\nexport type JSONObject = {\n [key: string]: JSONValue;\n};\nexport type JSONArray = JSONValue[];\nexport type JSONRPCMessage = JSONRPCRequest | JSONRPCNotification | JSONRPCResponse;\nexport const LATEST_PROTOCOL_VERSION = \"2026-07-28\";\nexport const JSONRPC_VERSION = \"2.0\";\nexport type MetaObject = Record;\nexport interface RequestMetaObject extends MetaObject {\n progressToken?: ProgressToken;\n \"io.modelcontextprotocol/protocolVersion\": string;\n \"io.modelcontextprotocol/clientInfo\"?: Implementation;\n \"io.modelcontextprotocol/clientCapabilities\": ClientCapabilities;\n \"io.modelcontextprotocol/logLevel\"?: LoggingLevel;\n}\nexport interface NotificationMetaObject extends MetaObject {\n \"io.modelcontextprotocol/subscriptionId\"?: RequestId;\n}\nexport interface ResultMetaObject extends MetaObject {\n \"io.modelcontextprotocol/serverInfo\"?: Implementation;\n}\nexport type ProgressToken = string | number;\nexport type Cursor = string;\nexport interface RequestParams {\n _meta: RequestMetaObject;\n}\nexport interface Request {\n method: string;\n params?: {\n [key: string]: any;\n };\n}\nexport interface NotificationParams {\n _meta?: NotificationMetaObject;\n}\nexport interface Notification {\n method: string;\n params?: {\n [key: string]: any;\n };\n}\nexport type ResultType = \"complete\" | \"input_required\" | string;\nexport interface Result {\n _meta?: ResultMetaObject;\n resultType: ResultType;\n [key: string]: unknown;\n}\nexport interface Error {\n code: number;\n message: string;\n data?: unknown;\n}\nexport type RequestId = string | number;\nexport interface JSONRPCRequest extends Request {\n jsonrpc: typeof JSONRPC_VERSION;\n id: RequestId;\n}\nexport interface JSONRPCNotification extends Notification {\n jsonrpc: typeof JSONRPC_VERSION;\n}\nexport interface JSONRPCResultResponse {\n jsonrpc: typeof JSONRPC_VERSION;\n id: RequestId;\n result: Result;\n}\nexport interface JSONRPCErrorResponse {\n jsonrpc: typeof JSONRPC_VERSION;\n id?: RequestId;\n error: Error;\n}\nexport type JSONRPCResponse = JSONRPCResultResponse | JSONRPCErrorResponse;\nexport const PARSE_ERROR = -32700;\nexport const INVALID_REQUEST = -32600;\nexport const METHOD_NOT_FOUND = -32601;\nexport const INVALID_PARAMS = -32602;\nexport const INTERNAL_ERROR = -32603;\nexport interface ParseError extends Error {\n code: typeof PARSE_ERROR;\n}\nexport interface InvalidRequestError extends Error {\n code: typeof INVALID_REQUEST;\n}\nexport interface MethodNotFoundError extends Error {\n code: typeof METHOD_NOT_FOUND;\n}\nexport interface InvalidParamsError extends Error {\n code: typeof INVALID_PARAMS;\n}\nexport interface InternalError extends Error {\n code: typeof INTERNAL_ERROR;\n}\nexport const HEADER_MISMATCH = -32020;\nexport const MISSING_REQUIRED_CLIENT_CAPABILITY = -32021;\nexport const UNSUPPORTED_PROTOCOL_VERSION = -32022;\nexport interface HeaderMismatchError extends Omit {\n error: Error & {\n code: typeof HEADER_MISMATCH;\n };\n}\nexport interface UnsupportedProtocolVersionError extends Omit {\n error: Error & {\n code: typeof UNSUPPORTED_PROTOCOL_VERSION;\n data: {\n supported: string[];\n requested: string;\n };\n };\n}\nexport interface MissingRequiredClientCapabilityError extends Omit {\n error: Error & {\n code: typeof MISSING_REQUIRED_CLIENT_CAPABILITY;\n data: {\n requiredCapabilities: ClientCapabilities;\n };\n };\n}\nexport type EmptyResult = Result;\nexport type InputRequest = CreateMessageRequest | ListRootsRequest | ElicitRequest;\nexport type InputResponse = CreateMessageResult | ListRootsResult | ElicitResult;\nexport interface InputRequests {\n [key: string]: InputRequest;\n}\nexport interface InputResponses {\n [key: string]: InputResponse;\n}\nexport interface InputRequiredResult extends Result {\n inputRequests?: InputRequests;\n requestState?: string;\n}\nexport interface InputResponseRequestParams extends RequestParams {\n inputResponses?: InputResponses;\n requestState?: string;\n}\nexport interface CancelledNotificationParams extends NotificationParams {\n requestId: RequestId;\n reason?: string;\n}\nexport interface CancelledNotification extends JSONRPCNotification {\n method: \"notifications/cancelled\";\n params: CancelledNotificationParams;\n}\nexport interface DiscoverRequest extends JSONRPCRequest {\n method: \"server/discover\";\n params: RequestParams;\n}\nexport interface DiscoverResult extends CacheableResult {\n supportedVersions: string[];\n capabilities: ServerCapabilities;\n instructions?: string;\n}\nexport interface DiscoverResultResponse extends JSONRPCResultResponse {\n result: DiscoverResult;\n}\nexport interface ClientCapabilities {\n experimental?: {\n [key: string]: JSONObject;\n };\n roots?: {};\n sampling?: {\n context?: JSONObject;\n tools?: JSONObject;\n };\n elicitation?: {\n form?: JSONObject;\n url?: JSONObject;\n };\n extensions?: {\n [key: string]: JSONObject;\n };\n}\nexport interface ServerCapabilities {\n experimental?: {\n [key: string]: JSONObject;\n };\n logging?: JSONObject;\n completions?: JSONObject;\n prompts?: {\n listChanged?: boolean;\n };\n resources?: {\n subscribe?: boolean;\n listChanged?: boolean;\n };\n tools?: {\n listChanged?: boolean;\n };\n extensions?: {\n [key: string]: JSONObject;\n };\n}\nexport interface Icon {\n src: string;\n mimeType?: string;\n sizes?: string[];\n theme?: \"light\" | \"dark\";\n}\nexport interface Icons {\n icons?: Icon[];\n}\nexport interface BaseMetadata {\n name: string;\n title?: string;\n}\nexport interface Implementation extends BaseMetadata, Icons {\n version: string;\n description?: string;\n websiteUrl?: string;\n}\nexport interface ProgressNotificationParams extends NotificationParams {\n progressToken: ProgressToken;\n progress: number;\n total?: number;\n message?: string;\n}\nexport interface ProgressNotification extends JSONRPCNotification {\n method: \"notifications/progress\";\n params: ProgressNotificationParams;\n}\nexport interface PaginatedRequestParams extends RequestParams {\n cursor?: Cursor;\n}\nexport interface PaginatedRequest extends JSONRPCRequest {\n params: PaginatedRequestParams;\n}\nexport interface PaginatedResult extends Result {\n nextCursor?: Cursor;\n}\nexport interface CacheableResult extends Result {\n ttlMs: number;\n cacheScope: \"public\" | \"private\";\n}\nexport interface ListResourcesRequest extends PaginatedRequest {\n method: \"resources/list\";\n}\nexport interface ListResourcesResult extends PaginatedResult, CacheableResult {\n resources: Resource[];\n}\nexport interface ListResourcesResultResponse extends JSONRPCResultResponse {\n result: ListResourcesResult;\n}\nexport interface ListResourceTemplatesRequest extends PaginatedRequest {\n method: \"resources/templates/list\";\n}\nexport interface ListResourceTemplatesResult extends PaginatedResult, CacheableResult {\n resourceTemplates: ResourceTemplate[];\n}\nexport interface ListResourceTemplatesResultResponse extends JSONRPCResultResponse {\n result: ListResourceTemplatesResult;\n}\nexport interface ResourceRequestParams extends RequestParams {\n uri: string;\n}\nexport interface ReadResourceRequestParams extends ResourceRequestParams, InputResponseRequestParams {\n}\nexport interface ReadResourceRequest extends JSONRPCRequest {\n method: \"resources/read\";\n params: ReadResourceRequestParams;\n}\nexport interface ReadResourceResult extends CacheableResult {\n contents: (TextResourceContents | BlobResourceContents)[];\n}\nexport interface ReadResourceResultResponse extends JSONRPCResultResponse {\n result: ReadResourceResult | InputRequiredResult;\n}\nexport interface ResourceListChangedNotification extends JSONRPCNotification {\n method: \"notifications/resources/list_changed\";\n params?: NotificationParams;\n}\nexport interface SubscriptionFilter {\n toolsListChanged?: boolean;\n promptsListChanged?: boolean;\n resourcesListChanged?: boolean;\n resourceSubscriptions?: string[];\n}\nexport interface SubscriptionsListenRequestParams extends RequestParams {\n notifications: SubscriptionFilter;\n}\nexport interface SubscriptionsListenRequest extends JSONRPCRequest {\n method: \"subscriptions/listen\";\n params: SubscriptionsListenRequestParams;\n}\nexport interface SubscriptionsListenResultMeta extends ResultMetaObject {\n \"io.modelcontextprotocol/subscriptionId\": RequestId;\n}\nexport interface SubscriptionsListenResult extends Result {\n _meta: SubscriptionsListenResultMeta;\n}\nexport interface SubscriptionsAcknowledgedNotificationParams extends NotificationParams {\n notifications: SubscriptionFilter;\n}\nexport interface SubscriptionsAcknowledgedNotification extends JSONRPCNotification {\n method: \"notifications/subscriptions/acknowledged\";\n params: SubscriptionsAcknowledgedNotificationParams;\n}\nexport interface ResourceUpdatedNotificationParams extends NotificationParams {\n uri: string;\n}\nexport interface ResourceUpdatedNotification extends JSONRPCNotification {\n method: \"notifications/resources/updated\";\n params: ResourceUpdatedNotificationParams;\n}\nexport interface Resource extends BaseMetadata, Icons {\n uri: string;\n description?: string;\n mimeType?: string;\n annotations?: Annotations;\n size?: number;\n _meta?: MetaObject;\n}\nexport interface ResourceTemplate extends BaseMetadata, Icons {\n uriTemplate: string;\n description?: string;\n mimeType?: string;\n annotations?: Annotations;\n _meta?: MetaObject;\n}\nexport interface ResourceContents {\n uri: string;\n mimeType?: string;\n _meta?: MetaObject;\n}\nexport interface TextResourceContents extends ResourceContents {\n text: string;\n}\nexport interface BlobResourceContents extends ResourceContents {\n blob: string;\n}\nexport interface ListPromptsRequest extends PaginatedRequest {\n method: \"prompts/list\";\n}\nexport interface ListPromptsResult extends PaginatedResult, CacheableResult {\n prompts: Prompt[];\n}\nexport interface ListPromptsResultResponse extends JSONRPCResultResponse {\n result: ListPromptsResult;\n}\nexport interface GetPromptRequestParams extends InputResponseRequestParams {\n name: string;\n arguments?: {\n [key: string]: string;\n };\n}\nexport interface GetPromptRequest extends JSONRPCRequest {\n method: \"prompts/get\";\n params: GetPromptRequestParams;\n}\nexport interface GetPromptResult extends Result {\n description?: string;\n messages: PromptMessage[];\n}\nexport interface GetPromptResultResponse extends JSONRPCResultResponse {\n result: GetPromptResult | InputRequiredResult;\n}\nexport interface Prompt extends BaseMetadata, Icons {\n description?: string;\n arguments?: PromptArgument[];\n _meta?: MetaObject;\n}\nexport interface PromptArgument extends BaseMetadata {\n description?: string;\n required?: boolean;\n}\nexport type Role = \"user\" | \"assistant\";\nexport interface PromptMessage {\n role: Role;\n content: ContentBlock;\n}\nexport interface ResourceLink extends Resource {\n type: \"resource_link\";\n}\nexport interface EmbeddedResource {\n type: \"resource\";\n resource: TextResourceContents | BlobResourceContents;\n annotations?: Annotations;\n _meta?: MetaObject;\n}\nexport interface PromptListChangedNotification extends JSONRPCNotification {\n method: \"notifications/prompts/list_changed\";\n params?: NotificationParams;\n}\nexport interface ListToolsRequest extends PaginatedRequest {\n method: \"tools/list\";\n}\nexport interface ListToolsResult extends PaginatedResult, CacheableResult {\n tools: Tool[];\n}\nexport interface ListToolsResultResponse extends JSONRPCResultResponse {\n result: ListToolsResult;\n}\nexport interface CallToolResult extends Result {\n content: ContentBlock[];\n structuredContent?: unknown;\n isError?: boolean;\n}\nexport interface CallToolResultResponse extends JSONRPCResultResponse {\n result: CallToolResult | InputRequiredResult;\n}\nexport interface CallToolRequestParams extends InputResponseRequestParams {\n name: string;\n arguments?: {\n [key: string]: unknown;\n };\n}\nexport interface CallToolRequest extends JSONRPCRequest {\n method: \"tools/call\";\n params: CallToolRequestParams;\n}\nexport interface ToolListChangedNotification extends JSONRPCNotification {\n method: \"notifications/tools/list_changed\";\n params?: NotificationParams;\n}\nexport interface ToolAnnotations {\n title?: string;\n readOnlyHint?: boolean;\n destructiveHint?: boolean;\n idempotentHint?: boolean;\n openWorldHint?: boolean;\n}\nexport interface Tool extends BaseMetadata, Icons {\n description?: string;\n inputSchema: {\n $schema?: string;\n type: \"object\";\n [key: string]: unknown;\n };\n outputSchema?: {\n $schema?: string;\n [key: string]: unknown;\n };\n annotations?: ToolAnnotations;\n _meta?: MetaObject;\n}\nexport interface LoggingMessageNotificationParams extends NotificationParams {\n level: LoggingLevel;\n logger?: string;\n data: unknown;\n}\nexport interface LoggingMessageNotification extends JSONRPCNotification {\n method: \"notifications/message\";\n params: LoggingMessageNotificationParams;\n}\nexport type LoggingLevel = \"debug\" | \"info\" | \"notice\" | \"warning\" | \"error\" | \"critical\" | \"alert\" | \"emergency\";\nexport interface CreateMessageRequestParams {\n messages: SamplingMessage[];\n modelPreferences?: ModelPreferences;\n systemPrompt?: string;\n includeContext?: \"none\" | \"thisServer\" | \"allServers\";\n temperature?: number;\n maxTokens: number;\n stopSequences?: string[];\n metadata?: JSONObject;\n tools?: Tool[];\n toolChoice?: ToolChoice;\n}\nexport interface ToolChoice {\n mode?: \"auto\" | \"required\" | \"none\";\n}\nexport interface CreateMessageRequest {\n method: \"sampling/createMessage\";\n params: CreateMessageRequestParams;\n}\nexport interface CreateMessageResult extends SamplingMessage {\n model: string;\n stopReason?: \"endTurn\" | \"stopSequence\" | \"maxTokens\" | \"toolUse\" | string;\n}\nexport interface SamplingMessage {\n role: Role;\n content: SamplingMessageContentBlock | SamplingMessageContentBlock[];\n _meta?: MetaObject;\n}\nexport type SamplingMessageContentBlock = TextContent | ImageContent | AudioContent | ToolUseContent | ToolResultContent;\nexport interface Annotations {\n audience?: Role[];\n priority?: number;\n lastModified?: string;\n}\nexport type ContentBlock = TextContent | ImageContent | AudioContent | ResourceLink | EmbeddedResource;\nexport interface TextContent {\n type: \"text\";\n text: string;\n annotations?: Annotations;\n _meta?: MetaObject;\n}\nexport interface ImageContent {\n type: \"image\";\n data: string;\n mimeType: string;\n annotations?: Annotations;\n _meta?: MetaObject;\n}\nexport interface AudioContent {\n type: \"audio\";\n data: string;\n mimeType: string;\n annotations?: Annotations;\n _meta?: MetaObject;\n}\nexport interface ToolUseContent {\n type: \"tool_use\";\n id: string;\n name: string;\n input: {\n [key: string]: unknown;\n };\n _meta?: MetaObject;\n}\nexport interface ToolResultContent {\n type: \"tool_result\";\n toolUseId: string;\n content: ContentBlock[];\n structuredContent?: unknown;\n isError?: boolean;\n _meta?: MetaObject;\n}\nexport interface ModelPreferences {\n hints?: ModelHint[];\n costPriority?: number;\n speedPriority?: number;\n intelligencePriority?: number;\n}\nexport interface ModelHint {\n name?: string;\n}\nexport interface CompleteRequestParams extends RequestParams {\n ref: PromptReference | ResourceTemplateReference;\n argument: {\n name: string;\n value: string;\n };\n context?: {\n arguments?: {\n [key: string]: string;\n };\n };\n}\nexport interface CompleteRequest extends JSONRPCRequest {\n method: \"completion/complete\";\n params: CompleteRequestParams;\n}\nexport interface CompleteResult extends Result {\n completion: {\n values: string[];\n total?: number;\n hasMore?: boolean;\n };\n}\nexport interface CompleteResultResponse extends JSONRPCResultResponse {\n result: CompleteResult;\n}\nexport interface ResourceTemplateReference {\n type: \"ref/resource\";\n uri: string;\n}\nexport interface PromptReference extends BaseMetadata {\n type: \"ref/prompt\";\n}\nexport interface ListRootsRequest {\n method: \"roots/list\";\n params?: {\n _meta?: MetaObject;\n };\n}\nexport interface ListRootsResult {\n roots: Root[];\n}\nexport interface Root {\n uri: string;\n name?: string;\n _meta?: MetaObject;\n}\nexport interface ElicitRequestFormParams {\n mode?: \"form\";\n message: string;\n requestedSchema: {\n $schema?: string;\n type: \"object\";\n properties: {\n [key: string]: PrimitiveSchemaDefinition;\n };\n required?: string[];\n };\n}\nexport interface ElicitRequestURLParams {\n mode: \"url\";\n message: string;\n url: string;\n}\nexport type ElicitRequestParams = ElicitRequestFormParams | ElicitRequestURLParams;\nexport interface ElicitRequest {\n method: \"elicitation/create\";\n params: ElicitRequestParams;\n}\nexport type PrimitiveSchemaDefinition = StringSchema | NumberSchema | BooleanSchema | EnumSchema;\nexport interface StringSchema {\n type: \"string\";\n title?: string;\n description?: string;\n minLength?: number;\n maxLength?: number;\n format?: \"email\" | \"uri\" | \"date\" | \"date-time\";\n default?: string;\n}\nexport interface NumberSchema {\n type: \"number\" | \"integer\";\n title?: string;\n description?: string;\n minimum?: number;\n maximum?: number;\n default?: number;\n}\nexport interface BooleanSchema {\n type: \"boolean\";\n title?: string;\n description?: string;\n default?: boolean;\n}\nexport interface UntitledSingleSelectEnumSchema {\n type: \"string\";\n title?: string;\n description?: string;\n enum: string[];\n default?: string;\n}\nexport interface TitledSingleSelectEnumSchema {\n type: \"string\";\n title?: string;\n description?: string;\n oneOf: Array<{\n const: string;\n title: string;\n }>;\n default?: string;\n}\nexport type SingleSelectEnumSchema = UntitledSingleSelectEnumSchema | TitledSingleSelectEnumSchema;\nexport interface UntitledMultiSelectEnumSchema {\n type: \"array\";\n title?: string;\n description?: string;\n minItems?: number;\n maxItems?: number;\n items: {\n type: \"string\";\n enum: string[];\n };\n default?: string[];\n}\nexport interface TitledMultiSelectEnumSchema {\n type: \"array\";\n title?: string;\n description?: string;\n minItems?: number;\n maxItems?: number;\n items: {\n anyOf: Array<{\n const: string;\n title: string;\n }>;\n };\n default?: string[];\n}\nexport type MultiSelectEnumSchema = UntitledMultiSelectEnumSchema | TitledMultiSelectEnumSchema;\nexport interface LegacyTitledEnumSchema {\n type: \"string\";\n title?: string;\n description?: string;\n enum: string[];\n enumNames?: string[];\n default?: string;\n}\nexport type EnumSchema = SingleSelectEnumSchema | MultiSelectEnumSchema | LegacyTitledEnumSchema;\nexport interface ElicitResult {\n action: \"accept\" | \"decline\" | \"cancel\";\n content?: {\n [key: string]: string | number | boolean | string[];\n };\n}\nexport type ClientRequest = DiscoverRequest | CompleteRequest | GetPromptRequest | ListPromptsRequest | ListResourcesRequest | ListResourceTemplatesRequest | ReadResourceRequest | SubscriptionsListenRequest | CallToolRequest | ListToolsRequest;\nexport type ClientNotification = CancelledNotification;\nexport type ClientResult = EmptyResult;\nexport type ServerNotification = CancelledNotification | ProgressNotification | LoggingMessageNotification | ResourceUpdatedNotification | ResourceListChangedNotification | ToolListChangedNotification | PromptListChangedNotification | SubscriptionsAcknowledgedNotification;\nexport type ServerResult = EmptyResult | DiscoverResult | CompleteResult | GetPromptResult | ListPromptsResult | ListResourceTemplatesResult | ListResourcesResult | ReadResourceResult | SubscriptionsListenResult | CallToolResult | ListToolsResult | InputRequiredResult;\n",[],[142,380,372],"spec-types","12332fa3-d439-4110-b807-4fd7e2cd15f9","draft.schema.json.ts","5b816290-ad1c-11f1-9be2-1607ee4eb77e",154,["D",1789047273073],"import p0 from './draft.schema.json.part0.ts';\nimport p1 from './draft.schema.json.part1.ts';\nexport default JSON.parse(p0 + p1);\n",[],[142,380,382],"375cc913-07c5-4ec7-b13e-44100b241fc4","draft.schema.json.part1.ts","5aff35e0-ad1c-11f1-9239-1607ee4eb77e",153,["D",1789047272237],"export default \"escription\\\":\\\"The progress thus far. This should increase every time progress is made, even if the total is unknown.\\\",\\\"type\\\":\\\"number\\\"},\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"The progress token which was given in the initial request, used to associate this notification with the request that is proceeding.\\\"},\\\"total\\\":{\\\"description\\\":\\\"Total number of items to process (or total progress required), if known.\\\",\\\"type\\\":\\\"number\\\"}},\\\"required\\\":[\\\"progress\\\",\\\"progressToken\\\"],\\\"type\\\":\\\"object\\\"},\\\"ProgressToken\\\":{\\\"description\\\":\\\"A progress token, used to associate progress notifications with the original request.\\\",\\\"type\\\":[\\\"string\\\",\\\"integer\\\"]},\\\"Prompt\\\":{\\\"description\\\":\\\"A prompt or prompt template that the server offers.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"arguments\\\":{\\\"description\\\":\\\"A list of arguments to use for templating the prompt.\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/PromptArgument\\\"},\\\"type\\\":\\\"array\\\"},\\\"description\\\":{\\\"description\\\":\\\"An optional description of what this prompt provides\\\",\\\"type\\\":\\\"string\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for {@link Tool},\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"PromptArgument\\\":{\\\"description\\\":\\\"Describes an argument that a prompt can accept.\\\",\\\"properties\\\":{\\\"description\\\":{\\\"description\\\":\\\"A human-readable description of the argument.\\\",\\\"type\\\":\\\"string\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"required\\\":{\\\"description\\\":\\\"Whether this argument must be provided.\\\",\\\"type\\\":\\\"boolean\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for {@link Tool},\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"PromptListChangedNotification\\\":{\\\"description\\\":\\\"An optional notification from the server to the client, informing it that the list of prompts it offers has changed. This is only delivered on a {@link SubscriptionsListenRequestsubscriptions/listen} stream when the client requested it via the `promptsListChanged` filter field.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/prompts/list_changed\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"PromptMessage\\\":{\\\"description\\\":\\\"Describes a message returned as part of a prompt.\\\\n\\\\nThis is similar to {@link SamplingMessage}, but also supports the embedding of\\\\nresources from the MCP server.\\\",\\\"properties\\\":{\\\"content\\\":{\\\"$ref\\\":\\\"#/$defs/ContentBlock\\\"},\\\"role\\\":{\\\"$ref\\\":\\\"#/$defs/Role\\\"}},\\\"required\\\":[\\\"content\\\",\\\"role\\\"],\\\"type\\\":\\\"object\\\"},\\\"PromptReference\\\":{\\\"description\\\":\\\"Identifies a prompt.\\\",\\\"properties\\\":{\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for {@link Tool},\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"ref/prompt\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"ReadResourceRequest\\\":{\\\"description\\\":\\\"Sent from the client to the server, to read a specific resource URI.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"resources/read\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/ReadResourceRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ReadResourceRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `resources/read` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/RequestMetaObject\\\"},\\\"inputResponses\\\":{\\\"$ref\\\":\\\"#/$defs/InputResponses\\\"},\\\"requestState\\\":{\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of the resource. The URI can use any protocol; it is up to the server how to interpret it.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"_meta\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ReadResourceResult\\\":{\\\"description\\\":\\\"The result returned by the server for a {@link ReadResourceRequestresources/read} request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"cacheScope\\\":{\\\"description\\\":\\\"Indicates the intended scope of the cached response, analogous to HTTP\\\\n`Cache-Control: public` vs `Cache-Control: private`.\\\\n\\\\n- `\\\\\\\"public\\\\\\\"`: The response does not contain user-specific data. Any\\\\n client or intermediary (e.g., shared gateway, caching proxy) MAY cache\\\\n the response and serve it across authorization contexts.\\\\n- `\\\\\\\"private\\\\\\\"`: The response MAY be cached and reused only within the\\\\n same authorization context. Caches MUST NOT be shared across\\\\n authorization contexts (e.g., a different access token requires a\\\\n different cache).\\\",\\\"enum\\\":[\\\"private\\\",\\\"public\\\"],\\\"type\\\":\\\"string\\\"},\\\"contents\\\":{\\\"items\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextResourceContents\\\"},{\\\"$ref\\\":\\\"#/$defs/BlobResourceContents\\\"}]},\\\"type\\\":\\\"array\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"},\\\"ttlMs\\\":{\\\"description\\\":\\\"A hint from the server indicating how long (in milliseconds) the\\\\nclient MAY cache this response before re-fetching. Semantics are\\\\nanalogous to HTTP Cache-Control max-age.\\\\n\\\\n- If 0, The response SHOULD be considered immediately stale,\\\\n The client MAY re-fetch every time the result is needed.\\\\n- If positive, the client SHOULD consider the result fresh for this many\\\\n milliseconds after receiving the response.\\\",\\\"minimum\\\":0,\\\"type\\\":\\\"integer\\\"}},\\\"required\\\":[\\\"cacheScope\\\",\\\"contents\\\",\\\"resultType\\\",\\\"ttlMs\\\"],\\\"type\\\":\\\"object\\\"},\\\"ReadResourceResultResponse\\\":{\\\"description\\\":\\\"A successful response from the server for a {@link ReadResourceRequestresources/read} request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"result\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/InputRequiredResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ReadResourceResult\\\"}]}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"result\\\"],\\\"type\\\":\\\"object\\\"},\\\"Request\\\":{\\\"properties\\\":{\\\"method\\\":{\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"additionalProperties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"RequestId\\\":{\\\"description\\\":\\\"A uniquely identifying ID for a request in JSON-RPC.\\\",\\\"type\\\":[\\\"string\\\",\\\"integer\\\"]},\\\"RequestMetaObject\\\":{\\\"description\\\":\\\"Extends {@link MetaObject} with additional request-specific fields. All key naming rules from `MetaObject` apply.\\\",\\\"properties\\\":{\\\"io.modelcontextprotocol/clientCapabilities\\\":{\\\"$ref\\\":\\\"#/$defs/ClientCapabilities\\\",\\\"description\\\":\\\"The client's capabilities for this specific request. Required.\\\\n\\\\nCapabilities are declared per-request rather than once at initialization;\\\\nan empty object means the client supports no optional capabilities.\\\\nServers MUST NOT infer capabilities from prior requests.\\\"},\\\"io.modelcontextprotocol/clientInfo\\\":{\\\"$ref\\\":\\\"#/$defs/Implementation\\\",\\\"description\\\":\\\"Identifies the client software making the request. Clients SHOULD\\\\ninclude this field on every request unless specifically configured not\\\\nto do so.\\\\n\\\\nThe {@link Implementation} schema requires `name` and `version`; other\\\\nfields are optional.\\\\n\\\\nThe value is self-reported by the client and is not verified by the\\\\nprotocol. It is intended for display, logging, and debugging. Servers\\\\nSHOULD NOT use it to change their behavior, and SHOULD NOT rely on it for\\\\nsecurity decisions.\\\"},\\\"io.modelcontextprotocol/logLevel\\\":{\\\"$ref\\\":\\\"#/$defs/LoggingLevel\\\",\\\"description\\\":\\\"The desired log level for this request. Optional.\\\\n\\\\nIf absent, the server MUST NOT send any {@link LoggingMessageNotificationnotifications/message}\\\\nnotifications for this request. The client opts in to log messages by\\\\nexplicitly setting a level. Replaces the former `logging/setLevel` RPC.\\\"},\\\"io.modelcontextprotocol/protocolVersion\\\":{\\\"description\\\":\\\"The MCP Protocol Version being used for this request. Required.\\\\n\\\\nFor the HTTP transport, this value MUST match the `MCP-Protocol-Version`\\\\nheader; otherwise the server MUST return a `400 Bad Request`. If the\\\\nserver does not support the requested version, it MUST return an\\\\n{@link UnsupportedProtocolVersionError}.\\\",\\\"type\\\":\\\"string\\\"},\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by {@link ProgressNotificationnotifications/progress}). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"required\\\":[\\\"io.modelcontextprotocol/clientCapabilities\\\",\\\"io.modelcontextprotocol/protocolVersion\\\"],\\\"type\\\":\\\"object\\\"},\\\"RequestParams\\\":{\\\"description\\\":\\\"Common params for any request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/RequestMetaObject\\\"}},\\\"required\\\":[\\\"_meta\\\"],\\\"type\\\":\\\"object\\\"},\\\"Resource\\\":{\\\"description\\\":\\\"A known resource that the server is capable of reading.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"description\\\":{\\\"description\\\":\\\"A description of what this resource represents.\\\\n\\\\nThis can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \\\\\\\"hint\\\\\\\" to the model.\\\",\\\"type\\\":\\\"string\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of this resource, if known.\\\",\\\"type\\\":\\\"string\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"size\\\":{\\\"description\\\":\\\"The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.\\\\n\\\\nThis can be used by Hosts to display file sizes and estimate context window usage.\\\",\\\"type\\\":\\\"integer\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for {@link Tool},\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of this resource.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceContents\\\":{\\\"description\\\":\\\"The contents of a specific resource or sub-resource.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of this resource, if known.\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of this resource.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceLink\\\":{\\\"description\\\":\\\"A resource that the server is capable of reading, included in a prompt or tool call result.\\\\n\\\\nNote: resource links returned by tools are not guaranteed to appear in the results of {@link ListResourcesRequestresources/list} requests.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"description\\\":{\\\"description\\\":\\\"A description of what this resource represents.\\\\n\\\\nThis can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \\\\\\\"hint\\\\\\\" to the model.\\\",\\\"type\\\":\\\"string\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of this resource, if known.\\\",\\\"type\\\":\\\"string\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"size\\\":{\\\"description\\\":\\\"The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.\\\\n\\\\nThis can be used by Hosts to display file sizes and estimate context window usage.\\\",\\\"type\\\":\\\"integer\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for {@link Tool},\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"resource_link\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of this resource.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"type\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceListChangedNotification\\\":{\\\"description\\\":\\\"An optional notification from the server to the client, informing it that the list of resources it can read from has changed. This is only delivered on a {@link SubscriptionsListenRequestsubscriptions/listen} stream when the client requested it via the `resourcesListChanged` filter field.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/resources/list_changed\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceRequestParams\\\":{\\\"description\\\":\\\"Common params for resource-related requests.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/RequestMetaObject\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of the resource. The URI can use any protocol; it is up to the server how to interpret it.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"_meta\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceTemplate\\\":{\\\"description\\\":\\\"A template description for resources available on the server.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"description\\\":{\\\"description\\\":\\\"A description of what this template is for.\\\\n\\\\nThis can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \\\\\\\"hint\\\\\\\" to the model.\\\",\\\"type\\\":\\\"string\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type for all resources that match this template. This should only be included if all resources matching this template have the same type.\\\",\\\"type\\\":\\\"string\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for {@link Tool},\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"},\\\"uriTemplate\\\":{\\\"description\\\":\\\"A URI template (according to RFC 6570) that can be used to construct resource URIs.\\\",\\\"format\\\":\\\"uri-template\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"uriTemplate\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceTemplateReference\\\":{\\\"description\\\":\\\"A reference to a resource or resource template definition.\\\",\\\"properties\\\":{\\\"type\\\":{\\\"const\\\":\\\"ref/resource\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI or URI template of the resource.\\\",\\\"format\\\":\\\"uri-template\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"type\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceUpdatedNotification\\\":{\\\"description\\\":\\\"A notification from the server to the client, informing it that a resource has changed and may need to be read again. This is only sent for resources the client opted in to via the `resourceSubscriptions` field of a {@link SubscriptionsListenRequestsubscriptions/listen} request.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/resources/updated\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/ResourceUpdatedNotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceUpdatedNotificationParams\\\":{\\\"description\\\":\\\"Parameters for a `notifications/resources/updated` notification.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationMetaObject\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of the resource that has been updated. This might be a sub-resource of the one that the client actually subscribed to.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"Result\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"Common result fields.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"resultType\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResultMetaObject\\\":{\\\"description\\\":\\\"Extends {@link MetaObject} with additional result-specific fields. All key naming rules from `MetaObject` apply.\\\",\\\"properties\\\":{\\\"io.modelcontextprotocol/serverInfo\\\":{\\\"$ref\\\":\\\"#/$defs/Implementation\\\",\\\"description\\\":\\\"Identifies the server software producing the response. Servers SHOULD\\\\ninclude this field on every response unless specifically configured not\\\\nto do so.\\\\n\\\\nThe {@link Implementation} schema requires `name` and `version`; other\\\\nfields are optional.\\\\n\\\\nThe value is self-reported by the server and is not verified by the\\\\nprotocol. It is intended for display, logging, and debugging. Clients\\\\nSHOULD NOT use it to change their behavior, and SHOULD NOT rely on it for\\\\nsecurity decisions.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ResultType\\\":{\\\"description\\\":\\\"Indicates the type of a {@link Result} object, allowing the client to\\\\ndetermine how to parse the response.\\\\n\\\\ncomplete - the request completed successfully and the result contains the final content.\\\\ninput_required - the request requires additional input and the result contains an {@link InputRequiredResult} object with instructions for the client to provide additional input before retrying the original request.\\\",\\\"type\\\":\\\"string\\\"},\\\"Role\\\":{\\\"description\\\":\\\"The sender or recipient of messages and data in a conversation.\\\",\\\"enum\\\":[\\\"assistant\\\",\\\"user\\\"],\\\"type\\\":\\\"string\\\"},\\\"Root\\\":{\\\"description\\\":\\\"Represents a root directory or file that the server can operate on.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"name\\\":{\\\"description\\\":\\\"An optional name for the root. This can be used to provide a human-readable\\\\nidentifier for the root, which may be useful for display purposes or for\\\\nreferencing the root in other parts of the application.\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI identifying the root. This *must* start with `file://` for now.\\\\nThis restriction may be relaxed in future versions of the protocol to allow\\\\nother URI schemes.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"SamplingMessage\\\":{\\\"description\\\":\\\"Describes a message issued to or received from an LLM API.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"content\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ImageContent\\\"},{\\\"$ref\\\":\\\"#/$defs/AudioContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolUseContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolResultContent\\\"},{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/SamplingMessageContentBlock\\\"},\\\"type\\\":\\\"array\\\"}]},\\\"role\\\":{\\\"$ref\\\":\\\"#/$defs/Role\\\"}},\\\"required\\\":[\\\"content\\\",\\\"role\\\"],\\\"type\\\":\\\"object\\\"},\\\"SamplingMessageContentBlock\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ImageContent\\\"},{\\\"$ref\\\":\\\"#/$defs/AudioContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolUseContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolResultContent\\\"}]},\\\"ServerCapabilities\\\":{\\\"description\\\":\\\"Capabilities that a server may support. Known capabilities are defined here, in this schema, but this is not a closed set: any server can define its own, additional capabilities.\\\",\\\"properties\\\":{\\\"completions\\\":{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\",\\\"description\\\":\\\"Present if the server supports argument autocompletion suggestions.\\\"},\\\"experimental\\\":{\\\"additionalProperties\\\":{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\"},\\\"description\\\":\\\"Experimental, non-standard capabilities that the server supports.\\\",\\\"type\\\":\\\"object\\\"},\\\"extensions\\\":{\\\"additionalProperties\\\":{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\"},\\\"description\\\":\\\"Optional MCP extensions that the server supports. Keys are extension identifiers\\\\n(e.g., \\\\\\\"io.modelcontextprotocol/tasks\\\\\\\"), and values are per-extension settings\\\\nobjects. An empty object indicates support with no settings.\\\\n\\\\nKeys MUST follow the {@link MetaObject`_meta` key naming rules}, with a\\\\nmandatory prefix.\\\",\\\"type\\\":\\\"object\\\"},\\\"logging\\\":{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\",\\\"description\\\":\\\"Present if the server supports sending log messages to the client.\\\"},\\\"prompts\\\":{\\\"description\\\":\\\"Present if the server offers any prompt templates.\\\",\\\"properties\\\":{\\\"listChanged\\\":{\\\"description\\\":\\\"Whether this server supports notifications for changes to the prompt list.\\\",\\\"type\\\":\\\"boolean\\\"}},\\\"type\\\":\\\"object\\\"},\\\"resources\\\":{\\\"description\\\":\\\"Present if the server offers any resources to read.\\\",\\\"properties\\\":{\\\"listChanged\\\":{\\\"description\\\":\\\"Whether this server supports notifications for changes to the resource list.\\\",\\\"type\\\":\\\"boolean\\\"},\\\"subscribe\\\":{\\\"description\\\":\\\"Whether this server supports subscribing to resource updates.\\\",\\\"type\\\":\\\"boolean\\\"}},\\\"type\\\":\\\"object\\\"},\\\"tools\\\":{\\\"description\\\":\\\"Present if the server offers any tools to call.\\\",\\\"properties\\\":{\\\"listChanged\\\":{\\\"description\\\":\\\"Whether this server supports notifications for changes to the tool list.\\\",\\\"type\\\":\\\"boolean\\\"}},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ServerNotification\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/CancelledNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/ProgressNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/ResourceListChangedNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/SubscriptionsAcknowledgedNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/ResourceUpdatedNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/PromptListChangedNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolListChangedNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/LoggingMessageNotification\\\"}]},\\\"ServerResult\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/Result\\\"},{\\\"$ref\\\":\\\"#/$defs/InputRequiredResult\\\"},{\\\"$ref\\\":\\\"#/$defs/DiscoverResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ListResourcesResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ListResourceTemplatesResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ReadResourceResult\\\"},{\\\"$ref\\\":\\\"#/$defs/SubscriptionsListenResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ListPromptsResult\\\"},{\\\"$ref\\\":\\\"#/$defs/GetPromptResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ListToolsResult\\\"},{\\\"$ref\\\":\\\"#/$defs/CallToolResult\\\"},{\\\"$ref\\\":\\\"#/$defs/CompleteResult\\\"}]},\\\"SingleSelectEnumSchema\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/UntitledSingleSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledSingleSelectEnumSchema\\\"}]},\\\"StringSchema\\\":{\\\"properties\\\":{\\\"default\\\":{\\\"type\\\":\\\"string\\\"},\\\"description\\\":{\\\"type\\\":\\\"string\\\"},\\\"format\\\":{\\\"enum\\\":[\\\"date\\\",\\\"date-time\\\",\\\"email\\\",\\\"uri\\\"],\\\"type\\\":\\\"string\\\"},\\\"maxLength\\\":{\\\"type\\\":\\\"integer\\\"},\\\"minLength\\\":{\\\"type\\\":\\\"integer\\\"},\\\"title\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"string\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"SubscriptionFilter\\\":{\\\"description\\\":\\\"The set of notification types a client may opt in to on a\\\\n{@link SubscriptionsListenRequestsubscriptions/listen} request.\\\\n\\\\nEach notification type is **opt-in**; the server **MUST NOT** send\\\\nnotification types the client has not explicitly requested here.\\\",\\\"properties\\\":{\\\"promptsListChanged\\\":{\\\"description\\\":\\\"If true, receive {@link PromptListChangedNotificationnotifications/prompts/list_changed}.\\\",\\\"type\\\":\\\"boolean\\\"},\\\"resourceSubscriptions\\\":{\\\"description\\\":\\\"Subscribe to {@link ResourceUpdatedNotificationnotifications/resources/updated} for these resource URIs.\\\\nReplaces the former `resources/subscribe` RPC.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"resourcesListChanged\\\":{\\\"description\\\":\\\"If true, receive {@link ResourceListChangedNotificationnotifications/resources/list_changed}.\\\",\\\"type\\\":\\\"boolean\\\"},\\\"toolsListChanged\\\":{\\\"description\\\":\\\"If true, receive {@link ToolListChangedNotificationnotifications/tools/list_changed}.\\\",\\\"type\\\":\\\"boolean\\\"}},\\\"type\\\":\\\"object\\\"},\\\"SubscriptionsAcknowledgedNotification\\\":{\\\"description\\\":\\\"Sent by the server to acknowledge that a\\\\n{@link SubscriptionsListenRequestsubscriptions/listen} subscription has been\\\\nestablished and to report which notification types it agreed to honor.\\\\n\\\\nThis notification MUST be the first message the server sends carrying the\\\\nsubscription's ID in `io.modelcontextprotocol/subscriptionId`. The server MUST\\\\nNOT send any notification on the subscription before acknowledging it. On\\\\nstdio, where every subscription shares one channel, this ordering is defined\\\\nper subscription ID and not per channel: messages belonging to other\\\\nsubscriptions MAY be interleaved before it.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/subscriptions/acknowledged\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/SubscriptionsAcknowledgedNotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"SubscriptionsAcknowledgedNotificationParams\\\":{\\\"description\\\":\\\"Parameters for a {@link SubscriptionsAcknowledgedNotificationnotifications/subscriptions/acknowledged} notification.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationMetaObject\\\"},\\\"notifications\\\":{\\\"$ref\\\":\\\"#/$defs/SubscriptionFilter\\\",\\\"description\\\":\\\"The subset of requested notification types the server agreed to honor.\\\\nOnly includes notification types the server actually supports; if the\\\\nclient requested an unsupported type (e.g., `promptsListChanged` when\\\\nthe server has no prompts), it is omitted from this set.\\\"}},\\\"required\\\":[\\\"notifications\\\"],\\\"type\\\":\\\"object\\\"},\\\"SubscriptionsListenRequest\\\":{\\\"description\\\":\\\"Sent from the client to open a long-lived channel for receiving notifications\\\\noutside the context of a specific request. Replaces the previous HTTP GET\\\\nendpoint and ensures consistent behavior between HTTP and STDIO.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"subscriptions/listen\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/SubscriptionsListenRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"SubscriptionsListenRequestParams\\\":{\\\"description\\\":\\\"Parameters for a {@link SubscriptionsListenRequestsubscriptions/listen} request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/RequestMetaObject\\\"},\\\"notifications\\\":{\\\"$ref\\\":\\\"#/$defs/SubscriptionFilter\\\",\\\"description\\\":\\\"The notifications the client opts in to on this stream. The server\\\\n**MUST NOT** send notification types the client has not explicitly\\\\nrequested.\\\"}},\\\"required\\\":[\\\"_meta\\\",\\\"notifications\\\"],\\\"type\\\":\\\"object\\\"},\\\"SubscriptionsListenResult\\\":{\\\"description\\\":\\\"The response to a {@link SubscriptionsListenRequestsubscriptions/listen}\\\\nrequest, signalling that the subscription has ended gracefully (for example,\\\\nduring server shutdown). Because the listen stream is long-lived, this result\\\\nis sent only when the server tears the subscription down; an abrupt transport\\\\nclose carries no response. The result body is otherwise empty.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/SubscriptionsListenResultMeta\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"_meta\\\",\\\"resultType\\\"],\\\"type\\\":\\\"object\\\"},\\\"SubscriptionsListenResultMeta\\\":{\\\"description\\\":\\\"Extends {@link ResultMetaObject} with the subscription-stream identifier carried by a\\\\n{@link SubscriptionsListenResult}. All key naming rules from `MetaObject` apply.\\\",\\\"properties\\\":{\\\"io.modelcontextprotocol/serverInfo\\\":{\\\"$ref\\\":\\\"#/$defs/Implementation\\\",\\\"description\\\":\\\"Identifies the server software producing the response. Servers SHOULD\\\\ninclude this field on every response unless specifically configured not\\\\nto do so.\\\\n\\\\nThe {@link Implementation} schema requires `name` and `version`; other\\\\nfields are optional.\\\\n\\\\nThe value is self-reported by the server and is not verified by the\\\\nprotocol. It is intended for display, logging, and debugging. Clients\\\\nSHOULD NOT use it to change their behavior, and SHOULD NOT rely on it for\\\\nsecurity decisions.\\\"},\\\"io.modelcontextprotocol/subscriptionId\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\",\\\"description\\\":\\\"Identifies the subscription stream this response closes, so the client can\\\\ncorrelate it with the originating subscription — mirroring the same key on\\\\nthe stream's notifications. The value is the JSON-RPC ID of the\\\\n`subscriptions/listen` request that opened the stream (and equals this\\\\nresponse's `id`).\\\"}},\\\"required\\\":[\\\"io.modelcontextprotocol/subscriptionId\\\"],\\\"type\\\":\\\"object\\\"},\\\"TextContent\\\":{\\\"description\\\":\\\"Text provided to or from an LLM.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"text\\\":{\\\"description\\\":\\\"The text content of the message.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"text\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"text\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"TextResourceContents\\\":{\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of this resource, if known.\\\",\\\"type\\\":\\\"string\\\"},\\\"text\\\":{\\\"description\\\":\\\"The text of the item. This must only be set if the item can actually be represented as text (not binary data).\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of this resource.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"text\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"TitledMultiSelectEnumSchema\\\":{\\\"description\\\":\\\"Schema for multiple-selection enumeration with display titles for each option.\\\",\\\"properties\\\":{\\\"default\\\":{\\\"description\\\":\\\"Optional default value.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"description\\\":{\\\"description\\\":\\\"Optional description for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"items\\\":{\\\"description\\\":\\\"Schema for array items with enum options and display labels.\\\",\\\"properties\\\":{\\\"anyOf\\\":{\\\"description\\\":\\\"Array of enum options with values and display labels.\\\",\\\"items\\\":{\\\"properties\\\":{\\\"const\\\":{\\\"description\\\":\\\"The constant enum value.\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Display title for this option.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"const\\\",\\\"title\\\"],\\\"type\\\":\\\"object\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"anyOf\\\"],\\\"type\\\":\\\"object\\\"},\\\"maxItems\\\":{\\\"description\\\":\\\"Maximum number of items to select.\\\",\\\"type\\\":\\\"integer\\\"},\\\"minItems\\\":{\\\"description\\\":\\\"Minimum number of items to select.\\\",\\\"type\\\":\\\"integer\\\"},\\\"title\\\":{\\\"description\\\":\\\"Optional title for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"array\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"items\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"TitledSingleSelectEnumSchema\\\":{\\\"description\\\":\\\"Schema for single-selection enumeration with display titles for each option.\\\",\\\"properties\\\":{\\\"default\\\":{\\\"description\\\":\\\"Optional default value.\\\",\\\"type\\\":\\\"string\\\"},\\\"description\\\":{\\\"description\\\":\\\"Optional description for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"oneOf\\\":{\\\"description\\\":\\\"Array of enum options with values and display labels.\\\",\\\"items\\\":{\\\"properties\\\":{\\\"const\\\":{\\\"description\\\":\\\"The enum value.\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Display label for this option.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"const\\\",\\\"title\\\"],\\\"type\\\":\\\"object\\\"},\\\"type\\\":\\\"array\\\"},\\\"title\\\":{\\\"description\\\":\\\"Optional title for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"string\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"oneOf\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"Tool\\\":{\\\"description\\\":\\\"Definition for a tool the client can call.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/ToolAnnotations\\\",\\\"description\\\":\\\"Optional additional tool information.\\\\n\\\\nDisplay name precedence order is: `title`, `annotations.title`, then `name`.\\\"},\\\"description\\\":{\\\"description\\\":\\\"A human-readable description of the tool.\\\\n\\\\nThis can be used by clients to improve the LLM's understanding of available tools. It can be thought of like a \\\\\\\"hint\\\\\\\" to the model.\\\",\\\"type\\\":\\\"string\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"inputSchema\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"A JSON Schema object defining the expected parameters for the tool.\\\\n\\\\nTool arguments are always JSON objects, so `type: \\\\\\\"object\\\\\\\"` is required at the root.\\\\nBeyond that, any JSON Schema 2020-12 keyword may appear alongside `type` — including\\\\ncomposition keywords (`oneOf`, `anyOf`, `allOf`, `not`), conditional keywords\\\\n(`if`/`then`/`else`), reference keywords (`$ref`, `$defs`, `$anchor`), and any other\\\\nstandard validation or annotation keywords.\\\\n\\\\nProperty schemas may carry an `x-mcp-header` annotation to mirror the\\\\nargument value into an HTTP header on the Streamable HTTP transport. See\\\\nthe Streamable HTTP transport specification for the validity and\\\\nextraction rules.\\\\n\\\\nDefaults to JSON Schema 2020-12 when no explicit `$schema` is provided.\\\",\\\"properties\\\":{\\\"$schema\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"object\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"outputSchema\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"An optional JSON Schema object defining the structure of the tool's output returned in\\\\nthe structuredContent field of a {@link CallToolResult}. This can be any valid JSON Schema 2020-12.\\\\n\\\\nDefaults to JSON Schema 2020-12 when no explicit `$schema` is provided.\\\",\\\"properties\\\":{\\\"$schema\\\":{\\\"type\\\":\\\"string\\\"}},\\\"type\\\":\\\"object\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for {@link Tool},\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"inputSchema\\\",\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"ToolAnnotations\\\":{\\\"description\\\":\\\"Additional properties describing a {@link Tool} to clients.\\\\n\\\\nNOTE: all properties in `ToolAnnotations` are **hints**.\\\\nThey are not guaranteed to provide a faithful description of\\\\ntool behavior (including descriptive properties like `title`).\\\\n\\\\nClients should never make tool use decisions based on `ToolAnnotations`\\\\nreceived from untrusted servers.\\\",\\\"properties\\\":{\\\"destructiveHint\\\":{\\\"description\\\":\\\"If true, the tool may perform destructive updates to its environment.\\\\nIf false, the tool performs only additive updates.\\\\n\\\\n(This property is meaningful only when `readOnlyHint == false`)\\\\n\\\\nDefault: true\\\",\\\"type\\\":\\\"boolean\\\"},\\\"idempotentHint\\\":{\\\"description\\\":\\\"If true, calling the tool repeatedly with the same arguments\\\\nwill have no additional effect on its environment.\\\\n\\\\n(This property is meaningful only when `readOnlyHint == false`)\\\\n\\\\nDefault: false\\\",\\\"type\\\":\\\"boolean\\\"},\\\"openWorldHint\\\":{\\\"description\\\":\\\"If true, this tool may interact with an \\\\\\\"open world\\\\\\\" of external\\\\nentities. If false, the tool's domain of interaction is closed.\\\\nFor example, the world of a web search tool is open, whereas that\\\\nof a memory tool is not.\\\\n\\\\nDefault: true\\\",\\\"type\\\":\\\"boolean\\\"},\\\"readOnlyHint\\\":{\\\"description\\\":\\\"If true, the tool does not modify its environment.\\\\n\\\\nDefault: false\\\",\\\"type\\\":\\\"boolean\\\"},\\\"title\\\":{\\\"description\\\":\\\"A human-readable title for the tool.\\\",\\\"type\\\":\\\"string\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ToolChoice\\\":{\\\"description\\\":\\\"Controls tool selection behavior for sampling requests.\\\",\\\"properties\\\":{\\\"mode\\\":{\\\"description\\\":\\\"Controls the tool use ability of the model:\\\\n- `\\\\\\\"auto\\\\\\\"`: Model decides whether to use tools (default)\\\\n- `\\\\\\\"required\\\\\\\"`: Model MUST use at least one tool before completing\\\\n- `\\\\\\\"none\\\\\\\"`: Model MUST NOT use any tools\\\",\\\"enum\\\":[\\\"auto\\\",\\\"none\\\",\\\"required\\\"],\\\"type\\\":\\\"string\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ToolListChangedNotification\\\":{\\\"description\\\":\\\"An optional notification from the server to the client, informing it that the list of tools it offers has changed. This is only delivered on a {@link SubscriptionsListenRequestsubscriptions/listen} stream when the client requested it via the `toolsListChanged` filter field.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/tools/list_changed\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"ToolResultContent\\\":{\\\"description\\\":\\\"The result of a tool use, provided by the user back to the assistant.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\",\\\"description\\\":\\\"Optional metadata about the tool result. Clients SHOULD preserve this field when\\\\nincluding tool results in subsequent sampling requests to enable caching optimizations.\\\"},\\\"content\\\":{\\\"description\\\":\\\"The unstructured result content of the tool use.\\\\n\\\\nThis has the same format as {@link CallToolResult.content} and can include text, images,\\\\naudio, resource links, and embedded resources.\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/ContentBlock\\\"},\\\"type\\\":\\\"array\\\"},\\\"isError\\\":{\\\"description\\\":\\\"Whether the tool use resulted in an error.\\\\n\\\\nIf true, the content typically describes the error that occurred.\\\\nDefault: false\\\",\\\"type\\\":\\\"boolean\\\"},\\\"structuredContent\\\":{\\\"description\\\":\\\"An optional structured result value.\\\\n\\\\nThis can be any JSON value (object, array, string, number, boolean, or null).\\\\nIf the tool defined an {@link Tool.outputSchema}, this SHOULD conform to that schema.\\\"},\\\"toolUseId\\\":{\\\"description\\\":\\\"The ID of the tool use this result corresponds to.\\\\n\\\\nThis MUST match the ID from a previous {@link ToolUseContent}.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"tool_result\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"content\\\",\\\"toolUseId\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"ToolUseContent\\\":{\\\"description\\\":\\\"A request from the assistant to call a tool.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\",\\\"description\\\":\\\"Optional metadata about the tool use. Clients SHOULD preserve this field when\\\\nincluding tool uses in subsequent sampling requests to enable caching optimizations.\\\"},\\\"id\\\":{\\\"description\\\":\\\"A unique identifier for this tool use.\\\\n\\\\nThis ID is used to match tool results to their corresponding tool uses.\\\",\\\"type\\\":\\\"string\\\"},\\\"input\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"The arguments to pass to the tool, conforming to the tool's input schema.\\\",\\\"type\\\":\\\"object\\\"},\\\"name\\\":{\\\"description\\\":\\\"The name of the tool to call.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"tool_use\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"id\\\",\\\"input\\\",\\\"name\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"UnsupportedProtocolVersionError\\\":{\\\"description\\\":\\\"Returned when the request's protocol version is unknown to the server or\\\\nunsupported (e.g., a known experimental or draft version the server has\\\\nchosen not to implement). For HTTP, the response status code MUST be\\\\n`400 Bad Request`.\\\",\\\"properties\\\":{\\\"error\\\":{\\\"allOf\\\":[{\\\"$ref\\\":\\\"#/$defs/Error\\\"},{\\\"properties\\\":{\\\"code\\\":{\\\"const\\\":-32022,\\\"type\\\":\\\"integer\\\"},\\\"data\\\":{\\\"properties\\\":{\\\"requested\\\":{\\\"description\\\":\\\"The protocol version that was requested by the client.\\\",\\\"type\\\":\\\"string\\\"},\\\"supported\\\":{\\\"description\\\":\\\"Protocol versions the server supports. The client should choose a\\\\nmutually supported version from this list and retry.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"requested\\\",\\\"supported\\\"],\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"code\\\",\\\"data\\\"],\\\"type\\\":\\\"object\\\"}]},\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"error\\\",\\\"jsonrpc\\\"],\\\"type\\\":\\\"object\\\"},\\\"UntitledMultiSelectEnumSchema\\\":{\\\"description\\\":\\\"Schema for multiple-selection enumeration without display titles for options.\\\",\\\"properties\\\":{\\\"default\\\":{\\\"description\\\":\\\"Optional default value.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"description\\\":{\\\"description\\\":\\\"Optional description for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"items\\\":{\\\"description\\\":\\\"Schema for the array items.\\\",\\\"properties\\\":{\\\"enum\\\":{\\\"description\\\":\\\"Array of enum values to choose from.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"type\\\":{\\\"const\\\":\\\"string\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"enum\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"maxItems\\\":{\\\"description\\\":\\\"Maximum number of items to select.\\\",\\\"type\\\":\\\"integer\\\"},\\\"minItems\\\":{\\\"description\\\":\\\"Minimum number of items to select.\\\",\\\"type\\\":\\\"integer\\\"},\\\"title\\\":{\\\"description\\\":\\\"Optional title for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"array\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"items\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"UntitledSingleSelectEnumSchema\\\":{\\\"description\\\":\\\"Schema for single-selection enumeration without display titles for options.\\\",\\\"properties\\\":{\\\"default\\\":{\\\"description\\\":\\\"Optional default value.\\\",\\\"type\\\":\\\"string\\\"},\\\"description\\\":{\\\"description\\\":\\\"Optional description for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"enum\\\":{\\\"description\\\":\\\"Array of enum values to choose from.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"title\\\":{\\\"description\\\":\\\"Optional title for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"string\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"enum\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"}}}\";\n",[],[142,380,390],"6e82839e-0c2d-4469-bcf7-c0453b4b0d12","draft.schema.json.part0.ts","5aa22710-ad1c-11f1-955e-1607ee4eb77e",152,["D",1789047271632],"export default \"{\\\"$schema\\\":\\\"https://json-schema.org/draft/2020-12/schema\\\",\\\"$defs\\\":{\\\"Annotations\\\":{\\\"description\\\":\\\"Optional annotations for the client. The client can use annotations to inform how objects are used or displayed\\\",\\\"properties\\\":{\\\"audience\\\":{\\\"description\\\":\\\"Describes who the intended audience of this object or data is.\\\\n\\\\nIt can include multiple entries to indicate content useful for multiple audiences (e.g., `[\\\\\\\"user\\\\\\\", \\\\\\\"assistant\\\\\\\"]`).\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Role\\\"},\\\"type\\\":\\\"array\\\"},\\\"lastModified\\\":{\\\"description\\\":\\\"The moment the resource was last modified, as an ISO 8601 formatted string.\\\\n\\\\nShould be an ISO 8601 formatted string (e.g., \\\\\\\"2025-01-12T15:00:58Z\\\\\\\").\\\\n\\\\nExamples: last activity timestamp in an open file, timestamp when the resource\\\\nwas attached, etc.\\\",\\\"type\\\":\\\"string\\\"},\\\"priority\\\":{\\\"description\\\":\\\"Describes how important this data is for operating the server.\\\\n\\\\nA value of 1 means \\\\\\\"most important,\\\\\\\" and indicates that the data is\\\\neffectively required, while 0 means \\\\\\\"least important,\\\\\\\" and indicates that\\\\nthe data is entirely optional.\\\",\\\"maximum\\\":1,\\\"minimum\\\":0,\\\"type\\\":\\\"number\\\"}},\\\"type\\\":\\\"object\\\"},\\\"AudioContent\\\":{\\\"description\\\":\\\"Audio provided to or from an LLM.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"data\\\":{\\\"description\\\":\\\"The base64-encoded audio data.\\\",\\\"format\\\":\\\"byte\\\",\\\"type\\\":\\\"string\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of the audio. Different providers may support different audio types.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"audio\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"data\\\",\\\"mimeType\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"BaseMetadata\\\":{\\\"description\\\":\\\"Base interface for metadata with name (identifier) and title (display name) properties.\\\",\\\"properties\\\":{\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for {@link Tool},\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"BlobResourceContents\\\":{\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"blob\\\":{\\\"description\\\":\\\"A base64-encoded string representing the binary data of the item.\\\",\\\"format\\\":\\\"byte\\\",\\\"type\\\":\\\"string\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of this resource, if known.\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of this resource.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"blob\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"BooleanSchema\\\":{\\\"properties\\\":{\\\"default\\\":{\\\"type\\\":\\\"boolean\\\"},\\\"description\\\":{\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"boolean\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"CacheableResult\\\":{\\\"description\\\":\\\"A result that supports a time-to-live (TTL) hint for client-side caching.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"cacheScope\\\":{\\\"description\\\":\\\"Indicates the intended scope of the cached response, analogous to HTTP\\\\n`Cache-Control: public` vs `Cache-Control: private`.\\\\n\\\\n- `\\\\\\\"public\\\\\\\"`: The response does not contain user-specific data. Any\\\\n client or intermediary (e.g., shared gateway, caching proxy) MAY cache\\\\n the response and serve it across authorization contexts.\\\\n- `\\\\\\\"private\\\\\\\"`: The response MAY be cached and reused only within the\\\\n same authorization context. Caches MUST NOT be shared across\\\\n authorization contexts (e.g., a different access token requires a\\\\n different cache).\\\",\\\"enum\\\":[\\\"private\\\",\\\"public\\\"],\\\"type\\\":\\\"string\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"},\\\"ttlMs\\\":{\\\"description\\\":\\\"A hint from the server indicating how long (in milliseconds) the\\\\nclient MAY cache this response before re-fetching. Semantics are\\\\nanalogous to HTTP Cache-Control max-age.\\\\n\\\\n- If 0, The response SHOULD be considered immediately stale,\\\\n The client MAY re-fetch every time the result is needed.\\\\n- If positive, the client SHOULD consider the result fresh for this many\\\\n milliseconds after receiving the response.\\\",\\\"minimum\\\":0,\\\"type\\\":\\\"integer\\\"}},\\\"required\\\":[\\\"cacheScope\\\",\\\"resultType\\\",\\\"ttlMs\\\"],\\\"type\\\":\\\"object\\\"},\\\"CallToolRequest\\\":{\\\"description\\\":\\\"Used by the client to invoke a tool provided by the server.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"tools/call\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/CallToolRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"CallToolRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `tools/call` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/RequestMetaObject\\\"},\\\"arguments\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"Arguments to use for the tool call.\\\",\\\"type\\\":\\\"object\\\"},\\\"inputResponses\\\":{\\\"$ref\\\":\\\"#/$defs/InputResponses\\\"},\\\"name\\\":{\\\"description\\\":\\\"The name of the tool.\\\",\\\"type\\\":\\\"string\\\"},\\\"requestState\\\":{\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"_meta\\\",\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"CallToolResult\\\":{\\\"description\\\":\\\"The result returned by the server for a {@link CallToolRequesttools/call} request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"content\\\":{\\\"description\\\":\\\"A list of content objects that represent the unstructured result of the tool call.\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/ContentBlock\\\"},\\\"type\\\":\\\"array\\\"},\\\"isError\\\":{\\\"description\\\":\\\"Whether the tool call ended in an error.\\\\n\\\\nIf not set, this is assumed to be false (the call was successful).\\\\n\\\\nAny errors that originate from the tool SHOULD be reported inside the result\\\\nobject, with `isError` set to true, _not_ as an MCP protocol-level error\\\\nresponse. Otherwise, the LLM would not be able to see that an error occurred\\\\nand self-correct.\\\\n\\\\nHowever, any errors in _finding_ the tool, an error indicating that the\\\\nserver does not support tool calls, or any other exceptional conditions,\\\\nshould be reported as an MCP error response.\\\",\\\"type\\\":\\\"boolean\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"},\\\"structuredContent\\\":{\\\"description\\\":\\\"An optional JSON value that represents the structured result of the tool call.\\\\n\\\\nThis can be any JSON value (object, array, string, number, boolean, or null)\\\\nthat conforms to the tool's outputSchema if one is defined.\\\"}},\\\"required\\\":[\\\"content\\\",\\\"resultType\\\"],\\\"type\\\":\\\"object\\\"},\\\"CallToolResultResponse\\\":{\\\"description\\\":\\\"A successful response from the server for a {@link CallToolRequesttools/call} request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"result\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/InputRequiredResult\\\"},{\\\"$ref\\\":\\\"#/$defs/CallToolResult\\\"}]}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"result\\\"],\\\"type\\\":\\\"object\\\"},\\\"CancelledNotification\\\":{\\\"description\\\":\\\"This notification is sent by the client to indicate that it is cancelling a request it previously issued.\\\\n\\\\nOn stdio, the server also sends this notification, solely to terminate a {@link SubscriptionsListenRequestsubscriptions/listen} stream: it references the ID of the `subscriptions/listen` request that opened the stream. Servers MUST NOT use this notification to cancel any other request.\\\\n\\\\nThe request SHOULD still be in-flight, but due to communication latency, it is always possible that this notification MAY arrive after the request has already finished.\\\\n\\\\nThis notification indicates that the result will be unused, so any associated processing SHOULD cease.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/cancelled\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/CancelledNotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"CancelledNotificationParams\\\":{\\\"description\\\":\\\"Parameters for a `notifications/cancelled` notification.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationMetaObject\\\"},\\\"reason\\\":{\\\"description\\\":\\\"An optional string describing the reason for the cancellation. This MAY be logged or presented to the user.\\\",\\\"type\\\":\\\"string\\\"},\\\"requestId\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\",\\\"description\\\":\\\"The ID of the request to cancel.\\\\n\\\\nThis MUST correspond to the ID of a request the client previously issued.\\\"}},\\\"required\\\":[\\\"requestId\\\"],\\\"type\\\":\\\"object\\\"},\\\"ClientCapabilities\\\":{\\\"description\\\":\\\"Capabilities a client may support. Known capabilities are defined here, in this schema, but this is not a closed set: any client can define its own, additional capabilities.\\\",\\\"properties\\\":{\\\"elicitation\\\":{\\\"description\\\":\\\"Present if the client supports elicitation from the server.\\\",\\\"properties\\\":{\\\"form\\\":{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\"},\\\"url\\\":{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\"}},\\\"type\\\":\\\"object\\\"},\\\"experimental\\\":{\\\"additionalProperties\\\":{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\"},\\\"description\\\":\\\"Experimental, non-standard capabilities that the client supports.\\\",\\\"type\\\":\\\"object\\\"},\\\"extensions\\\":{\\\"additionalProperties\\\":{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\"},\\\"description\\\":\\\"Optional MCP extensions that the client supports. Keys are extension identifiers\\\\n(e.g., \\\\\\\"io.modelcontextprotocol/oauth-client-credentials\\\\\\\"), and values are\\\\nper-extension settings objects. An empty object indicates support with no settings.\\\\n\\\\nKeys MUST follow the {@link MetaObject`_meta` key naming rules}, with a\\\\nmandatory prefix.\\\",\\\"type\\\":\\\"object\\\"},\\\"roots\\\":{\\\"description\\\":\\\"Present if the client supports listing roots.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"sampling\\\":{\\\"description\\\":\\\"Present if the client supports sampling from an LLM.\\\",\\\"properties\\\":{\\\"context\\\":{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\",\\\"description\\\":\\\"Whether the client supports context inclusion via `includeContext` parameter.\\\\nIf not declared, servers SHOULD only use `includeContext: \\\\\\\"none\\\\\\\"` (or omit it).\\\"},\\\"tools\\\":{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\",\\\"description\\\":\\\"Whether the client supports tool use via `tools` and `toolChoice` parameters.\\\"}},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ClientNotification\\\":{\\\"description\\\":\\\"This notification is sent by the client to indicate that it is cancelling a request it previously issued.\\\\n\\\\nOn stdio, the server also sends this notification, solely to terminate a {@link SubscriptionsListenRequestsubscriptions/listen} stream: it references the ID of the `subscriptions/listen` request that opened the stream. Servers MUST NOT use this notification to cancel any other request.\\\\n\\\\nThe request SHOULD still be in-flight, but due to communication latency, it is always possible that this notification MAY arrive after the request has already finished.\\\\n\\\\nThis notification indicates that the result will be unused, so any associated processing SHOULD cease.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/cancelled\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/CancelledNotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ClientRequest\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/DiscoverRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListResourcesRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListResourceTemplatesRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ReadResourceRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/SubscriptionsListenRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListPromptsRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/GetPromptRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListToolsRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/CallToolRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/CompleteRequest\\\"}]},\\\"ClientResult\\\":{\\\"$ref\\\":\\\"#/$defs/Result\\\",\\\"description\\\":\\\"Common result fields.\\\"},\\\"CompleteRequest\\\":{\\\"description\\\":\\\"A request from the client to the server, to ask for completion options.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"completion/complete\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/CompleteRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"CompleteRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `completion/complete` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/RequestMetaObject\\\"},\\\"argument\\\":{\\\"description\\\":\\\"The argument's information\\\",\\\"properties\\\":{\\\"name\\\":{\\\"description\\\":\\\"The name of the argument\\\",\\\"type\\\":\\\"string\\\"},\\\"value\\\":{\\\"description\\\":\\\"The value of the argument to use for completion matching.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"value\\\"],\\\"type\\\":\\\"object\\\"},\\\"context\\\":{\\\"description\\\":\\\"Additional, optional context for completions\\\",\\\"properties\\\":{\\\"arguments\\\":{\\\"additionalProperties\\\":{\\\"type\\\":\\\"string\\\"},\\\"description\\\":\\\"Previously-resolved variables in a URI template or prompt.\\\",\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ref\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/PromptReference\\\"},{\\\"$ref\\\":\\\"#/$defs/ResourceTemplateReference\\\"}]}},\\\"required\\\":[\\\"_meta\\\",\\\"argument\\\",\\\"ref\\\"],\\\"type\\\":\\\"object\\\"},\\\"CompleteResult\\\":{\\\"description\\\":\\\"The result returned by the server for a {@link CompleteRequestcompletion/complete} request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"completion\\\":{\\\"properties\\\":{\\\"hasMore\\\":{\\\"description\\\":\\\"Indicates whether there are additional completion options beyond those provided in the current response, even if the exact total is unknown.\\\",\\\"type\\\":\\\"boolean\\\"},\\\"total\\\":{\\\"description\\\":\\\"The total number of completion options available. This can exceed the number of values actually sent in the response.\\\",\\\"type\\\":\\\"integer\\\"},\\\"values\\\":{\\\"description\\\":\\\"An array of completion values. Must not exceed 100 items.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"maxItems\\\":100,\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"values\\\"],\\\"type\\\":\\\"object\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"completion\\\",\\\"resultType\\\"],\\\"type\\\":\\\"object\\\"},\\\"CompleteResultResponse\\\":{\\\"description\\\":\\\"A successful response from the server for a {@link CompleteRequestcompletion/complete} request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"result\\\":{\\\"$ref\\\":\\\"#/$defs/CompleteResult\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"result\\\"],\\\"type\\\":\\\"object\\\"},\\\"ContentBlock\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ImageContent\\\"},{\\\"$ref\\\":\\\"#/$defs/AudioContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ResourceLink\\\"},{\\\"$ref\\\":\\\"#/$defs/EmbeddedResource\\\"}]},\\\"CreateMessageRequest\\\":{\\\"description\\\":\\\"A request from the server to sample an LLM via the client. The client has full discretion over which model to select. The client should also inform the user before beginning sampling, to allow them to inspect the request (human in the loop) and decide whether to approve it.\\\",\\\"properties\\\":{\\\"method\\\":{\\\"const\\\":\\\"sampling/createMessage\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/CreateMessageRequestParams\\\"}},\\\"required\\\":[\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"CreateMessageRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `sampling/createMessage` request.\\\",\\\"properties\\\":{\\\"includeContext\\\":{\\\"description\\\":\\\"A request to include context from one or more MCP servers (including the caller), to be attached to the prompt.\\\\nThe client MAY ignore this request.\\\\n\\\\nDefault is `\\\\\\\"none\\\\\\\"`. The values `\\\\\\\"thisServer\\\\\\\"` and `\\\\\\\"allServers\\\\\\\"` are deprecated (SEP-2596): servers SHOULD\\\\nomit this field or use `\\\\\\\"none\\\\\\\"`, and SHOULD only use the deprecated values if the client declares\\\\n{@link ClientCapabilities.sampling.context}.\\\",\\\"enum\\\":[\\\"allServers\\\",\\\"none\\\",\\\"thisServer\\\"],\\\"type\\\":\\\"string\\\"},\\\"maxTokens\\\":{\\\"description\\\":\\\"The requested maximum number of tokens to sample (to prevent runaway completions).\\\\n\\\\nThe client MAY choose to sample fewer tokens than the requested maximum.\\\",\\\"type\\\":\\\"integer\\\"},\\\"messages\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/SamplingMessage\\\"},\\\"type\\\":\\\"array\\\"},\\\"metadata\\\":{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\",\\\"description\\\":\\\"Optional metadata to pass through to the LLM provider. The format of this metadata is provider-specific.\\\"},\\\"modelPreferences\\\":{\\\"$ref\\\":\\\"#/$defs/ModelPreferences\\\",\\\"description\\\":\\\"The server's preferences for which model to select. The client MAY ignore these preferences.\\\"},\\\"stopSequences\\\":{\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"systemPrompt\\\":{\\\"description\\\":\\\"An optional system prompt the server wants to use for sampling. The client MAY modify or omit this prompt.\\\",\\\"type\\\":\\\"string\\\"},\\\"temperature\\\":{\\\"type\\\":\\\"number\\\"},\\\"toolChoice\\\":{\\\"$ref\\\":\\\"#/$defs/ToolChoice\\\",\\\"description\\\":\\\"Controls how the model uses tools.\\\\nThe client MUST return an error if this field is provided but {@link ClientCapabilities.sampling.tools} is not declared.\\\\nDefault is `{ mode: \\\\\\\"auto\\\\\\\" }`.\\\"},\\\"tools\\\":{\\\"description\\\":\\\"Tools that the model may use during generation.\\\\nThe client MUST return an error if this field is provided but {@link ClientCapabilities.sampling.tools} is not declared.\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Tool\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"maxTokens\\\",\\\"messages\\\"],\\\"type\\\":\\\"object\\\"},\\\"CreateMessageResult\\\":{\\\"description\\\":\\\"The result returned by the client for a {@link CreateMessageRequestsampling/createMessage} request.\\\\nThe client should inform the user before returning the sampled message, to allow them\\\\nto inspect the response (human in the loop) and decide whether to allow the server to see it.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"content\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ImageContent\\\"},{\\\"$ref\\\":\\\"#/$defs/AudioContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolUseContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolResultContent\\\"},{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/SamplingMessageContentBlock\\\"},\\\"type\\\":\\\"array\\\"}]},\\\"model\\\":{\\\"description\\\":\\\"The name of the model that generated the message.\\\",\\\"type\\\":\\\"string\\\"},\\\"role\\\":{\\\"$ref\\\":\\\"#/$defs/Role\\\"},\\\"stopReason\\\":{\\\"description\\\":\\\"The reason why sampling stopped, if known.\\\\n\\\\nStandard values:\\\\n- `\\\\\\\"endTurn\\\\\\\"`: Natural end of the assistant's turn\\\\n- `\\\\\\\"stopSequence\\\\\\\"`: A stop sequence was encountered\\\\n- `\\\\\\\"maxTokens\\\\\\\"`: Maximum token limit was reached\\\\n- `\\\\\\\"toolUse\\\\\\\"`: The model wants to use one or more tools\\\\n\\\\nThis field is an open string to allow for provider-specific stop reasons.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"content\\\",\\\"model\\\",\\\"role\\\"],\\\"type\\\":\\\"object\\\"},\\\"Cursor\\\":{\\\"description\\\":\\\"An opaque token used to represent a cursor for pagination.\\\",\\\"type\\\":\\\"string\\\"},\\\"DiscoverRequest\\\":{\\\"description\\\":\\\"A request from the client asking the server to advertise its supported\\\\nprotocol versions, capabilities, and other metadata. Servers **MUST**\\\\nimplement `server/discover`. Clients **MAY** call it but are not required\\\\nto — version negotiation can also happen inline via per-request `_meta`.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"server/discover\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/RequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"DiscoverResult\\\":{\\\"description\\\":\\\"The result returned by the server for a {@link DiscoverRequestserver/discover} request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"cacheScope\\\":{\\\"description\\\":\\\"Indicates the intended scope of the cached response, analogous to HTTP\\\\n`Cache-Control: public` vs `Cache-Control: private`.\\\\n\\\\n- `\\\\\\\"public\\\\\\\"`: The response does not contain user-specific data. Any\\\\n client or intermediary (e.g., shared gateway, caching proxy) MAY cache\\\\n the response and serve it across authorization contexts.\\\\n- `\\\\\\\"private\\\\\\\"`: The response MAY be cached and reused only within the\\\\n same authorization context. Caches MUST NOT be shared across\\\\n authorization contexts (e.g., a different access token requires a\\\\n different cache).\\\",\\\"enum\\\":[\\\"private\\\",\\\"public\\\"],\\\"type\\\":\\\"string\\\"},\\\"capabilities\\\":{\\\"$ref\\\":\\\"#/$defs/ServerCapabilities\\\",\\\"description\\\":\\\"The capabilities of the server.\\\"},\\\"instructions\\\":{\\\"description\\\":\\\"Natural-language guidance describing the server and its features.\\\\n\\\\nThis can be used by clients to improve an LLM's understanding of\\\\navailable tools (e.g., by including it in a system prompt). It should\\\\nfocus on information that helps the model use the server effectively\\\\nand should not duplicate information already in tool descriptions.\\\",\\\"type\\\":\\\"string\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"},\\\"supportedVersions\\\":{\\\"description\\\":\\\"MCP Protocol Versions this server supports. The client should choose a\\\\nversion from this list for use in subsequent requests.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"ttlMs\\\":{\\\"description\\\":\\\"A hint from the server indicating how long (in milliseconds) the\\\\nclient MAY cache this response before re-fetching. Semantics are\\\\nanalogous to HTTP Cache-Control max-age.\\\\n\\\\n- If 0, The response SHOULD be considered immediately stale,\\\\n The client MAY re-fetch every time the result is needed.\\\\n- If positive, the client SHOULD consider the result fresh for this many\\\\n milliseconds after receiving the response.\\\",\\\"minimum\\\":0,\\\"type\\\":\\\"integer\\\"}},\\\"required\\\":[\\\"cacheScope\\\",\\\"capabilities\\\",\\\"resultType\\\",\\\"supportedVersions\\\",\\\"ttlMs\\\"],\\\"type\\\":\\\"object\\\"},\\\"DiscoverResultResponse\\\":{\\\"description\\\":\\\"A successful response from the server for a {@link DiscoverRequestserver/discover} request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"result\\\":{\\\"$ref\\\":\\\"#/$defs/DiscoverResult\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"result\\\"],\\\"type\\\":\\\"object\\\"},\\\"ElicitRequest\\\":{\\\"description\\\":\\\"A request from the server to elicit additional information from the user via the client.\\\",\\\"properties\\\":{\\\"method\\\":{\\\"const\\\":\\\"elicitation/create\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/ElicitRequestParams\\\"}},\\\"required\\\":[\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ElicitRequestFormParams\\\":{\\\"description\\\":\\\"The parameters for a request to elicit non-sensitive information from the user via a form in the client.\\\",\\\"properties\\\":{\\\"message\\\":{\\\"description\\\":\\\"The message to present to the user describing what information is being requested.\\\",\\\"type\\\":\\\"string\\\"},\\\"mode\\\":{\\\"const\\\":\\\"form\\\",\\\"description\\\":\\\"The elicitation mode.\\\",\\\"type\\\":\\\"string\\\"},\\\"requestedSchema\\\":{\\\"description\\\":\\\"A restricted subset of JSON Schema.\\\\nOnly top-level properties are allowed, without nesting.\\\",\\\"properties\\\":{\\\"$schema\\\":{\\\"type\\\":\\\"string\\\"},\\\"properties\\\":{\\\"additionalProperties\\\":{\\\"$ref\\\":\\\"#/$defs/PrimitiveSchemaDefinition\\\"},\\\"type\\\":\\\"object\\\"},\\\"required\\\":{\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"type\\\":{\\\"const\\\":\\\"object\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"properties\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"message\\\",\\\"requestedSchema\\\"],\\\"type\\\":\\\"object\\\"},\\\"ElicitRequestParams\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/ElicitRequestFormParams\\\"},{\\\"$ref\\\":\\\"#/$defs/ElicitRequestURLParams\\\"}],\\\"description\\\":\\\"The parameters for a request to elicit additional information from the user via the client.\\\"},\\\"ElicitRequestURLParams\\\":{\\\"description\\\":\\\"The parameters for a request to elicit information from the user via a URL in the client.\\\",\\\"properties\\\":{\\\"message\\\":{\\\"description\\\":\\\"The message to present to the user explaining why the interaction is needed.\\\",\\\"type\\\":\\\"string\\\"},\\\"mode\\\":{\\\"const\\\":\\\"url\\\",\\\"description\\\":\\\"The elicitation mode.\\\",\\\"type\\\":\\\"string\\\"},\\\"url\\\":{\\\"description\\\":\\\"The URL that the user should navigate to.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"message\\\",\\\"mode\\\",\\\"url\\\"],\\\"type\\\":\\\"object\\\"},\\\"ElicitResult\\\":{\\\"description\\\":\\\"The result returned by the client for an {@link ElicitRequestelicitation/create} request.\\\",\\\"properties\\\":{\\\"action\\\":{\\\"description\\\":\\\"The user action in response to the elicitation.\\\\n- `\\\\\\\"accept\\\\\\\"`: User submitted the form/confirmed the action\\\\n- `\\\\\\\"decline\\\\\\\"`: User explicitly declined the action\\\\n- `\\\\\\\"cancel\\\\\\\"`: User dismissed without making an explicit choice\\\",\\\"enum\\\":[\\\"accept\\\",\\\"cancel\\\",\\\"decline\\\"],\\\"type\\\":\\\"string\\\"},\\\"content\\\":{\\\"additionalProperties\\\":{\\\"anyOf\\\":[{\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},{\\\"type\\\":[\\\"string\\\",\\\"integer\\\",\\\"boolean\\\"]}]},\\\"description\\\":\\\"The submitted form data, only present when action is `\\\\\\\"accept\\\\\\\"` and mode was `\\\\\\\"form\\\\\\\"`.\\\\nContains values matching the requested schema.\\\\nOmitted for out-of-band mode responses.\\\",\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"action\\\"],\\\"type\\\":\\\"object\\\"},\\\"EmbeddedResource\\\":{\\\"description\\\":\\\"The contents of a resource, embedded into a prompt or tool call result.\\\\n\\\\nIt is up to the client how best to render embedded resources for the benefit\\\\nof the LLM and/or the user.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"resource\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextResourceContents\\\"},{\\\"$ref\\\":\\\"#/$defs/BlobResourceContents\\\"}]},\\\"type\\\":{\\\"const\\\":\\\"resource\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"resource\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"EmptyResult\\\":{\\\"$ref\\\":\\\"#/$defs/Result\\\",\\\"description\\\":\\\"Common result fields.\\\"},\\\"EnumSchema\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/UntitledSingleSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledSingleSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/UntitledMultiSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledMultiSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/LegacyTitledEnumSchema\\\"}]},\\\"Error\\\":{\\\"properties\\\":{\\\"code\\\":{\\\"description\\\":\\\"The error type that occurred.\\\",\\\"type\\\":\\\"integer\\\"},\\\"data\\\":{\\\"description\\\":\\\"Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).\\\"},\\\"message\\\":{\\\"description\\\":\\\"A short description of the error. The message SHOULD be limited to a concise single sentence.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"code\\\",\\\"message\\\"],\\\"type\\\":\\\"object\\\"},\\\"GetPromptRequest\\\":{\\\"description\\\":\\\"Used by the client to get a prompt provided by the server.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"prompts/get\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/GetPromptRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"GetPromptRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `prompts/get` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/RequestMetaObject\\\"},\\\"arguments\\\":{\\\"additionalProperties\\\":{\\\"type\\\":\\\"string\\\"},\\\"description\\\":\\\"Arguments to use for templating the prompt.\\\",\\\"type\\\":\\\"object\\\"},\\\"inputResponses\\\":{\\\"$ref\\\":\\\"#/$defs/InputResponses\\\"},\\\"name\\\":{\\\"description\\\":\\\"The name of the prompt or prompt template.\\\",\\\"type\\\":\\\"string\\\"},\\\"requestState\\\":{\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"_meta\\\",\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"GetPromptResult\\\":{\\\"description\\\":\\\"The result returned by the server for a {@link GetPromptRequestprompts/get} request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"description\\\":{\\\"description\\\":\\\"An optional description for the prompt.\\\",\\\"type\\\":\\\"string\\\"},\\\"messages\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/PromptMessage\\\"},\\\"type\\\":\\\"array\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"messages\\\",\\\"resultType\\\"],\\\"type\\\":\\\"object\\\"},\\\"GetPromptResultResponse\\\":{\\\"description\\\":\\\"A successful response from the server for a {@link GetPromptRequestprompts/get} request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"result\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/InputRequiredResult\\\"},{\\\"$ref\\\":\\\"#/$defs/GetPromptResult\\\"}]}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"result\\\"],\\\"type\\\":\\\"object\\\"},\\\"HeaderMismatchError\\\":{\\\"description\\\":\\\"Returned when a server rejects a request because the values in the HTTP\\\\nheaders do not match the corresponding values in the request body, or\\\\nbecause required headers are missing or malformed. For HTTP, the response\\\\nstatus code MUST be `400 Bad Request`.\\\",\\\"properties\\\":{\\\"error\\\":{\\\"allOf\\\":[{\\\"$ref\\\":\\\"#/$defs/Error\\\"},{\\\"properties\\\":{\\\"code\\\":{\\\"const\\\":-32020,\\\"type\\\":\\\"integer\\\"}},\\\"required\\\":[\\\"code\\\"],\\\"type\\\":\\\"object\\\"}]},\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"error\\\",\\\"jsonrpc\\\"],\\\"type\\\":\\\"object\\\"},\\\"Icon\\\":{\\\"description\\\":\\\"An optionally-sized icon that can be displayed in a user interface.\\\",\\\"properties\\\":{\\\"mimeType\\\":{\\\"description\\\":\\\"Optional MIME type override if the source MIME type is missing or generic.\\\\nFor example: `\\\\\\\"image/png\\\\\\\"`, `\\\\\\\"image/jpeg\\\\\\\"`, or `\\\\\\\"image/svg+xml\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"},\\\"sizes\\\":{\\\"description\\\":\\\"Optional array of strings that specify sizes at which the icon can be used.\\\\nEach string should be in WxH format (e.g., `\\\\\\\"48x48\\\\\\\"`, `\\\\\\\"96x96\\\\\\\"`) or `\\\\\\\"any\\\\\\\"` for scalable formats like SVG.\\\\n\\\\nIf not provided, the client should assume that the icon can be used at any size.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"src\\\":{\\\"description\\\":\\\"A standard URI pointing to an icon resource. May be an HTTP/HTTPS URL or a\\\\n`data:` URI with Base64-encoded image data.\\\\n\\\\nConsumers SHOULD take steps to ensure URLs serving icons are from the\\\\nsame domain as the client/server or a trusted domain.\\\\n\\\\nConsumers SHOULD take appropriate precautions when consuming SVGs as they can contain\\\\nexecutable JavaScript.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"},\\\"theme\\\":{\\\"description\\\":\\\"Optional specifier for the theme this icon is designed for. `\\\\\\\"light\\\\\\\"` indicates\\\\nthe icon is designed to be used with a light background, and `\\\\\\\"dark\\\\\\\"` indicates\\\\nthe icon is designed to be used with a dark background.\\\\n\\\\nIf not provided, the client should assume the icon can be used with any theme.\\\",\\\"enum\\\":[\\\"dark\\\",\\\"light\\\"],\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"src\\\"],\\\"type\\\":\\\"object\\\"},\\\"Icons\\\":{\\\"description\\\":\\\"Base interface to add `icons` property.\\\",\\\"properties\\\":{\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ImageContent\\\":{\\\"description\\\":\\\"An image provided to or from an LLM.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"data\\\":{\\\"description\\\":\\\"The base64-encoded image data.\\\",\\\"format\\\":\\\"byte\\\",\\\"type\\\":\\\"string\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of the image. Different providers may support different image types.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"image\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"data\\\",\\\"mimeType\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"Implementation\\\":{\\\"description\\\":\\\"Describes the MCP implementation.\\\",\\\"properties\\\":{\\\"description\\\":{\\\"description\\\":\\\"An optional human-readable description of what this implementation does.\\\\n\\\\nThis can be used by clients or servers to provide context about their purpose\\\\nand capabilities. For example, a server might describe the types of resources\\\\nor tools it provides, while a client might describe its intended use case.\\\",\\\"type\\\":\\\"string\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for {@link Tool},\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"},\\\"version\\\":{\\\"description\\\":\\\"The version of this implementation.\\\",\\\"type\\\":\\\"string\\\"},\\\"websiteUrl\\\":{\\\"description\\\":\\\"An optional URL of the website for this implementation.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"version\\\"],\\\"type\\\":\\\"object\\\"},\\\"InputRequest\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/CreateMessageRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListRootsRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ElicitRequest\\\"}]},\\\"InputRequests\\\":{\\\"additionalProperties\\\":{\\\"$ref\\\":\\\"#/$defs/InputRequest\\\"},\\\"description\\\":\\\"A map of server-initiated requests that the client must fulfill.\\\\nKeys are server-assigned identifiers; values are the request objects.\\\",\\\"type\\\":\\\"object\\\"},\\\"InputRequiredResult\\\":{\\\"description\\\":\\\"An InputRequiredResult sent by the server to indicate that additional input is needed\\\\nbefore the request can be completed.\\\\n\\\\nAt least one of `inputRequests` or `requestState` MUST be present.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"inputRequests\\\":{\\\"$ref\\\":\\\"#/$defs/InputRequests\\\"},\\\"requestState\\\":{\\\"type\\\":\\\"string\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"resultType\\\"],\\\"type\\\":\\\"object\\\"},\\\"InputResponse\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/CreateMessageResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ListRootsResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ElicitResult\\\"}]},\\\"InputResponseRequestParams\\\":{\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/RequestMetaObject\\\"},\\\"inputResponses\\\":{\\\"$ref\\\":\\\"#/$defs/InputResponses\\\"},\\\"requestState\\\":{\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"_meta\\\"],\\\"type\\\":\\\"object\\\"},\\\"InputResponses\\\":{\\\"additionalProperties\\\":{\\\"$ref\\\":\\\"#/$defs/InputResponse\\\"},\\\"description\\\":\\\"A map of client responses to server-initiated requests.\\\\nKeys correspond to the keys in the {@link InputRequests} map;\\\\nvalues are the client's result for each request.\\\",\\\"type\\\":\\\"object\\\"},\\\"InternalError\\\":{\\\"description\\\":\\\"A JSON-RPC error indicating that an internal error occurred on the receiver. This error is returned when the receiver encounters an unexpected condition that prevents it from fulfilling the request.\\\",\\\"properties\\\":{\\\"code\\\":{\\\"const\\\":-32603,\\\"description\\\":\\\"The error type that occurred.\\\",\\\"type\\\":\\\"integer\\\"},\\\"data\\\":{\\\"description\\\":\\\"Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).\\\"},\\\"message\\\":{\\\"description\\\":\\\"A short description of the error. The message SHOULD be limited to a concise single sentence.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"code\\\",\\\"message\\\"],\\\"type\\\":\\\"object\\\"},\\\"InvalidParamsError\\\":{\\\"description\\\":\\\"A JSON-RPC error indicating that the method parameters are invalid or malformed.\\\\n\\\\nIn MCP, this error is returned in various contexts when request parameters fail validation:\\\\n\\\\n- **Tools**: Unknown tool name or invalid tool arguments\\\\n- **Prompts**: Unknown prompt name or missing required arguments\\\\n- **Pagination**: Invalid or expired cursor values\\\\n- **Logging**: Invalid log level\\\\n- **Elicitation**: Server requests an elicitation mode not declared in client capabilities\\\\n- **Sampling**: Missing tool result or tool results mixed with other content\\\",\\\"properties\\\":{\\\"code\\\":{\\\"const\\\":-32602,\\\"description\\\":\\\"The error type that occurred.\\\",\\\"type\\\":\\\"integer\\\"},\\\"data\\\":{\\\"description\\\":\\\"Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).\\\"},\\\"message\\\":{\\\"description\\\":\\\"A short description of the error. The message SHOULD be limited to a concise single sentence.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"code\\\",\\\"message\\\"],\\\"type\\\":\\\"object\\\"},\\\"InvalidRequestError\\\":{\\\"description\\\":\\\"A JSON-RPC error indicating that the request is not a valid request object. This error is returned when the message structure does not conform to the JSON-RPC 2.0 specification requirements for a request (e.g., missing required fields like `jsonrpc` or `method`, or using invalid types for these fields).\\\",\\\"properties\\\":{\\\"code\\\":{\\\"const\\\":-32600,\\\"description\\\":\\\"The error type that occurred.\\\",\\\"type\\\":\\\"integer\\\"},\\\"data\\\":{\\\"description\\\":\\\"Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).\\\"},\\\"message\\\":{\\\"description\\\":\\\"A short description of the error. The message SHOULD be limited to a concise single sentence.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"code\\\",\\\"message\\\"],\\\"type\\\":\\\"object\\\"},\\\"JSONArray\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/JSONValue\\\"},\\\"type\\\":\\\"array\\\"},\\\"JSONObject\\\":{\\\"additionalProperties\\\":{\\\"$ref\\\":\\\"#/$defs/JSONValue\\\"},\\\"type\\\":\\\"object\\\"},\\\"JSONRPCErrorResponse\\\":{\\\"description\\\":\\\"A response to a request that indicates an error occurred.\\\",\\\"properties\\\":{\\\"error\\\":{\\\"$ref\\\":\\\"#/$defs/Error\\\"},\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"error\\\",\\\"jsonrpc\\\"],\\\"type\\\":\\\"object\\\"},\\\"JSONRPCMessage\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/JSONRPCRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/JSONRPCNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/JSONRPCResultResponse\\\"},{\\\"$ref\\\":\\\"#/$defs/JSONRPCErrorResponse\\\"}],\\\"description\\\":\\\"Refers to any valid JSON-RPC object that can be decoded off the wire, or encoded to be sent.\\\"},\\\"JSONRPCNotification\\\":{\\\"description\\\":\\\"A notification which does not expect a response.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"additionalProperties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"JSONRPCRequest\\\":{\\\"description\\\":\\\"A request that expects a response.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"additionalProperties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"JSONRPCResponse\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/JSONRPCResultResponse\\\"},{\\\"$ref\\\":\\\"#/$defs/JSONRPCErrorResponse\\\"}],\\\"description\\\":\\\"A response to a request, containing either the result or error.\\\"},\\\"JSONRPCResultResponse\\\":{\\\"description\\\":\\\"A successful (non-error) response to a request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"result\\\":{\\\"$ref\\\":\\\"#/$defs/Result\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"result\\\"],\\\"type\\\":\\\"object\\\"},\\\"JSONValue\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/JSONObject\\\"},{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/JSONValue\\\"},\\\"type\\\":\\\"array\\\"},{\\\"type\\\":[\\\"string\\\",\\\"integer\\\",\\\"boolean\\\"]}]},\\\"LegacyTitledEnumSchema\\\":{\\\"description\\\":\\\"Use {@link TitledSingleSelectEnumSchema} instead.\\\\nThis interface will be removed in a future version.\\\",\\\"properties\\\":{\\\"default\\\":{\\\"type\\\":\\\"string\\\"},\\\"description\\\":{\\\"type\\\":\\\"string\\\"},\\\"enum\\\":{\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"enumNames\\\":{\\\"description\\\":\\\"(Legacy) Display names for enum values.\\\\nNon-standard according to JSON schema 2020-12.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"title\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"string\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"enum\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListPromptsRequest\\\":{\\\"description\\\":\\\"Sent from the client to request a list of prompts and prompt templates the server has.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"prompts/list\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/PaginatedRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListPromptsResult\\\":{\\\"description\\\":\\\"The result returned by the server for a {@link ListPromptsRequestprompts/list} request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"cacheScope\\\":{\\\"description\\\":\\\"Indicates the intended scope of the cached response, analogous to HTTP\\\\n`Cache-Control: public` vs `Cache-Control: private`.\\\\n\\\\n- `\\\\\\\"public\\\\\\\"`: The response does not contain user-specific data. Any\\\\n client or intermediary (e.g., shared gateway, caching proxy) MAY cache\\\\n the response and serve it across authorization contexts.\\\\n- `\\\\\\\"private\\\\\\\"`: The response MAY be cached and reused only within the\\\\n same authorization context. Caches MUST NOT be shared across\\\\n authorization contexts (e.g., a different access token requires a\\\\n different cache).\\\",\\\"enum\\\":[\\\"private\\\",\\\"public\\\"],\\\"type\\\":\\\"string\\\"},\\\"nextCursor\\\":{\\\"description\\\":\\\"An opaque token representing the pagination position after the last returned result.\\\\nIf present, there may be more results available.\\\",\\\"type\\\":\\\"string\\\"},\\\"prompts\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Prompt\\\"},\\\"type\\\":\\\"array\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"},\\\"ttlMs\\\":{\\\"description\\\":\\\"A hint from the server indicating how long (in milliseconds) the\\\\nclient MAY cache this response before re-fetching. Semantics are\\\\nanalogous to HTTP Cache-Control max-age.\\\\n\\\\n- If 0, The response SHOULD be considered immediately stale,\\\\n The client MAY re-fetch every time the result is needed.\\\\n- If positive, the client SHOULD consider the result fresh for this many\\\\n milliseconds after receiving the response.\\\",\\\"minimum\\\":0,\\\"type\\\":\\\"integer\\\"}},\\\"required\\\":[\\\"cacheScope\\\",\\\"prompts\\\",\\\"resultType\\\",\\\"ttlMs\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListPromptsResultResponse\\\":{\\\"description\\\":\\\"A successful response from the server for a {@link ListPromptsRequestprompts/list} request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"result\\\":{\\\"$ref\\\":\\\"#/$defs/ListPromptsResult\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"result\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListResourceTemplatesRequest\\\":{\\\"description\\\":\\\"Sent from the client to request a list of resource templates the server has.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"resources/templates/list\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/PaginatedRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListResourceTemplatesResult\\\":{\\\"description\\\":\\\"The result returned by the server for a {@link ListResourceTemplatesRequestresources/templates/list} request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"cacheScope\\\":{\\\"description\\\":\\\"Indicates the intended scope of the cached response, analogous to HTTP\\\\n`Cache-Control: public` vs `Cache-Control: private`.\\\\n\\\\n- `\\\\\\\"public\\\\\\\"`: The response does not contain user-specific data. Any\\\\n client or intermediary (e.g., shared gateway, caching proxy) MAY cache\\\\n the response and serve it across authorization contexts.\\\\n- `\\\\\\\"private\\\\\\\"`: The response MAY be cached and reused only within the\\\\n same authorization context. Caches MUST NOT be shared across\\\\n authorization contexts (e.g., a different access token requires a\\\\n different cache).\\\",\\\"enum\\\":[\\\"private\\\",\\\"public\\\"],\\\"type\\\":\\\"string\\\"},\\\"nextCursor\\\":{\\\"description\\\":\\\"An opaque token representing the pagination position after the last returned result.\\\\nIf present, there may be more results available.\\\",\\\"type\\\":\\\"string\\\"},\\\"resourceTemplates\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/ResourceTemplate\\\"},\\\"type\\\":\\\"array\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"},\\\"ttlMs\\\":{\\\"description\\\":\\\"A hint from the server indicating how long (in milliseconds) the\\\\nclient MAY cache this response before re-fetching. Semantics are\\\\nanalogous to HTTP Cache-Control max-age.\\\\n\\\\n- If 0, The response SHOULD be considered immediately stale,\\\\n The client MAY re-fetch every time the result is needed.\\\\n- If positive, the client SHOULD consider the result fresh for this many\\\\n milliseconds after receiving the response.\\\",\\\"minimum\\\":0,\\\"type\\\":\\\"integer\\\"}},\\\"required\\\":[\\\"cacheScope\\\",\\\"resourceTemplates\\\",\\\"resultType\\\",\\\"ttlMs\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListResourceTemplatesResultResponse\\\":{\\\"description\\\":\\\"A successful response from the server for a {@link ListResourceTemplatesRequestresources/templates/list} request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"result\\\":{\\\"$ref\\\":\\\"#/$defs/ListResourceTemplatesResult\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"result\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListResourcesRequest\\\":{\\\"description\\\":\\\"Sent from the client to request a list of resources the server has.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"resources/list\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/PaginatedRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListResourcesResult\\\":{\\\"description\\\":\\\"The result returned by the server for a {@link ListResourcesRequestresources/list} request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"cacheScope\\\":{\\\"description\\\":\\\"Indicates the intended scope of the cached response, analogous to HTTP\\\\n`Cache-Control: public` vs `Cache-Control: private`.\\\\n\\\\n- `\\\\\\\"public\\\\\\\"`: The response does not contain user-specific data. Any\\\\n client or intermediary (e.g., shared gateway, caching proxy) MAY cache\\\\n the response and serve it across authorization contexts.\\\\n- `\\\\\\\"private\\\\\\\"`: The response MAY be cached and reused only within the\\\\n same authorization context. Caches MUST NOT be shared across\\\\n authorization contexts (e.g., a different access token requires a\\\\n different cache).\\\",\\\"enum\\\":[\\\"private\\\",\\\"public\\\"],\\\"type\\\":\\\"string\\\"},\\\"nextCursor\\\":{\\\"description\\\":\\\"An opaque token representing the pagination position after the last returned result.\\\\nIf present, there may be more results available.\\\",\\\"type\\\":\\\"string\\\"},\\\"resources\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Resource\\\"},\\\"type\\\":\\\"array\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"},\\\"ttlMs\\\":{\\\"description\\\":\\\"A hint from the server indicating how long (in milliseconds) the\\\\nclient MAY cache this response before re-fetching. Semantics are\\\\nanalogous to HTTP Cache-Control max-age.\\\\n\\\\n- If 0, The response SHOULD be considered immediately stale,\\\\n The client MAY re-fetch every time the result is needed.\\\\n- If positive, the client SHOULD consider the result fresh for this many\\\\n milliseconds after receiving the response.\\\",\\\"minimum\\\":0,\\\"type\\\":\\\"integer\\\"}},\\\"required\\\":[\\\"cacheScope\\\",\\\"resources\\\",\\\"resultType\\\",\\\"ttlMs\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListResourcesResultResponse\\\":{\\\"description\\\":\\\"A successful response from the server for a {@link ListResourcesRequestresources/list} request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"result\\\":{\\\"$ref\\\":\\\"#/$defs/ListResourcesResult\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"result\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListRootsRequest\\\":{\\\"description\\\":\\\"Sent from the server to request a list of root URIs from the client. Roots allow\\\\nservers to ask for specific directories or files to operate on. A common example\\\\nfor roots is providing a set of repositories or directories a server should operate\\\\non.\\\\n\\\\nThis request is typically used when the server needs to understand the file system\\\\nstructure or access specific locations that the client has permission to read from.\\\",\\\"properties\\\":{\\\"method\\\":{\\\"const\\\":\\\"roots/list\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/MetaObject\\\"}},\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListRootsResult\\\":{\\\"description\\\":\\\"The result returned by the client for a {@link ListRootsRequestroots/list} request.\\\\nThis result contains an array of {@link Root} objects, each representing a root directory\\\\nor file that the server can operate on.\\\",\\\"properties\\\":{\\\"roots\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Root\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"roots\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListToolsRequest\\\":{\\\"description\\\":\\\"Sent from the client to request a list of tools the server has.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"tools/list\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/PaginatedRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListToolsResult\\\":{\\\"description\\\":\\\"The result returned by the server for a {@link ListToolsRequesttools/list} request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"cacheScope\\\":{\\\"description\\\":\\\"Indicates the intended scope of the cached response, analogous to HTTP\\\\n`Cache-Control: public` vs `Cache-Control: private`.\\\\n\\\\n- `\\\\\\\"public\\\\\\\"`: The response does not contain user-specific data. Any\\\\n client or intermediary (e.g., shared gateway, caching proxy) MAY cache\\\\n the response and serve it across authorization contexts.\\\\n- `\\\\\\\"private\\\\\\\"`: The response MAY be cached and reused only within the\\\\n same authorization context. Caches MUST NOT be shared across\\\\n authorization contexts (e.g., a different access token requires a\\\\n different cache).\\\",\\\"enum\\\":[\\\"private\\\",\\\"public\\\"],\\\"type\\\":\\\"string\\\"},\\\"nextCursor\\\":{\\\"description\\\":\\\"An opaque token representing the pagination position after the last returned result.\\\\nIf present, there may be more results available.\\\",\\\"type\\\":\\\"string\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"},\\\"tools\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Tool\\\"},\\\"type\\\":\\\"array\\\"},\\\"ttlMs\\\":{\\\"description\\\":\\\"A hint from the server indicating how long (in milliseconds) the\\\\nclient MAY cache this response before re-fetching. Semantics are\\\\nanalogous to HTTP Cache-Control max-age.\\\\n\\\\n- If 0, The response SHOULD be considered immediately stale,\\\\n The client MAY re-fetch every time the result is needed.\\\\n- If positive, the client SHOULD consider the result fresh for this many\\\\n milliseconds after receiving the response.\\\",\\\"minimum\\\":0,\\\"type\\\":\\\"integer\\\"}},\\\"required\\\":[\\\"cacheScope\\\",\\\"resultType\\\",\\\"tools\\\",\\\"ttlMs\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListToolsResultResponse\\\":{\\\"description\\\":\\\"A successful response from the server for a {@link ListToolsRequesttools/list} request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"result\\\":{\\\"$ref\\\":\\\"#/$defs/ListToolsResult\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"result\\\"],\\\"type\\\":\\\"object\\\"},\\\"LoggingLevel\\\":{\\\"description\\\":\\\"The severity of a log message.\\\\n\\\\nThese map to syslog message severities, as specified in RFC-5424:\\\\nhttps://datatracker.ietf.org/doc/html/rfc5424#section-6.2.1\\\",\\\"enum\\\":[\\\"alert\\\",\\\"critical\\\",\\\"debug\\\",\\\"emergency\\\",\\\"error\\\",\\\"info\\\",\\\"notice\\\",\\\"warning\\\"],\\\"type\\\":\\\"string\\\"},\\\"LoggingMessageNotification\\\":{\\\"description\\\":\\\"JSONRPCNotification of a log message passed from server to client. The client opts in by setting `\\\\\\\"io.modelcontextprotocol/logLevel\\\\\\\"` in a request's `_meta`.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/message\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/LoggingMessageNotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"LoggingMessageNotificationParams\\\":{\\\"description\\\":\\\"Parameters for a `notifications/message` notification.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationMetaObject\\\"},\\\"data\\\":{\\\"description\\\":\\\"The data to be logged, such as a string message or an object. Any JSON serializable type is allowed here.\\\"},\\\"level\\\":{\\\"$ref\\\":\\\"#/$defs/LoggingLevel\\\",\\\"description\\\":\\\"The severity of this log message.\\\"},\\\"logger\\\":{\\\"description\\\":\\\"An optional name of the logger issuing this message.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"data\\\",\\\"level\\\"],\\\"type\\\":\\\"object\\\"},\\\"MetaObject\\\":{\\\"description\\\":\\\"Represents the contents of a `_meta` field, which clients and servers use to attach additional metadata to their interactions.\\\\n\\\\nCertain key names are reserved by MCP for protocol-level metadata; implementations MUST NOT make assumptions about values at these keys. Additionally, specific schema definitions may reserve particular names for purpose-specific metadata, as declared in those definitions.\\\\n\\\\nValid keys have two segments:\\\\n\\\\n**Prefix:**\\\\n- Optional — if specified, MUST be a series of _labels_ separated by dots (`.`), followed by a slash (`/`).\\\\n- Labels MUST start with a letter and end with a letter or digit. Interior characters may be letters, digits, or hyphens (`-`).\\\\n- Implementations SHOULD use reverse DNS notation (e.g., `com.example/` rather than `example.com/`).\\\\n- Any prefix where the second label is `modelcontextprotocol` or `mcp` is **reserved** for MCP use. For example: `io.modelcontextprotocol/`, `dev.mcp/`, `org.modelcontextprotocol.api/`, and `com.mcp.tools/` are all reserved. However, `com.example.mcp/` is NOT reserved, as the second label is `example`.\\\\n\\\\n**Name:**\\\\n- Unless empty, MUST start and end with an alphanumeric character (`[a-z0-9A-Z]`).\\\\n- Interior characters may be alphanumeric, hyphens (`-`), underscores (`_`), or dots (`.`).\\\",\\\"type\\\":\\\"object\\\"},\\\"MethodNotFoundError\\\":{\\\"description\\\":\\\"A JSON-RPC error indicating that the requested method does not exist or is not available.\\\\n\\\\nIn MCP, a server returns this error when a client invokes a method the server does not implement — either a genuinely unknown method, or one gated behind a server capability the server did not advertise (e.g., calling `prompts/list` when the `prompts` capability was not advertised).\\\\n\\\\nA request that requires a client capability the client did not declare is signalled instead by {@link MissingRequiredClientCapabilityError} (`-32021`).\\\",\\\"properties\\\":{\\\"code\\\":{\\\"const\\\":-32601,\\\"description\\\":\\\"The error type that occurred.\\\",\\\"type\\\":\\\"integer\\\"},\\\"data\\\":{\\\"description\\\":\\\"Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).\\\"},\\\"message\\\":{\\\"description\\\":\\\"A short description of the error. The message SHOULD be limited to a concise single sentence.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"code\\\",\\\"message\\\"],\\\"type\\\":\\\"object\\\"},\\\"MissingRequiredClientCapabilityError\\\":{\\\"description\\\":\\\"Returned when processing a request requires a capability the client did not\\\\ndeclare in `clientCapabilities`. For HTTP, the response status code MUST be\\\\n`400 Bad Request`.\\\",\\\"properties\\\":{\\\"error\\\":{\\\"allOf\\\":[{\\\"$ref\\\":\\\"#/$defs/Error\\\"},{\\\"properties\\\":{\\\"code\\\":{\\\"const\\\":-32021,\\\"type\\\":\\\"integer\\\"},\\\"data\\\":{\\\"properties\\\":{\\\"requiredCapabilities\\\":{\\\"$ref\\\":\\\"#/$defs/ClientCapabilities\\\",\\\"description\\\":\\\"The capabilities the server requires from the client to process this request.\\\"}},\\\"required\\\":[\\\"requiredCapabilities\\\"],\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"code\\\",\\\"data\\\"],\\\"type\\\":\\\"object\\\"}]},\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"error\\\",\\\"jsonrpc\\\"],\\\"type\\\":\\\"object\\\"},\\\"ModelHint\\\":{\\\"description\\\":\\\"Hints to use for model selection.\\\\n\\\\nKeys not declared here are currently left unspecified by the spec and are up\\\\nto the client to interpret.\\\",\\\"properties\\\":{\\\"name\\\":{\\\"description\\\":\\\"A hint for a model name.\\\\n\\\\nThe client SHOULD treat this as a substring of a model name; for example:\\\\n - `claude-3-5-sonnet` should match `claude-3-5-sonnet-20241022`\\\\n - `sonnet` should match `claude-3-5-sonnet-20241022`, `claude-3-sonnet-20240229`, etc.\\\\n - `claude` should match any Claude model\\\\n\\\\nThe client MAY also map the string to a different provider's model name or a different model family, as long as it fills a similar niche; for example:\\\\n - `gemini-1.5-flash` could match `claude-3-haiku-20240307`\\\",\\\"type\\\":\\\"string\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ModelPreferences\\\":{\\\"description\\\":\\\"The server's preferences for model selection, requested of the client during sampling.\\\\n\\\\nBecause LLMs can vary along multiple dimensions, choosing the \\\\\\\"best\\\\\\\" model is\\\\nrarely straightforward. Different models excel in different areas—some are\\\\nfaster but less capable, others are more capable but more expensive, and so\\\\non. This interface allows servers to express their priorities across multiple\\\\ndimensions to help clients make an appropriate selection for their use case.\\\\n\\\\nThese preferences are always advisory. The client MAY ignore them. It is also\\\\nup to the client to decide how to interpret these preferences and how to\\\\nbalance them against other considerations.\\\",\\\"properties\\\":{\\\"costPriority\\\":{\\\"description\\\":\\\"How much to prioritize cost when selecting a model. A value of 0 means cost\\\\nis not important, while a value of 1 means cost is the most important\\\\nfactor.\\\",\\\"maximum\\\":1,\\\"minimum\\\":0,\\\"type\\\":\\\"number\\\"},\\\"hints\\\":{\\\"description\\\":\\\"Optional hints to use for model selection.\\\\n\\\\nIf multiple hints are specified, the client MUST evaluate them in order\\\\n(such that the first match is taken).\\\\n\\\\nThe client SHOULD prioritize these hints over the numeric priorities, but\\\\nMAY still use the priorities to select from ambiguous matches.\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/ModelHint\\\"},\\\"type\\\":\\\"array\\\"},\\\"intelligencePriority\\\":{\\\"description\\\":\\\"How much to prioritize intelligence and capabilities when selecting a\\\\nmodel. A value of 0 means intelligence is not important, while a value of 1\\\\nmeans intelligence is the most important factor.\\\",\\\"maximum\\\":1,\\\"minimum\\\":0,\\\"type\\\":\\\"number\\\"},\\\"speedPriority\\\":{\\\"description\\\":\\\"How much to prioritize sampling speed (latency) when selecting a model. A\\\\nvalue of 0 means speed is not important, while a value of 1 means speed is\\\\nthe most important factor.\\\",\\\"maximum\\\":1,\\\"minimum\\\":0,\\\"type\\\":\\\"number\\\"}},\\\"type\\\":\\\"object\\\"},\\\"MultiSelectEnumSchema\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/UntitledMultiSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledMultiSelectEnumSchema\\\"}]},\\\"Notification\\\":{\\\"properties\\\":{\\\"method\\\":{\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"additionalProperties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"NotificationMetaObject\\\":{\\\"description\\\":\\\"Extends {@link MetaObject} with additional notification-specific fields. All key naming rules from `MetaObject` apply.\\\",\\\"properties\\\":{\\\"io.modelcontextprotocol/subscriptionId\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\",\\\"description\\\":\\\"Identifies the subscription stream a notification was delivered on. The\\\\nserver MUST include this key on every notification delivered via a\\\\n{@link SubscriptionsListenRequestsubscriptions/listen} stream, so the\\\\nclient can correlate the notification with the originating subscription.\\\\nThe key is absent on notifications not delivered via a subscription\\\\nstream (e.g. progress notifications for an in-flight request), which is\\\\nwhy it is optional here.\\\\n\\\\nThe value is the JSON-RPC ID of the `subscriptions/listen` request that\\\\nopened the stream.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"NotificationParams\\\":{\\\"description\\\":\\\"Common params for any notification.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationMetaObject\\\"}},\\\"type\\\":\\\"object\\\"},\\\"NumberSchema\\\":{\\\"properties\\\":{\\\"default\\\":{\\\"type\\\":\\\"number\\\"},\\\"description\\\":{\\\"type\\\":\\\"string\\\"},\\\"maximum\\\":{\\\"type\\\":\\\"number\\\"},\\\"minimum\\\":{\\\"type\\\":\\\"number\\\"},\\\"title\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"enum\\\":[\\\"integer\\\",\\\"number\\\"],\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"PaginatedRequest\\\":{\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/PaginatedRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"PaginatedRequestParams\\\":{\\\"description\\\":\\\"Common params for paginated requests.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/RequestMetaObject\\\"},\\\"cursor\\\":{\\\"description\\\":\\\"An opaque token representing the current pagination position.\\\\nIf provided, the server should return results starting after this cursor.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"_meta\\\"],\\\"type\\\":\\\"object\\\"},\\\"PaginatedResult\\\":{\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/ResultMetaObject\\\"},\\\"nextCursor\\\":{\\\"description\\\":\\\"An opaque token representing the pagination position after the last returned result.\\\\nIf present, there may be more results available.\\\",\\\"type\\\":\\\"string\\\"},\\\"resultType\\\":{\\\"description\\\":\\\"Indicates the type of the result, which allows the client to determine\\\\nhow to parse the result object.\\\\n\\\\nServers implementing this protocol version MUST include this field.\\\\nFor backward compatibility, when a client receives a result from a\\\\nserver implementing an earlier protocol version (which does not include\\\\n`resultType`), the client MUST treat the absent field as `\\\\\\\"complete\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"resultType\\\"],\\\"type\\\":\\\"object\\\"},\\\"ParseError\\\":{\\\"description\\\":\\\"A JSON-RPC error indicating that invalid JSON was received by the server. This error is returned when the server cannot parse the JSON text of a message.\\\",\\\"properties\\\":{\\\"code\\\":{\\\"const\\\":-32700,\\\"description\\\":\\\"The error type that occurred.\\\",\\\"type\\\":\\\"integer\\\"},\\\"data\\\":{\\\"description\\\":\\\"Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).\\\"},\\\"message\\\":{\\\"description\\\":\\\"A short description of the error. The message SHOULD be limited to a concise single sentence.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"code\\\",\\\"message\\\"],\\\"type\\\":\\\"object\\\"},\\\"PrimitiveSchemaDefinition\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/StringSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/NumberSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/BooleanSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/UntitledSingleSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledSingleSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/UntitledMultiSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledMultiSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/LegacyTitledEnumSchema\\\"}],\\\"description\\\":\\\"Restricted schema definitions that only allow primitive types\\\\nwithout nested objects or arrays.\\\"},\\\"ProgressNotification\\\":{\\\"description\\\":\\\"An out-of-band notification used to inform the receiver of a progress update for a long-running request.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/progress\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressNotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ProgressNotificationParams\\\":{\\\"description\\\":\\\"Parameters for a {@link ProgressNotificationnotifications/progress} notification.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationMetaObject\\\"},\\\"message\\\":{\\\"description\\\":\\\"An optional message describing the current progress.\\\",\\\"type\\\":\\\"string\\\"},\\\"progress\\\":{\\\"d\";\n",[],[142,380,398],"4a8b1903-1f5e-4928-b92b-f05e92c8ef5e","2025-11-25.ts","71aa704e-ad1b-11f1-84f7-1607ee4eb77e",116,["D",1789046880774],"/* JSON-RPC types */\n\n/**\n * Refers to any valid JSON-RPC object that can be decoded off the wire, or encoded to be sent.\n *\n * @category JSON-RPC\n */\nexport type JSONRPCMessage =\n JSONRPCRequest | JSONRPCNotification | JSONRPCResponse;\n\n/** @internal */\nexport const LATEST_PROTOCOL_VERSION = \"2025-11-25\";\n/** @internal */\nexport const JSONRPC_VERSION = \"2.0\";\n\n/**\n * A progress token, used to associate progress notifications with the original request.\n *\n * @category Common Types\n */\nexport type ProgressToken = string | number;\n\n/**\n * An opaque token used to represent a cursor for pagination.\n *\n * @category Common Types\n */\nexport type Cursor = string;\n\n/**\n * Common params for any task-augmented request.\n *\n * @internal\n */\nexport interface TaskAugmentedRequestParams extends RequestParams {\n /**\n * If specified, the caller is requesting task-augmented execution for this request.\n * The request will return a CreateTaskResult immediately, and the actual result can be\n * retrieved later via tasks/result.\n *\n * Task augmentation is subject to capability negotiation - receivers MUST declare support\n * for task augmentation of specific request types in their capabilities.\n */\n task?: TaskMetadata;\n}\n/**\n * Common params for any request.\n *\n * @internal\n */\nexport interface RequestParams {\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: {\n /**\n * If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\n */\n progressToken?: ProgressToken;\n [key: string]: unknown;\n };\n}\n\n/** @internal */\nexport interface Request {\n method: string;\n // Allow unofficial extensions of `Request.params` without impacting `RequestParams`.\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n params?: { [key: string]: any };\n}\n\n/** @internal */\nexport interface NotificationParams {\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/** @internal */\nexport interface Notification {\n method: string;\n // Allow unofficial extensions of `Notification.params` without impacting `NotificationParams`.\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n params?: { [key: string]: any };\n}\n\n/**\n * @category Common Types\n */\nexport interface Result {\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n [key: string]: unknown;\n}\n\n/**\n * @category Common Types\n */\nexport interface Error {\n /**\n * The error type that occurred.\n */\n code: number;\n /**\n * A short description of the error. The message SHOULD be limited to a concise single sentence.\n */\n message: string;\n /**\n * Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).\n */\n data?: unknown;\n}\n\n/**\n * A uniquely identifying ID for a request in JSON-RPC.\n *\n * @category Common Types\n */\nexport type RequestId = string | number;\n\n/**\n * A request that expects a response.\n *\n * @category JSON-RPC\n */\nexport interface JSONRPCRequest extends Request {\n jsonrpc: typeof JSONRPC_VERSION;\n id: RequestId;\n}\n\n/**\n * A notification which does not expect a response.\n *\n * @category JSON-RPC\n */\nexport interface JSONRPCNotification extends Notification {\n jsonrpc: typeof JSONRPC_VERSION;\n}\n\n/**\n * A successful (non-error) response to a request.\n *\n * @category JSON-RPC\n */\nexport interface JSONRPCResultResponse {\n jsonrpc: typeof JSONRPC_VERSION;\n id: RequestId;\n result: Result;\n}\n\n/**\n * A response to a request that indicates an error occurred.\n *\n * @category JSON-RPC\n */\nexport interface JSONRPCErrorResponse {\n jsonrpc: typeof JSONRPC_VERSION;\n id?: RequestId;\n error: Error;\n}\n\n/**\n * A response to a request, containing either the result or error.\n *\n * @category JSON-RPC\n */\nexport type JSONRPCResponse = JSONRPCResultResponse | JSONRPCErrorResponse;\n\n// Standard JSON-RPC error codes\nexport const PARSE_ERROR = -32700;\nexport const INVALID_REQUEST = -32600;\nexport const METHOD_NOT_FOUND = -32601;\nexport const INVALID_PARAMS = -32602;\nexport const INTERNAL_ERROR = -32603;\n\n// Implementation-specific JSON-RPC error codes [-32000, -32099]\n/** @internal */\nexport const URL_ELICITATION_REQUIRED = -32042;\n\n/**\n * An error response that indicates that the server requires the client to provide additional information via an elicitation request.\n *\n * @internal\n */\nexport interface URLElicitationRequiredError extends Omit<\n JSONRPCErrorResponse,\n \"error\"\n> {\n error: Error & {\n code: typeof URL_ELICITATION_REQUIRED;\n data: {\n elicitations: ElicitRequestURLParams[];\n [key: string]: unknown;\n };\n };\n}\n\n/* Empty result */\n/**\n * A response that indicates success but carries no data.\n *\n * @category Common Types\n */\nexport type EmptyResult = Result;\n\n/* Cancellation */\n/**\n * Parameters for a `notifications/cancelled` notification.\n *\n * @category `notifications/cancelled`\n */\nexport interface CancelledNotificationParams extends NotificationParams {\n /**\n * The ID of the request to cancel.\n *\n * This MUST correspond to the ID of a request previously issued in the same direction.\n * This MUST be provided for cancelling non-task requests.\n * This MUST NOT be used for cancelling tasks (use the `tasks/cancel` request instead).\n */\n requestId?: RequestId;\n\n /**\n * An optional string describing the reason for the cancellation. This MAY be logged or presented to the user.\n */\n reason?: string;\n}\n\n/**\n * This notification can be sent by either side to indicate that it is cancelling a previously-issued request.\n *\n * The request SHOULD still be in-flight, but due to communication latency, it is always possible that this notification MAY arrive after the request has already finished.\n *\n * This notification indicates that the result will be unused, so any associated processing SHOULD cease.\n *\n * A client MUST NOT attempt to cancel its `initialize` request.\n *\n * For task cancellation, use the `tasks/cancel` request instead of this notification.\n *\n * @category `notifications/cancelled`\n */\nexport interface CancelledNotification extends JSONRPCNotification {\n method: \"notifications/cancelled\";\n params: CancelledNotificationParams;\n}\n\n/* Initialization */\n/**\n * Parameters for an `initialize` request.\n *\n * @category `initialize`\n */\nexport interface InitializeRequestParams extends RequestParams {\n /**\n * The latest version of the Model Context Protocol that the client supports. The client MAY decide to support older versions as well.\n */\n protocolVersion: string;\n capabilities: ClientCapabilities;\n clientInfo: Implementation;\n}\n\n/**\n * This request is sent from the client to the server when it first connects, asking it to begin initialization.\n *\n * @category `initialize`\n */\nexport interface InitializeRequest extends JSONRPCRequest {\n method: \"initialize\";\n params: InitializeRequestParams;\n}\n\n/**\n * After receiving an initialize request from the client, the server sends this response.\n *\n * @category `initialize`\n */\nexport interface InitializeResult extends Result {\n /**\n * The version of the Model Context Protocol that the server wants to use. This may not match the version that the client requested. If the client cannot support this version, it MUST disconnect.\n */\n protocolVersion: string;\n capabilities: ServerCapabilities;\n serverInfo: Implementation;\n\n /**\n * Instructions describing how to use the server and its features.\n *\n * This can be used by clients to improve the LLM's understanding of available tools, resources, etc. It can be thought of like a \"hint\" to the model. For example, this information MAY be added to the system prompt.\n */\n instructions?: string;\n}\n\n/**\n * This notification is sent from the client to the server after initialization has finished.\n *\n * @category `notifications/initialized`\n */\nexport interface InitializedNotification extends JSONRPCNotification {\n method: \"notifications/initialized\";\n params?: NotificationParams;\n}\n\n/**\n * Capabilities a client may support. Known capabilities are defined here, in this schema, but this is not a closed set: any client can define its own, additional capabilities.\n *\n * @category `initialize`\n */\nexport interface ClientCapabilities {\n /**\n * Experimental, non-standard capabilities that the client supports.\n */\n experimental?: { [key: string]: object };\n /**\n * Present if the client supports listing roots.\n */\n roots?: {\n /**\n * Whether the client supports notifications for changes to the roots list.\n */\n listChanged?: boolean;\n };\n /**\n * Present if the client supports sampling from an LLM.\n */\n sampling?: {\n /**\n * Whether the client supports context inclusion via includeContext parameter.\n * If not declared, servers SHOULD only use `includeContext: \"none\"` (or omit it).\n */\n context?: object;\n /**\n * Whether the client supports tool use via tools and toolChoice parameters.\n */\n tools?: object;\n };\n /**\n * Present if the client supports elicitation from the server.\n */\n elicitation?: { form?: object; url?: object };\n\n /**\n * Present if the client supports task-augmented requests.\n */\n tasks?: {\n /**\n * Whether this client supports tasks/list.\n */\n list?: object;\n /**\n * Whether this client supports tasks/cancel.\n */\n cancel?: object;\n /**\n * Specifies which request types can be augmented with tasks.\n */\n requests?: {\n /**\n * Task support for sampling-related requests.\n */\n sampling?: {\n /**\n * Whether the client supports task-augmented sampling/createMessage requests.\n */\n createMessage?: object;\n };\n /**\n * Task support for elicitation-related requests.\n */\n elicitation?: {\n /**\n * Whether the client supports task-augmented elicitation/create requests.\n */\n create?: object;\n };\n };\n };\n}\n\n/**\n * Capabilities that a server may support. Known capabilities are defined here, in this schema, but this is not a closed set: any server can define its own, additional capabilities.\n *\n * @category `initialize`\n */\nexport interface ServerCapabilities {\n /**\n * Experimental, non-standard capabilities that the server supports.\n */\n experimental?: { [key: string]: object };\n /**\n * Present if the server supports sending log messages to the client.\n */\n logging?: object;\n /**\n * Present if the server supports argument autocompletion suggestions.\n */\n completions?: object;\n /**\n * Present if the server offers any prompt templates.\n */\n prompts?: {\n /**\n * Whether this server supports notifications for changes to the prompt list.\n */\n listChanged?: boolean;\n };\n /**\n * Present if the server offers any resources to read.\n */\n resources?: {\n /**\n * Whether this server supports subscribing to resource updates.\n */\n subscribe?: boolean;\n /**\n * Whether this server supports notifications for changes to the resource list.\n */\n listChanged?: boolean;\n };\n /**\n * Present if the server offers any tools to call.\n */\n tools?: {\n /**\n * Whether this server supports notifications for changes to the tool list.\n */\n listChanged?: boolean;\n };\n /**\n * Present if the server supports task-augmented requests.\n */\n tasks?: {\n /**\n * Whether this server supports tasks/list.\n */\n list?: object;\n /**\n * Whether this server supports tasks/cancel.\n */\n cancel?: object;\n /**\n * Specifies which request types can be augmented with tasks.\n */\n requests?: {\n /**\n * Task support for tool-related requests.\n */\n tools?: {\n /**\n * Whether the server supports task-augmented tools/call requests.\n */\n call?: object;\n };\n };\n };\n}\n\n/**\n * An optionally-sized icon that can be displayed in a user interface.\n *\n * @category Common Types\n */\nexport interface Icon {\n /**\n * A standard URI pointing to an icon resource. May be an HTTP/HTTPS URL or a\n * `data:` URI with Base64-encoded image data.\n *\n * Consumers SHOULD takes steps to ensure URLs serving icons are from the\n * same domain as the client/server or a trusted domain.\n *\n * Consumers SHOULD take appropriate precautions when consuming SVGs as they can contain\n * executable JavaScript.\n *\n * @format uri\n */\n src: string;\n\n /**\n * Optional MIME type override if the source MIME type is missing or generic.\n * For example: `\"image/png\"`, `\"image/jpeg\"`, or `\"image/svg+xml\"`.\n */\n mimeType?: string;\n\n /**\n * Optional array of strings that specify sizes at which the icon can be used.\n * Each string should be in WxH format (e.g., `\"48x48\"`, `\"96x96\"`) or `\"any\"` for scalable formats like SVG.\n *\n * If not provided, the client should assume that the icon can be used at any size.\n */\n sizes?: string[];\n\n /**\n * Optional specifier for the theme this icon is designed for. `light` indicates\n * the icon is designed to be used with a light background, and `dark` indicates\n * the icon is designed to be used with a dark background.\n *\n * If not provided, the client should assume the icon can be used with any theme.\n */\n theme?: \"light\" | \"dark\";\n}\n\n/**\n * Base interface to add `icons` property.\n *\n * @internal\n */\nexport interface Icons {\n /**\n * Optional set of sized icons that the client can display in a user interface.\n *\n * Clients that support rendering icons MUST support at least the following MIME types:\n * - `image/png` - PNG images (safe, universal compatibility)\n * - `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\n *\n * Clients that support rendering icons SHOULD also support:\n * - `image/svg+xml` - SVG images (scalable but requires security precautions)\n * - `image/webp` - WebP images (modern, efficient format)\n */\n icons?: Icon[];\n}\n\n/**\n * Base interface for metadata with name (identifier) and title (display name) properties.\n *\n * @internal\n */\nexport interface BaseMetadata {\n /**\n * Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\n */\n name: string;\n\n /**\n * Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\n * even by those unfamiliar with domain-specific terminology.\n *\n * If not provided, the name should be used for display (except for Tool,\n * where `annotations.title` should be given precedence over using `name`,\n * if present).\n */\n title?: string;\n}\n\n/**\n * Describes the MCP implementation.\n *\n * @category `initialize`\n */\nexport interface Implementation extends BaseMetadata, Icons {\n version: string;\n\n /**\n * An optional human-readable description of what this implementation does.\n *\n * This can be used by clients or servers to provide context about their purpose\n * and capabilities. For example, a server might describe the types of resources\n * or tools it provides, while a client might describe its intended use case.\n */\n description?: string;\n\n /**\n * An optional URL of the website for this implementation.\n *\n * @format uri\n */\n websiteUrl?: string;\n}\n\n/* Ping */\n/**\n * A ping, issued by either the server or the client, to check that the other party is still alive. The receiver must promptly respond, or else may be disconnected.\n *\n * @category `ping`\n */\nexport interface PingRequest extends JSONRPCRequest {\n method: \"ping\";\n params?: RequestParams;\n}\n\n/* Progress notifications */\n\n/**\n * Parameters for a `notifications/progress` notification.\n *\n * @category `notifications/progress`\n */\nexport interface ProgressNotificationParams extends NotificationParams {\n /**\n * The progress token which was given in the initial request, used to associate this notification with the request that is proceeding.\n */\n progressToken: ProgressToken;\n /**\n * The progress thus far. This should increase every time progress is made, even if the total is unknown.\n *\n * @TJS-type number\n */\n progress: number;\n /**\n * Total number of items to process (or total progress required), if known.\n *\n * @TJS-type number\n */\n total?: number;\n /**\n * An optional message describing the current progress.\n */\n message?: string;\n}\n\n/**\n * An out-of-band notification used to inform the receiver of a progress update for a long-running request.\n *\n * @category `notifications/progress`\n */\nexport interface ProgressNotification extends JSONRPCNotification {\n method: \"notifications/progress\";\n params: ProgressNotificationParams;\n}\n\n/* Pagination */\n/**\n * Common parameters for paginated requests.\n *\n * @internal\n */\nexport interface PaginatedRequestParams extends RequestParams {\n /**\n * An opaque token representing the current pagination position.\n * If provided, the server should return results starting after this cursor.\n */\n cursor?: Cursor;\n}\n\n/** @internal */\nexport interface PaginatedRequest extends JSONRPCRequest {\n params?: PaginatedRequestParams;\n}\n\n/** @internal */\nexport interface PaginatedResult extends Result {\n /**\n * An opaque token representing the pagination position after the last returned result.\n * If present, there may be more results available.\n */\n nextCursor?: Cursor;\n}\n\n/* Resources */\n/**\n * Sent from the client to request a list of resources the server has.\n *\n * @category `resources/list`\n */\nexport interface ListResourcesRequest extends PaginatedRequest {\n method: \"resources/list\";\n}\n\n/**\n * The server's response to a resources/list request from the client.\n *\n * @category `resources/list`\n */\nexport interface ListResourcesResult extends PaginatedResult {\n resources: Resource[];\n}\n\n/**\n * Sent from the client to request a list of resource templates the server has.\n *\n * @category `resources/templates/list`\n */\nexport interface ListResourceTemplatesRequest extends PaginatedRequest {\n method: \"resources/templates/list\";\n}\n\n/**\n * The server's response to a resources/templates/list request from the client.\n *\n * @category `resources/templates/list`\n */\nexport interface ListResourceTemplatesResult extends PaginatedResult {\n resourceTemplates: ResourceTemplate[];\n}\n\n/**\n * Common parameters when working with resources.\n *\n * @internal\n */\nexport interface ResourceRequestParams extends RequestParams {\n /**\n * The URI of the resource. The URI can use any protocol; it is up to the server how to interpret it.\n *\n * @format uri\n */\n uri: string;\n}\n\n/**\n * Parameters for a `resources/read` request.\n *\n * @category `resources/read`\n */\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type\nexport interface ReadResourceRequestParams extends ResourceRequestParams {}\n\n/**\n * Sent from the client to the server, to read a specific resource URI.\n *\n * @category `resources/read`\n */\nexport interface ReadResourceRequest extends JSONRPCRequest {\n method: \"resources/read\";\n params: ReadResourceRequestParams;\n}\n\n/**\n * The server's response to a resources/read request from the client.\n *\n * @category `resources/read`\n */\nexport interface ReadResourceResult extends Result {\n contents: (TextResourceContents | BlobResourceContents)[];\n}\n\n/**\n * An optional notification from the server to the client, informing it that the list of resources it can read from has changed. This may be issued by servers without any previous subscription from the client.\n *\n * @category `notifications/resources/list_changed`\n */\nexport interface ResourceListChangedNotification extends JSONRPCNotification {\n method: \"notifications/resources/list_changed\";\n params?: NotificationParams;\n}\n\n/**\n * Parameters for a `resources/subscribe` request.\n *\n * @category `resources/subscribe`\n */\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type\nexport interface SubscribeRequestParams extends ResourceRequestParams {}\n\n/**\n * Sent from the client to request resources/updated notifications from the server whenever a particular resource changes.\n *\n * @category `resources/subscribe`\n */\nexport interface SubscribeRequest extends JSONRPCRequest {\n method: \"resources/subscribe\";\n params: SubscribeRequestParams;\n}\n\n/**\n * Parameters for a `resources/unsubscribe` request.\n *\n * @category `resources/unsubscribe`\n */\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type\nexport interface UnsubscribeRequestParams extends ResourceRequestParams {}\n\n/**\n * Sent from the client to request cancellation of resources/updated notifications from the server. This should follow a previous resources/subscribe request.\n *\n * @category `resources/unsubscribe`\n */\nexport interface UnsubscribeRequest extends JSONRPCRequest {\n method: \"resources/unsubscribe\";\n params: UnsubscribeRequestParams;\n}\n\n/**\n * Parameters for a `notifications/resources/updated` notification.\n *\n * @category `notifications/resources/updated`\n */\nexport interface ResourceUpdatedNotificationParams extends NotificationParams {\n /**\n * The URI of the resource that has been updated. This might be a sub-resource of the one that the client actually subscribed to.\n *\n * @format uri\n */\n uri: string;\n}\n\n/**\n * A notification from the server to the client, informing it that a resource has changed and may need to be read again. This should only be sent if the client previously sent a resources/subscribe request.\n *\n * @category `notifications/resources/updated`\n */\nexport interface ResourceUpdatedNotification extends JSONRPCNotification {\n method: \"notifications/resources/updated\";\n params: ResourceUpdatedNotificationParams;\n}\n\n/**\n * A known resource that the server is capable of reading.\n *\n * @category `resources/list`\n */\nexport interface Resource extends BaseMetadata, Icons {\n /**\n * The URI of this resource.\n *\n * @format uri\n */\n uri: string;\n\n /**\n * A description of what this resource represents.\n *\n * This can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \"hint\" to the model.\n */\n description?: string;\n\n /**\n * The MIME type of this resource, if known.\n */\n mimeType?: string;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.\n *\n * This can be used by Hosts to display file sizes and estimate context window usage.\n */\n size?: number;\n\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * A template description for resources available on the server.\n *\n * @category `resources/templates/list`\n */\nexport interface ResourceTemplate extends BaseMetadata, Icons {\n /**\n * A URI template (according to RFC 6570) that can be used to construct resource URIs.\n *\n * @format uri-template\n */\n uriTemplate: string;\n\n /**\n * A description of what this template is for.\n *\n * This can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \"hint\" to the model.\n */\n description?: string;\n\n /**\n * The MIME type for all resources that match this template. This should only be included if all resources matching this template have the same type.\n */\n mimeType?: string;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * The contents of a specific resource or sub-resource.\n *\n * @internal\n */\nexport interface ResourceContents {\n /**\n * The URI of this resource.\n *\n * @format uri\n */\n uri: string;\n /**\n * The MIME type of this resource, if known.\n */\n mimeType?: string;\n\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * @category Content\n */\nexport interface TextResourceContents extends ResourceContents {\n /**\n * The text of the item. This must only be set if the item can actually be represented as text (not binary data).\n */\n text: string;\n}\n\n/**\n * @category Content\n */\nexport interface BlobResourceContents extends ResourceContents {\n /**\n * A base64-encoded string representing the binary data of the item.\n *\n * @format byte\n */\n blob: string;\n}\n\n/* Prompts */\n/**\n * Sent from the client to request a list of prompts and prompt templates the server has.\n *\n * @category `prompts/list`\n */\nexport interface ListPromptsRequest extends PaginatedRequest {\n method: \"prompts/list\";\n}\n\n/**\n * The server's response to a prompts/list request from the client.\n *\n * @category `prompts/list`\n */\nexport interface ListPromptsResult extends PaginatedResult {\n prompts: Prompt[];\n}\n\n/**\n * Parameters for a `prompts/get` request.\n *\n * @category `prompts/get`\n */\nexport interface GetPromptRequestParams extends RequestParams {\n /**\n * The name of the prompt or prompt template.\n */\n name: string;\n /**\n * Arguments to use for templating the prompt.\n */\n arguments?: { [key: string]: string };\n}\n\n/**\n * Used by the client to get a prompt provided by the server.\n *\n * @category `prompts/get`\n */\nexport interface GetPromptRequest extends JSONRPCRequest {\n method: \"prompts/get\";\n params: GetPromptRequestParams;\n}\n\n/**\n * The server's response to a prompts/get request from the client.\n *\n * @category `prompts/get`\n */\nexport interface GetPromptResult extends Result {\n /**\n * An optional description for the prompt.\n */\n description?: string;\n messages: PromptMessage[];\n}\n\n/**\n * A prompt or prompt template that the server offers.\n *\n * @category `prompts/list`\n */\nexport interface Prompt extends BaseMetadata, Icons {\n /**\n * An optional description of what this prompt provides\n */\n description?: string;\n\n /**\n * A list of arguments to use for templating the prompt.\n */\n arguments?: PromptArgument[];\n\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * Describes an argument that a prompt can accept.\n *\n * @category `prompts/list`\n */\nexport interface PromptArgument extends BaseMetadata {\n /**\n * A human-readable description of the argument.\n */\n description?: string;\n /**\n * Whether this argument must be provided.\n */\n required?: boolean;\n}\n\n/**\n * The sender or recipient of messages and data in a conversation.\n *\n * @category Common Types\n */\nexport type Role = \"user\" | \"assistant\";\n\n/**\n * Describes a message returned as part of a prompt.\n *\n * This is similar to `SamplingMessage`, but also supports the embedding of\n * resources from the MCP server.\n *\n * @category `prompts/get`\n */\nexport interface PromptMessage {\n role: Role;\n content: ContentBlock;\n}\n\n/**\n * A resource that the server is capable of reading, included in a prompt or tool call result.\n *\n * Note: resource links returned by tools are not guaranteed to appear in the results of `resources/list` requests.\n *\n * @category Content\n */\nexport interface ResourceLink extends Resource {\n type: \"resource_link\";\n}\n\n/**\n * The contents of a resource, embedded into a prompt or tool call result.\n *\n * It is up to the client how best to render embedded resources for the benefit\n * of the LLM and/or the user.\n *\n * @category Content\n */\nexport interface EmbeddedResource {\n type: \"resource\";\n resource: TextResourceContents | BlobResourceContents;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n/**\n * An optional notification from the server to the client, informing it that the list of prompts it offers has changed. This may be issued by servers without any previous subscription from the client.\n *\n * @category `notifications/prompts/list_changed`\n */\nexport interface PromptListChangedNotification extends JSONRPCNotification {\n method: \"notifications/prompts/list_changed\";\n params?: NotificationParams;\n}\n\n/* Tools */\n/**\n * Sent from the client to request a list of tools the server has.\n *\n * @category `tools/list`\n */\nexport interface ListToolsRequest extends PaginatedRequest {\n method: \"tools/list\";\n}\n\n/**\n * The server's response to a tools/list request from the client.\n *\n * @category `tools/list`\n */\nexport interface ListToolsResult extends PaginatedResult {\n tools: Tool[];\n}\n\n/**\n * The server's response to a tool call.\n *\n * @category `tools/call`\n */\nexport interface CallToolResult extends Result {\n /**\n * A list of content objects that represent the unstructured result of the tool call.\n */\n content: ContentBlock[];\n\n /**\n * An optional JSON object that represents the structured result of the tool call.\n */\n structuredContent?: { [key: string]: unknown };\n\n /**\n * Whether the tool call ended in an error.\n *\n * If not set, this is assumed to be false (the call was successful).\n *\n * Any errors that originate from the tool SHOULD be reported inside the result\n * object, with `isError` set to true, _not_ as an MCP protocol-level error\n * response. Otherwise, the LLM would not be able to see that an error occurred\n * and self-correct.\n *\n * However, any errors in _finding_ the tool, an error indicating that the\n * server does not support tool calls, or any other exceptional conditions,\n * should be reported as an MCP error response.\n */\n isError?: boolean;\n}\n\n/**\n * Parameters for a `tools/call` request.\n *\n * @category `tools/call`\n */\nexport interface CallToolRequestParams extends TaskAugmentedRequestParams {\n /**\n * The name of the tool.\n */\n name: string;\n /**\n * Arguments to use for the tool call.\n */\n arguments?: { [key: string]: unknown };\n}\n\n/**\n * Used by the client to invoke a tool provided by the server.\n *\n * @category `tools/call`\n */\nexport interface CallToolRequest extends JSONRPCRequest {\n method: \"tools/call\";\n params: CallToolRequestParams;\n}\n\n/**\n * An optional notification from the server to the client, informing it that the list of tools it offers has changed. This may be issued by servers without any previous subscription from the client.\n *\n * @category `notifications/tools/list_changed`\n */\nexport interface ToolListChangedNotification extends JSONRPCNotification {\n method: \"notifications/tools/list_changed\";\n params?: NotificationParams;\n}\n\n/**\n * Additional properties describing a Tool to clients.\n *\n * NOTE: all properties in ToolAnnotations are **hints**.\n * They are not guaranteed to provide a faithful description of\n * tool behavior (including descriptive properties like `title`).\n *\n * Clients should never make tool use decisions based on ToolAnnotations\n * received from untrusted servers.\n *\n * @category `tools/list`\n */\nexport interface ToolAnnotations {\n /**\n * A human-readable title for the tool.\n */\n title?: string;\n\n /**\n * If true, the tool does not modify its environment.\n *\n * Default: false\n */\n readOnlyHint?: boolean;\n\n /**\n * If true, the tool may perform destructive updates to its environment.\n * If false, the tool performs only additive updates.\n *\n * (This property is meaningful only when `readOnlyHint == false`)\n *\n * Default: true\n */\n destructiveHint?: boolean;\n\n /**\n * If true, calling the tool repeatedly with the same arguments\n * will have no additional effect on its environment.\n *\n * (This property is meaningful only when `readOnlyHint == false`)\n *\n * Default: false\n */\n idempotentHint?: boolean;\n\n /**\n * If true, this tool may interact with an \"open world\" of external\n * entities. If false, the tool's domain of interaction is closed.\n * For example, the world of a web search tool is open, whereas that\n * of a memory tool is not.\n *\n * Default: true\n */\n openWorldHint?: boolean;\n}\n\n/**\n * Execution-related properties for a tool.\n *\n * @category `tools/list`\n */\nexport interface ToolExecution {\n /**\n * Indicates whether this tool supports task-augmented execution.\n * This allows clients to handle long-running operations through polling\n * the task system.\n *\n * - \"forbidden\": Tool does not support task-augmented execution (default when absent)\n * - \"optional\": Tool may support task-augmented execution\n * - \"required\": Tool requires task-augmented execution\n *\n * Default: \"forbidden\"\n */\n taskSupport?: \"forbidden\" | \"optional\" | \"required\";\n}\n\n/**\n * Definition for a tool the client can call.\n *\n * @category `tools/list`\n */\nexport interface Tool extends BaseMetadata, Icons {\n /**\n * A human-readable description of the tool.\n *\n * This can be used by clients to improve the LLM's understanding of available tools. It can be thought of like a \"hint\" to the model.\n */\n description?: string;\n\n /**\n * A JSON Schema object defining the expected parameters for the tool.\n */\n inputSchema: {\n $schema?: string;\n type: \"object\";\n properties?: { [key: string]: object };\n required?: string[];\n };\n\n /**\n * Execution-related properties for this tool.\n */\n execution?: ToolExecution;\n\n /**\n * An optional JSON Schema object defining the structure of the tool's output returned in\n * the structuredContent field of a CallToolResult.\n *\n * Defaults to JSON Schema 2020-12 when no explicit $schema is provided.\n * Currently restricted to type: \"object\" at the root level.\n */\n outputSchema?: {\n $schema?: string;\n type: \"object\";\n properties?: { [key: string]: object };\n required?: string[];\n };\n\n /**\n * Optional additional tool information.\n *\n * Display name precedence order is: title, annotations.title, then name.\n */\n annotations?: ToolAnnotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/* Tasks */\n\n/**\n * The status of a task.\n *\n * @category `tasks`\n */\nexport type TaskStatus =\n | \"working\" // The request is currently being processed\n | \"input_required\" // The task is waiting for input (e.g., elicitation or sampling)\n | \"completed\" // The request completed successfully and results are available\n | \"failed\" // The associated request did not complete successfully. For tool calls specifically, this includes cases where the tool call result has `isError` set to true.\n | \"cancelled\"; // The request was cancelled before completion\n\n/**\n * Metadata for augmenting a request with task execution.\n * Include this in the `task` field of the request parameters.\n *\n * @category `tasks`\n */\nexport interface TaskMetadata {\n /**\n * Requested duration in milliseconds to retain task from creation.\n */\n ttl?: number;\n}\n\n/**\n * Metadata for associating messages with a task.\n * Include this in the `_meta` field under the key `io.modelcontextprotocol/related-task`.\n *\n * @category `tasks`\n */\nexport interface RelatedTaskMetadata {\n /**\n * The task identifier this message is associated with.\n */\n taskId: string;\n}\n\n/**\n * Data associated with a task.\n *\n * @category `tasks`\n */\nexport interface Task {\n /**\n * The task identifier.\n */\n taskId: string;\n\n /**\n * Current task state.\n */\n status: TaskStatus;\n\n /**\n * Optional human-readable message describing the current task state.\n * This can provide context for any status, including:\n * - Reasons for \"cancelled\" status\n * - Summaries for \"completed\" status\n * - Diagnostic information for \"failed\" status (e.g., error details, what went wrong)\n */\n statusMessage?: string;\n\n /**\n * ISO 8601 timestamp when the task was created.\n */\n createdAt: string;\n\n /**\n * ISO 8601 timestamp when the task was last updated.\n */\n lastUpdatedAt: string;\n\n /**\n * Actual retention duration from creation in milliseconds, null for unlimited.\n * @nullable\n */\n ttl: number | null;\n\n /**\n * Suggested polling interval in milliseconds.\n */\n pollInterval?: number;\n}\n\n/**\n * A response to a task-augmented request.\n *\n * @category `tasks`\n */\nexport interface CreateTaskResult extends Result {\n task: Task;\n}\n\n/**\n * A request to retrieve the state of a task.\n *\n * @category `tasks/get`\n */\nexport interface GetTaskRequest extends JSONRPCRequest {\n method: \"tasks/get\";\n params: {\n /**\n * The task identifier to query.\n */\n taskId: string;\n };\n}\n\n/**\n * The response to a tasks/get request.\n *\n * @category `tasks/get`\n */\nexport type GetTaskResult = Result & Task;\n\n/**\n * A request to retrieve the result of a completed task.\n *\n * @category `tasks/result`\n */\nexport interface GetTaskPayloadRequest extends JSONRPCRequest {\n method: \"tasks/result\";\n params: {\n /**\n * The task identifier to retrieve results for.\n */\n taskId: string;\n };\n}\n\n/**\n * The response to a tasks/result request.\n * The structure matches the result type of the original request.\n * For example, a tools/call task would return the CallToolResult structure.\n *\n * @category `tasks/result`\n */\nexport interface GetTaskPayloadResult extends Result {\n [key: string]: unknown;\n}\n\n/**\n * A request to cancel a task.\n *\n * @category `tasks/cancel`\n */\nexport interface CancelTaskRequest extends JSONRPCRequest {\n method: \"tasks/cancel\";\n params: {\n /**\n * The task identifier to cancel.\n */\n taskId: string;\n };\n}\n\n/**\n * The response to a tasks/cancel request.\n *\n * @category `tasks/cancel`\n */\nexport type CancelTaskResult = Result & Task;\n\n/**\n * A request to retrieve a list of tasks.\n *\n * @category `tasks/list`\n */\nexport interface ListTasksRequest extends PaginatedRequest {\n method: \"tasks/list\";\n}\n\n/**\n * The response to a tasks/list request.\n *\n * @category `tasks/list`\n */\nexport interface ListTasksResult extends PaginatedResult {\n tasks: Task[];\n}\n\n/**\n * Parameters for a `notifications/tasks/status` notification.\n *\n * @category `notifications/tasks/status`\n */\nexport type TaskStatusNotificationParams = NotificationParams & Task;\n\n/**\n * An optional notification from the receiver to the requestor, informing them that a task's status has changed. Receivers are not required to send these notifications.\n *\n * @category `notifications/tasks/status`\n */\nexport interface TaskStatusNotification extends JSONRPCNotification {\n method: \"notifications/tasks/status\";\n params: TaskStatusNotificationParams;\n}\n\n/* Logging */\n\n/**\n * Parameters for a `logging/setLevel` request.\n *\n * @category `logging/setLevel`\n */\nexport interface SetLevelRequestParams extends RequestParams {\n /**\n * The level of logging that the client wants to receive from the server. The server should send all logs at this level and higher (i.e., more severe) to the client as notifications/message.\n */\n level: LoggingLevel;\n}\n\n/**\n * A request from the client to the server, to enable or adjust logging.\n *\n * @category `logging/setLevel`\n */\nexport interface SetLevelRequest extends JSONRPCRequest {\n method: \"logging/setLevel\";\n params: SetLevelRequestParams;\n}\n\n/**\n * Parameters for a `notifications/message` notification.\n *\n * @category `notifications/message`\n */\nexport interface LoggingMessageNotificationParams extends NotificationParams {\n /**\n * The severity of this log message.\n */\n level: LoggingLevel;\n /**\n * An optional name of the logger issuing this message.\n */\n logger?: string;\n /**\n * The data to be logged, such as a string message or an object. Any JSON serializable type is allowed here.\n */\n data: unknown;\n}\n\n/**\n * JSONRPCNotification of a log message passed from server to client. If no logging/setLevel request has been sent from the client, the server MAY decide which messages to send automatically.\n *\n * @category `notifications/message`\n */\nexport interface LoggingMessageNotification extends JSONRPCNotification {\n method: \"notifications/message\";\n params: LoggingMessageNotificationParams;\n}\n\n/**\n * The severity of a log message.\n *\n * These map to syslog message severities, as specified in RFC-5424:\n * https://datatracker.ietf.org/doc/html/rfc5424#section-6.2.1\n *\n * @category Common Types\n */\nexport type LoggingLevel =\n | \"debug\"\n | \"info\"\n | \"notice\"\n | \"warning\"\n | \"error\"\n | \"critical\"\n | \"alert\"\n | \"emergency\";\n\n/* Sampling */\n/**\n * Parameters for a `sampling/createMessage` request.\n *\n * @category `sampling/createMessage`\n */\nexport interface CreateMessageRequestParams extends TaskAugmentedRequestParams {\n messages: SamplingMessage[];\n /**\n * The server's preferences for which model to select. The client MAY ignore these preferences.\n */\n modelPreferences?: ModelPreferences;\n /**\n * An optional system prompt the server wants to use for sampling. The client MAY modify or omit this prompt.\n */\n systemPrompt?: string;\n /**\n * A request to include context from one or more MCP servers (including the caller), to be attached to the prompt.\n * The client MAY ignore this request.\n *\n * Default is \"none\". Values \"thisServer\" and \"allServers\" are soft-deprecated. Servers SHOULD only use these values if the client\n * declares ClientCapabilities.sampling.context. These values may be removed in future spec releases.\n */\n includeContext?: \"none\" | \"thisServer\" | \"allServers\";\n /**\n * @TJS-type number\n */\n temperature?: number;\n /**\n * The requested maximum number of tokens to sample (to prevent runaway completions).\n *\n * The client MAY choose to sample fewer tokens than the requested maximum.\n */\n maxTokens: number;\n stopSequences?: string[];\n /**\n * Optional metadata to pass through to the LLM provider. The format of this metadata is provider-specific.\n */\n metadata?: object;\n /**\n * Tools that the model may use during generation.\n * The client MUST return an error if this field is provided but ClientCapabilities.sampling.tools is not declared.\n */\n tools?: Tool[];\n /**\n * Controls how the model uses tools.\n * The client MUST return an error if this field is provided but ClientCapabilities.sampling.tools is not declared.\n * Default is `{ mode: \"auto\" }`.\n */\n toolChoice?: ToolChoice;\n}\n\n/**\n * Controls tool selection behavior for sampling requests.\n *\n * @category `sampling/createMessage`\n */\nexport interface ToolChoice {\n /**\n * Controls the tool use ability of the model:\n * - \"auto\": Model decides whether to use tools (default)\n * - \"required\": Model MUST use at least one tool before completing\n * - \"none\": Model MUST NOT use any tools\n */\n mode?: \"auto\" | \"required\" | \"none\";\n}\n\n/**\n * A request from the server to sample an LLM via the client. The client has full discretion over which model to select. The client should also inform the user before beginning sampling, to allow them to inspect the request (human in the loop) and decide whether to approve it.\n *\n * @category `sampling/createMessage`\n */\nexport interface CreateMessageRequest extends JSONRPCRequest {\n method: \"sampling/createMessage\";\n params: CreateMessageRequestParams;\n}\n\n/**\n * The client's response to a sampling/createMessage request from the server.\n * The client should inform the user before returning the sampled message, to allow them\n * to inspect the response (human in the loop) and decide whether to allow the server to see it.\n *\n * @category `sampling/createMessage`\n */\nexport interface CreateMessageResult extends Result, SamplingMessage {\n /**\n * The name of the model that generated the message.\n */\n model: string;\n\n /**\n * The reason why sampling stopped, if known.\n *\n * Standard values:\n * - \"endTurn\": Natural end of the assistant's turn\n * - \"stopSequence\": A stop sequence was encountered\n * - \"maxTokens\": Maximum token limit was reached\n * - \"toolUse\": The model wants to use one or more tools\n *\n * This field is an open string to allow for provider-specific stop reasons.\n */\n stopReason?: \"endTurn\" | \"stopSequence\" | \"maxTokens\" | \"toolUse\" | string;\n}\n\n/**\n * Describes a message issued to or received from an LLM API.\n *\n * @category `sampling/createMessage`\n */\nexport interface SamplingMessage {\n role: Role;\n content: SamplingMessageContentBlock | SamplingMessageContentBlock[];\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * @category `sampling/createMessage`\n */\nexport type SamplingMessageContentBlock =\n | TextContent\n | ImageContent\n | AudioContent\n | ToolUseContent\n | ToolResultContent;\n\n/**\n * Optional annotations for the client. The client can use annotations to inform how objects are used or displayed\n *\n * @category Common Types\n */\nexport interface Annotations {\n /**\n * Describes who the intended audience of this object or data is.\n *\n * It can include multiple entries to indicate content useful for multiple audiences (e.g., `[\"user\", \"assistant\"]`).\n */\n audience?: Role[];\n\n /**\n * Describes how important this data is for operating the server.\n *\n * A value of 1 means \"most important,\" and indicates that the data is\n * effectively required, while 0 means \"least important,\" and indicates that\n * the data is entirely optional.\n *\n * @TJS-type number\n * @minimum 0\n * @maximum 1\n */\n priority?: number;\n\n /**\n * The moment the resource was last modified, as an ISO 8601 formatted string.\n *\n * Should be an ISO 8601 formatted string (e.g., \"2025-01-12T15:00:58Z\").\n *\n * Examples: last activity timestamp in an open file, timestamp when the resource\n * was attached, etc.\n */\n lastModified?: string;\n}\n\n/**\n * @category Content\n */\nexport type ContentBlock =\n TextContent | ImageContent | AudioContent | ResourceLink | EmbeddedResource;\n\n/**\n * Text provided to or from an LLM.\n *\n * @category Content\n */\nexport interface TextContent {\n type: \"text\";\n\n /**\n * The text content of the message.\n */\n text: string;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * An image provided to or from an LLM.\n *\n * @category Content\n */\nexport interface ImageContent {\n type: \"image\";\n\n /**\n * The base64-encoded image data.\n *\n * @format byte\n */\n data: string;\n\n /**\n * The MIME type of the image. Different providers may support different image types.\n */\n mimeType: string;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * Audio provided to or from an LLM.\n *\n * @category Content\n */\nexport interface AudioContent {\n type: \"audio\";\n\n /**\n * The base64-encoded audio data.\n *\n * @format byte\n */\n data: string;\n\n /**\n * The MIME type of the audio. Different providers may support different audio types.\n */\n mimeType: string;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * A request from the assistant to call a tool.\n *\n * @category `sampling/createMessage`\n */\nexport interface ToolUseContent {\n type: \"tool_use\";\n\n /**\n * A unique identifier for this tool use.\n *\n * This ID is used to match tool results to their corresponding tool uses.\n */\n id: string;\n\n /**\n * The name of the tool to call.\n */\n name: string;\n\n /**\n * The arguments to pass to the tool, conforming to the tool's input schema.\n */\n input: { [key: string]: unknown };\n\n /**\n * Optional metadata about the tool use. Clients SHOULD preserve this field when\n * including tool uses in subsequent sampling requests to enable caching optimizations.\n *\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * The result of a tool use, provided by the user back to the assistant.\n *\n * @category `sampling/createMessage`\n */\nexport interface ToolResultContent {\n type: \"tool_result\";\n\n /**\n * The ID of the tool use this result corresponds to.\n *\n * This MUST match the ID from a previous ToolUseContent.\n */\n toolUseId: string;\n\n /**\n * The unstructured result content of the tool use.\n *\n * This has the same format as CallToolResult.content and can include text, images,\n * audio, resource links, and embedded resources.\n */\n content: ContentBlock[];\n\n /**\n * An optional structured result object.\n *\n * If the tool defined an outputSchema, this SHOULD conform to that schema.\n */\n structuredContent?: { [key: string]: unknown };\n\n /**\n * Whether the tool use resulted in an error.\n *\n * If true, the content typically describes the error that occurred.\n * Default: false\n */\n isError?: boolean;\n\n /**\n * Optional metadata about the tool result. Clients SHOULD preserve this field when\n * including tool results in subsequent sampling requests to enable caching optimizations.\n *\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * The server's preferences for model selection, requested of the client during sampling.\n *\n * Because LLMs can vary along multiple dimensions, choosing the \"best\" model is\n * rarely straightforward. Different models excel in different areas—some are\n * faster but less capable, others are more capable but more expensive, and so\n * on. This interface allows servers to express their priorities across multiple\n * dimensions to help clients make an appropriate selection for their use case.\n *\n * These preferences are always advisory. The client MAY ignore them. It is also\n * up to the client to decide how to interpret these preferences and how to\n * balance them against other considerations.\n *\n * @category `sampling/createMessage`\n */\nexport interface ModelPreferences {\n /**\n * Optional hints to use for model selection.\n *\n * If multiple hints are specified, the client MUST evaluate them in order\n * (such that the first match is taken).\n *\n * The client SHOULD prioritize these hints over the numeric priorities, but\n * MAY still use the priorities to select from ambiguous matches.\n */\n hints?: ModelHint[];\n\n /**\n * How much to prioritize cost when selecting a model. A value of 0 means cost\n * is not important, while a value of 1 means cost is the most important\n * factor.\n *\n * @TJS-type number\n * @minimum 0\n * @maximum 1\n */\n costPriority?: number;\n\n /**\n * How much to prioritize sampling speed (latency) when selecting a model. A\n * value of 0 means speed is not important, while a value of 1 means speed is\n * the most important factor.\n *\n * @TJS-type number\n * @minimum 0\n * @maximum 1\n */\n speedPriority?: number;\n\n /**\n * How much to prioritize intelligence and capabilities when selecting a\n * model. A value of 0 means intelligence is not important, while a value of 1\n * means intelligence is the most important factor.\n *\n * @TJS-type number\n * @minimum 0\n * @maximum 1\n */\n intelligencePriority?: number;\n}\n\n/**\n * Hints to use for model selection.\n *\n * Keys not declared here are currently left unspecified by the spec and are up\n * to the client to interpret.\n *\n * @category `sampling/createMessage`\n */\nexport interface ModelHint {\n /**\n * A hint for a model name.\n *\n * The client SHOULD treat this as a substring of a model name; for example:\n * - `claude-3-5-sonnet` should match `claude-3-5-sonnet-20241022`\n * - `sonnet` should match `claude-3-5-sonnet-20241022`, `claude-3-sonnet-20240229`, etc.\n * - `claude` should match any Claude model\n *\n * The client MAY also map the string to a different provider's model name or a different model family, as long as it fills a similar niche; for example:\n * - `gemini-1.5-flash` could match `claude-3-haiku-20240307`\n */\n name?: string;\n}\n\n/* Autocomplete */\n/**\n * Parameters for a `completion/complete` request.\n *\n * @category `completion/complete`\n */\nexport interface CompleteRequestParams extends RequestParams {\n ref: PromptReference | ResourceTemplateReference;\n /**\n * The argument's information\n */\n argument: {\n /**\n * The name of the argument\n */\n name: string;\n /**\n * The value of the argument to use for completion matching.\n */\n value: string;\n };\n\n /**\n * Additional, optional context for completions\n */\n context?: {\n /**\n * Previously-resolved variables in a URI template or prompt.\n */\n arguments?: { [key: string]: string };\n };\n}\n\n/**\n * A request from the client to the server, to ask for completion options.\n *\n * @category `completion/complete`\n */\nexport interface CompleteRequest extends JSONRPCRequest {\n method: \"completion/complete\";\n params: CompleteRequestParams;\n}\n\n/**\n * The server's response to a completion/complete request\n *\n * @category `completion/complete`\n */\nexport interface CompleteResult extends Result {\n completion: {\n /**\n * An array of completion values. Must not exceed 100 items.\n */\n values: string[];\n /**\n * The total number of completion options available. This can exceed the number of values actually sent in the response.\n */\n total?: number;\n /**\n * Indicates whether there are additional completion options beyond those provided in the current response, even if the exact total is unknown.\n */\n hasMore?: boolean;\n };\n}\n\n/**\n * A reference to a resource or resource template definition.\n *\n * @category `completion/complete`\n */\nexport interface ResourceTemplateReference {\n type: \"ref/resource\";\n /**\n * The URI or URI template of the resource.\n *\n * @format uri-template\n */\n uri: string;\n}\n\n/**\n * Identifies a prompt.\n *\n * @category `completion/complete`\n */\nexport interface PromptReference extends BaseMetadata {\n type: \"ref/prompt\";\n}\n\n/* Roots */\n/**\n * Sent from the server to request a list of root URIs from the client. Roots allow\n * servers to ask for specific directories or files to operate on. A common example\n * for roots is providing a set of repositories or directories a server should operate\n * on.\n *\n * This request is typically used when the server needs to understand the file system\n * structure or access specific locations that the client has permission to read from.\n *\n * @category `roots/list`\n */\nexport interface ListRootsRequest extends JSONRPCRequest {\n method: \"roots/list\";\n params?: RequestParams;\n}\n\n/**\n * The client's response to a roots/list request from the server.\n * This result contains an array of Root objects, each representing a root directory\n * or file that the server can operate on.\n *\n * @category `roots/list`\n */\nexport interface ListRootsResult extends Result {\n roots: Root[];\n}\n\n/**\n * Represents a root directory or file that the server can operate on.\n *\n * @category `roots/list`\n */\nexport interface Root {\n /**\n * The URI identifying the root. This *must* start with file:// for now.\n * This restriction may be relaxed in future versions of the protocol to allow\n * other URI schemes.\n *\n * @format uri\n */\n uri: string;\n /**\n * An optional name for the root. This can be used to provide a human-readable\n * identifier for the root, which may be useful for display purposes or for\n * referencing the root in other parts of the application.\n */\n name?: string;\n\n /**\n * See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * A notification from the client to the server, informing it that the list of roots has changed.\n * This notification should be sent whenever the client adds, removes, or modifies any root.\n * The server should then request an updated list of roots using the ListRootsRequest.\n *\n * @category `notifications/roots/list_changed`\n */\nexport interface RootsListChangedNotification extends JSONRPCNotification {\n method: \"notifications/roots/list_changed\";\n params?: NotificationParams;\n}\n\n/**\n * The parameters for a request to elicit non-sensitive information from the user via a form in the client.\n *\n * @category `elicitation/create`\n */\nexport interface ElicitRequestFormParams extends TaskAugmentedRequestParams {\n /**\n * The elicitation mode.\n */\n mode?: \"form\";\n\n /**\n * The message to present to the user describing what information is being requested.\n */\n message: string;\n\n /**\n * A restricted subset of JSON Schema.\n * Only top-level properties are allowed, without nesting.\n */\n requestedSchema: {\n $schema?: string;\n type: \"object\";\n properties: {\n [key: string]: PrimitiveSchemaDefinition;\n };\n required?: string[];\n };\n}\n\n/**\n * The parameters for a request to elicit information from the user via a URL in the client.\n *\n * @category `elicitation/create`\n */\nexport interface ElicitRequestURLParams extends TaskAugmentedRequestParams {\n /**\n * The elicitation mode.\n */\n mode: \"url\";\n\n /**\n * The message to present to the user explaining why the interaction is needed.\n */\n message: string;\n\n /**\n * The ID of the elicitation, which must be unique within the context of the server.\n * The client MUST treat this ID as an opaque value.\n */\n elicitationId: string;\n\n /**\n * The URL that the user should navigate to.\n *\n * @format uri\n */\n url: string;\n}\n\n/**\n * The parameters for a request to elicit additional information from the user via the client.\n *\n * @category `elicitation/create`\n */\nexport type ElicitRequestParams =\n ElicitRequestFormParams | ElicitRequestURLParams;\n\n/**\n * A request from the server to elicit additional information from the user via the client.\n *\n * @category `elicitation/create`\n */\nexport interface ElicitRequest extends JSONRPCRequest {\n method: \"elicitation/create\";\n params: ElicitRequestParams;\n}\n\n/**\n * Restricted schema definitions that only allow primitive types\n * without nested objects or arrays.\n *\n * @category `elicitation/create`\n */\nexport type PrimitiveSchemaDefinition =\n StringSchema | NumberSchema | BooleanSchema | EnumSchema;\n\n/**\n * @category `elicitation/create`\n */\nexport interface StringSchema {\n type: \"string\";\n title?: string;\n description?: string;\n minLength?: number;\n maxLength?: number;\n format?: \"email\" | \"uri\" | \"date\" | \"date-time\";\n default?: string;\n}\n\n/**\n * @category `elicitation/create`\n */\nexport interface NumberSchema {\n type: \"number\" | \"integer\";\n title?: string;\n description?: string;\n minimum?: number;\n maximum?: number;\n default?: number;\n}\n\n/**\n * @category `elicitation/create`\n */\nexport interface BooleanSchema {\n type: \"boolean\";\n title?: string;\n description?: string;\n default?: boolean;\n}\n\n/**\n * Schema for single-selection enumeration without display titles for options.\n *\n * @category `elicitation/create`\n */\nexport interface UntitledSingleSelectEnumSchema {\n type: \"string\";\n /**\n * Optional title for the enum field.\n */\n title?: string;\n /**\n * Optional description for the enum field.\n */\n description?: string;\n /**\n * Array of enum values to choose from.\n */\n enum: string[];\n /**\n * Optional default value.\n */\n default?: string;\n}\n\n/**\n * Schema for single-selection enumeration with display titles for each option.\n *\n * @category `elicitation/create`\n */\nexport interface TitledSingleSelectEnumSchema {\n type: \"string\";\n /**\n * Optional title for the enum field.\n */\n title?: string;\n /**\n * Optional description for the enum field.\n */\n description?: string;\n /**\n * Array of enum options with values and display labels.\n */\n oneOf: Array<{\n /**\n * The enum value.\n */\n const: string;\n /**\n * Display label for this option.\n */\n title: string;\n }>;\n /**\n * Optional default value.\n */\n default?: string;\n}\n\n/**\n * @category `elicitation/create`\n */\n// Combined single selection enumeration\nexport type SingleSelectEnumSchema =\n UntitledSingleSelectEnumSchema | TitledSingleSelectEnumSchema;\n\n/**\n * Schema for multiple-selection enumeration without display titles for options.\n *\n * @category `elicitation/create`\n */\nexport interface UntitledMultiSelectEnumSchema {\n type: \"array\";\n /**\n * Optional title for the enum field.\n */\n title?: string;\n /**\n * Optional description for the enum field.\n */\n description?: string;\n /**\n * Minimum number of items to select.\n */\n minItems?: number;\n /**\n * Maximum number of items to select.\n */\n maxItems?: number;\n /**\n * Schema for the array items.\n */\n items: {\n type: \"string\";\n /**\n * Array of enum values to choose from.\n */\n enum: string[];\n };\n /**\n * Optional default value.\n */\n default?: string[];\n}\n\n/**\n * Schema for multiple-selection enumeration with display titles for each option.\n *\n * @category `elicitation/create`\n */\nexport interface TitledMultiSelectEnumSchema {\n type: \"array\";\n /**\n * Optional title for the enum field.\n */\n title?: string;\n /**\n * Optional description for the enum field.\n */\n description?: string;\n /**\n * Minimum number of items to select.\n */\n minItems?: number;\n /**\n * Maximum number of items to select.\n */\n maxItems?: number;\n /**\n * Schema for array items with enum options and display labels.\n */\n items: {\n /**\n * Array of enum options with values and display labels.\n */\n anyOf: Array<{\n /**\n * The constant enum value.\n */\n const: string;\n /**\n * Display title for this option.\n */\n title: string;\n }>;\n };\n /**\n * Optional default value.\n */\n default?: string[];\n}\n\n/**\n * @category `elicitation/create`\n */\n// Combined multiple selection enumeration\nexport type MultiSelectEnumSchema =\n UntitledMultiSelectEnumSchema | TitledMultiSelectEnumSchema;\n\n/**\n * Use TitledSingleSelectEnumSchema instead.\n * This interface will be removed in a future version.\n *\n * @category `elicitation/create`\n */\nexport interface LegacyTitledEnumSchema {\n type: \"string\";\n title?: string;\n description?: string;\n enum: string[];\n /**\n * (Legacy) Display names for enum values.\n * Non-standard according to JSON schema 2020-12.\n */\n enumNames?: string[];\n default?: string;\n}\n\n/**\n * @category `elicitation/create`\n */\n// Union type for all enum schemas\nexport type EnumSchema =\n SingleSelectEnumSchema | MultiSelectEnumSchema | LegacyTitledEnumSchema;\n\n/**\n * The client's response to an elicitation request.\n *\n * @category `elicitation/create`\n */\nexport interface ElicitResult extends Result {\n /**\n * The user action in response to the elicitation.\n * - \"accept\": User submitted the form/confirmed the action\n * - \"decline\": User explicitly decline the action\n * - \"cancel\": User dismissed without making an explicit choice\n */\n action: \"accept\" | \"decline\" | \"cancel\";\n\n /**\n * The submitted form data, only present when action is \"accept\" and mode was \"form\".\n * Contains values matching the requested schema.\n * Omitted for out-of-band mode responses.\n */\n content?: { [key: string]: string | number | boolean | string[] };\n}\n\n/**\n * An optional notification from the server to the client, informing it of a completion of a out-of-band elicitation request.\n *\n * @category `notifications/elicitation/complete`\n */\nexport interface ElicitationCompleteNotification extends JSONRPCNotification {\n method: \"notifications/elicitation/complete\";\n params: {\n /**\n * The ID of the elicitation that completed.\n */\n elicitationId: string;\n };\n}\n\n/* Client messages */\n/** @internal */\nexport type ClientRequest =\n | PingRequest\n | InitializeRequest\n | CompleteRequest\n | SetLevelRequest\n | GetPromptRequest\n | ListPromptsRequest\n | ListResourcesRequest\n | ListResourceTemplatesRequest\n | ReadResourceRequest\n | SubscribeRequest\n | UnsubscribeRequest\n | CallToolRequest\n | ListToolsRequest\n | GetTaskRequest\n | GetTaskPayloadRequest\n | ListTasksRequest\n | CancelTaskRequest;\n\n/** @internal */\nexport type ClientNotification =\n | CancelledNotification\n | ProgressNotification\n | InitializedNotification\n | RootsListChangedNotification\n | TaskStatusNotification;\n\n/** @internal */\nexport type ClientResult =\n | EmptyResult\n | CreateMessageResult\n | ListRootsResult\n | ElicitResult\n | GetTaskResult\n | GetTaskPayloadResult\n | ListTasksResult\n | CancelTaskResult;\n\n/* Server messages */\n/** @internal */\nexport type ServerRequest =\n | PingRequest\n | CreateMessageRequest\n | ListRootsRequest\n | ElicitRequest\n | GetTaskRequest\n | GetTaskPayloadRequest\n | ListTasksRequest\n | CancelTaskRequest;\n\n/** @internal */\nexport type ServerNotification =\n | CancelledNotification\n | ProgressNotification\n | LoggingMessageNotification\n | ResourceUpdatedNotification\n | ResourceListChangedNotification\n | ToolListChangedNotification\n | PromptListChangedNotification\n | ElicitationCompleteNotification\n | TaskStatusNotification;\n\n/** @internal */\nexport type ServerResult =\n | EmptyResult\n | InitializeResult\n | CompleteResult\n | GetPromptResult\n | ListPromptsResult\n | ListResourceTemplatesResult\n | ListResourcesResult\n | ReadResourceResult\n | CallToolResult\n | ListToolsResult\n | GetTaskResult\n | GetTaskPayloadResult\n | ListTasksResult\n | CancelTaskResult;\n",[],[142,380,406],"c4c2d89f-a15d-4e89-8fb7-855f52d547f6","2025-11-25.schema.json.ts","5caed8d2-ad1c-11f1-bcb9-1607ee4eb77e",157,["D",1789047275069],"import p0 from './2025-11-25.schema.json.part0.ts';\nimport p1 from './2025-11-25.schema.json.part1.ts';\nexport default JSON.parse(p0 + p1);\n",[],[142,380,414],"7205b359-3916-48be-bf57-d3dd5da82694","2025-11-25.schema.json.part1.ts","5c65f66c-ad1c-11f1-9ee5-1607ee4eb77e",156,["D",1789047274598],"export default \") for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"description\\\":{\\\"description\\\":\\\"A description of what this resource represents.\\\\n\\\\nThis can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \\\\\\\"hint\\\\\\\" to the model.\\\",\\\"type\\\":\\\"string\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of this resource, if known.\\\",\\\"type\\\":\\\"string\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"size\\\":{\\\"description\\\":\\\"The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.\\\\n\\\\nThis can be used by Hosts to display file sizes and estimate context window usage.\\\",\\\"type\\\":\\\"integer\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for Tool,\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"resource_link\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of this resource.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"type\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceListChangedNotification\\\":{\\\"description\\\":\\\"An optional notification from the server to the client, informing it that the list of resources it can read from has changed. This may be issued by servers without any previous subscription from the client.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/resources/list_changed\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceRequestParams\\\":{\\\"description\\\":\\\"Common parameters when working with resources.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of the resource. The URI can use any protocol; it is up to the server how to interpret it.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceTemplate\\\":{\\\"description\\\":\\\"A template description for resources available on the server.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"description\\\":{\\\"description\\\":\\\"A description of what this template is for.\\\\n\\\\nThis can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \\\\\\\"hint\\\\\\\" to the model.\\\",\\\"type\\\":\\\"string\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type for all resources that match this template. This should only be included if all resources matching this template have the same type.\\\",\\\"type\\\":\\\"string\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for Tool,\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"},\\\"uriTemplate\\\":{\\\"description\\\":\\\"A URI template (according to RFC 6570) that can be used to construct resource URIs.\\\",\\\"format\\\":\\\"uri-template\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"uriTemplate\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceTemplateReference\\\":{\\\"description\\\":\\\"A reference to a resource or resource template definition.\\\",\\\"properties\\\":{\\\"type\\\":{\\\"const\\\":\\\"ref/resource\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI or URI template of the resource.\\\",\\\"format\\\":\\\"uri-template\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"type\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceUpdatedNotification\\\":{\\\"description\\\":\\\"A notification from the server to the client, informing it that a resource has changed and may need to be read again. This should only be sent if the client previously sent a resources/subscribe request.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/resources/updated\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/ResourceUpdatedNotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceUpdatedNotificationParams\\\":{\\\"description\\\":\\\"Parameters for a `notifications/resources/updated` notification.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of the resource that has been updated. This might be a sub-resource of the one that the client actually subscribed to.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"Result\\\":{\\\"additionalProperties\\\":{},\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"Role\\\":{\\\"description\\\":\\\"The sender or recipient of messages and data in a conversation.\\\",\\\"enum\\\":[\\\"assistant\\\",\\\"user\\\"],\\\"type\\\":\\\"string\\\"},\\\"Root\\\":{\\\"description\\\":\\\"Represents a root directory or file that the server can operate on.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"name\\\":{\\\"description\\\":\\\"An optional name for the root. This can be used to provide a human-readable\\\\nidentifier for the root, which may be useful for display purposes or for\\\\nreferencing the root in other parts of the application.\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI identifying the root. This *must* start with file:// for now.\\\\nThis restriction may be relaxed in future versions of the protocol to allow\\\\nother URI schemes.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"RootsListChangedNotification\\\":{\\\"description\\\":\\\"A notification from the client to the server, informing it that the list of roots has changed.\\\\nThis notification should be sent whenever the client adds, removes, or modifies any root.\\\\nThe server should then request an updated list of roots using the ListRootsRequest.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/roots/list_changed\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"SamplingMessage\\\":{\\\"description\\\":\\\"Describes a message issued to or received from an LLM API.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"content\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ImageContent\\\"},{\\\"$ref\\\":\\\"#/$defs/AudioContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolUseContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolResultContent\\\"},{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/SamplingMessageContentBlock\\\"},\\\"type\\\":\\\"array\\\"}]},\\\"role\\\":{\\\"$ref\\\":\\\"#/$defs/Role\\\"}},\\\"required\\\":[\\\"content\\\",\\\"role\\\"],\\\"type\\\":\\\"object\\\"},\\\"SamplingMessageContentBlock\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ImageContent\\\"},{\\\"$ref\\\":\\\"#/$defs/AudioContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolUseContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolResultContent\\\"}]},\\\"ServerCapabilities\\\":{\\\"description\\\":\\\"Capabilities that a server may support. Known capabilities are defined here, in this schema, but this is not a closed set: any server can define its own, additional capabilities.\\\",\\\"properties\\\":{\\\"completions\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Present if the server supports argument autocompletion suggestions.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"experimental\\\":{\\\"additionalProperties\\\":{\\\"additionalProperties\\\":true,\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"description\\\":\\\"Experimental, non-standard capabilities that the server supports.\\\",\\\"type\\\":\\\"object\\\"},\\\"logging\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Present if the server supports sending log messages to the client.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"prompts\\\":{\\\"description\\\":\\\"Present if the server offers any prompt templates.\\\",\\\"properties\\\":{\\\"listChanged\\\":{\\\"description\\\":\\\"Whether this server supports notifications for changes to the prompt list.\\\",\\\"type\\\":\\\"boolean\\\"}},\\\"type\\\":\\\"object\\\"},\\\"resources\\\":{\\\"description\\\":\\\"Present if the server offers any resources to read.\\\",\\\"properties\\\":{\\\"listChanged\\\":{\\\"description\\\":\\\"Whether this server supports notifications for changes to the resource list.\\\",\\\"type\\\":\\\"boolean\\\"},\\\"subscribe\\\":{\\\"description\\\":\\\"Whether this server supports subscribing to resource updates.\\\",\\\"type\\\":\\\"boolean\\\"}},\\\"type\\\":\\\"object\\\"},\\\"tasks\\\":{\\\"description\\\":\\\"Present if the server supports task-augmented requests.\\\",\\\"properties\\\":{\\\"cancel\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Whether this server supports tasks/cancel.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"list\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Whether this server supports tasks/list.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"requests\\\":{\\\"description\\\":\\\"Specifies which request types can be augmented with tasks.\\\",\\\"properties\\\":{\\\"tools\\\":{\\\"description\\\":\\\"Task support for tool-related requests.\\\",\\\"properties\\\":{\\\"call\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Whether the server supports task-augmented tools/call requests.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"tools\\\":{\\\"description\\\":\\\"Present if the server offers any tools to call.\\\",\\\"properties\\\":{\\\"listChanged\\\":{\\\"description\\\":\\\"Whether this server supports notifications for changes to the tool list.\\\",\\\"type\\\":\\\"boolean\\\"}},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ServerNotification\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/CancelledNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/ProgressNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/ResourceListChangedNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/ResourceUpdatedNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/PromptListChangedNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolListChangedNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/TaskStatusNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/LoggingMessageNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/ElicitationCompleteNotification\\\"}]},\\\"ServerRequest\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/PingRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/GetTaskRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/GetTaskPayloadRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/CancelTaskRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListTasksRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/CreateMessageRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListRootsRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ElicitRequest\\\"}]},\\\"ServerResult\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/Result\\\"},{\\\"$ref\\\":\\\"#/$defs/InitializeResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ListResourcesResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ListResourceTemplatesResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ReadResourceResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ListPromptsResult\\\"},{\\\"$ref\\\":\\\"#/$defs/GetPromptResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ListToolsResult\\\"},{\\\"$ref\\\":\\\"#/$defs/CallToolResult\\\"},{\\\"$ref\\\":\\\"#/$defs/GetTaskResult\\\",\\\"description\\\":\\\"The response to a tasks/get request.\\\"},{\\\"$ref\\\":\\\"#/$defs/GetTaskPayloadResult\\\"},{\\\"$ref\\\":\\\"#/$defs/CancelTaskResult\\\",\\\"description\\\":\\\"The response to a tasks/cancel request.\\\"},{\\\"$ref\\\":\\\"#/$defs/ListTasksResult\\\"},{\\\"$ref\\\":\\\"#/$defs/CompleteResult\\\"}]},\\\"SetLevelRequest\\\":{\\\"description\\\":\\\"A request from the client to the server, to enable or adjust logging.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"logging/setLevel\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/SetLevelRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"SetLevelRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `logging/setLevel` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"level\\\":{\\\"$ref\\\":\\\"#/$defs/LoggingLevel\\\",\\\"description\\\":\\\"The level of logging that the client wants to receive from the server. The server should send all logs at this level and higher (i.e., more severe) to the client as notifications/message.\\\"}},\\\"required\\\":[\\\"level\\\"],\\\"type\\\":\\\"object\\\"},\\\"SingleSelectEnumSchema\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/UntitledSingleSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledSingleSelectEnumSchema\\\"}]},\\\"StringSchema\\\":{\\\"properties\\\":{\\\"default\\\":{\\\"type\\\":\\\"string\\\"},\\\"description\\\":{\\\"type\\\":\\\"string\\\"},\\\"format\\\":{\\\"enum\\\":[\\\"date\\\",\\\"date-time\\\",\\\"email\\\",\\\"uri\\\"],\\\"type\\\":\\\"string\\\"},\\\"maxLength\\\":{\\\"type\\\":\\\"integer\\\"},\\\"minLength\\\":{\\\"type\\\":\\\"integer\\\"},\\\"title\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"string\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"SubscribeRequest\\\":{\\\"description\\\":\\\"Sent from the client to request resources/updated notifications from the server whenever a particular resource changes.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"resources/subscribe\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/SubscribeRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"SubscribeRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `resources/subscribe` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of the resource. The URI can use any protocol; it is up to the server how to interpret it.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"Task\\\":{\\\"description\\\":\\\"Data associated with a task.\\\",\\\"properties\\\":{\\\"createdAt\\\":{\\\"description\\\":\\\"ISO 8601 timestamp when the task was created.\\\",\\\"type\\\":\\\"string\\\"},\\\"lastUpdatedAt\\\":{\\\"description\\\":\\\"ISO 8601 timestamp when the task was last updated.\\\",\\\"type\\\":\\\"string\\\"},\\\"pollInterval\\\":{\\\"description\\\":\\\"Suggested polling interval in milliseconds.\\\",\\\"type\\\":\\\"integer\\\"},\\\"status\\\":{\\\"$ref\\\":\\\"#/$defs/TaskStatus\\\",\\\"description\\\":\\\"Current task state.\\\"},\\\"statusMessage\\\":{\\\"description\\\":\\\"Optional human-readable message describing the current task state.\\\\nThis can provide context for any status, including:\\\\n- Reasons for \\\\\\\"cancelled\\\\\\\" status\\\\n- Summaries for \\\\\\\"completed\\\\\\\" status\\\\n- Diagnostic information for \\\\\\\"failed\\\\\\\" status (e.g., error details, what went wrong)\\\",\\\"type\\\":\\\"string\\\"},\\\"taskId\\\":{\\\"description\\\":\\\"The task identifier.\\\",\\\"type\\\":\\\"string\\\"},\\\"ttl\\\":{\\\"description\\\":\\\"Actual retention duration from creation in milliseconds, null for unlimited.\\\",\\\"type\\\":[\\\"integer\\\",\\\"null\\\"]}},\\\"required\\\":[\\\"createdAt\\\",\\\"lastUpdatedAt\\\",\\\"status\\\",\\\"taskId\\\",\\\"ttl\\\"],\\\"type\\\":\\\"object\\\"},\\\"TaskAugmentedRequestParams\\\":{\\\"description\\\":\\\"Common params for any task-augmented request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"task\\\":{\\\"$ref\\\":\\\"#/$defs/TaskMetadata\\\",\\\"description\\\":\\\"If specified, the caller is requesting task-augmented execution for this request.\\\\nThe request will return a CreateTaskResult immediately, and the actual result can be\\\\nretrieved later via tasks/result.\\\\n\\\\nTask augmentation is subject to capability negotiation - receivers MUST declare support\\\\nfor task augmentation of specific request types in their capabilities.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"TaskMetadata\\\":{\\\"description\\\":\\\"Metadata for augmenting a request with task execution.\\\\nInclude this in the `task` field of the request parameters.\\\",\\\"properties\\\":{\\\"ttl\\\":{\\\"description\\\":\\\"Requested duration in milliseconds to retain task from creation.\\\",\\\"type\\\":\\\"integer\\\"}},\\\"type\\\":\\\"object\\\"},\\\"TaskStatus\\\":{\\\"description\\\":\\\"The status of a task.\\\",\\\"enum\\\":[\\\"cancelled\\\",\\\"completed\\\",\\\"failed\\\",\\\"input_required\\\",\\\"working\\\"],\\\"type\\\":\\\"string\\\"},\\\"TaskStatusNotification\\\":{\\\"description\\\":\\\"An optional notification from the receiver to the requestor, informing them that a task's status has changed. Receivers are not required to send these notifications.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/tasks/status\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/TaskStatusNotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"TaskStatusNotificationParams\\\":{\\\"allOf\\\":[{\\\"$ref\\\":\\\"#/$defs/NotificationParams\\\"},{\\\"$ref\\\":\\\"#/$defs/Task\\\"}],\\\"description\\\":\\\"Parameters for a `notifications/tasks/status` notification.\\\"},\\\"TextContent\\\":{\\\"description\\\":\\\"Text provided to or from an LLM.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"text\\\":{\\\"description\\\":\\\"The text content of the message.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"text\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"text\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"TextResourceContents\\\":{\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of this resource, if known.\\\",\\\"type\\\":\\\"string\\\"},\\\"text\\\":{\\\"description\\\":\\\"The text of the item. This must only be set if the item can actually be represented as text (not binary data).\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of this resource.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"text\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"TitledMultiSelectEnumSchema\\\":{\\\"description\\\":\\\"Schema for multiple-selection enumeration with display titles for each option.\\\",\\\"properties\\\":{\\\"default\\\":{\\\"description\\\":\\\"Optional default value.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"description\\\":{\\\"description\\\":\\\"Optional description for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"items\\\":{\\\"description\\\":\\\"Schema for array items with enum options and display labels.\\\",\\\"properties\\\":{\\\"anyOf\\\":{\\\"description\\\":\\\"Array of enum options with values and display labels.\\\",\\\"items\\\":{\\\"properties\\\":{\\\"const\\\":{\\\"description\\\":\\\"The constant enum value.\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Display title for this option.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"const\\\",\\\"title\\\"],\\\"type\\\":\\\"object\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"anyOf\\\"],\\\"type\\\":\\\"object\\\"},\\\"maxItems\\\":{\\\"description\\\":\\\"Maximum number of items to select.\\\",\\\"type\\\":\\\"integer\\\"},\\\"minItems\\\":{\\\"description\\\":\\\"Minimum number of items to select.\\\",\\\"type\\\":\\\"integer\\\"},\\\"title\\\":{\\\"description\\\":\\\"Optional title for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"array\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"items\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"TitledSingleSelectEnumSchema\\\":{\\\"description\\\":\\\"Schema for single-selection enumeration with display titles for each option.\\\",\\\"properties\\\":{\\\"default\\\":{\\\"description\\\":\\\"Optional default value.\\\",\\\"type\\\":\\\"string\\\"},\\\"description\\\":{\\\"description\\\":\\\"Optional description for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"oneOf\\\":{\\\"description\\\":\\\"Array of enum options with values and display labels.\\\",\\\"items\\\":{\\\"properties\\\":{\\\"const\\\":{\\\"description\\\":\\\"The enum value.\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Display label for this option.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"const\\\",\\\"title\\\"],\\\"type\\\":\\\"object\\\"},\\\"type\\\":\\\"array\\\"},\\\"title\\\":{\\\"description\\\":\\\"Optional title for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"string\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"oneOf\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"Tool\\\":{\\\"description\\\":\\\"Definition for a tool the client can call.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/ToolAnnotations\\\",\\\"description\\\":\\\"Optional additional tool information.\\\\n\\\\nDisplay name precedence order is: title, annotations.title, then name.\\\"},\\\"description\\\":{\\\"description\\\":\\\"A human-readable description of the tool.\\\\n\\\\nThis can be used by clients to improve the LLM's understanding of available tools. It can be thought of like a \\\\\\\"hint\\\\\\\" to the model.\\\",\\\"type\\\":\\\"string\\\"},\\\"execution\\\":{\\\"$ref\\\":\\\"#/$defs/ToolExecution\\\",\\\"description\\\":\\\"Execution-related properties for this tool.\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"inputSchema\\\":{\\\"description\\\":\\\"A JSON Schema object defining the expected parameters for the tool.\\\",\\\"properties\\\":{\\\"$schema\\\":{\\\"type\\\":\\\"string\\\"},\\\"properties\\\":{\\\"additionalProperties\\\":{\\\"additionalProperties\\\":true,\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"type\\\":\\\"object\\\"},\\\"required\\\":{\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"type\\\":{\\\"const\\\":\\\"object\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"outputSchema\\\":{\\\"description\\\":\\\"An optional JSON Schema object defining the structure of the tool's output returned in\\\\nthe structuredContent field of a CallToolResult.\\\\n\\\\nDefaults to JSON Schema 2020-12 when no explicit $schema is provided.\\\\nCurrently restricted to type: \\\\\\\"object\\\\\\\" at the root level.\\\",\\\"properties\\\":{\\\"$schema\\\":{\\\"type\\\":\\\"string\\\"},\\\"properties\\\":{\\\"additionalProperties\\\":{\\\"additionalProperties\\\":true,\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"type\\\":\\\"object\\\"},\\\"required\\\":{\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"type\\\":{\\\"const\\\":\\\"object\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for Tool,\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"inputSchema\\\",\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"ToolAnnotations\\\":{\\\"description\\\":\\\"Additional properties describing a Tool to clients.\\\\n\\\\nNOTE: all properties in ToolAnnotations are **hints**.\\\\nThey are not guaranteed to provide a faithful description of\\\\ntool behavior (including descriptive properties like `title`).\\\\n\\\\nClients should never make tool use decisions based on ToolAnnotations\\\\nreceived from untrusted servers.\\\",\\\"properties\\\":{\\\"destructiveHint\\\":{\\\"description\\\":\\\"If true, the tool may perform destructive updates to its environment.\\\\nIf false, the tool performs only additive updates.\\\\n\\\\n(This property is meaningful only when `readOnlyHint == false`)\\\\n\\\\nDefault: true\\\",\\\"type\\\":\\\"boolean\\\"},\\\"idempotentHint\\\":{\\\"description\\\":\\\"If true, calling the tool repeatedly with the same arguments\\\\nwill have no additional effect on its environment.\\\\n\\\\n(This property is meaningful only when `readOnlyHint == false`)\\\\n\\\\nDefault: false\\\",\\\"type\\\":\\\"boolean\\\"},\\\"openWorldHint\\\":{\\\"description\\\":\\\"If true, this tool may interact with an \\\\\\\"open world\\\\\\\" of external\\\\nentities. If false, the tool's domain of interaction is closed.\\\\nFor example, the world of a web search tool is open, whereas that\\\\nof a memory tool is not.\\\\n\\\\nDefault: true\\\",\\\"type\\\":\\\"boolean\\\"},\\\"readOnlyHint\\\":{\\\"description\\\":\\\"If true, the tool does not modify its environment.\\\\n\\\\nDefault: false\\\",\\\"type\\\":\\\"boolean\\\"},\\\"title\\\":{\\\"description\\\":\\\"A human-readable title for the tool.\\\",\\\"type\\\":\\\"string\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ToolChoice\\\":{\\\"description\\\":\\\"Controls tool selection behavior for sampling requests.\\\",\\\"properties\\\":{\\\"mode\\\":{\\\"description\\\":\\\"Controls the tool use ability of the model:\\\\n- \\\\\\\"auto\\\\\\\": Model decides whether to use tools (default)\\\\n- \\\\\\\"required\\\\\\\": Model MUST use at least one tool before completing\\\\n- \\\\\\\"none\\\\\\\": Model MUST NOT use any tools\\\",\\\"enum\\\":[\\\"auto\\\",\\\"none\\\",\\\"required\\\"],\\\"type\\\":\\\"string\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ToolExecution\\\":{\\\"description\\\":\\\"Execution-related properties for a tool.\\\",\\\"properties\\\":{\\\"taskSupport\\\":{\\\"description\\\":\\\"Indicates whether this tool supports task-augmented execution.\\\\nThis allows clients to handle long-running operations through polling\\\\nthe task system.\\\\n\\\\n- \\\\\\\"forbidden\\\\\\\": Tool does not support task-augmented execution (default when absent)\\\\n- \\\\\\\"optional\\\\\\\": Tool may support task-augmented execution\\\\n- \\\\\\\"required\\\\\\\": Tool requires task-augmented execution\\\\n\\\\nDefault: \\\\\\\"forbidden\\\\\\\"\\\",\\\"enum\\\":[\\\"forbidden\\\",\\\"optional\\\",\\\"required\\\"],\\\"type\\\":\\\"string\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ToolListChangedNotification\\\":{\\\"description\\\":\\\"An optional notification from the server to the client, informing it that the list of tools it offers has changed. This may be issued by servers without any previous subscription from the client.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/tools/list_changed\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"ToolResultContent\\\":{\\\"description\\\":\\\"The result of a tool use, provided by the user back to the assistant.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"Optional metadata about the tool result. Clients SHOULD preserve this field when\\\\nincluding tool results in subsequent sampling requests to enable caching optimizations.\\\\n\\\\nSee [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"content\\\":{\\\"description\\\":\\\"The unstructured result content of the tool use.\\\\n\\\\nThis has the same format as CallToolResult.content and can include text, images,\\\\naudio, resource links, and embedded resources.\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/ContentBlock\\\"},\\\"type\\\":\\\"array\\\"},\\\"isError\\\":{\\\"description\\\":\\\"Whether the tool use resulted in an error.\\\\n\\\\nIf true, the content typically describes the error that occurred.\\\\nDefault: false\\\",\\\"type\\\":\\\"boolean\\\"},\\\"structuredContent\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"An optional structured result object.\\\\n\\\\nIf the tool defined an outputSchema, this SHOULD conform to that schema.\\\",\\\"type\\\":\\\"object\\\"},\\\"toolUseId\\\":{\\\"description\\\":\\\"The ID of the tool use this result corresponds to.\\\\n\\\\nThis MUST match the ID from a previous ToolUseContent.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"tool_result\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"content\\\",\\\"toolUseId\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"ToolUseContent\\\":{\\\"description\\\":\\\"A request from the assistant to call a tool.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"Optional metadata about the tool use. Clients SHOULD preserve this field when\\\\nincluding tool uses in subsequent sampling requests to enable caching optimizations.\\\\n\\\\nSee [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"id\\\":{\\\"description\\\":\\\"A unique identifier for this tool use.\\\\n\\\\nThis ID is used to match tool results to their corresponding tool uses.\\\",\\\"type\\\":\\\"string\\\"},\\\"input\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"The arguments to pass to the tool, conforming to the tool's input schema.\\\",\\\"type\\\":\\\"object\\\"},\\\"name\\\":{\\\"description\\\":\\\"The name of the tool to call.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"tool_use\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"id\\\",\\\"input\\\",\\\"name\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"URLElicitationRequiredError\\\":{\\\"description\\\":\\\"An error response that indicates that the server requires the client to provide additional information via an elicitation request.\\\",\\\"properties\\\":{\\\"error\\\":{\\\"allOf\\\":[{\\\"$ref\\\":\\\"#/$defs/Error\\\"},{\\\"properties\\\":{\\\"code\\\":{\\\"const\\\":-32042,\\\"type\\\":\\\"integer\\\"},\\\"data\\\":{\\\"additionalProperties\\\":{},\\\"properties\\\":{\\\"elicitations\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/ElicitRequestURLParams\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"elicitations\\\"],\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"code\\\",\\\"data\\\"],\\\"type\\\":\\\"object\\\"}]},\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"error\\\",\\\"jsonrpc\\\"],\\\"type\\\":\\\"object\\\"},\\\"UnsubscribeRequest\\\":{\\\"description\\\":\\\"Sent from the client to request cancellation of resources/updated notifications from the server. This should follow a previous resources/subscribe request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"resources/unsubscribe\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/UnsubscribeRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"UnsubscribeRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `resources/unsubscribe` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of the resource. The URI can use any protocol; it is up to the server how to interpret it.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"UntitledMultiSelectEnumSchema\\\":{\\\"description\\\":\\\"Schema for multiple-selection enumeration without display titles for options.\\\",\\\"properties\\\":{\\\"default\\\":{\\\"description\\\":\\\"Optional default value.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"description\\\":{\\\"description\\\":\\\"Optional description for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"items\\\":{\\\"description\\\":\\\"Schema for the array items.\\\",\\\"properties\\\":{\\\"enum\\\":{\\\"description\\\":\\\"Array of enum values to choose from.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"type\\\":{\\\"const\\\":\\\"string\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"enum\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"maxItems\\\":{\\\"description\\\":\\\"Maximum number of items to select.\\\",\\\"type\\\":\\\"integer\\\"},\\\"minItems\\\":{\\\"description\\\":\\\"Minimum number of items to select.\\\",\\\"type\\\":\\\"integer\\\"},\\\"title\\\":{\\\"description\\\":\\\"Optional title for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"array\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"items\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"UntitledSingleSelectEnumSchema\\\":{\\\"description\\\":\\\"Schema for single-selection enumeration without display titles for options.\\\",\\\"properties\\\":{\\\"default\\\":{\\\"description\\\":\\\"Optional default value.\\\",\\\"type\\\":\\\"string\\\"},\\\"description\\\":{\\\"description\\\":\\\"Optional description for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"enum\\\":{\\\"description\\\":\\\"Array of enum values to choose from.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"title\\\":{\\\"description\\\":\\\"Optional title for the enum field.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"string\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"enum\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"}}}\";\n",[],[142,380,422],"8071c64a-c1d7-4c00-aa3d-121142cb3898","2025-11-25.schema.json.part0.ts","5bf07dc4-ad1c-11f1-b98a-1607ee4eb77e",155,["D",1789047273817],"export default \"{\\\"$schema\\\":\\\"https://json-schema.org/draft/2020-12/schema\\\",\\\"$defs\\\":{\\\"Annotations\\\":{\\\"description\\\":\\\"Optional annotations for the client. The client can use annotations to inform how objects are used or displayed\\\",\\\"properties\\\":{\\\"audience\\\":{\\\"description\\\":\\\"Describes who the intended audience of this object or data is.\\\\n\\\\nIt can include multiple entries to indicate content useful for multiple audiences (e.g., `[\\\\\\\"user\\\\\\\", \\\\\\\"assistant\\\\\\\"]`).\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Role\\\"},\\\"type\\\":\\\"array\\\"},\\\"lastModified\\\":{\\\"description\\\":\\\"The moment the resource was last modified, as an ISO 8601 formatted string.\\\\n\\\\nShould be an ISO 8601 formatted string (e.g., \\\\\\\"2025-01-12T15:00:58Z\\\\\\\").\\\\n\\\\nExamples: last activity timestamp in an open file, timestamp when the resource\\\\nwas attached, etc.\\\",\\\"type\\\":\\\"string\\\"},\\\"priority\\\":{\\\"description\\\":\\\"Describes how important this data is for operating the server.\\\\n\\\\nA value of 1 means \\\\\\\"most important,\\\\\\\" and indicates that the data is\\\\neffectively required, while 0 means \\\\\\\"least important,\\\\\\\" and indicates that\\\\nthe data is entirely optional.\\\",\\\"maximum\\\":1,\\\"minimum\\\":0,\\\"type\\\":\\\"number\\\"}},\\\"type\\\":\\\"object\\\"},\\\"AudioContent\\\":{\\\"description\\\":\\\"Audio provided to or from an LLM.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"data\\\":{\\\"description\\\":\\\"The base64-encoded audio data.\\\",\\\"format\\\":\\\"byte\\\",\\\"type\\\":\\\"string\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of the audio. Different providers may support different audio types.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"audio\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"data\\\",\\\"mimeType\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"BaseMetadata\\\":{\\\"description\\\":\\\"Base interface for metadata with name (identifier) and title (display name) properties.\\\",\\\"properties\\\":{\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for Tool,\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"BlobResourceContents\\\":{\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"blob\\\":{\\\"description\\\":\\\"A base64-encoded string representing the binary data of the item.\\\",\\\"format\\\":\\\"byte\\\",\\\"type\\\":\\\"string\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of this resource, if known.\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of this resource.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"blob\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"BooleanSchema\\\":{\\\"properties\\\":{\\\"default\\\":{\\\"type\\\":\\\"boolean\\\"},\\\"description\\\":{\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"boolean\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"CallToolRequest\\\":{\\\"description\\\":\\\"Used by the client to invoke a tool provided by the server.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"tools/call\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/CallToolRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"CallToolRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `tools/call` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"arguments\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"Arguments to use for the tool call.\\\",\\\"type\\\":\\\"object\\\"},\\\"name\\\":{\\\"description\\\":\\\"The name of the tool.\\\",\\\"type\\\":\\\"string\\\"},\\\"task\\\":{\\\"$ref\\\":\\\"#/$defs/TaskMetadata\\\",\\\"description\\\":\\\"If specified, the caller is requesting task-augmented execution for this request.\\\\nThe request will return a CreateTaskResult immediately, and the actual result can be\\\\nretrieved later via tasks/result.\\\\n\\\\nTask augmentation is subject to capability negotiation - receivers MUST declare support\\\\nfor task augmentation of specific request types in their capabilities.\\\"}},\\\"required\\\":[\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"CallToolResult\\\":{\\\"description\\\":\\\"The server's response to a tool call.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"content\\\":{\\\"description\\\":\\\"A list of content objects that represent the unstructured result of the tool call.\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/ContentBlock\\\"},\\\"type\\\":\\\"array\\\"},\\\"isError\\\":{\\\"description\\\":\\\"Whether the tool call ended in an error.\\\\n\\\\nIf not set, this is assumed to be false (the call was successful).\\\\n\\\\nAny errors that originate from the tool SHOULD be reported inside the result\\\\nobject, with `isError` set to true, _not_ as an MCP protocol-level error\\\\nresponse. Otherwise, the LLM would not be able to see that an error occurred\\\\nand self-correct.\\\\n\\\\nHowever, any errors in _finding_ the tool, an error indicating that the\\\\nserver does not support tool calls, or any other exceptional conditions,\\\\nshould be reported as an MCP error response.\\\",\\\"type\\\":\\\"boolean\\\"},\\\"structuredContent\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"An optional JSON object that represents the structured result of the tool call.\\\",\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"content\\\"],\\\"type\\\":\\\"object\\\"},\\\"CancelTaskRequest\\\":{\\\"description\\\":\\\"A request to cancel a task.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"tasks/cancel\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"properties\\\":{\\\"taskId\\\":{\\\"description\\\":\\\"The task identifier to cancel.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"taskId\\\"],\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"CancelTaskResult\\\":{\\\"allOf\\\":[{\\\"$ref\\\":\\\"#/$defs/Result\\\"},{\\\"$ref\\\":\\\"#/$defs/Task\\\"}],\\\"description\\\":\\\"The response to a tasks/cancel request.\\\"},\\\"CancelledNotification\\\":{\\\"description\\\":\\\"This notification can be sent by either side to indicate that it is cancelling a previously-issued request.\\\\n\\\\nThe request SHOULD still be in-flight, but due to communication latency, it is always possible that this notification MAY arrive after the request has already finished.\\\\n\\\\nThis notification indicates that the result will be unused, so any associated processing SHOULD cease.\\\\n\\\\nA client MUST NOT attempt to cancel its `initialize` request.\\\\n\\\\nFor task cancellation, use the `tasks/cancel` request instead of this notification.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/cancelled\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/CancelledNotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"CancelledNotificationParams\\\":{\\\"description\\\":\\\"Parameters for a `notifications/cancelled` notification.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"reason\\\":{\\\"description\\\":\\\"An optional string describing the reason for the cancellation. This MAY be logged or presented to the user.\\\",\\\"type\\\":\\\"string\\\"},\\\"requestId\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\",\\\"description\\\":\\\"The ID of the request to cancel.\\\\n\\\\nThis MUST correspond to the ID of a request previously issued in the same direction.\\\\nThis MUST be provided for cancelling non-task requests.\\\\nThis MUST NOT be used for cancelling tasks (use the `tasks/cancel` request instead).\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ClientCapabilities\\\":{\\\"description\\\":\\\"Capabilities a client may support. Known capabilities are defined here, in this schema, but this is not a closed set: any client can define its own, additional capabilities.\\\",\\\"properties\\\":{\\\"elicitation\\\":{\\\"description\\\":\\\"Present if the client supports elicitation from the server.\\\",\\\"properties\\\":{\\\"form\\\":{\\\"additionalProperties\\\":true,\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"url\\\":{\\\"additionalProperties\\\":true,\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"experimental\\\":{\\\"additionalProperties\\\":{\\\"additionalProperties\\\":true,\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"description\\\":\\\"Experimental, non-standard capabilities that the client supports.\\\",\\\"type\\\":\\\"object\\\"},\\\"roots\\\":{\\\"description\\\":\\\"Present if the client supports listing roots.\\\",\\\"properties\\\":{\\\"listChanged\\\":{\\\"description\\\":\\\"Whether the client supports notifications for changes to the roots list.\\\",\\\"type\\\":\\\"boolean\\\"}},\\\"type\\\":\\\"object\\\"},\\\"sampling\\\":{\\\"description\\\":\\\"Present if the client supports sampling from an LLM.\\\",\\\"properties\\\":{\\\"context\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Whether the client supports context inclusion via includeContext parameter.\\\\nIf not declared, servers SHOULD only use `includeContext: \\\\\\\"none\\\\\\\"` (or omit it).\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"tools\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Whether the client supports tool use via tools and toolChoice parameters.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"tasks\\\":{\\\"description\\\":\\\"Present if the client supports task-augmented requests.\\\",\\\"properties\\\":{\\\"cancel\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Whether this client supports tasks/cancel.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"list\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Whether this client supports tasks/list.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"requests\\\":{\\\"description\\\":\\\"Specifies which request types can be augmented with tasks.\\\",\\\"properties\\\":{\\\"elicitation\\\":{\\\"description\\\":\\\"Task support for elicitation-related requests.\\\",\\\"properties\\\":{\\\"create\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Whether the client supports task-augmented elicitation/create requests.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"sampling\\\":{\\\"description\\\":\\\"Task support for sampling-related requests.\\\",\\\"properties\\\":{\\\"createMessage\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Whether the client supports task-augmented sampling/createMessage requests.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ClientNotification\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/CancelledNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/InitializedNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/ProgressNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/TaskStatusNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/RootsListChangedNotification\\\"}]},\\\"ClientRequest\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/InitializeRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/PingRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListResourcesRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListResourceTemplatesRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ReadResourceRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/SubscribeRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/UnsubscribeRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListPromptsRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/GetPromptRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListToolsRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/CallToolRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/GetTaskRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/GetTaskPayloadRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/CancelTaskRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/ListTasksRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/SetLevelRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/CompleteRequest\\\"}]},\\\"ClientResult\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/Result\\\"},{\\\"$ref\\\":\\\"#/$defs/GetTaskResult\\\",\\\"description\\\":\\\"The response to a tasks/get request.\\\"},{\\\"$ref\\\":\\\"#/$defs/GetTaskPayloadResult\\\"},{\\\"$ref\\\":\\\"#/$defs/CancelTaskResult\\\",\\\"description\\\":\\\"The response to a tasks/cancel request.\\\"},{\\\"$ref\\\":\\\"#/$defs/ListTasksResult\\\"},{\\\"$ref\\\":\\\"#/$defs/CreateMessageResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ListRootsResult\\\"},{\\\"$ref\\\":\\\"#/$defs/ElicitResult\\\"}]},\\\"CompleteRequest\\\":{\\\"description\\\":\\\"A request from the client to the server, to ask for completion options.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"completion/complete\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/CompleteRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"CompleteRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `completion/complete` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"argument\\\":{\\\"description\\\":\\\"The argument's information\\\",\\\"properties\\\":{\\\"name\\\":{\\\"description\\\":\\\"The name of the argument\\\",\\\"type\\\":\\\"string\\\"},\\\"value\\\":{\\\"description\\\":\\\"The value of the argument to use for completion matching.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"value\\\"],\\\"type\\\":\\\"object\\\"},\\\"context\\\":{\\\"description\\\":\\\"Additional, optional context for completions\\\",\\\"properties\\\":{\\\"arguments\\\":{\\\"additionalProperties\\\":{\\\"type\\\":\\\"string\\\"},\\\"description\\\":\\\"Previously-resolved variables in a URI template or prompt.\\\",\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ref\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/PromptReference\\\"},{\\\"$ref\\\":\\\"#/$defs/ResourceTemplateReference\\\"}]}},\\\"required\\\":[\\\"argument\\\",\\\"ref\\\"],\\\"type\\\":\\\"object\\\"},\\\"CompleteResult\\\":{\\\"description\\\":\\\"The server's response to a completion/complete request\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"completion\\\":{\\\"properties\\\":{\\\"hasMore\\\":{\\\"description\\\":\\\"Indicates whether there are additional completion options beyond those provided in the current response, even if the exact total is unknown.\\\",\\\"type\\\":\\\"boolean\\\"},\\\"total\\\":{\\\"description\\\":\\\"The total number of completion options available. This can exceed the number of values actually sent in the response.\\\",\\\"type\\\":\\\"integer\\\"},\\\"values\\\":{\\\"description\\\":\\\"An array of completion values. Must not exceed 100 items.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"values\\\"],\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"completion\\\"],\\\"type\\\":\\\"object\\\"},\\\"ContentBlock\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ImageContent\\\"},{\\\"$ref\\\":\\\"#/$defs/AudioContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ResourceLink\\\"},{\\\"$ref\\\":\\\"#/$defs/EmbeddedResource\\\"}]},\\\"CreateMessageRequest\\\":{\\\"description\\\":\\\"A request from the server to sample an LLM via the client. The client has full discretion over which model to select. The client should also inform the user before beginning sampling, to allow them to inspect the request (human in the loop) and decide whether to approve it.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"sampling/createMessage\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/CreateMessageRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"CreateMessageRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `sampling/createMessage` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"includeContext\\\":{\\\"description\\\":\\\"A request to include context from one or more MCP servers (including the caller), to be attached to the prompt.\\\\nThe client MAY ignore this request.\\\\n\\\\nDefault is \\\\\\\"none\\\\\\\". Values \\\\\\\"thisServer\\\\\\\" and \\\\\\\"allServers\\\\\\\" are soft-deprecated. Servers SHOULD only use these values if the client\\\\ndeclares ClientCapabilities.sampling.context. These values may be removed in future spec releases.\\\",\\\"enum\\\":[\\\"allServers\\\",\\\"none\\\",\\\"thisServer\\\"],\\\"type\\\":\\\"string\\\"},\\\"maxTokens\\\":{\\\"description\\\":\\\"The requested maximum number of tokens to sample (to prevent runaway completions).\\\\n\\\\nThe client MAY choose to sample fewer tokens than the requested maximum.\\\",\\\"type\\\":\\\"integer\\\"},\\\"messages\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/SamplingMessage\\\"},\\\"type\\\":\\\"array\\\"},\\\"metadata\\\":{\\\"additionalProperties\\\":true,\\\"description\\\":\\\"Optional metadata to pass through to the LLM provider. The format of this metadata is provider-specific.\\\",\\\"properties\\\":{},\\\"type\\\":\\\"object\\\"},\\\"modelPreferences\\\":{\\\"$ref\\\":\\\"#/$defs/ModelPreferences\\\",\\\"description\\\":\\\"The server's preferences for which model to select. The client MAY ignore these preferences.\\\"},\\\"stopSequences\\\":{\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"systemPrompt\\\":{\\\"description\\\":\\\"An optional system prompt the server wants to use for sampling. The client MAY modify or omit this prompt.\\\",\\\"type\\\":\\\"string\\\"},\\\"task\\\":{\\\"$ref\\\":\\\"#/$defs/TaskMetadata\\\",\\\"description\\\":\\\"If specified, the caller is requesting task-augmented execution for this request.\\\\nThe request will return a CreateTaskResult immediately, and the actual result can be\\\\nretrieved later via tasks/result.\\\\n\\\\nTask augmentation is subject to capability negotiation - receivers MUST declare support\\\\nfor task augmentation of specific request types in their capabilities.\\\"},\\\"temperature\\\":{\\\"type\\\":\\\"number\\\"},\\\"toolChoice\\\":{\\\"$ref\\\":\\\"#/$defs/ToolChoice\\\",\\\"description\\\":\\\"Controls how the model uses tools.\\\\nThe client MUST return an error if this field is provided but ClientCapabilities.sampling.tools is not declared.\\\\nDefault is `{ mode: \\\\\\\"auto\\\\\\\" }`.\\\"},\\\"tools\\\":{\\\"description\\\":\\\"Tools that the model may use during generation.\\\\nThe client MUST return an error if this field is provided but ClientCapabilities.sampling.tools is not declared.\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Tool\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"maxTokens\\\",\\\"messages\\\"],\\\"type\\\":\\\"object\\\"},\\\"CreateMessageResult\\\":{\\\"description\\\":\\\"The client's response to a sampling/createMessage request from the server.\\\\nThe client should inform the user before returning the sampled message, to allow them\\\\nto inspect the response (human in the loop) and decide whether to allow the server to see it.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"content\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ImageContent\\\"},{\\\"$ref\\\":\\\"#/$defs/AudioContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolUseContent\\\"},{\\\"$ref\\\":\\\"#/$defs/ToolResultContent\\\"},{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/SamplingMessageContentBlock\\\"},\\\"type\\\":\\\"array\\\"}]},\\\"model\\\":{\\\"description\\\":\\\"The name of the model that generated the message.\\\",\\\"type\\\":\\\"string\\\"},\\\"role\\\":{\\\"$ref\\\":\\\"#/$defs/Role\\\"},\\\"stopReason\\\":{\\\"description\\\":\\\"The reason why sampling stopped, if known.\\\\n\\\\nStandard values:\\\\n- \\\\\\\"endTurn\\\\\\\": Natural end of the assistant's turn\\\\n- \\\\\\\"stopSequence\\\\\\\": A stop sequence was encountered\\\\n- \\\\\\\"maxTokens\\\\\\\": Maximum token limit was reached\\\\n- \\\\\\\"toolUse\\\\\\\": The model wants to use one or more tools\\\\n\\\\nThis field is an open string to allow for provider-specific stop reasons.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"content\\\",\\\"model\\\",\\\"role\\\"],\\\"type\\\":\\\"object\\\"},\\\"CreateTaskResult\\\":{\\\"description\\\":\\\"A response to a task-augmented request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"task\\\":{\\\"$ref\\\":\\\"#/$defs/Task\\\"}},\\\"required\\\":[\\\"task\\\"],\\\"type\\\":\\\"object\\\"},\\\"Cursor\\\":{\\\"description\\\":\\\"An opaque token used to represent a cursor for pagination.\\\",\\\"type\\\":\\\"string\\\"},\\\"ElicitRequest\\\":{\\\"description\\\":\\\"A request from the server to elicit additional information from the user via the client.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"elicitation/create\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/ElicitRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ElicitRequestFormParams\\\":{\\\"description\\\":\\\"The parameters for a request to elicit non-sensitive information from the user via a form in the client.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"message\\\":{\\\"description\\\":\\\"The message to present to the user describing what information is being requested.\\\",\\\"type\\\":\\\"string\\\"},\\\"mode\\\":{\\\"const\\\":\\\"form\\\",\\\"description\\\":\\\"The elicitation mode.\\\",\\\"type\\\":\\\"string\\\"},\\\"requestedSchema\\\":{\\\"description\\\":\\\"A restricted subset of JSON Schema.\\\\nOnly top-level properties are allowed, without nesting.\\\",\\\"properties\\\":{\\\"$schema\\\":{\\\"type\\\":\\\"string\\\"},\\\"properties\\\":{\\\"additionalProperties\\\":{\\\"$ref\\\":\\\"#/$defs/PrimitiveSchemaDefinition\\\"},\\\"type\\\":\\\"object\\\"},\\\"required\\\":{\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"type\\\":{\\\"const\\\":\\\"object\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"properties\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"task\\\":{\\\"$ref\\\":\\\"#/$defs/TaskMetadata\\\",\\\"description\\\":\\\"If specified, the caller is requesting task-augmented execution for this request.\\\\nThe request will return a CreateTaskResult immediately, and the actual result can be\\\\nretrieved later via tasks/result.\\\\n\\\\nTask augmentation is subject to capability negotiation - receivers MUST declare support\\\\nfor task augmentation of specific request types in their capabilities.\\\"}},\\\"required\\\":[\\\"message\\\",\\\"requestedSchema\\\"],\\\"type\\\":\\\"object\\\"},\\\"ElicitRequestParams\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/ElicitRequestURLParams\\\"},{\\\"$ref\\\":\\\"#/$defs/ElicitRequestFormParams\\\"}],\\\"description\\\":\\\"The parameters for a request to elicit additional information from the user via the client.\\\"},\\\"ElicitRequestURLParams\\\":{\\\"description\\\":\\\"The parameters for a request to elicit information from the user via a URL in the client.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"elicitationId\\\":{\\\"description\\\":\\\"The ID of the elicitation, which must be unique within the context of the server.\\\\nThe client MUST treat this ID as an opaque value.\\\",\\\"type\\\":\\\"string\\\"},\\\"message\\\":{\\\"description\\\":\\\"The message to present to the user explaining why the interaction is needed.\\\",\\\"type\\\":\\\"string\\\"},\\\"mode\\\":{\\\"const\\\":\\\"url\\\",\\\"description\\\":\\\"The elicitation mode.\\\",\\\"type\\\":\\\"string\\\"},\\\"task\\\":{\\\"$ref\\\":\\\"#/$defs/TaskMetadata\\\",\\\"description\\\":\\\"If specified, the caller is requesting task-augmented execution for this request.\\\\nThe request will return a CreateTaskResult immediately, and the actual result can be\\\\nretrieved later via tasks/result.\\\\n\\\\nTask augmentation is subject to capability negotiation - receivers MUST declare support\\\\nfor task augmentation of specific request types in their capabilities.\\\"},\\\"url\\\":{\\\"description\\\":\\\"The URL that the user should navigate to.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"elicitationId\\\",\\\"message\\\",\\\"mode\\\",\\\"url\\\"],\\\"type\\\":\\\"object\\\"},\\\"ElicitResult\\\":{\\\"description\\\":\\\"The client's response to an elicitation request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"action\\\":{\\\"description\\\":\\\"The user action in response to the elicitation.\\\\n- \\\\\\\"accept\\\\\\\": User submitted the form/confirmed the action\\\\n- \\\\\\\"decline\\\\\\\": User explicitly decline the action\\\\n- \\\\\\\"cancel\\\\\\\": User dismissed without making an explicit choice\\\",\\\"enum\\\":[\\\"accept\\\",\\\"cancel\\\",\\\"decline\\\"],\\\"type\\\":\\\"string\\\"},\\\"content\\\":{\\\"additionalProperties\\\":{\\\"anyOf\\\":[{\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},{\\\"type\\\":[\\\"string\\\",\\\"integer\\\",\\\"boolean\\\"]}]},\\\"description\\\":\\\"The submitted form data, only present when action is \\\\\\\"accept\\\\\\\" and mode was \\\\\\\"form\\\\\\\".\\\\nContains values matching the requested schema.\\\\nOmitted for out-of-band mode responses.\\\",\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"action\\\"],\\\"type\\\":\\\"object\\\"},\\\"ElicitationCompleteNotification\\\":{\\\"description\\\":\\\"An optional notification from the server to the client, informing it of a completion of a out-of-band elicitation request.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/elicitation/complete\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"properties\\\":{\\\"elicitationId\\\":{\\\"description\\\":\\\"The ID of the elicitation that completed.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"elicitationId\\\"],\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"EmbeddedResource\\\":{\\\"description\\\":\\\"The contents of a resource, embedded into a prompt or tool call result.\\\\n\\\\nIt is up to the client how best to render embedded resources for the benefit\\\\nof the LLM and/or the user.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"resource\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextResourceContents\\\"},{\\\"$ref\\\":\\\"#/$defs/BlobResourceContents\\\"}]},\\\"type\\\":{\\\"const\\\":\\\"resource\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"resource\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"EmptyResult\\\":{\\\"$ref\\\":\\\"#/$defs/Result\\\"},\\\"EnumSchema\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/UntitledSingleSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledSingleSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/UntitledMultiSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledMultiSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/LegacyTitledEnumSchema\\\"}]},\\\"Error\\\":{\\\"properties\\\":{\\\"code\\\":{\\\"description\\\":\\\"The error type that occurred.\\\",\\\"type\\\":\\\"integer\\\"},\\\"data\\\":{\\\"description\\\":\\\"Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).\\\"},\\\"message\\\":{\\\"description\\\":\\\"A short description of the error. The message SHOULD be limited to a concise single sentence.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"code\\\",\\\"message\\\"],\\\"type\\\":\\\"object\\\"},\\\"GetPromptRequest\\\":{\\\"description\\\":\\\"Used by the client to get a prompt provided by the server.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"prompts/get\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/GetPromptRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"GetPromptRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `prompts/get` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"arguments\\\":{\\\"additionalProperties\\\":{\\\"type\\\":\\\"string\\\"},\\\"description\\\":\\\"Arguments to use for templating the prompt.\\\",\\\"type\\\":\\\"object\\\"},\\\"name\\\":{\\\"description\\\":\\\"The name of the prompt or prompt template.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"GetPromptResult\\\":{\\\"description\\\":\\\"The server's response to a prompts/get request from the client.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"description\\\":{\\\"description\\\":\\\"An optional description for the prompt.\\\",\\\"type\\\":\\\"string\\\"},\\\"messages\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/PromptMessage\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"messages\\\"],\\\"type\\\":\\\"object\\\"},\\\"GetTaskPayloadRequest\\\":{\\\"description\\\":\\\"A request to retrieve the result of a completed task.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"tasks/result\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"properties\\\":{\\\"taskId\\\":{\\\"description\\\":\\\"The task identifier to retrieve results for.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"taskId\\\"],\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"GetTaskPayloadResult\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"The response to a tasks/result request.\\\\nThe structure matches the result type of the original request.\\\\nFor example, a tools/call task would return the CallToolResult structure.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"GetTaskRequest\\\":{\\\"description\\\":\\\"A request to retrieve the state of a task.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"tasks/get\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"properties\\\":{\\\"taskId\\\":{\\\"description\\\":\\\"The task identifier to query.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"taskId\\\"],\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"GetTaskResult\\\":{\\\"allOf\\\":[{\\\"$ref\\\":\\\"#/$defs/Result\\\"},{\\\"$ref\\\":\\\"#/$defs/Task\\\"}],\\\"description\\\":\\\"The response to a tasks/get request.\\\"},\\\"Icon\\\":{\\\"description\\\":\\\"An optionally-sized icon that can be displayed in a user interface.\\\",\\\"properties\\\":{\\\"mimeType\\\":{\\\"description\\\":\\\"Optional MIME type override if the source MIME type is missing or generic.\\\\nFor example: `\\\\\\\"image/png\\\\\\\"`, `\\\\\\\"image/jpeg\\\\\\\"`, or `\\\\\\\"image/svg+xml\\\\\\\"`.\\\",\\\"type\\\":\\\"string\\\"},\\\"sizes\\\":{\\\"description\\\":\\\"Optional array of strings that specify sizes at which the icon can be used.\\\\nEach string should be in WxH format (e.g., `\\\\\\\"48x48\\\\\\\"`, `\\\\\\\"96x96\\\\\\\"`) or `\\\\\\\"any\\\\\\\"` for scalable formats like SVG.\\\\n\\\\nIf not provided, the client should assume that the icon can be used at any size.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"src\\\":{\\\"description\\\":\\\"A standard URI pointing to an icon resource. May be an HTTP/HTTPS URL or a\\\\n`data:` URI with Base64-encoded image data.\\\\n\\\\nConsumers SHOULD takes steps to ensure URLs serving icons are from the\\\\nsame domain as the client/server or a trusted domain.\\\\n\\\\nConsumers SHOULD take appropriate precautions when consuming SVGs as they can contain\\\\nexecutable JavaScript.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"},\\\"theme\\\":{\\\"description\\\":\\\"Optional specifier for the theme this icon is designed for. `light` indicates\\\\nthe icon is designed to be used with a light background, and `dark` indicates\\\\nthe icon is designed to be used with a dark background.\\\\n\\\\nIf not provided, the client should assume the icon can be used with any theme.\\\",\\\"enum\\\":[\\\"dark\\\",\\\"light\\\"],\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"src\\\"],\\\"type\\\":\\\"object\\\"},\\\"Icons\\\":{\\\"description\\\":\\\"Base interface to add `icons` property.\\\",\\\"properties\\\":{\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ImageContent\\\":{\\\"description\\\":\\\"An image provided to or from an LLM.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"data\\\":{\\\"description\\\":\\\"The base64-encoded image data.\\\",\\\"format\\\":\\\"byte\\\",\\\"type\\\":\\\"string\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of the image. Different providers may support different image types.\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"image\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"data\\\",\\\"mimeType\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"Implementation\\\":{\\\"description\\\":\\\"Describes the MCP implementation.\\\",\\\"properties\\\":{\\\"description\\\":{\\\"description\\\":\\\"An optional human-readable description of what this implementation does.\\\\n\\\\nThis can be used by clients or servers to provide context about their purpose\\\\nand capabilities. For example, a server might describe the types of resources\\\\nor tools it provides, while a client might describe its intended use case.\\\",\\\"type\\\":\\\"string\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for Tool,\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"},\\\"version\\\":{\\\"type\\\":\\\"string\\\"},\\\"websiteUrl\\\":{\\\"description\\\":\\\"An optional URL of the website for this implementation.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"version\\\"],\\\"type\\\":\\\"object\\\"},\\\"InitializeRequest\\\":{\\\"description\\\":\\\"This request is sent from the client to the server when it first connects, asking it to begin initialization.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"initialize\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/InitializeRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"InitializeRequestParams\\\":{\\\"description\\\":\\\"Parameters for an `initialize` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"capabilities\\\":{\\\"$ref\\\":\\\"#/$defs/ClientCapabilities\\\"},\\\"clientInfo\\\":{\\\"$ref\\\":\\\"#/$defs/Implementation\\\"},\\\"protocolVersion\\\":{\\\"description\\\":\\\"The latest version of the Model Context Protocol that the client supports. The client MAY decide to support older versions as well.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"capabilities\\\",\\\"clientInfo\\\",\\\"protocolVersion\\\"],\\\"type\\\":\\\"object\\\"},\\\"InitializeResult\\\":{\\\"description\\\":\\\"After receiving an initialize request from the client, the server sends this response.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"capabilities\\\":{\\\"$ref\\\":\\\"#/$defs/ServerCapabilities\\\"},\\\"instructions\\\":{\\\"description\\\":\\\"Instructions describing how to use the server and its features.\\\\n\\\\nThis can be used by clients to improve the LLM's understanding of available tools, resources, etc. It can be thought of like a \\\\\\\"hint\\\\\\\" to the model. For example, this information MAY be added to the system prompt.\\\",\\\"type\\\":\\\"string\\\"},\\\"protocolVersion\\\":{\\\"description\\\":\\\"The version of the Model Context Protocol that the server wants to use. This may not match the version that the client requested. If the client cannot support this version, it MUST disconnect.\\\",\\\"type\\\":\\\"string\\\"},\\\"serverInfo\\\":{\\\"$ref\\\":\\\"#/$defs/Implementation\\\"}},\\\"required\\\":[\\\"capabilities\\\",\\\"protocolVersion\\\",\\\"serverInfo\\\"],\\\"type\\\":\\\"object\\\"},\\\"InitializedNotification\\\":{\\\"description\\\":\\\"This notification is sent from the client to the server after initialization has finished.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/initialized\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"JSONRPCErrorResponse\\\":{\\\"description\\\":\\\"A response to a request that indicates an error occurred.\\\",\\\"properties\\\":{\\\"error\\\":{\\\"$ref\\\":\\\"#/$defs/Error\\\"},\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"error\\\",\\\"jsonrpc\\\"],\\\"type\\\":\\\"object\\\"},\\\"JSONRPCMessage\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/JSONRPCRequest\\\"},{\\\"$ref\\\":\\\"#/$defs/JSONRPCNotification\\\"},{\\\"$ref\\\":\\\"#/$defs/JSONRPCResultResponse\\\"},{\\\"$ref\\\":\\\"#/$defs/JSONRPCErrorResponse\\\"}],\\\"description\\\":\\\"Refers to any valid JSON-RPC object that can be decoded off the wire, or encoded to be sent.\\\"},\\\"JSONRPCNotification\\\":{\\\"description\\\":\\\"A notification which does not expect a response.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"additionalProperties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"JSONRPCRequest\\\":{\\\"description\\\":\\\"A request that expects a response.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"additionalProperties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"JSONRPCResponse\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/JSONRPCResultResponse\\\"},{\\\"$ref\\\":\\\"#/$defs/JSONRPCErrorResponse\\\"}],\\\"description\\\":\\\"A response to a request, containing either the result or error.\\\"},\\\"JSONRPCResultResponse\\\":{\\\"description\\\":\\\"A successful (non-error) response to a request.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"result\\\":{\\\"$ref\\\":\\\"#/$defs/Result\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"result\\\"],\\\"type\\\":\\\"object\\\"},\\\"LegacyTitledEnumSchema\\\":{\\\"description\\\":\\\"Use TitledSingleSelectEnumSchema instead.\\\\nThis interface will be removed in a future version.\\\",\\\"properties\\\":{\\\"default\\\":{\\\"type\\\":\\\"string\\\"},\\\"description\\\":{\\\"type\\\":\\\"string\\\"},\\\"enum\\\":{\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"enumNames\\\":{\\\"description\\\":\\\"(Legacy) Display names for enum values.\\\\nNon-standard according to JSON schema 2020-12.\\\",\\\"items\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":\\\"array\\\"},\\\"title\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"string\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"enum\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListPromptsRequest\\\":{\\\"description\\\":\\\"Sent from the client to request a list of prompts and prompt templates the server has.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"prompts/list\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/PaginatedRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListPromptsResult\\\":{\\\"description\\\":\\\"The server's response to a prompts/list request from the client.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"nextCursor\\\":{\\\"description\\\":\\\"An opaque token representing the pagination position after the last returned result.\\\\nIf present, there may be more results available.\\\",\\\"type\\\":\\\"string\\\"},\\\"prompts\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Prompt\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"prompts\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListResourceTemplatesRequest\\\":{\\\"description\\\":\\\"Sent from the client to request a list of resource templates the server has.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"resources/templates/list\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/PaginatedRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListResourceTemplatesResult\\\":{\\\"description\\\":\\\"The server's response to a resources/templates/list request from the client.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"nextCursor\\\":{\\\"description\\\":\\\"An opaque token representing the pagination position after the last returned result.\\\\nIf present, there may be more results available.\\\",\\\"type\\\":\\\"string\\\"},\\\"resourceTemplates\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/ResourceTemplate\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"resourceTemplates\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListResourcesRequest\\\":{\\\"description\\\":\\\"Sent from the client to request a list of resources the server has.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"resources/list\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/PaginatedRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListResourcesResult\\\":{\\\"description\\\":\\\"The server's response to a resources/list request from the client.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"nextCursor\\\":{\\\"description\\\":\\\"An opaque token representing the pagination position after the last returned result.\\\\nIf present, there may be more results available.\\\",\\\"type\\\":\\\"string\\\"},\\\"resources\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Resource\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"resources\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListRootsRequest\\\":{\\\"description\\\":\\\"Sent from the server to request a list of root URIs from the client. Roots allow\\\\nservers to ask for specific directories or files to operate on. A common example\\\\nfor roots is providing a set of repositories or directories a server should operate\\\\non.\\\\n\\\\nThis request is typically used when the server needs to understand the file system\\\\nstructure or access specific locations that the client has permission to read from.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"roots/list\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/RequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListRootsResult\\\":{\\\"description\\\":\\\"The client's response to a roots/list request from the server.\\\\nThis result contains an array of Root objects, each representing a root directory\\\\nor file that the server can operate on.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"roots\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Root\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"roots\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListTasksRequest\\\":{\\\"description\\\":\\\"A request to retrieve a list of tasks.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"tasks/list\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/PaginatedRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListTasksResult\\\":{\\\"description\\\":\\\"The response to a tasks/list request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"nextCursor\\\":{\\\"description\\\":\\\"An opaque token representing the pagination position after the last returned result.\\\\nIf present, there may be more results available.\\\",\\\"type\\\":\\\"string\\\"},\\\"tasks\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Task\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"tasks\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListToolsRequest\\\":{\\\"description\\\":\\\"Sent from the client to request a list of tools the server has.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"tools/list\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/PaginatedRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"ListToolsResult\\\":{\\\"description\\\":\\\"The server's response to a tools/list request from the client.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"nextCursor\\\":{\\\"description\\\":\\\"An opaque token representing the pagination position after the last returned result.\\\\nIf present, there may be more results available.\\\",\\\"type\\\":\\\"string\\\"},\\\"tools\\\":{\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Tool\\\"},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"tools\\\"],\\\"type\\\":\\\"object\\\"},\\\"LoggingLevel\\\":{\\\"description\\\":\\\"The severity of a log message.\\\\n\\\\nThese map to syslog message severities, as specified in RFC-5424:\\\\nhttps://datatracker.ietf.org/doc/html/rfc5424#section-6.2.1\\\",\\\"enum\\\":[\\\"alert\\\",\\\"critical\\\",\\\"debug\\\",\\\"emergency\\\",\\\"error\\\",\\\"info\\\",\\\"notice\\\",\\\"warning\\\"],\\\"type\\\":\\\"string\\\"},\\\"LoggingMessageNotification\\\":{\\\"description\\\":\\\"JSONRPCNotification of a log message passed from server to client. If no logging/setLevel request has been sent from the client, the server MAY decide which messages to send automatically.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/message\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/LoggingMessageNotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"LoggingMessageNotificationParams\\\":{\\\"description\\\":\\\"Parameters for a `notifications/message` notification.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"data\\\":{\\\"description\\\":\\\"The data to be logged, such as a string message or an object. Any JSON serializable type is allowed here.\\\"},\\\"level\\\":{\\\"$ref\\\":\\\"#/$defs/LoggingLevel\\\",\\\"description\\\":\\\"The severity of this log message.\\\"},\\\"logger\\\":{\\\"description\\\":\\\"An optional name of the logger issuing this message.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"data\\\",\\\"level\\\"],\\\"type\\\":\\\"object\\\"},\\\"ModelHint\\\":{\\\"description\\\":\\\"Hints to use for model selection.\\\\n\\\\nKeys not declared here are currently left unspecified by the spec and are up\\\\nto the client to interpret.\\\",\\\"properties\\\":{\\\"name\\\":{\\\"description\\\":\\\"A hint for a model name.\\\\n\\\\nThe client SHOULD treat this as a substring of a model name; for example:\\\\n - `claude-3-5-sonnet` should match `claude-3-5-sonnet-20241022`\\\\n - `sonnet` should match `claude-3-5-sonnet-20241022`, `claude-3-sonnet-20240229`, etc.\\\\n - `claude` should match any Claude model\\\\n\\\\nThe client MAY also map the string to a different provider's model name or a different model family, as long as it fills a similar niche; for example:\\\\n - `gemini-1.5-flash` could match `claude-3-haiku-20240307`\\\",\\\"type\\\":\\\"string\\\"}},\\\"type\\\":\\\"object\\\"},\\\"ModelPreferences\\\":{\\\"description\\\":\\\"The server's preferences for model selection, requested of the client during sampling.\\\\n\\\\nBecause LLMs can vary along multiple dimensions, choosing the \\\\\\\"best\\\\\\\" model is\\\\nrarely straightforward. Different models excel in different areas—some are\\\\nfaster but less capable, others are more capable but more expensive, and so\\\\non. This interface allows servers to express their priorities across multiple\\\\ndimensions to help clients make an appropriate selection for their use case.\\\\n\\\\nThese preferences are always advisory. The client MAY ignore them. It is also\\\\nup to the client to decide how to interpret these preferences and how to\\\\nbalance them against other considerations.\\\",\\\"properties\\\":{\\\"costPriority\\\":{\\\"description\\\":\\\"How much to prioritize cost when selecting a model. A value of 0 means cost\\\\nis not important, while a value of 1 means cost is the most important\\\\nfactor.\\\",\\\"maximum\\\":1,\\\"minimum\\\":0,\\\"type\\\":\\\"number\\\"},\\\"hints\\\":{\\\"description\\\":\\\"Optional hints to use for model selection.\\\\n\\\\nIf multiple hints are specified, the client MUST evaluate them in order\\\\n(such that the first match is taken).\\\\n\\\\nThe client SHOULD prioritize these hints over the numeric priorities, but\\\\nMAY still use the priorities to select from ambiguous matches.\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/ModelHint\\\"},\\\"type\\\":\\\"array\\\"},\\\"intelligencePriority\\\":{\\\"description\\\":\\\"How much to prioritize intelligence and capabilities when selecting a\\\\nmodel. A value of 0 means intelligence is not important, while a value of 1\\\\nmeans intelligence is the most important factor.\\\",\\\"maximum\\\":1,\\\"minimum\\\":0,\\\"type\\\":\\\"number\\\"},\\\"speedPriority\\\":{\\\"description\\\":\\\"How much to prioritize sampling speed (latency) when selecting a model. A\\\\nvalue of 0 means speed is not important, while a value of 1 means speed is\\\\nthe most important factor.\\\",\\\"maximum\\\":1,\\\"minimum\\\":0,\\\"type\\\":\\\"number\\\"}},\\\"type\\\":\\\"object\\\"},\\\"MultiSelectEnumSchema\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/UntitledMultiSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledMultiSelectEnumSchema\\\"}]},\\\"Notification\\\":{\\\"properties\\\":{\\\"method\\\":{\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"additionalProperties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"NotificationParams\\\":{\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"NumberSchema\\\":{\\\"properties\\\":{\\\"default\\\":{\\\"type\\\":\\\"integer\\\"},\\\"description\\\":{\\\"type\\\":\\\"string\\\"},\\\"maximum\\\":{\\\"type\\\":\\\"integer\\\"},\\\"minimum\\\":{\\\"type\\\":\\\"integer\\\"},\\\"title\\\":{\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"enum\\\":[\\\"integer\\\",\\\"number\\\"],\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"PaginatedRequest\\\":{\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/PaginatedRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"PaginatedRequestParams\\\":{\\\"description\\\":\\\"Common parameters for paginated requests.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"cursor\\\":{\\\"description\\\":\\\"An opaque token representing the current pagination position.\\\\nIf provided, the server should return results starting after this cursor.\\\",\\\"type\\\":\\\"string\\\"}},\\\"type\\\":\\\"object\\\"},\\\"PaginatedResult\\\":{\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"nextCursor\\\":{\\\"description\\\":\\\"An opaque token representing the pagination position after the last returned result.\\\\nIf present, there may be more results available.\\\",\\\"type\\\":\\\"string\\\"}},\\\"type\\\":\\\"object\\\"},\\\"PingRequest\\\":{\\\"description\\\":\\\"A ping, issued by either the server or the client, to check that the other party is still alive. The receiver must promptly respond, or else may be disconnected.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"ping\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/RequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"PrimitiveSchemaDefinition\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/StringSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/NumberSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/BooleanSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/UntitledSingleSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledSingleSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/UntitledMultiSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/TitledMultiSelectEnumSchema\\\"},{\\\"$ref\\\":\\\"#/$defs/LegacyTitledEnumSchema\\\"}],\\\"description\\\":\\\"Restricted schema definitions that only allow primitive types\\\\nwithout nested objects or arrays.\\\"},\\\"ProgressNotification\\\":{\\\"description\\\":\\\"An out-of-band notification used to inform the receiver of a progress update for a long-running request.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/progress\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressNotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ProgressNotificationParams\\\":{\\\"description\\\":\\\"Parameters for a `notifications/progress` notification.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"message\\\":{\\\"description\\\":\\\"An optional message describing the current progress.\\\",\\\"type\\\":\\\"string\\\"},\\\"progress\\\":{\\\"description\\\":\\\"The progress thus far. This should increase every time progress is made, even if the total is unknown.\\\",\\\"type\\\":\\\"number\\\"},\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"The progress token which was given in the initial request, used to associate this notification with the request that is proceeding.\\\"},\\\"total\\\":{\\\"description\\\":\\\"Total number of items to process (or total progress required), if known.\\\",\\\"type\\\":\\\"number\\\"}},\\\"required\\\":[\\\"progress\\\",\\\"progressToken\\\"],\\\"type\\\":\\\"object\\\"},\\\"ProgressToken\\\":{\\\"description\\\":\\\"A progress token, used to associate progress notifications with the original request.\\\",\\\"type\\\":[\\\"string\\\",\\\"integer\\\"]},\\\"Prompt\\\":{\\\"description\\\":\\\"A prompt or prompt template that the server offers.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"arguments\\\":{\\\"description\\\":\\\"A list of arguments to use for templating the prompt.\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/PromptArgument\\\"},\\\"type\\\":\\\"array\\\"},\\\"description\\\":{\\\"description\\\":\\\"An optional description of what this prompt provides\\\",\\\"type\\\":\\\"string\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for Tool,\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"PromptArgument\\\":{\\\"description\\\":\\\"Describes an argument that a prompt can accept.\\\",\\\"properties\\\":{\\\"description\\\":{\\\"description\\\":\\\"A human-readable description of the argument.\\\",\\\"type\\\":\\\"string\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"required\\\":{\\\"description\\\":\\\"Whether this argument must be provided.\\\",\\\"type\\\":\\\"boolean\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for Tool,\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\"],\\\"type\\\":\\\"object\\\"},\\\"PromptListChangedNotification\\\":{\\\"description\\\":\\\"An optional notification from the server to the client, informing it that the list of prompts it offers has changed. This may be issued by servers without any previous subscription from the client.\\\",\\\"properties\\\":{\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"notifications/prompts/list_changed\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/NotificationParams\\\"}},\\\"required\\\":[\\\"jsonrpc\\\",\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"PromptMessage\\\":{\\\"description\\\":\\\"Describes a message returned as part of a prompt.\\\\n\\\\nThis is similar to `SamplingMessage`, but also supports the embedding of\\\\nresources from the MCP server.\\\",\\\"properties\\\":{\\\"content\\\":{\\\"$ref\\\":\\\"#/$defs/ContentBlock\\\"},\\\"role\\\":{\\\"$ref\\\":\\\"#/$defs/Role\\\"}},\\\"required\\\":[\\\"content\\\",\\\"role\\\"],\\\"type\\\":\\\"object\\\"},\\\"PromptReference\\\":{\\\"description\\\":\\\"Identifies a prompt.\\\",\\\"properties\\\":{\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for Tool,\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"},\\\"type\\\":{\\\"const\\\":\\\"ref/prompt\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"type\\\"],\\\"type\\\":\\\"object\\\"},\\\"ReadResourceRequest\\\":{\\\"description\\\":\\\"Sent from the client to the server, to read a specific resource URI.\\\",\\\"properties\\\":{\\\"id\\\":{\\\"$ref\\\":\\\"#/$defs/RequestId\\\"},\\\"jsonrpc\\\":{\\\"const\\\":\\\"2.0\\\",\\\"type\\\":\\\"string\\\"},\\\"method\\\":{\\\"const\\\":\\\"resources/read\\\",\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"$ref\\\":\\\"#/$defs/ReadResourceRequestParams\\\"}},\\\"required\\\":[\\\"id\\\",\\\"jsonrpc\\\",\\\"method\\\",\\\"params\\\"],\\\"type\\\":\\\"object\\\"},\\\"ReadResourceRequestParams\\\":{\\\"description\\\":\\\"Parameters for a `resources/read` request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of the resource. The URI can use any protocol; it is up to the server how to interpret it.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ReadResourceResult\\\":{\\\"description\\\":\\\"The server's response to a resources/read request from the client.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"contents\\\":{\\\"items\\\":{\\\"anyOf\\\":[{\\\"$ref\\\":\\\"#/$defs/TextResourceContents\\\"},{\\\"$ref\\\":\\\"#/$defs/BlobResourceContents\\\"}]},\\\"type\\\":\\\"array\\\"}},\\\"required\\\":[\\\"contents\\\"],\\\"type\\\":\\\"object\\\"},\\\"RelatedTaskMetadata\\\":{\\\"description\\\":\\\"Metadata for associating messages with a task.\\\\nInclude this in the `_meta` field under the key `io.modelcontextprotocol/related-task`.\\\",\\\"properties\\\":{\\\"taskId\\\":{\\\"description\\\":\\\"The task identifier this message is associated with.\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"taskId\\\"],\\\"type\\\":\\\"object\\\"},\\\"Request\\\":{\\\"properties\\\":{\\\"method\\\":{\\\"type\\\":\\\"string\\\"},\\\"params\\\":{\\\"additionalProperties\\\":{},\\\"type\\\":\\\"object\\\"}},\\\"required\\\":[\\\"method\\\"],\\\"type\\\":\\\"object\\\"},\\\"RequestId\\\":{\\\"description\\\":\\\"A uniquely identifying ID for a request in JSON-RPC.\\\",\\\"type\\\":[\\\"string\\\",\\\"integer\\\"]},\\\"RequestParams\\\":{\\\"description\\\":\\\"Common params for any request.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"properties\\\":{\\\"progressToken\\\":{\\\"$ref\\\":\\\"#/$defs/ProgressToken\\\",\\\"description\\\":\\\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\\\"}},\\\"type\\\":\\\"object\\\"}},\\\"type\\\":\\\"object\\\"},\\\"Resource\\\":{\\\"description\\\":\\\"A known resource that the server is capable of reading.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"annotations\\\":{\\\"$ref\\\":\\\"#/$defs/Annotations\\\",\\\"description\\\":\\\"Optional annotations for the client.\\\"},\\\"description\\\":{\\\"description\\\":\\\"A description of what this resource represents.\\\\n\\\\nThis can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \\\\\\\"hint\\\\\\\" to the model.\\\",\\\"type\\\":\\\"string\\\"},\\\"icons\\\":{\\\"description\\\":\\\"Optional set of sized icons that the client can display in a user interface.\\\\n\\\\nClients that support rendering icons MUST support at least the following MIME types:\\\\n- `image/png` - PNG images (safe, universal compatibility)\\\\n- `image/jpeg` (and `image/jpg`) - JPEG images (safe, universal compatibility)\\\\n\\\\nClients that support rendering icons SHOULD also support:\\\\n- `image/svg+xml` - SVG images (scalable but requires security precautions)\\\\n- `image/webp` - WebP images (modern, efficient format)\\\",\\\"items\\\":{\\\"$ref\\\":\\\"#/$defs/Icon\\\"},\\\"type\\\":\\\"array\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of this resource, if known.\\\",\\\"type\\\":\\\"string\\\"},\\\"name\\\":{\\\"description\\\":\\\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\\\",\\\"type\\\":\\\"string\\\"},\\\"size\\\":{\\\"description\\\":\\\"The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.\\\\n\\\\nThis can be used by Hosts to display file sizes and estimate context window usage.\\\",\\\"type\\\":\\\"integer\\\"},\\\"title\\\":{\\\"description\\\":\\\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\\\neven by those unfamiliar with domain-specific terminology.\\\\n\\\\nIf not provided, the name should be used for display (except for Tool,\\\\nwhere `annotations.title` should be given precedence over using `name`,\\\\nif present).\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of this resource.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"name\\\",\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceContents\\\":{\\\"description\\\":\\\"The contents of a specific resource or sub-resource.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta) for notes on `_meta` usage.\\\",\\\"type\\\":\\\"object\\\"},\\\"mimeType\\\":{\\\"description\\\":\\\"The MIME type of this resource, if known.\\\",\\\"type\\\":\\\"string\\\"},\\\"uri\\\":{\\\"description\\\":\\\"The URI of this resource.\\\",\\\"format\\\":\\\"uri\\\",\\\"type\\\":\\\"string\\\"}},\\\"required\\\":[\\\"uri\\\"],\\\"type\\\":\\\"object\\\"},\\\"ResourceLink\\\":{\\\"description\\\":\\\"A resource that the server is capable of reading, included in a prompt or tool call result.\\\\n\\\\nNote: resource links returned by tools are not guaranteed to appear in the results of `resources/list` requests.\\\",\\\"properties\\\":{\\\"_meta\\\":{\\\"additionalProperties\\\":{},\\\"description\\\":\\\"See [General fields: `_meta`](/specification/2025-11-25/basic/index#meta\";\n",[],[142,380,430],"71748977-06c8-447b-b281-d9fd01fb8fbd","2025-06-18.ts","56641c94-ad1c-11f1-82cc-1607ee4eb77e",145,["D",1789047264515],"/* JSON-RPC types */\n\n/**\n * Refers to any valid JSON-RPC object that can be decoded off the wire, or encoded to be sent.\n *\n * @category JSON-RPC\n */\nexport type JSONRPCMessage =\n JSONRPCRequest | JSONRPCNotification | JSONRPCResponse | JSONRPCError;\n\n/** @internal */\nexport const LATEST_PROTOCOL_VERSION = \"2025-06-18\";\n/** @internal */\nexport const JSONRPC_VERSION = \"2.0\";\n\n/**\n * A progress token, used to associate progress notifications with the original request.\n *\n * @category Common Types\n */\nexport type ProgressToken = string | number;\n\n/**\n * An opaque token used to represent a cursor for pagination.\n *\n * @category Common Types\n */\nexport type Cursor = string;\n\n/** @internal */\nexport interface Request {\n method: string;\n params?: {\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: {\n /**\n * If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\n */\n progressToken?: ProgressToken;\n [key: string]: unknown;\n };\n [key: string]: unknown;\n };\n}\n\n/** @internal */\nexport interface Notification {\n method: string;\n params?: {\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n [key: string]: unknown;\n };\n}\n\n/**\n * @category Common Types\n */\nexport interface Result {\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n [key: string]: unknown;\n}\n\n/**\n * A uniquely identifying ID for a request in JSON-RPC.\n *\n * @category Common Types\n */\nexport type RequestId = string | number;\n\n/**\n * A request that expects a response.\n *\n * @category JSON-RPC\n */\nexport interface JSONRPCRequest extends Request {\n jsonrpc: typeof JSONRPC_VERSION;\n id: RequestId;\n}\n\n/**\n * A notification which does not expect a response.\n *\n * @category JSON-RPC\n */\nexport interface JSONRPCNotification extends Notification {\n jsonrpc: typeof JSONRPC_VERSION;\n}\n\n/**\n * A successful (non-error) response to a request.\n *\n * @category JSON-RPC\n */\nexport interface JSONRPCResponse {\n jsonrpc: typeof JSONRPC_VERSION;\n id: RequestId;\n result: Result;\n}\n\n// Standard JSON-RPC error codes\nexport const PARSE_ERROR = -32700;\nexport const INVALID_REQUEST = -32600;\nexport const METHOD_NOT_FOUND = -32601;\nexport const INVALID_PARAMS = -32602;\nexport const INTERNAL_ERROR = -32603;\n\n/**\n * A response to a request that indicates an error occurred.\n *\n * @category JSON-RPC\n */\nexport interface JSONRPCError {\n jsonrpc: typeof JSONRPC_VERSION;\n id: RequestId;\n error: {\n /**\n * The error type that occurred.\n */\n code: number;\n /**\n * A short description of the error. The message SHOULD be limited to a concise single sentence.\n */\n message: string;\n /**\n * Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).\n */\n data?: unknown;\n };\n}\n\n/* Empty result */\n/**\n * A response that indicates success but carries no data.\n *\n * @category Common Types\n */\nexport type EmptyResult = Result;\n\n/* Cancellation */\n/**\n * This notification can be sent by either side to indicate that it is cancelling a previously-issued request.\n *\n * The request SHOULD still be in-flight, but due to communication latency, it is always possible that this notification MAY arrive after the request has already finished.\n *\n * This notification indicates that the result will be unused, so any associated processing SHOULD cease.\n *\n * A client MUST NOT attempt to cancel its `initialize` request.\n *\n * @category `notifications/cancelled`\n */\nexport interface CancelledNotification extends Notification {\n method: \"notifications/cancelled\";\n params: {\n /**\n * The ID of the request to cancel.\n *\n * This MUST correspond to the ID of a request previously issued in the same direction.\n */\n requestId: RequestId;\n\n /**\n * An optional string describing the reason for the cancellation. This MAY be logged or presented to the user.\n */\n reason?: string;\n };\n}\n\n/* Initialization */\n/**\n * This request is sent from the client to the server when it first connects, asking it to begin initialization.\n *\n * @category `initialize`\n */\nexport interface InitializeRequest extends Request {\n method: \"initialize\";\n params: {\n /**\n * The latest version of the Model Context Protocol that the client supports. The client MAY decide to support older versions as well.\n */\n protocolVersion: string;\n capabilities: ClientCapabilities;\n clientInfo: Implementation;\n };\n}\n\n/**\n * After receiving an initialize request from the client, the server sends this response.\n *\n * @category `initialize`\n */\nexport interface InitializeResult extends Result {\n /**\n * The version of the Model Context Protocol that the server wants to use. This may not match the version that the client requested. If the client cannot support this version, it MUST disconnect.\n */\n protocolVersion: string;\n capabilities: ServerCapabilities;\n serverInfo: Implementation;\n\n /**\n * Instructions describing how to use the server and its features.\n *\n * This can be used by clients to improve the LLM's understanding of available tools, resources, etc. It can be thought of like a \"hint\" to the model. For example, this information MAY be added to the system prompt.\n */\n instructions?: string;\n}\n\n/**\n * This notification is sent from the client to the server after initialization has finished.\n *\n * @category `notifications/initialized`\n */\nexport interface InitializedNotification extends Notification {\n method: \"notifications/initialized\";\n}\n\n/**\n * Capabilities a client may support. Known capabilities are defined here, in this schema, but this is not a closed set: any client can define its own, additional capabilities.\n *\n * @category `initialize`\n */\nexport interface ClientCapabilities {\n /**\n * Experimental, non-standard capabilities that the client supports.\n */\n experimental?: { [key: string]: object };\n /**\n * Present if the client supports listing roots.\n */\n roots?: {\n /**\n * Whether the client supports notifications for changes to the roots list.\n */\n listChanged?: boolean;\n };\n /**\n * Present if the client supports sampling from an LLM.\n */\n sampling?: object;\n /**\n * Present if the client supports elicitation from the server.\n */\n elicitation?: object;\n}\n\n/**\n * Capabilities that a server may support. Known capabilities are defined here, in this schema, but this is not a closed set: any server can define its own, additional capabilities.\n *\n * @category `initialize`\n */\nexport interface ServerCapabilities {\n /**\n * Experimental, non-standard capabilities that the server supports.\n */\n experimental?: { [key: string]: object };\n /**\n * Present if the server supports sending log messages to the client.\n */\n logging?: object;\n /**\n * Present if the server supports argument autocompletion suggestions.\n */\n completions?: object;\n /**\n * Present if the server offers any prompt templates.\n */\n prompts?: {\n /**\n * Whether this server supports notifications for changes to the prompt list.\n */\n listChanged?: boolean;\n };\n /**\n * Present if the server offers any resources to read.\n */\n resources?: {\n /**\n * Whether this server supports subscribing to resource updates.\n */\n subscribe?: boolean;\n /**\n * Whether this server supports notifications for changes to the resource list.\n */\n listChanged?: boolean;\n };\n /**\n * Present if the server offers any tools to call.\n */\n tools?: {\n /**\n * Whether this server supports notifications for changes to the tool list.\n */\n listChanged?: boolean;\n };\n}\n\n/**\n * Base interface for metadata with name (identifier) and title (display name) properties.\n *\n * @internal\n */\nexport interface BaseMetadata {\n /**\n * Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\n */\n name: string;\n\n /**\n * Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\n * even by those unfamiliar with domain-specific terminology.\n *\n * If not provided, the name should be used for display (except for Tool,\n * where `annotations.title` should be given precedence over using `name`,\n * if present).\n */\n title?: string;\n}\n\n/**\n * Describes the name and version of an MCP implementation, with an optional title for UI representation.\n *\n * @category `initialize`\n */\nexport interface Implementation extends BaseMetadata {\n version: string;\n}\n\n/* Ping */\n/**\n * A ping, issued by either the server or the client, to check that the other party is still alive. The receiver must promptly respond, or else may be disconnected.\n *\n * @category `ping`\n */\nexport interface PingRequest extends Request {\n method: \"ping\";\n}\n\n/* Progress notifications */\n/**\n * An out-of-band notification used to inform the receiver of a progress update for a long-running request.\n *\n * @category `notifications/progress`\n */\nexport interface ProgressNotification extends Notification {\n method: \"notifications/progress\";\n params: {\n /**\n * The progress token which was given in the initial request, used to associate this notification with the request that is proceeding.\n */\n progressToken: ProgressToken;\n /**\n * The progress thus far. This should increase every time progress is made, even if the total is unknown.\n *\n * @TJS-type number\n */\n progress: number;\n /**\n * Total number of items to process (or total progress required), if known.\n *\n * @TJS-type number\n */\n total?: number;\n /**\n * An optional message describing the current progress.\n */\n message?: string;\n };\n}\n\n/* Pagination */\n/** @internal */\nexport interface PaginatedRequest extends Request {\n params?: {\n /**\n * An opaque token representing the current pagination position.\n * If provided, the server should return results starting after this cursor.\n */\n cursor?: Cursor;\n };\n}\n\n/** @internal */\nexport interface PaginatedResult extends Result {\n /**\n * An opaque token representing the pagination position after the last returned result.\n * If present, there may be more results available.\n */\n nextCursor?: Cursor;\n}\n\n/* Resources */\n/**\n * Sent from the client to request a list of resources the server has.\n *\n * @category `resources/list`\n */\nexport interface ListResourcesRequest extends PaginatedRequest {\n method: \"resources/list\";\n}\n\n/**\n * The server's response to a resources/list request from the client.\n *\n * @category `resources/list`\n */\nexport interface ListResourcesResult extends PaginatedResult {\n resources: Resource[];\n}\n\n/**\n * Sent from the client to request a list of resource templates the server has.\n *\n * @category `resources/templates/list`\n */\nexport interface ListResourceTemplatesRequest extends PaginatedRequest {\n method: \"resources/templates/list\";\n}\n\n/**\n * The server's response to a resources/templates/list request from the client.\n *\n * @category `resources/templates/list`\n */\nexport interface ListResourceTemplatesResult extends PaginatedResult {\n resourceTemplates: ResourceTemplate[];\n}\n\n/**\n * Sent from the client to the server, to read a specific resource URI.\n *\n * @category `resources/read`\n */\nexport interface ReadResourceRequest extends Request {\n method: \"resources/read\";\n params: {\n /**\n * The URI of the resource to read. The URI can use any protocol; it is up to the server how to interpret it.\n *\n * @format uri\n */\n uri: string;\n };\n}\n\n/**\n * The server's response to a resources/read request from the client.\n *\n * @category `resources/read`\n */\nexport interface ReadResourceResult extends Result {\n contents: (TextResourceContents | BlobResourceContents)[];\n}\n\n/**\n * An optional notification from the server to the client, informing it that the list of resources it can read from has changed. This may be issued by servers without any previous subscription from the client.\n *\n * @category `notifications/resources/list_changed`\n */\nexport interface ResourceListChangedNotification extends Notification {\n method: \"notifications/resources/list_changed\";\n}\n\n/**\n * Sent from the client to request resources/updated notifications from the server whenever a particular resource changes.\n *\n * @category `resources/subscribe`\n */\nexport interface SubscribeRequest extends Request {\n method: \"resources/subscribe\";\n params: {\n /**\n * The URI of the resource to subscribe to. The URI can use any protocol; it is up to the server how to interpret it.\n *\n * @format uri\n */\n uri: string;\n };\n}\n\n/**\n * Sent from the client to request cancellation of resources/updated notifications from the server. This should follow a previous resources/subscribe request.\n *\n * @category `resources/unsubscribe`\n */\nexport interface UnsubscribeRequest extends Request {\n method: \"resources/unsubscribe\";\n params: {\n /**\n * The URI of the resource to unsubscribe from.\n *\n * @format uri\n */\n uri: string;\n };\n}\n\n/**\n * A notification from the server to the client, informing it that a resource has changed and may need to be read again. This should only be sent if the client previously sent a resources/subscribe request.\n *\n * @category `notifications/resources/updated`\n */\nexport interface ResourceUpdatedNotification extends Notification {\n method: \"notifications/resources/updated\";\n params: {\n /**\n * The URI of the resource that has been updated. This might be a sub-resource of the one that the client actually subscribed to.\n *\n * @format uri\n */\n uri: string;\n };\n}\n\n/**\n * A known resource that the server is capable of reading.\n *\n * @category `resources/list`\n */\nexport interface Resource extends BaseMetadata {\n /**\n * The URI of this resource.\n *\n * @format uri\n */\n uri: string;\n\n /**\n * A description of what this resource represents.\n *\n * This can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \"hint\" to the model.\n */\n description?: string;\n\n /**\n * The MIME type of this resource, if known.\n */\n mimeType?: string;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.\n *\n * This can be used by Hosts to display file sizes and estimate context window usage.\n */\n size?: number;\n\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * A template description for resources available on the server.\n *\n * @category `resources/templates/list`\n */\nexport interface ResourceTemplate extends BaseMetadata {\n /**\n * A URI template (according to RFC 6570) that can be used to construct resource URIs.\n *\n * @format uri-template\n */\n uriTemplate: string;\n\n /**\n * A description of what this template is for.\n *\n * This can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \"hint\" to the model.\n */\n description?: string;\n\n /**\n * The MIME type for all resources that match this template. This should only be included if all resources matching this template have the same type.\n */\n mimeType?: string;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * The contents of a specific resource or sub-resource.\n *\n * @internal\n */\nexport interface ResourceContents {\n /**\n * The URI of this resource.\n *\n * @format uri\n */\n uri: string;\n /**\n * The MIME type of this resource, if known.\n */\n mimeType?: string;\n\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * @category Content\n */\nexport interface TextResourceContents extends ResourceContents {\n /**\n * The text of the item. This must only be set if the item can actually be represented as text (not binary data).\n */\n text: string;\n}\n\n/**\n * @category Content\n */\nexport interface BlobResourceContents extends ResourceContents {\n /**\n * A base64-encoded string representing the binary data of the item.\n *\n * @format byte\n */\n blob: string;\n}\n\n/* Prompts */\n/**\n * Sent from the client to request a list of prompts and prompt templates the server has.\n *\n * @category `prompts/list`\n */\nexport interface ListPromptsRequest extends PaginatedRequest {\n method: \"prompts/list\";\n}\n\n/**\n * The server's response to a prompts/list request from the client.\n *\n * @category `prompts/list`\n */\nexport interface ListPromptsResult extends PaginatedResult {\n prompts: Prompt[];\n}\n\n/**\n * Used by the client to get a prompt provided by the server.\n *\n * @category `prompts/get`\n */\nexport interface GetPromptRequest extends Request {\n method: \"prompts/get\";\n params: {\n /**\n * The name of the prompt or prompt template.\n */\n name: string;\n /**\n * Arguments to use for templating the prompt.\n */\n arguments?: { [key: string]: string };\n };\n}\n\n/**\n * The server's response to a prompts/get request from the client.\n *\n * @category `prompts/get`\n */\nexport interface GetPromptResult extends Result {\n /**\n * An optional description for the prompt.\n */\n description?: string;\n messages: PromptMessage[];\n}\n\n/**\n * A prompt or prompt template that the server offers.\n *\n * @category `prompts/list`\n */\nexport interface Prompt extends BaseMetadata {\n /**\n * An optional description of what this prompt provides\n */\n description?: string;\n /**\n * A list of arguments to use for templating the prompt.\n */\n arguments?: PromptArgument[];\n\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * Describes an argument that a prompt can accept.\n *\n * @category `prompts/list`\n */\nexport interface PromptArgument extends BaseMetadata {\n /**\n * A human-readable description of the argument.\n */\n description?: string;\n /**\n * Whether this argument must be provided.\n */\n required?: boolean;\n}\n\n/**\n * The sender or recipient of messages and data in a conversation.\n *\n * @category Common Types\n */\nexport type Role = \"user\" | \"assistant\";\n\n/**\n * Describes a message returned as part of a prompt.\n *\n * This is similar to `SamplingMessage`, but also supports the embedding of\n * resources from the MCP server.\n *\n * @category `prompts/get`\n */\nexport interface PromptMessage {\n role: Role;\n content: ContentBlock;\n}\n\n/**\n * A resource that the server is capable of reading, included in a prompt or tool call result.\n *\n * Note: resource links returned by tools are not guaranteed to appear in the results of `resources/list` requests.\n *\n * @category Content\n */\nexport interface ResourceLink extends Resource {\n type: \"resource_link\";\n}\n\n/**\n * The contents of a resource, embedded into a prompt or tool call result.\n *\n * It is up to the client how best to render embedded resources for the benefit\n * of the LLM and/or the user.\n *\n * @category Content\n */\nexport interface EmbeddedResource {\n type: \"resource\";\n resource: TextResourceContents | BlobResourceContents;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n/**\n * An optional notification from the server to the client, informing it that the list of prompts it offers has changed. This may be issued by servers without any previous subscription from the client.\n *\n * @category `notifications/prompts/list_changed`\n */\nexport interface PromptListChangedNotification extends Notification {\n method: \"notifications/prompts/list_changed\";\n}\n\n/* Tools */\n/**\n * Sent from the client to request a list of tools the server has.\n *\n * @category `tools/list`\n */\nexport interface ListToolsRequest extends PaginatedRequest {\n method: \"tools/list\";\n}\n\n/**\n * The server's response to a tools/list request from the client.\n *\n * @category `tools/list`\n */\nexport interface ListToolsResult extends PaginatedResult {\n tools: Tool[];\n}\n\n/**\n * The server's response to a tool call.\n *\n * @category `tools/call`\n */\nexport interface CallToolResult extends Result {\n /**\n * A list of content objects that represent the unstructured result of the tool call.\n */\n content: ContentBlock[];\n\n /**\n * An optional JSON object that represents the structured result of the tool call.\n */\n structuredContent?: { [key: string]: unknown };\n\n /**\n * Whether the tool call ended in an error.\n *\n * If not set, this is assumed to be false (the call was successful).\n *\n * Any errors that originate from the tool SHOULD be reported inside the result\n * object, with `isError` set to true, _not_ as an MCP protocol-level error\n * response. Otherwise, the LLM would not be able to see that an error occurred\n * and self-correct.\n *\n * However, any errors in _finding_ the tool, an error indicating that the\n * server does not support tool calls, or any other exceptional conditions,\n * should be reported as an MCP error response.\n */\n isError?: boolean;\n}\n\n/**\n * Used by the client to invoke a tool provided by the server.\n *\n * @category `tools/call`\n */\nexport interface CallToolRequest extends Request {\n method: \"tools/call\";\n params: {\n name: string;\n arguments?: { [key: string]: unknown };\n };\n}\n\n/**\n * An optional notification from the server to the client, informing it that the list of tools it offers has changed. This may be issued by servers without any previous subscription from the client.\n *\n * @category `notifications/tools/list_changed`\n */\nexport interface ToolListChangedNotification extends Notification {\n method: \"notifications/tools/list_changed\";\n}\n\n/**\n * Additional properties describing a Tool to clients.\n *\n * NOTE: all properties in ToolAnnotations are **hints**.\n * They are not guaranteed to provide a faithful description of\n * tool behavior (including descriptive properties like `title`).\n *\n * Clients should never make tool use decisions based on ToolAnnotations\n * received from untrusted servers.\n *\n * @category `tools/list`\n */\nexport interface ToolAnnotations {\n /**\n * A human-readable title for the tool.\n */\n title?: string;\n\n /**\n * If true, the tool does not modify its environment.\n *\n * Default: false\n */\n readOnlyHint?: boolean;\n\n /**\n * If true, the tool may perform destructive updates to its environment.\n * If false, the tool performs only additive updates.\n *\n * (This property is meaningful only when `readOnlyHint == false`)\n *\n * Default: true\n */\n destructiveHint?: boolean;\n\n /**\n * If true, calling the tool repeatedly with the same arguments\n * will have no additional effect on the its environment.\n *\n * (This property is meaningful only when `readOnlyHint == false`)\n *\n * Default: false\n */\n idempotentHint?: boolean;\n\n /**\n * If true, this tool may interact with an \"open world\" of external\n * entities. If false, the tool's domain of interaction is closed.\n * For example, the world of a web search tool is open, whereas that\n * of a memory tool is not.\n *\n * Default: true\n */\n openWorldHint?: boolean;\n}\n\n/**\n * Definition for a tool the client can call.\n *\n * @category `tools/list`\n */\nexport interface Tool extends BaseMetadata {\n /**\n * A human-readable description of the tool.\n *\n * This can be used by clients to improve the LLM's understanding of available tools. It can be thought of like a \"hint\" to the model.\n */\n description?: string;\n\n /**\n * A JSON Schema object defining the expected parameters for the tool.\n */\n inputSchema: {\n type: \"object\";\n properties?: { [key: string]: object };\n required?: string[];\n };\n\n /**\n * An optional JSON Schema object defining the structure of the tool's output returned in\n * the structuredContent field of a CallToolResult.\n */\n outputSchema?: {\n type: \"object\";\n properties?: { [key: string]: object };\n required?: string[];\n };\n\n /**\n * Optional additional tool information.\n *\n * Display name precedence order is: title, annotations.title, then name.\n */\n annotations?: ToolAnnotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/* Logging */\n/**\n * A request from the client to the server, to enable or adjust logging.\n *\n * @category `logging/setLevel`\n */\nexport interface SetLevelRequest extends Request {\n method: \"logging/setLevel\";\n params: {\n /**\n * The level of logging that the client wants to receive from the server. The server should send all logs at this level and higher (i.e., more severe) to the client as notifications/message.\n */\n level: LoggingLevel;\n };\n}\n\n/**\n * Notification of a log message passed from server to client. If no logging/setLevel request has been sent from the client, the server MAY decide which messages to send automatically.\n *\n * @category `notifications/message`\n */\nexport interface LoggingMessageNotification extends Notification {\n method: \"notifications/message\";\n params: {\n /**\n * The severity of this log message.\n */\n level: LoggingLevel;\n /**\n * An optional name of the logger issuing this message.\n */\n logger?: string;\n /**\n * The data to be logged, such as a string message or an object. Any JSON serializable type is allowed here.\n */\n data: unknown;\n };\n}\n\n/**\n * The severity of a log message.\n *\n * These map to syslog message severities, as specified in RFC-5424:\n * https://datatracker.ietf.org/doc/html/rfc5424#section-6.2.1\n *\n * @category Common Types\n */\nexport type LoggingLevel =\n | \"debug\"\n | \"info\"\n | \"notice\"\n | \"warning\"\n | \"error\"\n | \"critical\"\n | \"alert\"\n | \"emergency\";\n\n/* Sampling */\n/**\n * A request from the server to sample an LLM via the client. The client has full discretion over which model to select. The client should also inform the user before beginning sampling, to allow them to inspect the request (human in the loop) and decide whether to approve it.\n *\n * @category `sampling/createMessage`\n */\nexport interface CreateMessageRequest extends Request {\n method: \"sampling/createMessage\";\n params: {\n messages: SamplingMessage[];\n /**\n * The server's preferences for which model to select. The client MAY ignore these preferences.\n */\n modelPreferences?: ModelPreferences;\n /**\n * An optional system prompt the server wants to use for sampling. The client MAY modify or omit this prompt.\n */\n systemPrompt?: string;\n /**\n * A request to include context from one or more MCP servers (including the caller), to be attached to the prompt. The client MAY ignore this request.\n */\n includeContext?: \"none\" | \"thisServer\" | \"allServers\";\n /**\n * @TJS-type number\n */\n temperature?: number;\n /**\n * The requested maximum number of tokens to sample (to prevent runaway completions).\n *\n * The client MAY choose to sample fewer tokens than the requested maximum.\n */\n maxTokens: number;\n stopSequences?: string[];\n /**\n * Optional metadata to pass through to the LLM provider. The format of this metadata is provider-specific.\n */\n metadata?: object;\n };\n}\n\n/**\n * The client's response to a sampling/create_message request from the server. The client should inform the user before returning the sampled message, to allow them to inspect the response (human in the loop) and decide whether to allow the server to see it.\n *\n * @category `sampling/createMessage`\n */\nexport interface CreateMessageResult extends Result, SamplingMessage {\n /**\n * The name of the model that generated the message.\n */\n model: string;\n /**\n * The reason why sampling stopped, if known.\n */\n stopReason?: \"endTurn\" | \"stopSequence\" | \"maxTokens\" | string;\n}\n\n/**\n * Describes a message issued to or received from an LLM API.\n *\n * @category `sampling/createMessage`\n */\nexport interface SamplingMessage {\n role: Role;\n content: TextContent | ImageContent | AudioContent;\n}\n\n/**\n * Optional annotations for the client. The client can use annotations to inform how objects are used or displayed\n *\n * @category Common Types\n */\nexport interface Annotations {\n /**\n * Describes who the intended customer of this object or data is.\n *\n * It can include multiple entries to indicate content useful for multiple audiences (e.g., `[\"user\", \"assistant\"]`).\n */\n audience?: Role[];\n\n /**\n * Describes how important this data is for operating the server.\n *\n * A value of 1 means \"most important,\" and indicates that the data is\n * effectively required, while 0 means \"least important,\" and indicates that\n * the data is entirely optional.\n *\n * @TJS-type number\n * @minimum 0\n * @maximum 1\n */\n priority?: number;\n\n /**\n * The moment the resource was last modified, as an ISO 8601 formatted string.\n *\n * Should be an ISO 8601 formatted string (e.g., \"2025-01-12T15:00:58Z\").\n *\n * Examples: last activity timestamp in an open file, timestamp when the resource\n * was attached, etc.\n */\n lastModified?: string;\n}\n\n/**\n * @category Content\n */\nexport type ContentBlock =\n TextContent | ImageContent | AudioContent | ResourceLink | EmbeddedResource;\n\n/**\n * Text provided to or from an LLM.\n *\n * @category Content\n */\nexport interface TextContent {\n type: \"text\";\n\n /**\n * The text content of the message.\n */\n text: string;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * An image provided to or from an LLM.\n *\n * @category Content\n */\nexport interface ImageContent {\n type: \"image\";\n\n /**\n * The base64-encoded image data.\n *\n * @format byte\n */\n data: string;\n\n /**\n * The MIME type of the image. Different providers may support different image types.\n */\n mimeType: string;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * Audio provided to or from an LLM.\n *\n * @category Content\n */\nexport interface AudioContent {\n type: \"audio\";\n\n /**\n * The base64-encoded audio data.\n *\n * @format byte\n */\n data: string;\n\n /**\n * The MIME type of the audio. Different providers may support different audio types.\n */\n mimeType: string;\n\n /**\n * Optional annotations for the client.\n */\n annotations?: Annotations;\n\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * The server's preferences for model selection, requested of the client during sampling.\n *\n * Because LLMs can vary along multiple dimensions, choosing the \"best\" model is\n * rarely straightforward. Different models excel in different areas—some are\n * faster but less capable, others are more capable but more expensive, and so\n * on. This interface allows servers to express their priorities across multiple\n * dimensions to help clients make an appropriate selection for their use case.\n *\n * These preferences are always advisory. The client MAY ignore them. It is also\n * up to the client to decide how to interpret these preferences and how to\n * balance them against other considerations.\n *\n * @category `sampling/createMessage`\n */\nexport interface ModelPreferences {\n /**\n * Optional hints to use for model selection.\n *\n * If multiple hints are specified, the client MUST evaluate them in order\n * (such that the first match is taken).\n *\n * The client SHOULD prioritize these hints over the numeric priorities, but\n * MAY still use the priorities to select from ambiguous matches.\n */\n hints?: ModelHint[];\n\n /**\n * How much to prioritize cost when selecting a model. A value of 0 means cost\n * is not important, while a value of 1 means cost is the most important\n * factor.\n *\n * @TJS-type number\n * @minimum 0\n * @maximum 1\n */\n costPriority?: number;\n\n /**\n * How much to prioritize sampling speed (latency) when selecting a model. A\n * value of 0 means speed is not important, while a value of 1 means speed is\n * the most important factor.\n *\n * @TJS-type number\n * @minimum 0\n * @maximum 1\n */\n speedPriority?: number;\n\n /**\n * How much to prioritize intelligence and capabilities when selecting a\n * model. A value of 0 means intelligence is not important, while a value of 1\n * means intelligence is the most important factor.\n *\n * @TJS-type number\n * @minimum 0\n * @maximum 1\n */\n intelligencePriority?: number;\n}\n\n/**\n * Hints to use for model selection.\n *\n * Keys not declared here are currently left unspecified by the spec and are up\n * to the client to interpret.\n *\n * @category `sampling/createMessage`\n */\nexport interface ModelHint {\n /**\n * A hint for a model name.\n *\n * The client SHOULD treat this as a substring of a model name; for example:\n * - `claude-3-5-sonnet` should match `claude-3-5-sonnet-20241022`\n * - `sonnet` should match `claude-3-5-sonnet-20241022`, `claude-3-sonnet-20240229`, etc.\n * - `claude` should match any Claude model\n *\n * The client MAY also map the string to a different provider's model name or a different model family, as long as it fills a similar niche; for example:\n * - `gemini-1.5-flash` could match `claude-3-haiku-20240307`\n */\n name?: string;\n}\n\n/* Autocomplete */\n/**\n * A request from the client to the server, to ask for completion options.\n *\n * @category `completion/complete`\n */\nexport interface CompleteRequest extends Request {\n method: \"completion/complete\";\n params: {\n ref: PromptReference | ResourceTemplateReference;\n /**\n * The argument's information\n */\n argument: {\n /**\n * The name of the argument\n */\n name: string;\n /**\n * The value of the argument to use for completion matching.\n */\n value: string;\n };\n\n /**\n * Additional, optional context for completions\n */\n context?: {\n /**\n * Previously-resolved variables in a URI template or prompt.\n */\n arguments?: { [key: string]: string };\n };\n };\n}\n\n/**\n * The server's response to a completion/complete request\n *\n * @category `completion/complete`\n */\nexport interface CompleteResult extends Result {\n completion: {\n /**\n * An array of completion values. Must not exceed 100 items.\n */\n values: string[];\n /**\n * The total number of completion options available. This can exceed the number of values actually sent in the response.\n */\n total?: number;\n /**\n * Indicates whether there are additional completion options beyond those provided in the current response, even if the exact total is unknown.\n */\n hasMore?: boolean;\n };\n}\n\n/**\n * A reference to a resource or resource template definition.\n *\n * @category `completion/complete`\n */\nexport interface ResourceTemplateReference {\n type: \"ref/resource\";\n /**\n * The URI or URI template of the resource.\n *\n * @format uri-template\n */\n uri: string;\n}\n\n/**\n * Identifies a prompt.\n *\n * @category `completion/complete`\n */\nexport interface PromptReference extends BaseMetadata {\n type: \"ref/prompt\";\n}\n\n/* Roots */\n/**\n * Sent from the server to request a list of root URIs from the client. Roots allow\n * servers to ask for specific directories or files to operate on. A common example\n * for roots is providing a set of repositories or directories a server should operate\n * on.\n *\n * This request is typically used when the server needs to understand the file system\n * structure or access specific locations that the client has permission to read from.\n *\n * @category `roots/list`\n */\nexport interface ListRootsRequest extends Request {\n method: \"roots/list\";\n}\n\n/**\n * The client's response to a roots/list request from the server.\n * This result contains an array of Root objects, each representing a root directory\n * or file that the server can operate on.\n *\n * @category `roots/list`\n */\nexport interface ListRootsResult extends Result {\n roots: Root[];\n}\n\n/**\n * Represents a root directory or file that the server can operate on.\n *\n * @category `roots/list`\n */\nexport interface Root {\n /**\n * The URI identifying the root. This *must* start with file:// for now.\n * This restriction may be relaxed in future versions of the protocol to allow\n * other URI schemes.\n *\n * @format uri\n */\n uri: string;\n /**\n * An optional name for the root. This can be used to provide a human-readable\n * identifier for the root, which may be useful for display purposes or for\n * referencing the root in other parts of the application.\n */\n name?: string;\n\n /**\n * See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\n */\n _meta?: { [key: string]: unknown };\n}\n\n/**\n * A notification from the client to the server, informing it that the list of roots has changed.\n * This notification should be sent whenever the client adds, removes, or modifies any root.\n * The server should then request an updated list of roots using the ListRootsRequest.\n *\n * @category `notifications/roots/list_changed`\n */\nexport interface RootsListChangedNotification extends Notification {\n method: \"notifications/roots/list_changed\";\n}\n\n/**\n * A request from the server to elicit additional information from the user via the client.\n *\n * @category `elicitation/create`\n */\nexport interface ElicitRequest extends Request {\n method: \"elicitation/create\";\n params: {\n /**\n * The message to present to the user.\n */\n message: string;\n /**\n * A restricted subset of JSON Schema.\n * Only top-level properties are allowed, without nesting.\n */\n requestedSchema: {\n type: \"object\";\n properties: {\n [key: string]: PrimitiveSchemaDefinition;\n };\n required?: string[];\n };\n };\n}\n\n/**\n * Restricted schema definitions that only allow primitive types\n * without nested objects or arrays.\n *\n * @category `elicitation/create`\n */\nexport type PrimitiveSchemaDefinition =\n StringSchema | NumberSchema | BooleanSchema | EnumSchema;\n\n/**\n * @category `elicitation/create`\n */\nexport interface StringSchema {\n type: \"string\";\n title?: string;\n description?: string;\n minLength?: number;\n maxLength?: number;\n format?: \"email\" | \"uri\" | \"date\" | \"date-time\";\n}\n\n/**\n * @category `elicitation/create`\n */\nexport interface NumberSchema {\n type: \"number\" | \"integer\";\n title?: string;\n description?: string;\n minimum?: number;\n maximum?: number;\n}\n\n/**\n * @category `elicitation/create`\n */\nexport interface BooleanSchema {\n type: \"boolean\";\n title?: string;\n description?: string;\n default?: boolean;\n}\n\n/**\n * @category `elicitation/create`\n */\nexport interface EnumSchema {\n type: \"string\";\n title?: string;\n description?: string;\n enum: string[];\n enumNames?: string[]; // Display names for enum values\n}\n\n/**\n * The client's response to an elicitation request.\n *\n * @category `elicitation/create`\n */\nexport interface ElicitResult extends Result {\n /**\n * The user action in response to the elicitation.\n * - \"accept\": User submitted the form/confirmed the action\n * - \"decline\": User explicitly declined the action\n * - \"cancel\": User dismissed without making an explicit choice\n */\n action: \"accept\" | \"decline\" | \"cancel\";\n\n /**\n * The submitted form data, only present when action is \"accept\".\n * Contains values matching the requested schema.\n */\n content?: { [key: string]: string | number | boolean };\n}\n\n/* Client messages */\n/** @internal */\nexport type ClientRequest =\n | PingRequest\n | InitializeRequest\n | CompleteRequest\n | SetLevelRequest\n | GetPromptRequest\n | ListPromptsRequest\n | ListResourcesRequest\n | ListResourceTemplatesRequest\n | ReadResourceRequest\n | SubscribeRequest\n | UnsubscribeRequest\n | CallToolRequest\n | ListToolsRequest;\n\n/** @internal */\nexport type ClientNotification =\n | CancelledNotification\n | ProgressNotification\n | InitializedNotification\n | RootsListChangedNotification;\n\n/** @internal */\nexport type ClientResult =\n EmptyResult | CreateMessageResult | ListRootsResult | ElicitResult;\n\n/* Server messages */\n/** @internal */\nexport type ServerRequest =\n PingRequest | CreateMessageRequest | ListRootsRequest | ElicitRequest;\n\n/** @internal */\nexport type ServerNotification =\n | CancelledNotification\n | ProgressNotification\n | LoggingMessageNotification\n | ResourceUpdatedNotification\n | ResourceListChangedNotification\n | ToolListChangedNotification\n | PromptListChangedNotification;\n\n/** @internal */\nexport type ServerResult =\n | EmptyResult\n | InitializeResult\n | CompleteResult\n | GetPromptResult\n | ListPromptsResult\n | ListResourceTemplatesResult\n | ListResourcesResult\n | ReadResourceResult\n | CallToolResult\n | ListToolsResult;\n",[],[142,380,438],"27659fc0-2593-4315-95bc-92812b054c12","2025-06-18.schema.json.ts","5d100f4e-ad1c-11f1-b895-1607ee4eb77e",158,["D",1789047275704],"export default {\"$schema\":\"http://json-schema.org/draft-07/schema#\",\"definitions\":{\"Annotations\":{\"description\":\"Optional annotations for the client. The client can use annotations to inform how objects are used or displayed\",\"properties\":{\"audience\":{\"description\":\"Describes who the intended customer of this object or data is.\\n\\nIt can include multiple entries to indicate content useful for multiple audiences (e.g., `[\\\"user\\\", \\\"assistant\\\"]`).\",\"items\":{\"$ref\":\"#/definitions/Role\"},\"type\":\"array\"},\"lastModified\":{\"description\":\"The moment the resource was last modified, as an ISO 8601 formatted string.\\n\\nShould be an ISO 8601 formatted string (e.g., \\\"2025-01-12T15:00:58Z\\\").\\n\\nExamples: last activity timestamp in an open file, timestamp when the resource\\nwas attached, etc.\",\"type\":\"string\"},\"priority\":{\"description\":\"Describes how important this data is for operating the server.\\n\\nA value of 1 means \\\"most important,\\\" and indicates that the data is\\neffectively required, while 0 means \\\"least important,\\\" and indicates that\\nthe data is entirely optional.\",\"maximum\":1,\"minimum\":0,\"type\":\"number\"}},\"type\":\"object\"},\"AudioContent\":{\"description\":\"Audio provided to or from an LLM.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"data\":{\"description\":\"The base64-encoded audio data.\",\"format\":\"byte\",\"type\":\"string\"},\"mimeType\":{\"description\":\"The MIME type of the audio. Different providers may support different audio types.\",\"type\":\"string\"},\"type\":{\"const\":\"audio\",\"type\":\"string\"}},\"required\":[\"data\",\"mimeType\",\"type\"],\"type\":\"object\"},\"BaseMetadata\":{\"description\":\"Base interface for metadata with name (identifier) and title (display name) properties.\",\"properties\":{\"name\":{\"description\":\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\",\"type\":\"string\"},\"title\":{\"description\":\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\neven by those unfamiliar with domain-specific terminology.\\n\\nIf not provided, the name should be used for display (except for Tool,\\nwhere `annotations.title` should be given precedence over using `name`,\\nif present).\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"BlobResourceContents\":{\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"blob\":{\"description\":\"A base64-encoded string representing the binary data of the item.\",\"format\":\"byte\",\"type\":\"string\"},\"mimeType\":{\"description\":\"The MIME type of this resource, if known.\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI of this resource.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"blob\",\"uri\"],\"type\":\"object\"},\"BooleanSchema\":{\"properties\":{\"default\":{\"type\":\"boolean\"},\"description\":{\"type\":\"string\"},\"title\":{\"type\":\"string\"},\"type\":{\"const\":\"boolean\",\"type\":\"string\"}},\"required\":[\"type\"],\"type\":\"object\"},\"CallToolRequest\":{\"description\":\"Used by the client to invoke a tool provided by the server.\",\"properties\":{\"method\":{\"const\":\"tools/call\",\"type\":\"string\"},\"params\":{\"properties\":{\"arguments\":{\"additionalProperties\":{},\"type\":\"object\"},\"name\":{\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"CallToolResult\":{\"description\":\"The server's response to a tool call.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"content\":{\"description\":\"A list of content objects that represent the unstructured result of the tool call.\",\"items\":{\"$ref\":\"#/definitions/ContentBlock\"},\"type\":\"array\"},\"isError\":{\"description\":\"Whether the tool call ended in an error.\\n\\nIf not set, this is assumed to be false (the call was successful).\\n\\nAny errors that originate from the tool SHOULD be reported inside the result\\nobject, with `isError` set to true, _not_ as an MCP protocol-level error\\nresponse. Otherwise, the LLM would not be able to see that an error occurred\\nand self-correct.\\n\\nHowever, any errors in _finding_ the tool, an error indicating that the\\nserver does not support tool calls, or any other exceptional conditions,\\nshould be reported as an MCP error response.\",\"type\":\"boolean\"},\"structuredContent\":{\"additionalProperties\":{},\"description\":\"An optional JSON object that represents the structured result of the tool call.\",\"type\":\"object\"}},\"required\":[\"content\"],\"type\":\"object\"},\"CancelledNotification\":{\"description\":\"This notification can be sent by either side to indicate that it is cancelling a previously-issued request.\\n\\nThe request SHOULD still be in-flight, but due to communication latency, it is always possible that this notification MAY arrive after the request has already finished.\\n\\nThis notification indicates that the result will be unused, so any associated processing SHOULD cease.\\n\\nA client MUST NOT attempt to cancel its `initialize` request.\",\"properties\":{\"method\":{\"const\":\"notifications/cancelled\",\"type\":\"string\"},\"params\":{\"properties\":{\"reason\":{\"description\":\"An optional string describing the reason for the cancellation. This MAY be logged or presented to the user.\",\"type\":\"string\"},\"requestId\":{\"$ref\":\"#/definitions/RequestId\",\"description\":\"The ID of the request to cancel.\\n\\nThis MUST correspond to the ID of a request previously issued in the same direction.\"}},\"required\":[\"requestId\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"ClientCapabilities\":{\"description\":\"Capabilities a client may support. Known capabilities are defined here, in this schema, but this is not a closed set: any client can define its own, additional capabilities.\",\"properties\":{\"elicitation\":{\"additionalProperties\":true,\"description\":\"Present if the client supports elicitation from the server.\",\"properties\":{},\"type\":\"object\"},\"experimental\":{\"additionalProperties\":{\"additionalProperties\":true,\"properties\":{},\"type\":\"object\"},\"description\":\"Experimental, non-standard capabilities that the client supports.\",\"type\":\"object\"},\"roots\":{\"description\":\"Present if the client supports listing roots.\",\"properties\":{\"listChanged\":{\"description\":\"Whether the client supports notifications for changes to the roots list.\",\"type\":\"boolean\"}},\"type\":\"object\"},\"sampling\":{\"additionalProperties\":true,\"description\":\"Present if the client supports sampling from an LLM.\",\"properties\":{},\"type\":\"object\"}},\"type\":\"object\"},\"ClientNotification\":{\"anyOf\":[{\"$ref\":\"#/definitions/CancelledNotification\"},{\"$ref\":\"#/definitions/InitializedNotification\"},{\"$ref\":\"#/definitions/ProgressNotification\"},{\"$ref\":\"#/definitions/RootsListChangedNotification\"}]},\"ClientRequest\":{\"anyOf\":[{\"$ref\":\"#/definitions/InitializeRequest\"},{\"$ref\":\"#/definitions/PingRequest\"},{\"$ref\":\"#/definitions/ListResourcesRequest\"},{\"$ref\":\"#/definitions/ListResourceTemplatesRequest\"},{\"$ref\":\"#/definitions/ReadResourceRequest\"},{\"$ref\":\"#/definitions/SubscribeRequest\"},{\"$ref\":\"#/definitions/UnsubscribeRequest\"},{\"$ref\":\"#/definitions/ListPromptsRequest\"},{\"$ref\":\"#/definitions/GetPromptRequest\"},{\"$ref\":\"#/definitions/ListToolsRequest\"},{\"$ref\":\"#/definitions/CallToolRequest\"},{\"$ref\":\"#/definitions/SetLevelRequest\"},{\"$ref\":\"#/definitions/CompleteRequest\"}]},\"ClientResult\":{\"anyOf\":[{\"$ref\":\"#/definitions/Result\"},{\"$ref\":\"#/definitions/CreateMessageResult\"},{\"$ref\":\"#/definitions/ListRootsResult\"},{\"$ref\":\"#/definitions/ElicitResult\"}]},\"CompleteRequest\":{\"description\":\"A request from the client to the server, to ask for completion options.\",\"properties\":{\"method\":{\"const\":\"completion/complete\",\"type\":\"string\"},\"params\":{\"properties\":{\"argument\":{\"description\":\"The argument's information\",\"properties\":{\"name\":{\"description\":\"The name of the argument\",\"type\":\"string\"},\"value\":{\"description\":\"The value of the argument to use for completion matching.\",\"type\":\"string\"}},\"required\":[\"name\",\"value\"],\"type\":\"object\"},\"context\":{\"description\":\"Additional, optional context for completions\",\"properties\":{\"arguments\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Previously-resolved variables in a URI template or prompt.\",\"type\":\"object\"}},\"type\":\"object\"},\"ref\":{\"anyOf\":[{\"$ref\":\"#/definitions/PromptReference\"},{\"$ref\":\"#/definitions/ResourceTemplateReference\"}]}},\"required\":[\"argument\",\"ref\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"CompleteResult\":{\"description\":\"The server's response to a completion/complete request\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"completion\":{\"properties\":{\"hasMore\":{\"description\":\"Indicates whether there are additional completion options beyond those provided in the current response, even if the exact total is unknown.\",\"type\":\"boolean\"},\"total\":{\"description\":\"The total number of completion options available. This can exceed the number of values actually sent in the response.\",\"type\":\"integer\"},\"values\":{\"description\":\"An array of completion values. Must not exceed 100 items.\",\"items\":{\"type\":\"string\"},\"type\":\"array\"}},\"required\":[\"values\"],\"type\":\"object\"}},\"required\":[\"completion\"],\"type\":\"object\"},\"ContentBlock\":{\"anyOf\":[{\"$ref\":\"#/definitions/TextContent\"},{\"$ref\":\"#/definitions/ImageContent\"},{\"$ref\":\"#/definitions/AudioContent\"},{\"$ref\":\"#/definitions/ResourceLink\"},{\"$ref\":\"#/definitions/EmbeddedResource\"}]},\"CreateMessageRequest\":{\"description\":\"A request from the server to sample an LLM via the client. The client has full discretion over which model to select. The client should also inform the user before beginning sampling, to allow them to inspect the request (human in the loop) and decide whether to approve it.\",\"properties\":{\"method\":{\"const\":\"sampling/createMessage\",\"type\":\"string\"},\"params\":{\"properties\":{\"includeContext\":{\"description\":\"A request to include context from one or more MCP servers (including the caller), to be attached to the prompt. The client MAY ignore this request.\",\"enum\":[\"allServers\",\"none\",\"thisServer\"],\"type\":\"string\"},\"maxTokens\":{\"description\":\"The requested maximum number of tokens to sample (to prevent runaway completions).\\n\\nThe client MAY choose to sample fewer tokens than the requested maximum.\",\"type\":\"integer\"},\"messages\":{\"items\":{\"$ref\":\"#/definitions/SamplingMessage\"},\"type\":\"array\"},\"metadata\":{\"additionalProperties\":true,\"description\":\"Optional metadata to pass through to the LLM provider. The format of this metadata is provider-specific.\",\"properties\":{},\"type\":\"object\"},\"modelPreferences\":{\"$ref\":\"#/definitions/ModelPreferences\",\"description\":\"The server's preferences for which model to select. The client MAY ignore these preferences.\"},\"stopSequences\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"systemPrompt\":{\"description\":\"An optional system prompt the server wants to use for sampling. The client MAY modify or omit this prompt.\",\"type\":\"string\"},\"temperature\":{\"type\":\"number\"}},\"required\":[\"maxTokens\",\"messages\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"CreateMessageResult\":{\"description\":\"The client's response to a sampling/create_message request from the server. The client should inform the user before returning the sampled message, to allow them to inspect the response (human in the loop) and decide whether to allow the server to see it.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"content\":{\"anyOf\":[{\"$ref\":\"#/definitions/TextContent\"},{\"$ref\":\"#/definitions/ImageContent\"},{\"$ref\":\"#/definitions/AudioContent\"}]},\"model\":{\"description\":\"The name of the model that generated the message.\",\"type\":\"string\"},\"role\":{\"$ref\":\"#/definitions/Role\"},\"stopReason\":{\"description\":\"The reason why sampling stopped, if known.\",\"type\":\"string\"}},\"required\":[\"content\",\"model\",\"role\"],\"type\":\"object\"},\"Cursor\":{\"description\":\"An opaque token used to represent a cursor for pagination.\",\"type\":\"string\"},\"ElicitRequest\":{\"description\":\"A request from the server to elicit additional information from the user via the client.\",\"properties\":{\"method\":{\"const\":\"elicitation/create\",\"type\":\"string\"},\"params\":{\"properties\":{\"message\":{\"description\":\"The message to present to the user.\",\"type\":\"string\"},\"requestedSchema\":{\"description\":\"A restricted subset of JSON Schema.\\nOnly top-level properties are allowed, without nesting.\",\"properties\":{\"properties\":{\"additionalProperties\":{\"$ref\":\"#/definitions/PrimitiveSchemaDefinition\"},\"type\":\"object\"},\"required\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"type\":{\"const\":\"object\",\"type\":\"string\"}},\"required\":[\"properties\",\"type\"],\"type\":\"object\"}},\"required\":[\"message\",\"requestedSchema\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"ElicitResult\":{\"description\":\"The client's response to an elicitation request.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"action\":{\"description\":\"The user action in response to the elicitation.\\n- \\\"accept\\\": User submitted the form/confirmed the action\\n- \\\"decline\\\": User explicitly declined the action\\n- \\\"cancel\\\": User dismissed without making an explicit choice\",\"enum\":[\"accept\",\"cancel\",\"decline\"],\"type\":\"string\"},\"content\":{\"additionalProperties\":{\"type\":[\"string\",\"integer\",\"boolean\"]},\"description\":\"The submitted form data, only present when action is \\\"accept\\\".\\nContains values matching the requested schema.\",\"type\":\"object\"}},\"required\":[\"action\"],\"type\":\"object\"},\"EmbeddedResource\":{\"description\":\"The contents of a resource, embedded into a prompt or tool call result.\\n\\nIt is up to the client how best to render embedded resources for the benefit\\nof the LLM and/or the user.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"resource\":{\"anyOf\":[{\"$ref\":\"#/definitions/TextResourceContents\"},{\"$ref\":\"#/definitions/BlobResourceContents\"}]},\"type\":{\"const\":\"resource\",\"type\":\"string\"}},\"required\":[\"resource\",\"type\"],\"type\":\"object\"},\"EmptyResult\":{\"$ref\":\"#/definitions/Result\"},\"EnumSchema\":{\"properties\":{\"description\":{\"type\":\"string\"},\"enum\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"enumNames\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"title\":{\"type\":\"string\"},\"type\":{\"const\":\"string\",\"type\":\"string\"}},\"required\":[\"enum\",\"type\"],\"type\":\"object\"},\"GetPromptRequest\":{\"description\":\"Used by the client to get a prompt provided by the server.\",\"properties\":{\"method\":{\"const\":\"prompts/get\",\"type\":\"string\"},\"params\":{\"properties\":{\"arguments\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Arguments to use for templating the prompt.\",\"type\":\"object\"},\"name\":{\"description\":\"The name of the prompt or prompt template.\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"GetPromptResult\":{\"description\":\"The server's response to a prompts/get request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"description\":{\"description\":\"An optional description for the prompt.\",\"type\":\"string\"},\"messages\":{\"items\":{\"$ref\":\"#/definitions/PromptMessage\"},\"type\":\"array\"}},\"required\":[\"messages\"],\"type\":\"object\"},\"ImageContent\":{\"description\":\"An image provided to or from an LLM.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"data\":{\"description\":\"The base64-encoded image data.\",\"format\":\"byte\",\"type\":\"string\"},\"mimeType\":{\"description\":\"The MIME type of the image. Different providers may support different image types.\",\"type\":\"string\"},\"type\":{\"const\":\"image\",\"type\":\"string\"}},\"required\":[\"data\",\"mimeType\",\"type\"],\"type\":\"object\"},\"Implementation\":{\"description\":\"Describes the name and version of an MCP implementation, with an optional title for UI representation.\",\"properties\":{\"name\":{\"description\":\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\",\"type\":\"string\"},\"title\":{\"description\":\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\neven by those unfamiliar with domain-specific terminology.\\n\\nIf not provided, the name should be used for display (except for Tool,\\nwhere `annotations.title` should be given precedence over using `name`,\\nif present).\",\"type\":\"string\"},\"version\":{\"type\":\"string\"}},\"required\":[\"name\",\"version\"],\"type\":\"object\"},\"InitializeRequest\":{\"description\":\"This request is sent from the client to the server when it first connects, asking it to begin initialization.\",\"properties\":{\"method\":{\"const\":\"initialize\",\"type\":\"string\"},\"params\":{\"properties\":{\"capabilities\":{\"$ref\":\"#/definitions/ClientCapabilities\"},\"clientInfo\":{\"$ref\":\"#/definitions/Implementation\"},\"protocolVersion\":{\"description\":\"The latest version of the Model Context Protocol that the client supports. The client MAY decide to support older versions as well.\",\"type\":\"string\"}},\"required\":[\"capabilities\",\"clientInfo\",\"protocolVersion\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"InitializeResult\":{\"description\":\"After receiving an initialize request from the client, the server sends this response.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"capabilities\":{\"$ref\":\"#/definitions/ServerCapabilities\"},\"instructions\":{\"description\":\"Instructions describing how to use the server and its features.\\n\\nThis can be used by clients to improve the LLM's understanding of available tools, resources, etc. It can be thought of like a \\\"hint\\\" to the model. For example, this information MAY be added to the system prompt.\",\"type\":\"string\"},\"protocolVersion\":{\"description\":\"The version of the Model Context Protocol that the server wants to use. This may not match the version that the client requested. If the client cannot support this version, it MUST disconnect.\",\"type\":\"string\"},\"serverInfo\":{\"$ref\":\"#/definitions/Implementation\"}},\"required\":[\"capabilities\",\"protocolVersion\",\"serverInfo\"],\"type\":\"object\"},\"InitializedNotification\":{\"description\":\"This notification is sent from the client to the server after initialization has finished.\",\"properties\":{\"method\":{\"const\":\"notifications/initialized\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"JSONRPCError\":{\"description\":\"A response to a request that indicates an error occurred.\",\"properties\":{\"error\":{\"properties\":{\"code\":{\"description\":\"The error type that occurred.\",\"type\":\"integer\"},\"data\":{\"description\":\"Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).\"},\"message\":{\"description\":\"A short description of the error. The message SHOULD be limited to a concise single sentence.\",\"type\":\"string\"}},\"required\":[\"code\",\"message\"],\"type\":\"object\"},\"id\":{\"$ref\":\"#/definitions/RequestId\"},\"jsonrpc\":{\"const\":\"2.0\",\"type\":\"string\"}},\"required\":[\"error\",\"id\",\"jsonrpc\"],\"type\":\"object\"},\"JSONRPCMessage\":{\"anyOf\":[{\"$ref\":\"#/definitions/JSONRPCRequest\"},{\"$ref\":\"#/definitions/JSONRPCNotification\"},{\"$ref\":\"#/definitions/JSONRPCResponse\"},{\"$ref\":\"#/definitions/JSONRPCError\"}],\"description\":\"Refers to any valid JSON-RPC object that can be decoded off the wire, or encoded to be sent.\"},\"JSONRPCNotification\":{\"description\":\"A notification which does not expect a response.\",\"properties\":{\"jsonrpc\":{\"const\":\"2.0\",\"type\":\"string\"},\"method\":{\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"jsonrpc\",\"method\"],\"type\":\"object\"},\"JSONRPCRequest\":{\"description\":\"A request that expects a response.\",\"properties\":{\"id\":{\"$ref\":\"#/definitions/RequestId\"},\"jsonrpc\":{\"const\":\"2.0\",\"type\":\"string\"},\"method\":{\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"properties\":{\"progressToken\":{\"$ref\":\"#/definitions/ProgressToken\",\"description\":\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\"}},\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"id\",\"jsonrpc\",\"method\"],\"type\":\"object\"},\"JSONRPCResponse\":{\"description\":\"A successful (non-error) response to a request.\",\"properties\":{\"id\":{\"$ref\":\"#/definitions/RequestId\"},\"jsonrpc\":{\"const\":\"2.0\",\"type\":\"string\"},\"result\":{\"$ref\":\"#/definitions/Result\"}},\"required\":[\"id\",\"jsonrpc\",\"result\"],\"type\":\"object\"},\"ListPromptsRequest\":{\"description\":\"Sent from the client to request a list of prompts and prompt templates the server has.\",\"properties\":{\"method\":{\"const\":\"prompts/list\",\"type\":\"string\"},\"params\":{\"properties\":{\"cursor\":{\"description\":\"An opaque token representing the current pagination position.\\nIf provided, the server should return results starting after this cursor.\",\"type\":\"string\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ListPromptsResult\":{\"description\":\"The server's response to a prompts/list request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"nextCursor\":{\"description\":\"An opaque token representing the pagination position after the last returned result.\\nIf present, there may be more results available.\",\"type\":\"string\"},\"prompts\":{\"items\":{\"$ref\":\"#/definitions/Prompt\"},\"type\":\"array\"}},\"required\":[\"prompts\"],\"type\":\"object\"},\"ListResourceTemplatesRequest\":{\"description\":\"Sent from the client to request a list of resource templates the server has.\",\"properties\":{\"method\":{\"const\":\"resources/templates/list\",\"type\":\"string\"},\"params\":{\"properties\":{\"cursor\":{\"description\":\"An opaque token representing the current pagination position.\\nIf provided, the server should return results starting after this cursor.\",\"type\":\"string\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ListResourceTemplatesResult\":{\"description\":\"The server's response to a resources/templates/list request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"nextCursor\":{\"description\":\"An opaque token representing the pagination position after the last returned result.\\nIf present, there may be more results available.\",\"type\":\"string\"},\"resourceTemplates\":{\"items\":{\"$ref\":\"#/definitions/ResourceTemplate\"},\"type\":\"array\"}},\"required\":[\"resourceTemplates\"],\"type\":\"object\"},\"ListResourcesRequest\":{\"description\":\"Sent from the client to request a list of resources the server has.\",\"properties\":{\"method\":{\"const\":\"resources/list\",\"type\":\"string\"},\"params\":{\"properties\":{\"cursor\":{\"description\":\"An opaque token representing the current pagination position.\\nIf provided, the server should return results starting after this cursor.\",\"type\":\"string\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ListResourcesResult\":{\"description\":\"The server's response to a resources/list request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"nextCursor\":{\"description\":\"An opaque token representing the pagination position after the last returned result.\\nIf present, there may be more results available.\",\"type\":\"string\"},\"resources\":{\"items\":{\"$ref\":\"#/definitions/Resource\"},\"type\":\"array\"}},\"required\":[\"resources\"],\"type\":\"object\"},\"ListRootsRequest\":{\"description\":\"Sent from the server to request a list of root URIs from the client. Roots allow\\nservers to ask for specific directories or files to operate on. A common example\\nfor roots is providing a set of repositories or directories a server should operate\\non.\\n\\nThis request is typically used when the server needs to understand the file system\\nstructure or access specific locations that the client has permission to read from.\",\"properties\":{\"method\":{\"const\":\"roots/list\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"properties\":{\"progressToken\":{\"$ref\":\"#/definitions/ProgressToken\",\"description\":\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\"}},\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ListRootsResult\":{\"description\":\"The client's response to a roots/list request from the server.\\nThis result contains an array of Root objects, each representing a root directory\\nor file that the server can operate on.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"roots\":{\"items\":{\"$ref\":\"#/definitions/Root\"},\"type\":\"array\"}},\"required\":[\"roots\"],\"type\":\"object\"},\"ListToolsRequest\":{\"description\":\"Sent from the client to request a list of tools the server has.\",\"properties\":{\"method\":{\"const\":\"tools/list\",\"type\":\"string\"},\"params\":{\"properties\":{\"cursor\":{\"description\":\"An opaque token representing the current pagination position.\\nIf provided, the server should return results starting after this cursor.\",\"type\":\"string\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ListToolsResult\":{\"description\":\"The server's response to a tools/list request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"nextCursor\":{\"description\":\"An opaque token representing the pagination position after the last returned result.\\nIf present, there may be more results available.\",\"type\":\"string\"},\"tools\":{\"items\":{\"$ref\":\"#/definitions/Tool\"},\"type\":\"array\"}},\"required\":[\"tools\"],\"type\":\"object\"},\"LoggingLevel\":{\"description\":\"The severity of a log message.\\n\\nThese map to syslog message severities, as specified in RFC-5424:\\nhttps://datatracker.ietf.org/doc/html/rfc5424#section-6.2.1\",\"enum\":[\"alert\",\"critical\",\"debug\",\"emergency\",\"error\",\"info\",\"notice\",\"warning\"],\"type\":\"string\"},\"LoggingMessageNotification\":{\"description\":\"Notification of a log message passed from server to client. If no logging/setLevel request has been sent from the client, the server MAY decide which messages to send automatically.\",\"properties\":{\"method\":{\"const\":\"notifications/message\",\"type\":\"string\"},\"params\":{\"properties\":{\"data\":{\"description\":\"The data to be logged, such as a string message or an object. Any JSON serializable type is allowed here.\"},\"level\":{\"$ref\":\"#/definitions/LoggingLevel\",\"description\":\"The severity of this log message.\"},\"logger\":{\"description\":\"An optional name of the logger issuing this message.\",\"type\":\"string\"}},\"required\":[\"data\",\"level\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"ModelHint\":{\"description\":\"Hints to use for model selection.\\n\\nKeys not declared here are currently left unspecified by the spec and are up\\nto the client to interpret.\",\"properties\":{\"name\":{\"description\":\"A hint for a model name.\\n\\nThe client SHOULD treat this as a substring of a model name; for example:\\n - `claude-3-5-sonnet` should match `claude-3-5-sonnet-20241022`\\n - `sonnet` should match `claude-3-5-sonnet-20241022`, `claude-3-sonnet-20240229`, etc.\\n - `claude` should match any Claude model\\n\\nThe client MAY also map the string to a different provider's model name or a different model family, as long as it fills a similar niche; for example:\\n - `gemini-1.5-flash` could match `claude-3-haiku-20240307`\",\"type\":\"string\"}},\"type\":\"object\"},\"ModelPreferences\":{\"description\":\"The server's preferences for model selection, requested of the client during sampling.\\n\\nBecause LLMs can vary along multiple dimensions, choosing the \\\"best\\\" model is\\nrarely straightforward. Different models excel in different areas—some are\\nfaster but less capable, others are more capable but more expensive, and so\\non. This interface allows servers to express their priorities across multiple\\ndimensions to help clients make an appropriate selection for their use case.\\n\\nThese preferences are always advisory. The client MAY ignore them. It is also\\nup to the client to decide how to interpret these preferences and how to\\nbalance them against other considerations.\",\"properties\":{\"costPriority\":{\"description\":\"How much to prioritize cost when selecting a model. A value of 0 means cost\\nis not important, while a value of 1 means cost is the most important\\nfactor.\",\"maximum\":1,\"minimum\":0,\"type\":\"number\"},\"hints\":{\"description\":\"Optional hints to use for model selection.\\n\\nIf multiple hints are specified, the client MUST evaluate them in order\\n(such that the first match is taken).\\n\\nThe client SHOULD prioritize these hints over the numeric priorities, but\\nMAY still use the priorities to select from ambiguous matches.\",\"items\":{\"$ref\":\"#/definitions/ModelHint\"},\"type\":\"array\"},\"intelligencePriority\":{\"description\":\"How much to prioritize intelligence and capabilities when selecting a\\nmodel. A value of 0 means intelligence is not important, while a value of 1\\nmeans intelligence is the most important factor.\",\"maximum\":1,\"minimum\":0,\"type\":\"number\"},\"speedPriority\":{\"description\":\"How much to prioritize sampling speed (latency) when selecting a model. A\\nvalue of 0 means speed is not important, while a value of 1 means speed is\\nthe most important factor.\",\"maximum\":1,\"minimum\":0,\"type\":\"number\"}},\"type\":\"object\"},\"Notification\":{\"properties\":{\"method\":{\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"NumberSchema\":{\"properties\":{\"description\":{\"type\":\"string\"},\"maximum\":{\"type\":\"integer\"},\"minimum\":{\"type\":\"integer\"},\"title\":{\"type\":\"string\"},\"type\":{\"enum\":[\"integer\",\"number\"],\"type\":\"string\"}},\"required\":[\"type\"],\"type\":\"object\"},\"PaginatedRequest\":{\"properties\":{\"method\":{\"type\":\"string\"},\"params\":{\"properties\":{\"cursor\":{\"description\":\"An opaque token representing the current pagination position.\\nIf provided, the server should return results starting after this cursor.\",\"type\":\"string\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"PaginatedResult\":{\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"nextCursor\":{\"description\":\"An opaque token representing the pagination position after the last returned result.\\nIf present, there may be more results available.\",\"type\":\"string\"}},\"type\":\"object\"},\"PingRequest\":{\"description\":\"A ping, issued by either the server or the client, to check that the other party is still alive. The receiver must promptly respond, or else may be disconnected.\",\"properties\":{\"method\":{\"const\":\"ping\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"properties\":{\"progressToken\":{\"$ref\":\"#/definitions/ProgressToken\",\"description\":\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\"}},\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"PrimitiveSchemaDefinition\":{\"anyOf\":[{\"$ref\":\"#/definitions/StringSchema\"},{\"$ref\":\"#/definitions/NumberSchema\"},{\"$ref\":\"#/definitions/BooleanSchema\"},{\"$ref\":\"#/definitions/EnumSchema\"}],\"description\":\"Restricted schema definitions that only allow primitive types\\nwithout nested objects or arrays.\"},\"ProgressNotification\":{\"description\":\"An out-of-band notification used to inform the receiver of a progress update for a long-running request.\",\"properties\":{\"method\":{\"const\":\"notifications/progress\",\"type\":\"string\"},\"params\":{\"properties\":{\"message\":{\"description\":\"An optional message describing the current progress.\",\"type\":\"string\"},\"progress\":{\"description\":\"The progress thus far. This should increase every time progress is made, even if the total is unknown.\",\"type\":\"number\"},\"progressToken\":{\"$ref\":\"#/definitions/ProgressToken\",\"description\":\"The progress token which was given in the initial request, used to associate this notification with the request that is proceeding.\"},\"total\":{\"description\":\"Total number of items to process (or total progress required), if known.\",\"type\":\"number\"}},\"required\":[\"progress\",\"progressToken\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"ProgressToken\":{\"description\":\"A progress token, used to associate progress notifications with the original request.\",\"type\":[\"string\",\"integer\"]},\"Prompt\":{\"description\":\"A prompt or prompt template that the server offers.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"arguments\":{\"description\":\"A list of arguments to use for templating the prompt.\",\"items\":{\"$ref\":\"#/definitions/PromptArgument\"},\"type\":\"array\"},\"description\":{\"description\":\"An optional description of what this prompt provides\",\"type\":\"string\"},\"name\":{\"description\":\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\",\"type\":\"string\"},\"title\":{\"description\":\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\neven by those unfamiliar with domain-specific terminology.\\n\\nIf not provided, the name should be used for display (except for Tool,\\nwhere `annotations.title` should be given precedence over using `name`,\\nif present).\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"PromptArgument\":{\"description\":\"Describes an argument that a prompt can accept.\",\"properties\":{\"description\":{\"description\":\"A human-readable description of the argument.\",\"type\":\"string\"},\"name\":{\"description\":\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\",\"type\":\"string\"},\"required\":{\"description\":\"Whether this argument must be provided.\",\"type\":\"boolean\"},\"title\":{\"description\":\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\neven by those unfamiliar with domain-specific terminology.\\n\\nIf not provided, the name should be used for display (except for Tool,\\nwhere `annotations.title` should be given precedence over using `name`,\\nif present).\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"PromptListChangedNotification\":{\"description\":\"An optional notification from the server to the client, informing it that the list of prompts it offers has changed. This may be issued by servers without any previous subscription from the client.\",\"properties\":{\"method\":{\"const\":\"notifications/prompts/list_changed\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"PromptMessage\":{\"description\":\"Describes a message returned as part of a prompt.\\n\\nThis is similar to `SamplingMessage`, but also supports the embedding of\\nresources from the MCP server.\",\"properties\":{\"content\":{\"$ref\":\"#/definitions/ContentBlock\"},\"role\":{\"$ref\":\"#/definitions/Role\"}},\"required\":[\"content\",\"role\"],\"type\":\"object\"},\"PromptReference\":{\"description\":\"Identifies a prompt.\",\"properties\":{\"name\":{\"description\":\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\",\"type\":\"string\"},\"title\":{\"description\":\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\neven by those unfamiliar with domain-specific terminology.\\n\\nIf not provided, the name should be used for display (except for Tool,\\nwhere `annotations.title` should be given precedence over using `name`,\\nif present).\",\"type\":\"string\"},\"type\":{\"const\":\"ref/prompt\",\"type\":\"string\"}},\"required\":[\"name\",\"type\"],\"type\":\"object\"},\"ReadResourceRequest\":{\"description\":\"Sent from the client to the server, to read a specific resource URI.\",\"properties\":{\"method\":{\"const\":\"resources/read\",\"type\":\"string\"},\"params\":{\"properties\":{\"uri\":{\"description\":\"The URI of the resource to read. The URI can use any protocol; it is up to the server how to interpret it.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"ReadResourceResult\":{\"description\":\"The server's response to a resources/read request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"contents\":{\"items\":{\"anyOf\":[{\"$ref\":\"#/definitions/TextResourceContents\"},{\"$ref\":\"#/definitions/BlobResourceContents\"}]},\"type\":\"array\"}},\"required\":[\"contents\"],\"type\":\"object\"},\"Request\":{\"properties\":{\"method\":{\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"properties\":{\"progressToken\":{\"$ref\":\"#/definitions/ProgressToken\",\"description\":\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\"}},\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"RequestId\":{\"description\":\"A uniquely identifying ID for a request in JSON-RPC.\",\"type\":[\"string\",\"integer\"]},\"Resource\":{\"description\":\"A known resource that the server is capable of reading.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"description\":{\"description\":\"A description of what this resource represents.\\n\\nThis can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \\\"hint\\\" to the model.\",\"type\":\"string\"},\"mimeType\":{\"description\":\"The MIME type of this resource, if known.\",\"type\":\"string\"},\"name\":{\"description\":\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\",\"type\":\"string\"},\"size\":{\"description\":\"The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.\\n\\nThis can be used by Hosts to display file sizes and estimate context window usage.\",\"type\":\"integer\"},\"title\":{\"description\":\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\neven by those unfamiliar with domain-specific terminology.\\n\\nIf not provided, the name should be used for display (except for Tool,\\nwhere `annotations.title` should be given precedence over using `name`,\\nif present).\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI of this resource.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"name\",\"uri\"],\"type\":\"object\"},\"ResourceContents\":{\"description\":\"The contents of a specific resource or sub-resource.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"mimeType\":{\"description\":\"The MIME type of this resource, if known.\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI of this resource.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"},\"ResourceLink\":{\"description\":\"A resource that the server is capable of reading, included in a prompt or tool call result.\\n\\nNote: resource links returned by tools are not guaranteed to appear in the results of `resources/list` requests.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"description\":{\"description\":\"A description of what this resource represents.\\n\\nThis can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \\\"hint\\\" to the model.\",\"type\":\"string\"},\"mimeType\":{\"description\":\"The MIME type of this resource, if known.\",\"type\":\"string\"},\"name\":{\"description\":\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\",\"type\":\"string\"},\"size\":{\"description\":\"The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.\\n\\nThis can be used by Hosts to display file sizes and estimate context window usage.\",\"type\":\"integer\"},\"title\":{\"description\":\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\neven by those unfamiliar with domain-specific terminology.\\n\\nIf not provided, the name should be used for display (except for Tool,\\nwhere `annotations.title` should be given precedence over using `name`,\\nif present).\",\"type\":\"string\"},\"type\":{\"const\":\"resource_link\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI of this resource.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"name\",\"type\",\"uri\"],\"type\":\"object\"},\"ResourceListChangedNotification\":{\"description\":\"An optional notification from the server to the client, informing it that the list of resources it can read from has changed. This may be issued by servers without any previous subscription from the client.\",\"properties\":{\"method\":{\"const\":\"notifications/resources/list_changed\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ResourceTemplate\":{\"description\":\"A template description for resources available on the server.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"description\":{\"description\":\"A description of what this template is for.\\n\\nThis can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \\\"hint\\\" to the model.\",\"type\":\"string\"},\"mimeType\":{\"description\":\"The MIME type for all resources that match this template. This should only be included if all resources matching this template have the same type.\",\"type\":\"string\"},\"name\":{\"description\":\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\",\"type\":\"string\"},\"title\":{\"description\":\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\neven by those unfamiliar with domain-specific terminology.\\n\\nIf not provided, the name should be used for display (except for Tool,\\nwhere `annotations.title` should be given precedence over using `name`,\\nif present).\",\"type\":\"string\"},\"uriTemplate\":{\"description\":\"A URI template (according to RFC 6570) that can be used to construct resource URIs.\",\"format\":\"uri-template\",\"type\":\"string\"}},\"required\":[\"name\",\"uriTemplate\"],\"type\":\"object\"},\"ResourceTemplateReference\":{\"description\":\"A reference to a resource or resource template definition.\",\"properties\":{\"type\":{\"const\":\"ref/resource\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI or URI template of the resource.\",\"format\":\"uri-template\",\"type\":\"string\"}},\"required\":[\"type\",\"uri\"],\"type\":\"object\"},\"ResourceUpdatedNotification\":{\"description\":\"A notification from the server to the client, informing it that a resource has changed and may need to be read again. This should only be sent if the client previously sent a resources/subscribe request.\",\"properties\":{\"method\":{\"const\":\"notifications/resources/updated\",\"type\":\"string\"},\"params\":{\"properties\":{\"uri\":{\"description\":\"The URI of the resource that has been updated. This might be a sub-resource of the one that the client actually subscribed to.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"Result\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"}},\"type\":\"object\"},\"Role\":{\"description\":\"The sender or recipient of messages and data in a conversation.\",\"enum\":[\"assistant\",\"user\"],\"type\":\"string\"},\"Root\":{\"description\":\"Represents a root directory or file that the server can operate on.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"name\":{\"description\":\"An optional name for the root. This can be used to provide a human-readable\\nidentifier for the root, which may be useful for display purposes or for\\nreferencing the root in other parts of the application.\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI identifying the root. This *must* start with file:// for now.\\nThis restriction may be relaxed in future versions of the protocol to allow\\nother URI schemes.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"},\"RootsListChangedNotification\":{\"description\":\"A notification from the client to the server, informing it that the list of roots has changed.\\nThis notification should be sent whenever the client adds, removes, or modifies any root.\\nThe server should then request an updated list of roots using the ListRootsRequest.\",\"properties\":{\"method\":{\"const\":\"notifications/roots/list_changed\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"SamplingMessage\":{\"description\":\"Describes a message issued to or received from an LLM API.\",\"properties\":{\"content\":{\"anyOf\":[{\"$ref\":\"#/definitions/TextContent\"},{\"$ref\":\"#/definitions/ImageContent\"},{\"$ref\":\"#/definitions/AudioContent\"}]},\"role\":{\"$ref\":\"#/definitions/Role\"}},\"required\":[\"content\",\"role\"],\"type\":\"object\"},\"ServerCapabilities\":{\"description\":\"Capabilities that a server may support. Known capabilities are defined here, in this schema, but this is not a closed set: any server can define its own, additional capabilities.\",\"properties\":{\"completions\":{\"additionalProperties\":true,\"description\":\"Present if the server supports argument autocompletion suggestions.\",\"properties\":{},\"type\":\"object\"},\"experimental\":{\"additionalProperties\":{\"additionalProperties\":true,\"properties\":{},\"type\":\"object\"},\"description\":\"Experimental, non-standard capabilities that the server supports.\",\"type\":\"object\"},\"logging\":{\"additionalProperties\":true,\"description\":\"Present if the server supports sending log messages to the client.\",\"properties\":{},\"type\":\"object\"},\"prompts\":{\"description\":\"Present if the server offers any prompt templates.\",\"properties\":{\"listChanged\":{\"description\":\"Whether this server supports notifications for changes to the prompt list.\",\"type\":\"boolean\"}},\"type\":\"object\"},\"resources\":{\"description\":\"Present if the server offers any resources to read.\",\"properties\":{\"listChanged\":{\"description\":\"Whether this server supports notifications for changes to the resource list.\",\"type\":\"boolean\"},\"subscribe\":{\"description\":\"Whether this server supports subscribing to resource updates.\",\"type\":\"boolean\"}},\"type\":\"object\"},\"tools\":{\"description\":\"Present if the server offers any tools to call.\",\"properties\":{\"listChanged\":{\"description\":\"Whether this server supports notifications for changes to the tool list.\",\"type\":\"boolean\"}},\"type\":\"object\"}},\"type\":\"object\"},\"ServerNotification\":{\"anyOf\":[{\"$ref\":\"#/definitions/CancelledNotification\"},{\"$ref\":\"#/definitions/ProgressNotification\"},{\"$ref\":\"#/definitions/ResourceListChangedNotification\"},{\"$ref\":\"#/definitions/ResourceUpdatedNotification\"},{\"$ref\":\"#/definitions/PromptListChangedNotification\"},{\"$ref\":\"#/definitions/ToolListChangedNotification\"},{\"$ref\":\"#/definitions/LoggingMessageNotification\"}]},\"ServerRequest\":{\"anyOf\":[{\"$ref\":\"#/definitions/PingRequest\"},{\"$ref\":\"#/definitions/CreateMessageRequest\"},{\"$ref\":\"#/definitions/ListRootsRequest\"},{\"$ref\":\"#/definitions/ElicitRequest\"}]},\"ServerResult\":{\"anyOf\":[{\"$ref\":\"#/definitions/Result\"},{\"$ref\":\"#/definitions/InitializeResult\"},{\"$ref\":\"#/definitions/ListResourcesResult\"},{\"$ref\":\"#/definitions/ListResourceTemplatesResult\"},{\"$ref\":\"#/definitions/ReadResourceResult\"},{\"$ref\":\"#/definitions/ListPromptsResult\"},{\"$ref\":\"#/definitions/GetPromptResult\"},{\"$ref\":\"#/definitions/ListToolsResult\"},{\"$ref\":\"#/definitions/CallToolResult\"},{\"$ref\":\"#/definitions/CompleteResult\"}]},\"SetLevelRequest\":{\"description\":\"A request from the client to the server, to enable or adjust logging.\",\"properties\":{\"method\":{\"const\":\"logging/setLevel\",\"type\":\"string\"},\"params\":{\"properties\":{\"level\":{\"$ref\":\"#/definitions/LoggingLevel\",\"description\":\"The level of logging that the client wants to receive from the server. The server should send all logs at this level and higher (i.e., more severe) to the client as notifications/message.\"}},\"required\":[\"level\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"StringSchema\":{\"properties\":{\"description\":{\"type\":\"string\"},\"format\":{\"enum\":[\"date\",\"date-time\",\"email\",\"uri\"],\"type\":\"string\"},\"maxLength\":{\"type\":\"integer\"},\"minLength\":{\"type\":\"integer\"},\"title\":{\"type\":\"string\"},\"type\":{\"const\":\"string\",\"type\":\"string\"}},\"required\":[\"type\"],\"type\":\"object\"},\"SubscribeRequest\":{\"description\":\"Sent from the client to request resources/updated notifications from the server whenever a particular resource changes.\",\"properties\":{\"method\":{\"const\":\"resources/subscribe\",\"type\":\"string\"},\"params\":{\"properties\":{\"uri\":{\"description\":\"The URI of the resource to subscribe to. The URI can use any protocol; it is up to the server how to interpret it.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"TextContent\":{\"description\":\"Text provided to or from an LLM.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"text\":{\"description\":\"The text content of the message.\",\"type\":\"string\"},\"type\":{\"const\":\"text\",\"type\":\"string\"}},\"required\":[\"text\",\"type\"],\"type\":\"object\"},\"TextResourceContents\":{\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"mimeType\":{\"description\":\"The MIME type of this resource, if known.\",\"type\":\"string\"},\"text\":{\"description\":\"The text of the item. This must only be set if the item can actually be represented as text (not binary data).\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI of this resource.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"text\",\"uri\"],\"type\":\"object\"},\"Tool\":{\"description\":\"Definition for a tool the client can call.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"},\"annotations\":{\"$ref\":\"#/definitions/ToolAnnotations\",\"description\":\"Optional additional tool information.\\n\\nDisplay name precedence order is: title, annotations.title, then name.\"},\"description\":{\"description\":\"A human-readable description of the tool.\\n\\nThis can be used by clients to improve the LLM's understanding of available tools. It can be thought of like a \\\"hint\\\" to the model.\",\"type\":\"string\"},\"inputSchema\":{\"description\":\"A JSON Schema object defining the expected parameters for the tool.\",\"properties\":{\"properties\":{\"additionalProperties\":{\"additionalProperties\":true,\"properties\":{},\"type\":\"object\"},\"type\":\"object\"},\"required\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"type\":{\"const\":\"object\",\"type\":\"string\"}},\"required\":[\"type\"],\"type\":\"object\"},\"name\":{\"description\":\"Intended for programmatic or logical use, but used as a display name in past specs or fallback (if title isn't present).\",\"type\":\"string\"},\"outputSchema\":{\"description\":\"An optional JSON Schema object defining the structure of the tool's output returned in\\nthe structuredContent field of a CallToolResult.\",\"properties\":{\"properties\":{\"additionalProperties\":{\"additionalProperties\":true,\"properties\":{},\"type\":\"object\"},\"type\":\"object\"},\"required\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"type\":{\"const\":\"object\",\"type\":\"string\"}},\"required\":[\"type\"],\"type\":\"object\"},\"title\":{\"description\":\"Intended for UI and end-user contexts — optimized to be human-readable and easily understood,\\neven by those unfamiliar with domain-specific terminology.\\n\\nIf not provided, the name should be used for display (except for Tool,\\nwhere `annotations.title` should be given precedence over using `name`,\\nif present).\",\"type\":\"string\"}},\"required\":[\"inputSchema\",\"name\"],\"type\":\"object\"},\"ToolAnnotations\":{\"description\":\"Additional properties describing a Tool to clients.\\n\\nNOTE: all properties in ToolAnnotations are **hints**.\\nThey are not guaranteed to provide a faithful description of\\ntool behavior (including descriptive properties like `title`).\\n\\nClients should never make tool use decisions based on ToolAnnotations\\nreceived from untrusted servers.\",\"properties\":{\"destructiveHint\":{\"description\":\"If true, the tool may perform destructive updates to its environment.\\nIf false, the tool performs only additive updates.\\n\\n(This property is meaningful only when `readOnlyHint == false`)\\n\\nDefault: true\",\"type\":\"boolean\"},\"idempotentHint\":{\"description\":\"If true, calling the tool repeatedly with the same arguments\\nwill have no additional effect on the its environment.\\n\\n(This property is meaningful only when `readOnlyHint == false`)\\n\\nDefault: false\",\"type\":\"boolean\"},\"openWorldHint\":{\"description\":\"If true, this tool may interact with an \\\"open world\\\" of external\\nentities. If false, the tool's domain of interaction is closed.\\nFor example, the world of a web search tool is open, whereas that\\nof a memory tool is not.\\n\\nDefault: true\",\"type\":\"boolean\"},\"readOnlyHint\":{\"description\":\"If true, the tool does not modify its environment.\\n\\nDefault: false\",\"type\":\"boolean\"},\"title\":{\"description\":\"A human-readable title for the tool.\",\"type\":\"string\"}},\"type\":\"object\"},\"ToolListChangedNotification\":{\"description\":\"An optional notification from the server to the client, informing it that the list of tools it offers has changed. This may be issued by servers without any previous subscription from the client.\",\"properties\":{\"method\":{\"const\":\"notifications/tools/list_changed\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"See [General fields: `_meta`](/specification/2025-06-18/basic/index#meta) for notes on `_meta` usage.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"UnsubscribeRequest\":{\"description\":\"Sent from the client to request cancellation of resources/updated notifications from the server. This should follow a previous resources/subscribe request.\",\"properties\":{\"method\":{\"const\":\"resources/unsubscribe\",\"type\":\"string\"},\"params\":{\"properties\":{\"uri\":{\"description\":\"The URI of the resource to unsubscribe from.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"}}};\n",[],[142,380,446],"be1898a8-a8fd-41ce-a579-8cc63cc9e8c1","2025-03-26.schema.json.ts","5dadbda2-ad1c-11f1-9c68-1607ee4eb77e",159,["D",1789047276722],"export default {\"$schema\":\"http://json-schema.org/draft-07/schema#\",\"definitions\":{\"Annotations\":{\"description\":\"Optional annotations for the client. The client can use annotations to inform how objects are used or displayed\",\"properties\":{\"audience\":{\"description\":\"Describes who the intended customer of this object or data is.\\n\\nIt can include multiple entries to indicate content useful for multiple audiences (e.g., `[\\\"user\\\", \\\"assistant\\\"]`).\",\"items\":{\"$ref\":\"#/definitions/Role\"},\"type\":\"array\"},\"priority\":{\"description\":\"Describes how important this data is for operating the server.\\n\\nA value of 1 means \\\"most important,\\\" and indicates that the data is\\neffectively required, while 0 means \\\"least important,\\\" and indicates that\\nthe data is entirely optional.\",\"maximum\":1,\"minimum\":0,\"type\":\"number\"}},\"type\":\"object\"},\"AudioContent\":{\"description\":\"Audio provided to or from an LLM.\",\"properties\":{\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"data\":{\"description\":\"The base64-encoded audio data.\",\"format\":\"byte\",\"type\":\"string\"},\"mimeType\":{\"description\":\"The MIME type of the audio. Different providers may support different audio types.\",\"type\":\"string\"},\"type\":{\"const\":\"audio\",\"type\":\"string\"}},\"required\":[\"data\",\"mimeType\",\"type\"],\"type\":\"object\"},\"BlobResourceContents\":{\"properties\":{\"blob\":{\"description\":\"A base64-encoded string representing the binary data of the item.\",\"format\":\"byte\",\"type\":\"string\"},\"mimeType\":{\"description\":\"The MIME type of this resource, if known.\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI of this resource.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"blob\",\"uri\"],\"type\":\"object\"},\"CallToolRequest\":{\"description\":\"Used by the client to invoke a tool provided by the server.\",\"properties\":{\"method\":{\"const\":\"tools/call\",\"type\":\"string\"},\"params\":{\"properties\":{\"arguments\":{\"additionalProperties\":{},\"type\":\"object\"},\"name\":{\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"CallToolResult\":{\"description\":\"The server's response to a tool call.\\n\\nAny errors that originate from the tool SHOULD be reported inside the result\\nobject, with `isError` set to true, _not_ as an MCP protocol-level error\\nresponse. Otherwise, the LLM would not be able to see that an error occurred\\nand self-correct.\\n\\nHowever, any errors in _finding_ the tool, an error indicating that the\\nserver does not support tool calls, or any other exceptional conditions,\\nshould be reported as an MCP error response.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"content\":{\"items\":{\"anyOf\":[{\"$ref\":\"#/definitions/TextContent\"},{\"$ref\":\"#/definitions/ImageContent\"},{\"$ref\":\"#/definitions/AudioContent\"},{\"$ref\":\"#/definitions/EmbeddedResource\"}]},\"type\":\"array\"},\"isError\":{\"description\":\"Whether the tool call ended in an error.\\n\\nIf not set, this is assumed to be false (the call was successful).\",\"type\":\"boolean\"}},\"required\":[\"content\"],\"type\":\"object\"},\"CancelledNotification\":{\"description\":\"This notification can be sent by either side to indicate that it is cancelling a previously-issued request.\\n\\nThe request SHOULD still be in-flight, but due to communication latency, it is always possible that this notification MAY arrive after the request has already finished.\\n\\nThis notification indicates that the result will be unused, so any associated processing SHOULD cease.\\n\\nA client MUST NOT attempt to cancel its `initialize` request.\",\"properties\":{\"method\":{\"const\":\"notifications/cancelled\",\"type\":\"string\"},\"params\":{\"properties\":{\"reason\":{\"description\":\"An optional string describing the reason for the cancellation. This MAY be logged or presented to the user.\",\"type\":\"string\"},\"requestId\":{\"$ref\":\"#/definitions/RequestId\",\"description\":\"The ID of the request to cancel.\\n\\nThis MUST correspond to the ID of a request previously issued in the same direction.\"}},\"required\":[\"requestId\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"ClientCapabilities\":{\"description\":\"Capabilities a client may support. Known capabilities are defined here, in this schema, but this is not a closed set: any client can define its own, additional capabilities.\",\"properties\":{\"experimental\":{\"additionalProperties\":{\"additionalProperties\":true,\"properties\":{},\"type\":\"object\"},\"description\":\"Experimental, non-standard capabilities that the client supports.\",\"type\":\"object\"},\"roots\":{\"description\":\"Present if the client supports listing roots.\",\"properties\":{\"listChanged\":{\"description\":\"Whether the client supports notifications for changes to the roots list.\",\"type\":\"boolean\"}},\"type\":\"object\"},\"sampling\":{\"additionalProperties\":true,\"description\":\"Present if the client supports sampling from an LLM.\",\"properties\":{},\"type\":\"object\"}},\"type\":\"object\"},\"ClientNotification\":{\"anyOf\":[{\"$ref\":\"#/definitions/CancelledNotification\"},{\"$ref\":\"#/definitions/InitializedNotification\"},{\"$ref\":\"#/definitions/ProgressNotification\"},{\"$ref\":\"#/definitions/RootsListChangedNotification\"}]},\"ClientRequest\":{\"anyOf\":[{\"$ref\":\"#/definitions/InitializeRequest\"},{\"$ref\":\"#/definitions/PingRequest\"},{\"$ref\":\"#/definitions/ListResourcesRequest\"},{\"$ref\":\"#/definitions/ListResourceTemplatesRequest\"},{\"$ref\":\"#/definitions/ReadResourceRequest\"},{\"$ref\":\"#/definitions/SubscribeRequest\"},{\"$ref\":\"#/definitions/UnsubscribeRequest\"},{\"$ref\":\"#/definitions/ListPromptsRequest\"},{\"$ref\":\"#/definitions/GetPromptRequest\"},{\"$ref\":\"#/definitions/ListToolsRequest\"},{\"$ref\":\"#/definitions/CallToolRequest\"},{\"$ref\":\"#/definitions/SetLevelRequest\"},{\"$ref\":\"#/definitions/CompleteRequest\"}]},\"ClientResult\":{\"anyOf\":[{\"$ref\":\"#/definitions/Result\"},{\"$ref\":\"#/definitions/CreateMessageResult\"},{\"$ref\":\"#/definitions/ListRootsResult\"}]},\"CompleteRequest\":{\"description\":\"A request from the client to the server, to ask for completion options.\",\"properties\":{\"method\":{\"const\":\"completion/complete\",\"type\":\"string\"},\"params\":{\"properties\":{\"argument\":{\"description\":\"The argument's information\",\"properties\":{\"name\":{\"description\":\"The name of the argument\",\"type\":\"string\"},\"value\":{\"description\":\"The value of the argument to use for completion matching.\",\"type\":\"string\"}},\"required\":[\"name\",\"value\"],\"type\":\"object\"},\"ref\":{\"anyOf\":[{\"$ref\":\"#/definitions/PromptReference\"},{\"$ref\":\"#/definitions/ResourceReference\"}]}},\"required\":[\"argument\",\"ref\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"CompleteResult\":{\"description\":\"The server's response to a completion/complete request\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"completion\":{\"properties\":{\"hasMore\":{\"description\":\"Indicates whether there are additional completion options beyond those provided in the current response, even if the exact total is unknown.\",\"type\":\"boolean\"},\"total\":{\"description\":\"The total number of completion options available. This can exceed the number of values actually sent in the response.\",\"type\":\"integer\"},\"values\":{\"description\":\"An array of completion values. Must not exceed 100 items.\",\"items\":{\"type\":\"string\"},\"type\":\"array\"}},\"required\":[\"values\"],\"type\":\"object\"}},\"required\":[\"completion\"],\"type\":\"object\"},\"CreateMessageRequest\":{\"description\":\"A request from the server to sample an LLM via the client. The client has full discretion over which model to select. The client should also inform the user before beginning sampling, to allow them to inspect the request (human in the loop) and decide whether to approve it.\",\"properties\":{\"method\":{\"const\":\"sampling/createMessage\",\"type\":\"string\"},\"params\":{\"properties\":{\"includeContext\":{\"description\":\"A request to include context from one or more MCP servers (including the caller), to be attached to the prompt. The client MAY ignore this request.\",\"enum\":[\"allServers\",\"none\",\"thisServer\"],\"type\":\"string\"},\"maxTokens\":{\"description\":\"The maximum number of tokens to sample, as requested by the server. The client MAY choose to sample fewer tokens than requested.\",\"type\":\"integer\"},\"messages\":{\"items\":{\"$ref\":\"#/definitions/SamplingMessage\"},\"type\":\"array\"},\"metadata\":{\"additionalProperties\":true,\"description\":\"Optional metadata to pass through to the LLM provider. The format of this metadata is provider-specific.\",\"properties\":{},\"type\":\"object\"},\"modelPreferences\":{\"$ref\":\"#/definitions/ModelPreferences\",\"description\":\"The server's preferences for which model to select. The client MAY ignore these preferences.\"},\"stopSequences\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"systemPrompt\":{\"description\":\"An optional system prompt the server wants to use for sampling. The client MAY modify or omit this prompt.\",\"type\":\"string\"},\"temperature\":{\"type\":\"number\"}},\"required\":[\"maxTokens\",\"messages\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"CreateMessageResult\":{\"description\":\"The client's response to a sampling/create_message request from the server. The client should inform the user before returning the sampled message, to allow them to inspect the response (human in the loop) and decide whether to allow the server to see it.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"content\":{\"anyOf\":[{\"$ref\":\"#/definitions/TextContent\"},{\"$ref\":\"#/definitions/ImageContent\"},{\"$ref\":\"#/definitions/AudioContent\"}]},\"model\":{\"description\":\"The name of the model that generated the message.\",\"type\":\"string\"},\"role\":{\"$ref\":\"#/definitions/Role\"},\"stopReason\":{\"description\":\"The reason why sampling stopped, if known.\",\"type\":\"string\"}},\"required\":[\"content\",\"model\",\"role\"],\"type\":\"object\"},\"Cursor\":{\"description\":\"An opaque token used to represent a cursor for pagination.\",\"type\":\"string\"},\"EmbeddedResource\":{\"description\":\"The contents of a resource, embedded into a prompt or tool call result.\\n\\nIt is up to the client how best to render embedded resources for the benefit\\nof the LLM and/or the user.\",\"properties\":{\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"resource\":{\"anyOf\":[{\"$ref\":\"#/definitions/TextResourceContents\"},{\"$ref\":\"#/definitions/BlobResourceContents\"}]},\"type\":{\"const\":\"resource\",\"type\":\"string\"}},\"required\":[\"resource\",\"type\"],\"type\":\"object\"},\"EmptyResult\":{\"$ref\":\"#/definitions/Result\"},\"GetPromptRequest\":{\"description\":\"Used by the client to get a prompt provided by the server.\",\"properties\":{\"method\":{\"const\":\"prompts/get\",\"type\":\"string\"},\"params\":{\"properties\":{\"arguments\":{\"additionalProperties\":{\"type\":\"string\"},\"description\":\"Arguments to use for templating the prompt.\",\"type\":\"object\"},\"name\":{\"description\":\"The name of the prompt or prompt template.\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"GetPromptResult\":{\"description\":\"The server's response to a prompts/get request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"description\":{\"description\":\"An optional description for the prompt.\",\"type\":\"string\"},\"messages\":{\"items\":{\"$ref\":\"#/definitions/PromptMessage\"},\"type\":\"array\"}},\"required\":[\"messages\"],\"type\":\"object\"},\"ImageContent\":{\"description\":\"An image provided to or from an LLM.\",\"properties\":{\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"data\":{\"description\":\"The base64-encoded image data.\",\"format\":\"byte\",\"type\":\"string\"},\"mimeType\":{\"description\":\"The MIME type of the image. Different providers may support different image types.\",\"type\":\"string\"},\"type\":{\"const\":\"image\",\"type\":\"string\"}},\"required\":[\"data\",\"mimeType\",\"type\"],\"type\":\"object\"},\"Implementation\":{\"description\":\"Describes the name and version of an MCP implementation.\",\"properties\":{\"name\":{\"type\":\"string\"},\"version\":{\"type\":\"string\"}},\"required\":[\"name\",\"version\"],\"type\":\"object\"},\"InitializeRequest\":{\"description\":\"This request is sent from the client to the server when it first connects, asking it to begin initialization.\",\"properties\":{\"method\":{\"const\":\"initialize\",\"type\":\"string\"},\"params\":{\"properties\":{\"capabilities\":{\"$ref\":\"#/definitions/ClientCapabilities\"},\"clientInfo\":{\"$ref\":\"#/definitions/Implementation\"},\"protocolVersion\":{\"description\":\"The latest version of the Model Context Protocol that the client supports. The client MAY decide to support older versions as well.\",\"type\":\"string\"}},\"required\":[\"capabilities\",\"clientInfo\",\"protocolVersion\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"InitializeResult\":{\"description\":\"After receiving an initialize request from the client, the server sends this response.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"capabilities\":{\"$ref\":\"#/definitions/ServerCapabilities\"},\"instructions\":{\"description\":\"Instructions describing how to use the server and its features.\\n\\nThis can be used by clients to improve the LLM's understanding of available tools, resources, etc. It can be thought of like a \\\"hint\\\" to the model. For example, this information MAY be added to the system prompt.\",\"type\":\"string\"},\"protocolVersion\":{\"description\":\"The version of the Model Context Protocol that the server wants to use. This may not match the version that the client requested. If the client cannot support this version, it MUST disconnect.\",\"type\":\"string\"},\"serverInfo\":{\"$ref\":\"#/definitions/Implementation\"}},\"required\":[\"capabilities\",\"protocolVersion\",\"serverInfo\"],\"type\":\"object\"},\"InitializedNotification\":{\"description\":\"This notification is sent from the client to the server after initialization has finished.\",\"properties\":{\"method\":{\"const\":\"notifications/initialized\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This parameter name is reserved by MCP to allow clients and servers to attach additional metadata to their notifications.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"JSONRPCBatchRequest\":{\"description\":\"A JSON-RPC batch request, as described in https://www.jsonrpc.org/specification#batch.\",\"items\":{\"anyOf\":[{\"$ref\":\"#/definitions/JSONRPCRequest\"},{\"$ref\":\"#/definitions/JSONRPCNotification\"}]},\"type\":\"array\"},\"JSONRPCBatchResponse\":{\"description\":\"A JSON-RPC batch response, as described in https://www.jsonrpc.org/specification#batch.\",\"items\":{\"anyOf\":[{\"$ref\":\"#/definitions/JSONRPCResponse\"},{\"$ref\":\"#/definitions/JSONRPCError\"}]},\"type\":\"array\"},\"JSONRPCError\":{\"description\":\"A response to a request that indicates an error occurred.\",\"properties\":{\"error\":{\"properties\":{\"code\":{\"description\":\"The error type that occurred.\",\"type\":\"integer\"},\"data\":{\"description\":\"Additional information about the error. The value of this member is defined by the sender (e.g. detailed error information, nested errors etc.).\"},\"message\":{\"description\":\"A short description of the error. The message SHOULD be limited to a concise single sentence.\",\"type\":\"string\"}},\"required\":[\"code\",\"message\"],\"type\":\"object\"},\"id\":{\"$ref\":\"#/definitions/RequestId\"},\"jsonrpc\":{\"const\":\"2.0\",\"type\":\"string\"}},\"required\":[\"error\",\"id\",\"jsonrpc\"],\"type\":\"object\"},\"JSONRPCMessage\":{\"anyOf\":[{\"$ref\":\"#/definitions/JSONRPCRequest\"},{\"$ref\":\"#/definitions/JSONRPCNotification\"},{\"description\":\"A JSON-RPC batch request, as described in https://www.jsonrpc.org/specification#batch.\",\"items\":{\"anyOf\":[{\"$ref\":\"#/definitions/JSONRPCRequest\"},{\"$ref\":\"#/definitions/JSONRPCNotification\"}]},\"type\":\"array\"},{\"$ref\":\"#/definitions/JSONRPCResponse\"},{\"$ref\":\"#/definitions/JSONRPCError\"},{\"description\":\"A JSON-RPC batch response, as described in https://www.jsonrpc.org/specification#batch.\",\"items\":{\"anyOf\":[{\"$ref\":\"#/definitions/JSONRPCResponse\"},{\"$ref\":\"#/definitions/JSONRPCError\"}]},\"type\":\"array\"}],\"description\":\"Refers to any valid JSON-RPC object that can be decoded off the wire, or encoded to be sent.\"},\"JSONRPCNotification\":{\"description\":\"A notification which does not expect a response.\",\"properties\":{\"jsonrpc\":{\"const\":\"2.0\",\"type\":\"string\"},\"method\":{\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This parameter name is reserved by MCP to allow clients and servers to attach additional metadata to their notifications.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"jsonrpc\",\"method\"],\"type\":\"object\"},\"JSONRPCRequest\":{\"description\":\"A request that expects a response.\",\"properties\":{\"id\":{\"$ref\":\"#/definitions/RequestId\"},\"jsonrpc\":{\"const\":\"2.0\",\"type\":\"string\"},\"method\":{\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"properties\":{\"progressToken\":{\"$ref\":\"#/definitions/ProgressToken\",\"description\":\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\"}},\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"id\",\"jsonrpc\",\"method\"],\"type\":\"object\"},\"JSONRPCResponse\":{\"description\":\"A successful (non-error) response to a request.\",\"properties\":{\"id\":{\"$ref\":\"#/definitions/RequestId\"},\"jsonrpc\":{\"const\":\"2.0\",\"type\":\"string\"},\"result\":{\"$ref\":\"#/definitions/Result\"}},\"required\":[\"id\",\"jsonrpc\",\"result\"],\"type\":\"object\"},\"ListPromptsRequest\":{\"description\":\"Sent from the client to request a list of prompts and prompt templates the server has.\",\"properties\":{\"method\":{\"const\":\"prompts/list\",\"type\":\"string\"},\"params\":{\"properties\":{\"cursor\":{\"description\":\"An opaque token representing the current pagination position.\\nIf provided, the server should return results starting after this cursor.\",\"type\":\"string\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ListPromptsResult\":{\"description\":\"The server's response to a prompts/list request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"nextCursor\":{\"description\":\"An opaque token representing the pagination position after the last returned result.\\nIf present, there may be more results available.\",\"type\":\"string\"},\"prompts\":{\"items\":{\"$ref\":\"#/definitions/Prompt\"},\"type\":\"array\"}},\"required\":[\"prompts\"],\"type\":\"object\"},\"ListResourceTemplatesRequest\":{\"description\":\"Sent from the client to request a list of resource templates the server has.\",\"properties\":{\"method\":{\"const\":\"resources/templates/list\",\"type\":\"string\"},\"params\":{\"properties\":{\"cursor\":{\"description\":\"An opaque token representing the current pagination position.\\nIf provided, the server should return results starting after this cursor.\",\"type\":\"string\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ListResourceTemplatesResult\":{\"description\":\"The server's response to a resources/templates/list request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"nextCursor\":{\"description\":\"An opaque token representing the pagination position after the last returned result.\\nIf present, there may be more results available.\",\"type\":\"string\"},\"resourceTemplates\":{\"items\":{\"$ref\":\"#/definitions/ResourceTemplate\"},\"type\":\"array\"}},\"required\":[\"resourceTemplates\"],\"type\":\"object\"},\"ListResourcesRequest\":{\"description\":\"Sent from the client to request a list of resources the server has.\",\"properties\":{\"method\":{\"const\":\"resources/list\",\"type\":\"string\"},\"params\":{\"properties\":{\"cursor\":{\"description\":\"An opaque token representing the current pagination position.\\nIf provided, the server should return results starting after this cursor.\",\"type\":\"string\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ListResourcesResult\":{\"description\":\"The server's response to a resources/list request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"nextCursor\":{\"description\":\"An opaque token representing the pagination position after the last returned result.\\nIf present, there may be more results available.\",\"type\":\"string\"},\"resources\":{\"items\":{\"$ref\":\"#/definitions/Resource\"},\"type\":\"array\"}},\"required\":[\"resources\"],\"type\":\"object\"},\"ListRootsRequest\":{\"description\":\"Sent from the server to request a list of root URIs from the client. Roots allow\\nservers to ask for specific directories or files to operate on. A common example\\nfor roots is providing a set of repositories or directories a server should operate\\non.\\n\\nThis request is typically used when the server needs to understand the file system\\nstructure or access specific locations that the client has permission to read from.\",\"properties\":{\"method\":{\"const\":\"roots/list\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"properties\":{\"progressToken\":{\"$ref\":\"#/definitions/ProgressToken\",\"description\":\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\"}},\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ListRootsResult\":{\"description\":\"The client's response to a roots/list request from the server.\\nThis result contains an array of Root objects, each representing a root directory\\nor file that the server can operate on.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"roots\":{\"items\":{\"$ref\":\"#/definitions/Root\"},\"type\":\"array\"}},\"required\":[\"roots\"],\"type\":\"object\"},\"ListToolsRequest\":{\"description\":\"Sent from the client to request a list of tools the server has.\",\"properties\":{\"method\":{\"const\":\"tools/list\",\"type\":\"string\"},\"params\":{\"properties\":{\"cursor\":{\"description\":\"An opaque token representing the current pagination position.\\nIf provided, the server should return results starting after this cursor.\",\"type\":\"string\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ListToolsResult\":{\"description\":\"The server's response to a tools/list request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"nextCursor\":{\"description\":\"An opaque token representing the pagination position after the last returned result.\\nIf present, there may be more results available.\",\"type\":\"string\"},\"tools\":{\"items\":{\"$ref\":\"#/definitions/Tool\"},\"type\":\"array\"}},\"required\":[\"tools\"],\"type\":\"object\"},\"LoggingLevel\":{\"description\":\"The severity of a log message.\\n\\nThese map to syslog message severities, as specified in RFC-5424:\\nhttps://datatracker.ietf.org/doc/html/rfc5424#section-6.2.1\",\"enum\":[\"alert\",\"critical\",\"debug\",\"emergency\",\"error\",\"info\",\"notice\",\"warning\"],\"type\":\"string\"},\"LoggingMessageNotification\":{\"description\":\"Notification of a log message passed from server to client. If no logging/setLevel request has been sent from the client, the server MAY decide which messages to send automatically.\",\"properties\":{\"method\":{\"const\":\"notifications/message\",\"type\":\"string\"},\"params\":{\"properties\":{\"data\":{\"description\":\"The data to be logged, such as a string message or an object. Any JSON serializable type is allowed here.\"},\"level\":{\"$ref\":\"#/definitions/LoggingLevel\",\"description\":\"The severity of this log message.\"},\"logger\":{\"description\":\"An optional name of the logger issuing this message.\",\"type\":\"string\"}},\"required\":[\"data\",\"level\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"ModelHint\":{\"description\":\"Hints to use for model selection.\\n\\nKeys not declared here are currently left unspecified by the spec and are up\\nto the client to interpret.\",\"properties\":{\"name\":{\"description\":\"A hint for a model name.\\n\\nThe client SHOULD treat this as a substring of a model name; for example:\\n - `claude-3-5-sonnet` should match `claude-3-5-sonnet-20241022`\\n - `sonnet` should match `claude-3-5-sonnet-20241022`, `claude-3-sonnet-20240229`, etc.\\n - `claude` should match any Claude model\\n\\nThe client MAY also map the string to a different provider's model name or a different model family, as long as it fills a similar niche; for example:\\n - `gemini-1.5-flash` could match `claude-3-haiku-20240307`\",\"type\":\"string\"}},\"type\":\"object\"},\"ModelPreferences\":{\"description\":\"The server's preferences for model selection, requested of the client during sampling.\\n\\nBecause LLMs can vary along multiple dimensions, choosing the \\\"best\\\" model is\\nrarely straightforward. Different models excel in different areas—some are\\nfaster but less capable, others are more capable but more expensive, and so\\non. This interface allows servers to express their priorities across multiple\\ndimensions to help clients make an appropriate selection for their use case.\\n\\nThese preferences are always advisory. The client MAY ignore them. It is also\\nup to the client to decide how to interpret these preferences and how to\\nbalance them against other considerations.\",\"properties\":{\"costPriority\":{\"description\":\"How much to prioritize cost when selecting a model. A value of 0 means cost\\nis not important, while a value of 1 means cost is the most important\\nfactor.\",\"maximum\":1,\"minimum\":0,\"type\":\"number\"},\"hints\":{\"description\":\"Optional hints to use for model selection.\\n\\nIf multiple hints are specified, the client MUST evaluate them in order\\n(such that the first match is taken).\\n\\nThe client SHOULD prioritize these hints over the numeric priorities, but\\nMAY still use the priorities to select from ambiguous matches.\",\"items\":{\"$ref\":\"#/definitions/ModelHint\"},\"type\":\"array\"},\"intelligencePriority\":{\"description\":\"How much to prioritize intelligence and capabilities when selecting a\\nmodel. A value of 0 means intelligence is not important, while a value of 1\\nmeans intelligence is the most important factor.\",\"maximum\":1,\"minimum\":0,\"type\":\"number\"},\"speedPriority\":{\"description\":\"How much to prioritize sampling speed (latency) when selecting a model. A\\nvalue of 0 means speed is not important, while a value of 1 means speed is\\nthe most important factor.\",\"maximum\":1,\"minimum\":0,\"type\":\"number\"}},\"type\":\"object\"},\"Notification\":{\"properties\":{\"method\":{\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This parameter name is reserved by MCP to allow clients and servers to attach additional metadata to their notifications.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"PaginatedRequest\":{\"properties\":{\"method\":{\"type\":\"string\"},\"params\":{\"properties\":{\"cursor\":{\"description\":\"An opaque token representing the current pagination position.\\nIf provided, the server should return results starting after this cursor.\",\"type\":\"string\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"PaginatedResult\":{\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"nextCursor\":{\"description\":\"An opaque token representing the pagination position after the last returned result.\\nIf present, there may be more results available.\",\"type\":\"string\"}},\"type\":\"object\"},\"PingRequest\":{\"description\":\"A ping, issued by either the server or the client, to check that the other party is still alive. The receiver must promptly respond, or else may be disconnected.\",\"properties\":{\"method\":{\"const\":\"ping\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"properties\":{\"progressToken\":{\"$ref\":\"#/definitions/ProgressToken\",\"description\":\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\"}},\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ProgressNotification\":{\"description\":\"An out-of-band notification used to inform the receiver of a progress update for a long-running request.\",\"properties\":{\"method\":{\"const\":\"notifications/progress\",\"type\":\"string\"},\"params\":{\"properties\":{\"message\":{\"description\":\"An optional message describing the current progress.\",\"type\":\"string\"},\"progress\":{\"description\":\"The progress thus far. This should increase every time progress is made, even if the total is unknown.\",\"type\":\"number\"},\"progressToken\":{\"$ref\":\"#/definitions/ProgressToken\",\"description\":\"The progress token which was given in the initial request, used to associate this notification with the request that is proceeding.\"},\"total\":{\"description\":\"Total number of items to process (or total progress required), if known.\",\"type\":\"number\"}},\"required\":[\"progress\",\"progressToken\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"ProgressToken\":{\"description\":\"A progress token, used to associate progress notifications with the original request.\",\"type\":[\"string\",\"integer\"]},\"Prompt\":{\"description\":\"A prompt or prompt template that the server offers.\",\"properties\":{\"arguments\":{\"description\":\"A list of arguments to use for templating the prompt.\",\"items\":{\"$ref\":\"#/definitions/PromptArgument\"},\"type\":\"array\"},\"description\":{\"description\":\"An optional description of what this prompt provides\",\"type\":\"string\"},\"name\":{\"description\":\"The name of the prompt or prompt template.\",\"type\":\"string\"}},\"required\":[\"name\"],\"type\":\"object\"},\"PromptArgument\":{\"description\":\"Describes an argument that a prompt can accept.\",\"properties\":{\"description\":{\"description\":\"A human-readable description of the argument.\",\"type\":\"string\"},\"name\":{\"description\":\"The name of the argument.\",\"type\":\"string\"},\"required\":{\"description\":\"Whether this argument must be provided.\",\"type\":\"boolean\"}},\"required\":[\"name\"],\"type\":\"object\"},\"PromptListChangedNotification\":{\"description\":\"An optional notification from the server to the client, informing it that the list of prompts it offers has changed. This may be issued by servers without any previous subscription from the client.\",\"properties\":{\"method\":{\"const\":\"notifications/prompts/list_changed\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This parameter name is reserved by MCP to allow clients and servers to attach additional metadata to their notifications.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"PromptMessage\":{\"description\":\"Describes a message returned as part of a prompt.\\n\\nThis is similar to `SamplingMessage`, but also supports the embedding of\\nresources from the MCP server.\",\"properties\":{\"content\":{\"anyOf\":[{\"$ref\":\"#/definitions/TextContent\"},{\"$ref\":\"#/definitions/ImageContent\"},{\"$ref\":\"#/definitions/AudioContent\"},{\"$ref\":\"#/definitions/EmbeddedResource\"}]},\"role\":{\"$ref\":\"#/definitions/Role\"}},\"required\":[\"content\",\"role\"],\"type\":\"object\"},\"PromptReference\":{\"description\":\"Identifies a prompt.\",\"properties\":{\"name\":{\"description\":\"The name of the prompt or prompt template\",\"type\":\"string\"},\"type\":{\"const\":\"ref/prompt\",\"type\":\"string\"}},\"required\":[\"name\",\"type\"],\"type\":\"object\"},\"ReadResourceRequest\":{\"description\":\"Sent from the client to the server, to read a specific resource URI.\",\"properties\":{\"method\":{\"const\":\"resources/read\",\"type\":\"string\"},\"params\":{\"properties\":{\"uri\":{\"description\":\"The URI of the resource to read. The URI can use any protocol; it is up to the server how to interpret it.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"ReadResourceResult\":{\"description\":\"The server's response to a resources/read request from the client.\",\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"},\"contents\":{\"items\":{\"anyOf\":[{\"$ref\":\"#/definitions/TextResourceContents\"},{\"$ref\":\"#/definitions/BlobResourceContents\"}]},\"type\":\"array\"}},\"required\":[\"contents\"],\"type\":\"object\"},\"Request\":{\"properties\":{\"method\":{\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"properties\":{\"progressToken\":{\"$ref\":\"#/definitions/ProgressToken\",\"description\":\"If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.\"}},\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"RequestId\":{\"description\":\"A uniquely identifying ID for a request in JSON-RPC.\",\"type\":[\"string\",\"integer\"]},\"Resource\":{\"description\":\"A known resource that the server is capable of reading.\",\"properties\":{\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"description\":{\"description\":\"A description of what this resource represents.\\n\\nThis can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \\\"hint\\\" to the model.\",\"type\":\"string\"},\"mimeType\":{\"description\":\"The MIME type of this resource, if known.\",\"type\":\"string\"},\"name\":{\"description\":\"A human-readable name for this resource.\\n\\nThis can be used by clients to populate UI elements.\",\"type\":\"string\"},\"size\":{\"description\":\"The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.\\n\\nThis can be used by Hosts to display file sizes and estimate context window usage.\",\"type\":\"integer\"},\"uri\":{\"description\":\"The URI of this resource.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"name\",\"uri\"],\"type\":\"object\"},\"ResourceContents\":{\"description\":\"The contents of a specific resource or sub-resource.\",\"properties\":{\"mimeType\":{\"description\":\"The MIME type of this resource, if known.\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI of this resource.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"},\"ResourceListChangedNotification\":{\"description\":\"An optional notification from the server to the client, informing it that the list of resources it can read from has changed. This may be issued by servers without any previous subscription from the client.\",\"properties\":{\"method\":{\"const\":\"notifications/resources/list_changed\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This parameter name is reserved by MCP to allow clients and servers to attach additional metadata to their notifications.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"ResourceReference\":{\"description\":\"A reference to a resource or resource template definition.\",\"properties\":{\"type\":{\"const\":\"ref/resource\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI or URI template of the resource.\",\"format\":\"uri-template\",\"type\":\"string\"}},\"required\":[\"type\",\"uri\"],\"type\":\"object\"},\"ResourceTemplate\":{\"description\":\"A template description for resources available on the server.\",\"properties\":{\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"description\":{\"description\":\"A description of what this template is for.\\n\\nThis can be used by clients to improve the LLM's understanding of available resources. It can be thought of like a \\\"hint\\\" to the model.\",\"type\":\"string\"},\"mimeType\":{\"description\":\"The MIME type for all resources that match this template. This should only be included if all resources matching this template have the same type.\",\"type\":\"string\"},\"name\":{\"description\":\"A human-readable name for the type of resource this template refers to.\\n\\nThis can be used by clients to populate UI elements.\",\"type\":\"string\"},\"uriTemplate\":{\"description\":\"A URI template (according to RFC 6570) that can be used to construct resource URIs.\",\"format\":\"uri-template\",\"type\":\"string\"}},\"required\":[\"name\",\"uriTemplate\"],\"type\":\"object\"},\"ResourceUpdatedNotification\":{\"description\":\"A notification from the server to the client, informing it that a resource has changed and may need to be read again. This should only be sent if the client previously sent a resources/subscribe request.\",\"properties\":{\"method\":{\"const\":\"notifications/resources/updated\",\"type\":\"string\"},\"params\":{\"properties\":{\"uri\":{\"description\":\"The URI of the resource that has been updated. This might be a sub-resource of the one that the client actually subscribed to.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"Result\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This result property is reserved by the protocol to allow clients and servers to attach additional metadata to their responses.\",\"type\":\"object\"}},\"type\":\"object\"},\"Role\":{\"description\":\"The sender or recipient of messages and data in a conversation.\",\"enum\":[\"assistant\",\"user\"],\"type\":\"string\"},\"Root\":{\"description\":\"Represents a root directory or file that the server can operate on.\",\"properties\":{\"name\":{\"description\":\"An optional name for the root. This can be used to provide a human-readable\\nidentifier for the root, which may be useful for display purposes or for\\nreferencing the root in other parts of the application.\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI identifying the root. This *must* start with file:// for now.\\nThis restriction may be relaxed in future versions of the protocol to allow\\nother URI schemes.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"},\"RootsListChangedNotification\":{\"description\":\"A notification from the client to the server, informing it that the list of roots has changed.\\nThis notification should be sent whenever the client adds, removes, or modifies any root.\\nThe server should then request an updated list of roots using the ListRootsRequest.\",\"properties\":{\"method\":{\"const\":\"notifications/roots/list_changed\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This parameter name is reserved by MCP to allow clients and servers to attach additional metadata to their notifications.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"SamplingMessage\":{\"description\":\"Describes a message issued to or received from an LLM API.\",\"properties\":{\"content\":{\"anyOf\":[{\"$ref\":\"#/definitions/TextContent\"},{\"$ref\":\"#/definitions/ImageContent\"},{\"$ref\":\"#/definitions/AudioContent\"}]},\"role\":{\"$ref\":\"#/definitions/Role\"}},\"required\":[\"content\",\"role\"],\"type\":\"object\"},\"ServerCapabilities\":{\"description\":\"Capabilities that a server may support. Known capabilities are defined here, in this schema, but this is not a closed set: any server can define its own, additional capabilities.\",\"properties\":{\"completions\":{\"additionalProperties\":true,\"description\":\"Present if the server supports argument autocompletion suggestions.\",\"properties\":{},\"type\":\"object\"},\"experimental\":{\"additionalProperties\":{\"additionalProperties\":true,\"properties\":{},\"type\":\"object\"},\"description\":\"Experimental, non-standard capabilities that the server supports.\",\"type\":\"object\"},\"logging\":{\"additionalProperties\":true,\"description\":\"Present if the server supports sending log messages to the client.\",\"properties\":{},\"type\":\"object\"},\"prompts\":{\"description\":\"Present if the server offers any prompt templates.\",\"properties\":{\"listChanged\":{\"description\":\"Whether this server supports notifications for changes to the prompt list.\",\"type\":\"boolean\"}},\"type\":\"object\"},\"resources\":{\"description\":\"Present if the server offers any resources to read.\",\"properties\":{\"listChanged\":{\"description\":\"Whether this server supports notifications for changes to the resource list.\",\"type\":\"boolean\"},\"subscribe\":{\"description\":\"Whether this server supports subscribing to resource updates.\",\"type\":\"boolean\"}},\"type\":\"object\"},\"tools\":{\"description\":\"Present if the server offers any tools to call.\",\"properties\":{\"listChanged\":{\"description\":\"Whether this server supports notifications for changes to the tool list.\",\"type\":\"boolean\"}},\"type\":\"object\"}},\"type\":\"object\"},\"ServerNotification\":{\"anyOf\":[{\"$ref\":\"#/definitions/CancelledNotification\"},{\"$ref\":\"#/definitions/ProgressNotification\"},{\"$ref\":\"#/definitions/ResourceListChangedNotification\"},{\"$ref\":\"#/definitions/ResourceUpdatedNotification\"},{\"$ref\":\"#/definitions/PromptListChangedNotification\"},{\"$ref\":\"#/definitions/ToolListChangedNotification\"},{\"$ref\":\"#/definitions/LoggingMessageNotification\"}]},\"ServerRequest\":{\"anyOf\":[{\"$ref\":\"#/definitions/PingRequest\"},{\"$ref\":\"#/definitions/CreateMessageRequest\"},{\"$ref\":\"#/definitions/ListRootsRequest\"}]},\"ServerResult\":{\"anyOf\":[{\"$ref\":\"#/definitions/Result\"},{\"$ref\":\"#/definitions/InitializeResult\"},{\"$ref\":\"#/definitions/ListResourcesResult\"},{\"$ref\":\"#/definitions/ListResourceTemplatesResult\"},{\"$ref\":\"#/definitions/ReadResourceResult\"},{\"$ref\":\"#/definitions/ListPromptsResult\"},{\"$ref\":\"#/definitions/GetPromptResult\"},{\"$ref\":\"#/definitions/ListToolsResult\"},{\"$ref\":\"#/definitions/CallToolResult\"},{\"$ref\":\"#/definitions/CompleteResult\"}]},\"SetLevelRequest\":{\"description\":\"A request from the client to the server, to enable or adjust logging.\",\"properties\":{\"method\":{\"const\":\"logging/setLevel\",\"type\":\"string\"},\"params\":{\"properties\":{\"level\":{\"$ref\":\"#/definitions/LoggingLevel\",\"description\":\"The level of logging that the client wants to receive from the server. The server should send all logs at this level and higher (i.e., more severe) to the client as notifications/message.\"}},\"required\":[\"level\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"SubscribeRequest\":{\"description\":\"Sent from the client to request resources/updated notifications from the server whenever a particular resource changes.\",\"properties\":{\"method\":{\"const\":\"resources/subscribe\",\"type\":\"string\"},\"params\":{\"properties\":{\"uri\":{\"description\":\"The URI of the resource to subscribe to. The URI can use any protocol; it is up to the server how to interpret it.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"},\"TextContent\":{\"description\":\"Text provided to or from an LLM.\",\"properties\":{\"annotations\":{\"$ref\":\"#/definitions/Annotations\",\"description\":\"Optional annotations for the client.\"},\"text\":{\"description\":\"The text content of the message.\",\"type\":\"string\"},\"type\":{\"const\":\"text\",\"type\":\"string\"}},\"required\":[\"text\",\"type\"],\"type\":\"object\"},\"TextResourceContents\":{\"properties\":{\"mimeType\":{\"description\":\"The MIME type of this resource, if known.\",\"type\":\"string\"},\"text\":{\"description\":\"The text of the item. This must only be set if the item can actually be represented as text (not binary data).\",\"type\":\"string\"},\"uri\":{\"description\":\"The URI of this resource.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"text\",\"uri\"],\"type\":\"object\"},\"Tool\":{\"description\":\"Definition for a tool the client can call.\",\"properties\":{\"annotations\":{\"$ref\":\"#/definitions/ToolAnnotations\",\"description\":\"Optional additional tool information.\"},\"description\":{\"description\":\"A human-readable description of the tool.\\n\\nThis can be used by clients to improve the LLM's understanding of available tools. It can be thought of like a \\\"hint\\\" to the model.\",\"type\":\"string\"},\"inputSchema\":{\"description\":\"A JSON Schema object defining the expected parameters for the tool.\",\"properties\":{\"properties\":{\"additionalProperties\":{\"additionalProperties\":true,\"properties\":{},\"type\":\"object\"},\"type\":\"object\"},\"required\":{\"items\":{\"type\":\"string\"},\"type\":\"array\"},\"type\":{\"const\":\"object\",\"type\":\"string\"}},\"required\":[\"type\"],\"type\":\"object\"},\"name\":{\"description\":\"The name of the tool.\",\"type\":\"string\"}},\"required\":[\"inputSchema\",\"name\"],\"type\":\"object\"},\"ToolAnnotations\":{\"description\":\"Additional properties describing a Tool to clients.\\n\\nNOTE: all properties in ToolAnnotations are **hints**.\\nThey are not guaranteed to provide a faithful description of\\ntool behavior (including descriptive properties like `title`).\\n\\nClients should never make tool use decisions based on ToolAnnotations\\nreceived from untrusted servers.\",\"properties\":{\"destructiveHint\":{\"description\":\"If true, the tool may perform destructive updates to its environment.\\nIf false, the tool performs only additive updates.\\n\\n(This property is meaningful only when `readOnlyHint == false`)\\n\\nDefault: true\",\"type\":\"boolean\"},\"idempotentHint\":{\"description\":\"If true, calling the tool repeatedly with the same arguments\\nwill have no additional effect on the its environment.\\n\\n(This property is meaningful only when `readOnlyHint == false`)\\n\\nDefault: false\",\"type\":\"boolean\"},\"openWorldHint\":{\"description\":\"If true, this tool may interact with an \\\"open world\\\" of external\\nentities. If false, the tool's domain of interaction is closed.\\nFor example, the world of a web search tool is open, whereas that\\nof a memory tool is not.\\n\\nDefault: true\",\"type\":\"boolean\"},\"readOnlyHint\":{\"description\":\"If true, the tool does not modify its environment.\\n\\nDefault: false\",\"type\":\"boolean\"},\"title\":{\"description\":\"A human-readable title for the tool.\",\"type\":\"string\"}},\"type\":\"object\"},\"ToolListChangedNotification\":{\"description\":\"An optional notification from the server to the client, informing it that the list of tools it offers has changed. This may be issued by servers without any previous subscription from the client.\",\"properties\":{\"method\":{\"const\":\"notifications/tools/list_changed\",\"type\":\"string\"},\"params\":{\"additionalProperties\":{},\"properties\":{\"_meta\":{\"additionalProperties\":{},\"description\":\"This parameter name is reserved by MCP to allow clients and servers to attach additional metadata to their notifications.\",\"type\":\"object\"}},\"type\":\"object\"}},\"required\":[\"method\"],\"type\":\"object\"},\"UnsubscribeRequest\":{\"description\":\"Sent from the client to request cancellation of resources/updated notifications from the server. This should follow a previous resources/subscribe request.\",\"properties\":{\"method\":{\"const\":\"resources/unsubscribe\",\"type\":\"string\"},\"params\":{\"properties\":{\"uri\":{\"description\":\"The URI of the resource to unsubscribe from.\",\"format\":\"uri\",\"type\":\"string\"}},\"required\":[\"uri\"],\"type\":\"object\"}},\"required\":[\"method\",\"params\"],\"type\":\"object\"}}};\n",[],[142,380,454],"73414211-194b-46ec-bf32-a8488a268760",["D",1789046880774],[294,295,296,297,298,299,300,301,302,303,304],[142,380],"8f1b9a02-e9f8-41c2-a615-86fc24c53cd4","untestable.ts","785adb18-ad1b-11f1-9f17-1607ee4eb77e","13d18508-400e-4bdc-9c25-c860c1b600e8",140,["D",1789046891997],"/**\n * \"Untestable\" check policy (issue #248).\n *\n * A check whose prerequisite is missing — the server under test lacks a\n * diagnostic fixture tool, rejects the probe that would exercise the\n * requirement, or advertises a feature it does not actually serve — MUST NOT\n * report SKIPPED: SKIPPED is excluded from pass/fail counts, exit codes, and\n * the expected-failures baseline, so the run reads as green and the gap is\n * invisible to anyone burning down a conformance list. Instead the check\n * fails, with an errorMessage that names the missing prerequisite, so the\n * result is red until the prerequisite exists and the scenario can sit in an\n * expected-failures baseline meanwhile (the documented escape hatch).\n *\n * SKIPPED remains correct only for checks that are legitimately not\n * applicable: an optional capability the server never claimed (e.g. a SHOULD\n * check gated on `prompts.listChanged` the server did not declare), or\n * spec-version inapplicability handled by the runner.\n */\n\nimport type { ConformanceCheck, SpecReference } from '../types.ts';\n\n/**\n * Format the errorMessage for a check that could not be exercised. The\n * stable prefix lets reports and dashboards distinguish \"requirement was\n * violated\" from \"requirement could not be verified\" without a new status.\n */\nexport function notTestable(reason: string): string {\n return `Not testable: ${reason}`;\n}\n\n/**\n * Build a failing check for a requirement that could not be exercised\n * because a prerequisite is missing. `severity` follows the spec keyword of\n * the underlying requirement (MUST -> FAILURE, SHOULD -> WARNING), matching\n * what the check could have reported had it run.\n */\nexport function untestableCheck(\n id: string,\n name: string,\n description: string,\n reason: string,\n specReferences: SpecReference[],\n severity: 'FAILURE' | 'WARNING' = 'FAILURE'\n): ConformanceCheck {\n return {\n id,\n name,\n description,\n status: severity,\n timestamp: new Date().toISOString(),\n errorMessage: notTestable(reason),\n specReferences,\n details: { untestable: true, reason }\n };\n}\n",[],[142,474,466],"scenarios","5b897f51-f2cf-482f-9f8d-f602f65b4f34","request-logger.ts","e54e4ca8-ad13-11f1-ad54-1607ee4eb77e",58,["D",1789043638809],"import { Request, Response, NextFunction } from 'npm:express@^5.1.0';\nimport { ConformanceCheck } from '../types.ts';\n\nexport interface LoggerOptions {\n incomingId: string;\n outgoingId: string;\n mcpRoute?: string;\n}\n\nexport function createRequestLogger(\n checks: ConformanceCheck[],\n options: LoggerOptions\n) {\n return (req: Request, res: Response, next: NextFunction) => {\n // Log incoming request\n let requestDescription = `Received ${req.method} request for ${req.path}`;\n const requestDetails: any = {\n method: req.method,\n path: req.path,\n body: req.body\n };\n\n // Add query parameters to details if they exist\n if (Object.keys(req.query).length > 0) {\n requestDetails.query = req.query;\n }\n\n // Extract MCP method if this is the MCP route\n if (\n options.mcpRoute &&\n req.path === options.mcpRoute &&\n req.get('content-type')?.includes('application/json') &&\n req.body &&\n typeof req.body === 'object' &&\n req.body.method\n ) {\n const mcpMethod = req.body.method;\n requestDescription += ` (method: ${mcpMethod})`;\n requestDetails.mcpMethod = mcpMethod;\n }\n\n checks.push({\n id: options.incomingId,\n name:\n options.incomingId.charAt(0).toUpperCase() +\n options.incomingId.slice(1),\n description: requestDescription,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: requestDetails\n });\n\n // Capture response body\n const oldWrite = res.write.bind(res);\n const oldEnd = res.end.bind(res);\n const chunks: (Buffer | string)[] = [];\n\n (res.write as any) = function (chunk: any, ...args: any[]) {\n chunks.push(chunk);\n return oldWrite(chunk, ...args);\n };\n\n (res.end as any) = function (chunk?: any, ...args: any[]) {\n if (chunk) {\n chunks.push(chunk);\n }\n\n const buffers = chunks.map((c) =>\n typeof c === 'string' ? Buffer.from(c) : c\n );\n const body = Buffer.concat(buffers).toString('utf8');\n let responseDescription = `Sent ${res.statusCode} response for ${req.method} ${req.path}`;\n const responseDetails: any = {\n method: req.method,\n path: req.path,\n statusCode: res.statusCode\n };\n\n // Include MCP method in response log if present\n if (requestDetails.mcpMethod) {\n responseDescription += ` (method: ${requestDetails.mcpMethod})`;\n responseDetails.mcpMethod = requestDetails.mcpMethod;\n }\n\n // Add response headers\n const headers = res.getHeaders();\n if (Object.keys(headers).length > 0) {\n responseDetails.headers = headers;\n }\n\n // Add response body if available\n if (body) {\n try {\n responseDetails.body = JSON.parse(body);\n } catch {\n responseDetails.body = body;\n }\n }\n\n checks.push({\n id: options.outgoingId,\n name:\n options.outgoingId.charAt(0).toUpperCase() +\n options.outgoingId.slice(1),\n description: responseDescription,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: responseDetails\n });\n\n return oldEnd(chunk, ...args);\n };\n\n next();\n };\n}\n",[],[142,474,476],"56e64779-9e39-4191-9cfe-5be3c3756464","d3f3dc70-ad13-11f1-8f33-1607ee4eb77e",172,["D",1789153932148],"import {\n Scenario,\n ClientScenario,\n ClientScenarioForAuthorizationServer,\n ScenarioSource,\n SpecVersion,\n DatedSpecVersion,\n ScenarioSpecTag,\n DATED_SPEC_VERSIONS,\n DRAFT_PROTOCOL_VERSION\n} from '../types.ts';\nimport { InitializeScenario } from './client/initialize.ts';\nimport { SkillsNoPrefetchScenario } from './client/skills/no-prefetch.ts';\nimport { SkillsVerificationScenario } from './client/skills/verification.ts';\nimport { ToolsCallScenario } from './client/tools_call.ts';\nimport { ElicitationClientDefaultsScenario } from './client/elicitation-defaults.ts';\nimport { SSERetryScenario } from './client/sse-retry.ts';\nimport { RequestMetadataScenario } from './client/request-metadata.ts';\nimport { MRTRClientScenario } from './client/mrtr-client.ts';\n\n// Import all new server test scenarios\nimport { ServerInitializeScenario } from './server/lifecycle.ts';\nimport { SessionLifecycleScenario } from './server/session-lifecycle.ts';\nimport { ServerStatelessScenario } from './server/stateless.ts';\n\nimport {\n PingScenario,\n LoggingSetLevelScenario,\n CompletionCompleteScenario\n} from './server/utils.ts';\n\nimport {\n ToolsListScenario,\n ToolsCallSimpleTextScenario,\n ToolsCallImageScenario,\n ToolsCallMultipleContentTypesScenario,\n ToolsCallWithLoggingScenario,\n ToolsCallErrorScenario,\n ToolsCallWithProgressScenario,\n ToolsCallSamplingScenario,\n ToolsCallElicitationScenario,\n ToolsCallAudioScenario,\n ToolsCallEmbeddedResourceScenario\n} from './server/tools.ts';\n\nimport { JsonSchema2020_12Scenario } from './server/json-schema-2020-12.ts';\n\nimport { ElicitationDefaultsScenario } from './server/elicitation-defaults.ts';\nimport { ElicitationEnumsScenario } from './server/elicitation-enums.ts';\nimport { ServerSSEPollingScenario } from './server/sse-polling.ts';\nimport { ServerSSEMultipleStreamsScenario } from './server/sse-multiple-streams.ts';\n\nimport {\n ResourcesListScenario,\n ResourcesReadTextScenario,\n ResourcesReadBinaryScenario,\n ResourcesTemplateReadScenario,\n ResourcesSubscribeScenario,\n ResourcesUnsubscribeScenario,\n ResourcesNotFoundErrorScenario\n} from './server/resources.ts';\n\nimport { SkillsDirectoryReadScenario } from './server/skills/directory.ts';\nimport { SkillsEnumerationScenario } from './server/skills/enumeration.ts';\nimport { SkillsManifestScenario } from './server/skills/manifest.ts';\n\nimport {\n PromptsListScenario,\n PromptsGetSimpleScenario,\n PromptsGetWithArgsScenario,\n PromptsGetEmbeddedResourceScenario,\n PromptsGetWithImageScenario\n} from './server/prompts.ts';\n\nimport { DNSRebindingProtectionScenario } from './server/dns-rebinding.ts';\nimport { CachingScenario } from './server/caching.ts';\n\n// InputRequiredResult scenarios from (SEP-2322)\nimport {\n InputRequiredResultBasicElicitationScenario,\n InputRequiredResultBasicSamplingScenario,\n InputRequiredResultBasicListRootsScenario,\n InputRequiredResultRequestStateScenario,\n InputRequiredResultMultipleInputRequestsScenario,\n InputRequiredResultMultiRoundScenario,\n InputRequiredResultMissingInputResponseScenario,\n InputRequiredResultNonToolRequestScenario,\n InputRequiredResultResultTypeScenario,\n InputRequiredResultUnsupportedMethodsScenario,\n InputRequiredResultTamperedStateScenario,\n InputRequiredResultCapabilityCheckScenario,\n InputRequiredResultIgnoreExtraParamsScenario,\n InputRequiredResultValidateInputScenario\n} from './server/input-required-result.ts';\n\nimport { TasksLifecycleScenario } from './server/tasks/lifecycle.ts';\nimport { TasksCapabilityNegotiationScenario } from './server/tasks/capability.ts';\nimport { TasksWireFieldsScenario } from './server/tasks/wire-fields.ts';\nimport { TasksRequestStateRemovalScenario } from './server/tasks/request-state.ts';\nimport { TasksMRTRInputScenario } from './server/tasks/mrtr-input.ts';\nimport { TasksRequestHeadersScenario } from './server/tasks/headers.ts';\nimport { TasksDispatchScenario } from './server/tasks/dispatch.ts';\nimport { TasksStatusNotificationsScenario } from './server/tasks/notifications.ts';\nimport { TasksRequiredTaskErrorScenario } from './server/tasks/required-task-error.ts';\nimport { TasksMrtrCompositionScenario } from './server/tasks/composition.ts';\n\nimport {\n HttpHeaderValidationScenario,\n HttpCustomHeaderServerValidationScenario\n} from './server/http-standard-headers.ts';\n\nimport {\n authScenariosList,\n backcompatScenariosList,\n draftScenariosList,\n extensionScenariosList\n} from './client/auth/index.ts';\nimport { listMetadataScenarios } from './client/auth/discovery-metadata.ts';\nimport { AuthorizationServerMetadataEndpointScenario } from './authorization-server/authorization-server-metadata.ts';\nimport { AuthorizationCodeGrantScenario } from './authorization-server/authorization-code-grant.ts';\n\nimport { HttpStandardHeadersScenario } from './client/http-standard-headers.ts';\nimport {\n HttpCustomHeadersScenario,\n HttpInvalidToolHeadersScenario\n} from './client/http-custom-headers.ts';\nimport { JsonSchemaRefDerefScenario } from './client/json-schema-ref-deref.ts';\nimport { JsonSchema2020_12PreservationScenario } from './client/json-schema-2020-12-preservation.ts';\n\n// Pending client scenarios (not yet fully tested/implemented)\nconst pendingClientScenariosList: ClientScenario[] = [\n // JSON Schema 2020-12 (SEP-1613)\n // This test is pending until the SDK includes PR #1135 which preserves\n // $schema, $defs, and additionalProperties fields in tool schemas.\n new JsonSchema2020_12Scenario(),\n\n // On hold until server-side SSE improvements are made\n // https://github.com/modelcontextprotocol/typescript-sdk/pull/1129\n new ServerSSEPollingScenario(),\n\n // HTTP Standardization (SEP-2243)\n // Pending until the everything-server fully implements SEP-2243\n // header validation (case-insensitive names, whitespace trimming, -32020 error code)\n new HttpHeaderValidationScenario(),\n new HttpCustomHeaderServerValidationScenario(),\n\n // SEP-2663 Tasks extension. Pending because the everything-server\n // does not implement io.modelcontextprotocol/tasks; targeted runs\n // point at a SEP-2663-conformant fixture via\n // `npm start -- server --scenario tasks-* --url `.\n new TasksLifecycleScenario(),\n new TasksCapabilityNegotiationScenario(),\n new TasksWireFieldsScenario(),\n new TasksRequestStateRemovalScenario(),\n new TasksMRTRInputScenario(),\n new TasksRequestHeadersScenario(),\n new TasksDispatchScenario(),\n new TasksStatusNotificationsScenario(),\n new TasksRequiredTaskErrorScenario(),\n new TasksMrtrCompositionScenario(),\n\n // SEP-2640 Skills extension. Pending because the everything-server does not\n // implement io.modelcontextprotocol/skills; targeted runs point at a\n // SEP-2640-conformant fixture via\n // `npm start -- server --scenario sep-2640-skills-* --url `.\n new SkillsDirectoryReadScenario(),\n new SkillsEnumerationScenario(),\n new SkillsManifestScenario()\n];\n\n// All client scenarios\nconst allClientScenariosList: ClientScenario[] = [\n // Lifecycle scenarios\n new ServerInitializeScenario(),\n new SessionLifecycleScenario(),\n new ServerStatelessScenario(),\n\n // Utilities scenarios\n new LoggingSetLevelScenario(),\n new PingScenario(),\n new CompletionCompleteScenario(),\n\n // Tools scenarios\n new ToolsListScenario(),\n new ToolsCallSimpleTextScenario(),\n new ToolsCallImageScenario(),\n new ToolsCallAudioScenario(),\n new ToolsCallEmbeddedResourceScenario(),\n new ToolsCallMultipleContentTypesScenario(),\n new ToolsCallWithLoggingScenario(),\n new ToolsCallErrorScenario(),\n new ToolsCallWithProgressScenario(),\n new ToolsCallSamplingScenario(),\n new ToolsCallElicitationScenario(),\n\n // JSON Schema 2020-12 support (SEP-1613)\n new JsonSchema2020_12Scenario(),\n\n // Elicitation scenarios (SEP-1034)\n new ElicitationDefaultsScenario(),\n\n // SSE Polling scenarios (SEP-1699)\n new ServerSSEPollingScenario(),\n new ServerSSEMultipleStreamsScenario(),\n\n // Elicitation scenarios (SEP-1330) - pending\n new ElicitationEnumsScenario(),\n\n // Resources scenarios\n new ResourcesListScenario(),\n new ResourcesReadTextScenario(),\n new ResourcesReadBinaryScenario(),\n new ResourcesTemplateReadScenario(),\n new ResourcesSubscribeScenario(),\n new ResourcesUnsubscribeScenario(),\n\n // Resources error handling (SEP-2164)\n new ResourcesNotFoundErrorScenario(),\n\n // Skills extension (SEP-2640). Fixture-dependent (needs a SEP-2640 server);\n // each scenario SKIPs cleanly when the extension is not declared.\n new SkillsDirectoryReadScenario(),\n new SkillsEnumerationScenario(),\n new SkillsManifestScenario(),\n\n // Prompts scenarios\n new PromptsListScenario(),\n new PromptsGetSimpleScenario(),\n new PromptsGetWithArgsScenario(),\n new PromptsGetEmbeddedResourceScenario(),\n new PromptsGetWithImageScenario(),\n\n // Security scenarios\n new DNSRebindingProtectionScenario(),\n\n // Caching scenarios (SEP-2549)\n new CachingScenario(),\n // HTTP Standardization scenarios (SEP-2243)\n new HttpHeaderValidationScenario(),\n new HttpCustomHeaderServerValidationScenario(),\n\n // SEP-2663 Tasks extension. Pending against the everything-server;\n // targeted runs point at a SEP-2663-conformant fixture.\n new TasksLifecycleScenario(),\n new TasksCapabilityNegotiationScenario(),\n new TasksWireFieldsScenario(),\n new TasksRequestStateRemovalScenario(),\n new TasksMRTRInputScenario(),\n new TasksRequestHeadersScenario(),\n new TasksDispatchScenario(),\n new TasksStatusNotificationsScenario(),\n new TasksRequiredTaskErrorScenario(),\n new TasksMrtrCompositionScenario(),\n\n // InputRequiredResult scenarios (SEP-2322)\n new InputRequiredResultBasicElicitationScenario(),\n new InputRequiredResultBasicSamplingScenario(),\n new InputRequiredResultBasicListRootsScenario(),\n new InputRequiredResultRequestStateScenario(),\n new InputRequiredResultMultipleInputRequestsScenario(),\n new InputRequiredResultMultiRoundScenario(),\n new InputRequiredResultMissingInputResponseScenario(),\n new InputRequiredResultNonToolRequestScenario(),\n new InputRequiredResultResultTypeScenario(),\n new InputRequiredResultUnsupportedMethodsScenario(),\n new InputRequiredResultTamperedStateScenario(),\n new InputRequiredResultCapabilityCheckScenario(),\n new InputRequiredResultIgnoreExtraParamsScenario(),\n new InputRequiredResultValidateInputScenario()\n];\n\n// Scenarios that test requirements introduced in the in-progress draft spec.\n// They run via `--suite draft` (or `--suite all`) and are excluded from the\n// default `active` suite until the draft is published as a dated release.\nconst draftClientScenariosList: ClientScenario[] =\n allClientScenariosList.filter(\n (scenario) =>\n 'introducedIn' in scenario.source &&\n scenario.source.introducedIn === DRAFT_PROTOCOL_VERSION\n );\n\n// Active client scenarios (excludes pending and draft)\nconst activeClientScenariosList: ClientScenario[] =\n allClientScenariosList.filter(\n (scenario) =>\n !pendingClientScenariosList.some(\n (pending) => pending.name === scenario.name\n ) &&\n !draftClientScenariosList.some((draft) => draft.name === scenario.name)\n );\n\n// Client scenarios map - built from list\nexport const clientScenarios = new Map(\n allClientScenariosList.map((scenario) => [scenario.name, scenario])\n);\n\n// All client scenarios for authorization server\nconst allClientScenariosListForAuthorizationServer: ClientScenarioForAuthorizationServer[] =\n [\n // Authorization server scenarios\n new AuthorizationServerMetadataEndpointScenario(),\n new AuthorizationCodeGrantScenario()\n ];\n\n// Client scenarios map for authorization server - built from list\nexport const clientScenariosForAuthorizationServer = new Map<\n string,\n ClientScenarioForAuthorizationServer\n>(\n allClientScenariosListForAuthorizationServer.map((scenario) => [\n scenario.name,\n scenario\n ])\n);\n\n// All client test scenarios (core + backcompat + extensions)\nconst scenariosList: Scenario[] = [\n new InitializeScenario(),\n new ToolsCallScenario(),\n new ElicitationClientDefaultsScenario(),\n new SSERetryScenario(),\n new RequestMetadataScenario(),\n ...authScenariosList,\n ...backcompatScenariosList,\n ...draftScenariosList,\n ...extensionScenariosList,\n\n // MRTR client conformance (SEP-2322)\n new MRTRClientScenario(),\n\n // HTTP Standardization scenarios (SEP-2243)\n new HttpStandardHeadersScenario(),\n new HttpCustomHeadersScenario(),\n new HttpInvalidToolHeadersScenario(),\n\n // JSON Schema network $ref dereferencing (SEP-2106)\n new JsonSchemaRefDerefScenario(),\n\n // JSON Schema 2020-12 client-side keyword preservation (SEP-1613, SEP-2106)\n new JsonSchema2020_12PreservationScenario(),\n\n // SEP-2640 skills, client side. The harness is the server and grades what\n // the client requests, which is how the retrieval-policy MUSTs become\n // observable at all.\n new SkillsNoPrefetchScenario(),\n new SkillsVerificationScenario('digest'),\n new SkillsVerificationScenario('size'),\n new SkillsVerificationScenario('frontmatter')\n];\n\n// Core scenarios (tier 1 requirements)\nconst coreScenariosList: Scenario[] = [\n new InitializeScenario(),\n new ToolsCallScenario(),\n new ElicitationClientDefaultsScenario(),\n new SSERetryScenario(),\n ...authScenariosList\n];\n\n// Scenarios map - built from list\nexport const scenarios = new Map(\n scenariosList.map((scenario) => [scenario.name, scenario])\n);\n\nexport function registerScenario(name: string, scenario: Scenario): void {\n scenarios.set(name, scenario);\n}\n\nexport function getScenario(name: string): Scenario | undefined {\n return scenarios.get(name);\n}\n\nexport function getClientScenario(name: string): ClientScenario | undefined {\n return clientScenarios.get(name);\n}\n\nexport function getClientScenarioForAuthorizationServer(\n name: string\n): ClientScenarioForAuthorizationServer | undefined {\n return clientScenariosForAuthorizationServer.get(name);\n}\n\nexport function listScenarios(): string[] {\n return Array.from(scenarios.keys());\n}\n\nexport function listClientScenarios(): string[] {\n return Array.from(clientScenarios.keys());\n}\n\nexport function listActiveClientScenarios(): string[] {\n return activeClientScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listPendingClientScenarios(): string[] {\n return pendingClientScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listAuthScenarios(): string[] {\n return authScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listCoreScenarios(): string[] {\n return coreScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listExtensionScenarios(): string[] {\n return extensionScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listBackcompatScenarios(): string[] {\n return backcompatScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listClientScenariosForAuthorizationServer(): string[] {\n return Array.from(clientScenariosForAuthorizationServer.keys());\n}\n\n// All client-testing scenarios that target the draft spec, derived from the\n// declared `source.introducedIn` rather than a hand-maintained list (covers\n// both the auth draft scenarios and the non-auth ones, e.g. SEP-2243/2575).\nconst draftSpecScenariosList: Scenario[] = scenariosList.filter(\n (scenario) =>\n 'introducedIn' in scenario.source &&\n scenario.source.introducedIn === DRAFT_PROTOCOL_VERSION\n);\n\nexport function listDraftScenarios(): string[] {\n return draftSpecScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listDraftClientScenarios(): string[] {\n return draftClientScenariosList.map((scenario) => scenario.name);\n}\n\nexport { listMetadataScenarios };\n\n// All valid spec versions, used by the CLI to validate --spec-version input.\n// 'extension' is intentionally excluded — extension scenarios are off-timeline\n// and selected via `--suite extensions`, not `--spec-version`.\nexport const ALL_SPEC_VERSIONS: SpecVersion[] = [\n ...DATED_SPEC_VERSIONS,\n DRAFT_PROTOCOL_VERSION\n];\n\nexport function resolveSpecVersion(value: string): SpecVersion {\n if (value === 'draft') return DRAFT_PROTOCOL_VERSION;\n if (ALL_SPEC_VERSIONS.includes(value as SpecVersion)) {\n return value as SpecVersion;\n }\n console.error(`Unknown spec version: ${value}`);\n console.error(\n `Valid versions: ${ALL_SPEC_VERSIONS.join(', ')} (or 'draft' as an alias for ${DRAFT_PROTOCOL_VERSION})`\n );\n process.exit(1);\n}\n\nfunction versionIndex(\n v: DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION\n): number {\n return ALL_SPEC_VERSIONS.indexOf(v);\n}\n\n// Off-timeline sources (extensions etc.) are never selected by --spec-version.\nexport function matchesSpecVersion(\n source: ScenarioSource,\n version: SpecVersion\n): boolean {\n if ('extensionId' in source) return false;\n return (\n versionIndex(source.introducedIn) <= versionIndex(version) &&\n (source.removedIn === undefined ||\n versionIndex(version) < versionIndex(source.removedIn))\n );\n}\n\n/**\n * Whether a scenario's applicability window covers `version`. Used by the\n * runner to skip explicitly-requested scenario/spec-version combinations\n * that contradict (e.g. a draft-only scenario at a dated spec version).\n */\nexport function isScenarioApplicableAt(\n source: ScenarioSource,\n version: SpecVersion\n): boolean {\n return matchesSpecVersion(source, version);\n}\n\nexport function listScenariosForSpec(version: SpecVersion): string[] {\n return scenariosList\n .filter((s) => matchesSpecVersion(s.source, version))\n .map((s) => s.name);\n}\n\nexport function listClientScenariosForSpec(version: SpecVersion): string[] {\n return allClientScenariosList\n .filter((s) => matchesSpecVersion(s.source, version))\n .map((s) => s.name);\n}\n\nexport function listClientScenariosForAuthorizationServerForSpec(\n version: SpecVersion\n): string[] {\n return allClientScenariosListForAuthorizationServer\n .filter((s) => matchesSpecVersion(s.source, version))\n .map((s) => s.name);\n}\n\nexport function getScenarioSpecVersions(\n name: string\n): ScenarioSpecTag[] | undefined {\n const s =\n scenarios.get(name) ??\n clientScenarios.get(name) ??\n clientScenariosForAuthorizationServer.get(name);\n if (!s) return undefined;\n if ('extensionId' in s.source) return ['extension'];\n const result: ScenarioSpecTag[] = [];\n for (const v of ALL_SPEC_VERSIONS) {\n if (matchesSpecVersion(s.source, v)) result.push(v);\n }\n return result;\n}\n\nexport type { SpecVersion, ScenarioSpecTag };\n",[],[142,474,357],"63dc3487-74d6-4b0b-84f8-96d520abfc62","utils.ts","db81afe4-ad13-11f1-a25b-1607ee4eb77e","ba69bf07-8a57-469b-9cb9-0369b79d16d1",102,["D",1789046872572],"/**\n * Utilities test scenarios for MCP servers\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport type { RunContext } from '../../connection/index.ts';\nimport type { CompleteResult, EmptyResult } from '../../spec-types/2025-06-18.ts';\n\nexport class LoggingSetLevelScenario implements ClientScenario {\n name = 'logging-set-level';\n readonly source = {\n introducedIn: '2025-06-18',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = `Test setting logging level.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`logging/setLevel\\`\n\n**Requirements**:\n- Accept log level setting\n- Filter subsequent log notifications based on level\n- Return empty object \\`{}\\`\n\n**Log Levels** (in order of severity):\n- \\`debug\\`\n- \\`info\\`\n- \\`notice\\`\n- \\`warning\\`\n- \\`error\\`\n- \\`critical\\`\n- \\`alert\\`\n- \\`emergency\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n // Send logging/setLevel request\n const result = await conn.request('logging/setLevel', {\n level: 'info'\n });\n\n // Validate response (should return empty object {})\n const errors: string[] = [];\n if (result && Object.keys(result).length > 0) {\n errors.push('Expected empty object {} response');\n }\n\n checks.push({\n id: 'logging-set-level',\n name: 'LoggingSetLevel',\n description: 'Server accepts logging level setting',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Logging',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/logging'\n }\n ],\n details: {\n result\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'logging-set-level',\n name: 'LoggingSetLevel',\n description: 'Server accepts logging level setting',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Logging',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/logging'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class PingScenario implements ClientScenario {\n name = 'ping';\n readonly source = {\n introducedIn: '2025-06-18',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = `Test ping utility for connection health check.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`ping\\`\n\n**Requirements**:\n- Accept ping request with no parameters\n- Respond promptly with empty object \\`{}\\`\n\n**Request Format**:\n\n\\`\\`\\`json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": \"123\",\n \"method\": \"ping\"\n}\n\\`\\`\\`\n\n**Response Format**:\n\n\\`\\`\\`json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": \"123\",\n \"result\": {}\n}\n\\`\\`\\`\n\n**Implementation Note**: The ping utility allows either party to verify that their counterpart is still responsive and the connection is alive.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n // Send ping request\n const result = await conn.request('ping');\n\n // Validate response (should return empty object {})\n const errors: string[] = [];\n if (result && Object.keys(result).length > 0) {\n errors.push('Expected empty object {} response');\n }\n\n checks.push({\n id: 'ping',\n name: 'Ping',\n description: 'Server responds to ping requests',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Ping',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/ping'\n }\n ],\n details: {\n result\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'ping',\n name: 'Ping',\n description: 'Server responds to ping requests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Ping',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/ping'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class CompletionCompleteScenario implements ClientScenario {\n name = 'completion-complete';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test completion endpoint.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`completion/complete\\`\n\n**Requirements**:\n- Accept completion requests for prompt or resource template arguments\n- Provide contextual suggestions based on partial input\n- Return array of completion values ranked by relevance\n\n**Request Format**:\n\n\\`\\`\\`json\n{\n \"method\": \"completion/complete\",\n \"params\": {\n \"ref\": {\n \"type\": \"ref/prompt\",\n \"name\": \"test_prompt_with_arguments\"\n },\n \"argument\": {\n \"name\": \"arg1\",\n \"value\": \"par\"\n }\n }\n}\n\\`\\`\\`\n\n**Response Format**:\n\n\\`\\`\\`json\n{\n \"completion\": {\n \"values\": [\"paris\", \"park\", \"party\"],\n \"total\": 150,\n \"hasMore\": false\n }\n}\n\\`\\`\\`\n\n**Implementation Note**: For conformance testing, completion support can be minimal or return empty arrays. The capability just needs to be declared and the endpoint must respond correctly.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n // Send completion/complete request\n const result = await conn.request('completion/complete', {\n ref: {\n type: 'ref/prompt',\n name: 'test_prompt_with_arguments'\n },\n argument: {\n name: 'arg1',\n value: 'test'\n }\n });\n\n // Validate response structure\n const errors: string[] = [];\n if (!result.completion) {\n errors.push('Missing completion field');\n } else {\n if (!result.completion.values)\n errors.push('Missing values array in completion');\n if (!Array.isArray(result.completion.values))\n errors.push('completion.values is not an array');\n }\n\n checks.push({\n id: 'completion-complete',\n name: 'CompletionComplete',\n description: 'Server responds to completion requests',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Completion',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/completion'\n }\n ],\n details: {\n result\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'completion-complete',\n name: 'CompletionComplete',\n description: 'Server responds to completion requests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Completion',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/completion'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,499,491],"server","b947859d-5de7-4488-92ef-39d23f6c6997","tools.ts","db1d9f18-ad13-11f1-8a3f-1607ee4eb77e",101,["D",1789046872269],"/**\n * Tools test scenarios for MCP servers\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION,\n specVersionAtLeast,\n type SpecVersion\n} from '../../types.ts';\nimport type { RunContext } from '../../connection/index.ts';\nimport { notTestable, untestableCheck } from '../untestable.ts';\nimport type {\n ListToolsResult,\n CallToolResult\n} from '../../spec-types/2025-06-18.ts';\nimport {\n connectToServer,\n NotificationCollector\n} from '../../connection/sdk-client.ts';\nimport {\n CreateMessageRequestSchema,\n ElicitRequestSchema\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\n\n/**\n * Tool name rules per the 2025-11-25 spec prose (#tool-names): 1–128 chars of\n * [A-Za-z0-9_.-]. (The SEP-986 markdown still shows the older 64-char / `/`\n * rules; the published spec is authoritative.)\n */\nconst TOOL_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;\nconst TOOL_NAME_MAX_LENGTH = 128;\n\nconst TOOLS_NAME_FORMAT_SPEC_REFS = [\n {\n id: 'MCP-Tool-Names',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/server/tools#tool-names'\n },\n {\n id: 'MCP-Tool-Names-Draft',\n url: 'https://modelcontextprotocol.io/specification/draft/server/tools#tool-names'\n },\n // Background only; the dated spec above is the rule source.\n {\n id: 'SEP-986-History',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/986'\n },\n {\n id: 'SEP-986-Spec-Integration',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1603'\n }\n];\n\n/** The Tool Names rules first appear in the 2025-11-25 revision. */\nexport function toolNameFormatCheckApplies(specVersion: SpecVersion): boolean {\n return specVersionAtLeast(specVersion, '2025-11-25');\n}\n\nexport function validateToolNameFormat(name: string): string | null {\n if (name.length < 1 || name.length > TOOL_NAME_MAX_LENGTH) {\n return `length ${name.length} is outside 1-${TOOL_NAME_MAX_LENGTH}`;\n }\n if (!TOOL_NAME_PATTERN.test(name)) {\n return 'contains characters outside [A-Za-z0-9_.-]';\n }\n return null;\n}\n\nexport function buildToolsNameFormatCheck(\n tools: ReadonlyArray<{ name?: unknown }> | undefined\n): ConformanceCheck {\n const timestamp = new Date().toISOString();\n const baseCheck = {\n id: 'tools-name-format',\n name: 'ToolsNameFormat',\n description:\n 'Tool names SHOULD be 1-128 characters and match ^[A-Za-z0-9_.-]+$',\n specReferences: TOOLS_NAME_FORMAT_SPEC_REFS,\n timestamp\n };\n\n if (!Array.isArray(tools) || tools.length === 0) {\n return {\n ...baseCheck,\n status: 'INFO',\n errorMessage: 'No tools advertised; nothing to validate',\n details: { toolCount: 0 }\n };\n }\n\n const toolResults: Record = {};\n const violations: string[] = [];\n\n tools.forEach((tool, index) => {\n const name = typeof tool.name === 'string' ? tool.name : '';\n const key = name || ``;\n const reason =\n typeof tool.name === 'string'\n ? validateToolNameFormat(tool.name)\n : 'name is not a string';\n if (reason) {\n toolResults[key] = `invalid: ${reason}`;\n violations.push(`${key}: ${reason}`);\n } else {\n toolResults[key] = 'valid';\n }\n });\n\n return {\n ...baseCheck,\n status: violations.length === 0 ? 'SUCCESS' : 'WARNING',\n errorMessage:\n violations.length > 0\n ? `${violations.length} tool name(s) violate spec Tool Names SHOULD rules: ${violations.join('; ')}`\n : undefined,\n details: {\n toolCount: tools.length,\n results: toolResults\n }\n };\n}\n\n/** How many consecutive tools/list snapshots the ordering check compares. */\nconst TOOLS_LIST_ORDER_PROBES = 3;\n\nconst TOOLS_LIST_ORDER_SPEC_REFS = [\n {\n id: 'MCP-Tools-Deterministic-Order',\n url: 'https://modelcontextprotocol.io/specification/2026-07-28/server/tools#capabilities'\n }\n];\n\n/**\n * Build the tools-list-deterministic-order check from consecutive tools/list\n * snapshots.\n *\n * 2026-07-28 server/tools.mdx: \"Servers SHOULD return tools in a deterministic\n * order (i.e., the same ordering across requests when the underlying set of\n * tools has not changed).\" SHOULD, so a violation is WARNING.\n *\n * The spec scopes the SHOULD to an unchanged set, so a set that differs\n * between probes is reported as untestable (issue #248) rather than as a\n * violation: from the outside, a sample cannot tell a nondeterministic server\n * from one whose tools legitimately changed between two requests.\n */\nexport function buildToolsListDeterministicOrderCheck(\n snapshots: ReadonlyArray | undefined>\n): ConformanceCheck {\n const timestamp = new Date().toISOString();\n const baseCheck = {\n id: 'tools-list-deterministic-order',\n name: 'ToolsListDeterministicOrder',\n description:\n 'Consecutive tools/list requests return the same tools in the same order',\n specReferences: TOOLS_LIST_ORDER_SPEC_REFS,\n source: { introducedIn: '2026-07-28' as const },\n timestamp\n };\n const untestable = (reason: string): ConformanceCheck => ({\n ...baseCheck,\n status: 'WARNING',\n errorMessage: notTestable(reason),\n details: { untestable: true, reason, probes: snapshots.length }\n });\n\n if (snapshots.length < 2) {\n return untestable(\n `needs at least two tools/list snapshots to compare, got ${snapshots.length}`\n );\n }\n const missing = snapshots.findIndex((tools) => !Array.isArray(tools));\n if (missing !== -1) {\n return untestable(\n `tools/list probe ${missing + 1} did not return a tools array`\n );\n }\n\n // A position-independent placeholder, so that a nameless tool moving\n // around reads as an order change rather than as a set change.\n const orders = snapshots.map((tools) =>\n (tools as ReadonlyArray<{ name?: unknown }>).map((tool) =>\n typeof tool.name === 'string' ? tool.name : ''\n )\n );\n\n // Nothing to order when no probe saw two tools.\n if (orders.every((order) => order.length < 2)) {\n return {\n ...baseCheck,\n status: 'INFO',\n errorMessage: `${orders[0].length} tool(s) advertised; nothing to compare`,\n details: { toolCount: orders[0].length, probes: orders.length, orders }\n };\n }\n\n // The SHOULD only binds while the set is unchanged: compare multisets first.\n const countNames = (names: string[]): Map => {\n const counts = new Map();\n for (const name of names) counts.set(name, (counts.get(name) ?? 0) + 1);\n return counts;\n };\n const baseline = countNames(orders[0]);\n for (let probe = 1; probe < orders.length; probe++) {\n const current = countNames(orders[probe]);\n const added: string[] = [];\n const removed: string[] = [];\n for (const [name, count] of current) {\n const before = baseline.get(name) ?? 0;\n if (count > before) added.push(name);\n }\n for (const [name, count] of baseline) {\n const now = current.get(name) ?? 0;\n if (count > now) removed.push(name);\n }\n if (added.length > 0 || removed.length > 0) {\n return untestable(\n `the set of tools changed between tools/list probe 1 and probe ${probe + 1} ` +\n `(added: ${added.join(', ') || 'none'}; removed: ${removed.join(', ') || 'none'}), ` +\n 'so the deterministic-order SHOULD does not apply to this sample'\n );\n }\n }\n\n const toolCount = orders[0].length;\n\n for (let probe = 1; probe < orders.length; probe++) {\n const index = orders[probe].findIndex((name, i) => name !== orders[0][i]);\n if (index !== -1) {\n return {\n ...baseCheck,\n status: 'WARNING',\n errorMessage:\n `tools/list returned the same ${toolCount} tools in a different order across ` +\n `consecutive requests: probe ${probe + 1} diverges from probe 1 at index ${index} ` +\n `(${orders[0][index]} vs ${orders[probe][index]})`,\n details: { toolCount, probes: orders.length, orders }\n };\n }\n }\n\n return {\n ...baseCheck,\n status: 'SUCCESS',\n details: { toolCount, probes: orders.length, orders }\n };\n}\n\nexport class ToolsListScenario implements ClientScenario {\n name = 'tools-list';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test listing available tools.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`tools/list\\`\n\n**Requirements**:\n- Return array of all available tools\n- Each tool MUST have:\n - \\`name\\` (string)\n - \\`description\\` (string)\n - \\`inputSchema\\` (valid JSON Schema object)\n- From 2025-11-25 onward, advertised \\`name\\` values SHOULD follow the spec Tool Names rules (1–128 chars, \\`[A-Za-z0-9_.-]\\` only) — see \\`tools-name-format\\` check\n- From 2026-07-28: return tools in a deterministic order across requests\n when the set of tools has not changed (SHOULD)`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('tools/list');\n\n // Validate response structure\n const errors: string[] = [];\n if (!result.tools) {\n errors.push('Missing tools array');\n } else {\n if (!Array.isArray(result.tools)) {\n errors.push('tools is not an array');\n }\n\n result.tools.forEach((tool, index) => {\n if (!tool.name) errors.push(`Tool ${index}: missing name`);\n if (!tool.description)\n errors.push(`Tool ${index}: missing description`);\n if (!tool.inputSchema)\n errors.push(`Tool ${index}: missing inputSchema`);\n });\n }\n\n checks.push({\n id: 'tools-list',\n name: 'ToolsList',\n description: 'Server lists available tools with valid structure',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#listing-tools'\n }\n ],\n details: {\n toolCount: result.tools?.length || 0,\n tools: result.tools?.map((t) => t.name)\n }\n });\n\n if (toolNameFormatCheckApplies(ctx.specVersion)) {\n checks.push(buildToolsNameFormatCheck(result.tools));\n }\n\n // 2026-07-28: tools SHOULD come back in a deterministic order across\n // requests. Take two more consecutive tools/list snapshots and compare.\n if (specVersionAtLeast(ctx.specVersion, '2026-07-28')) {\n const snapshots: Array = [\n result.tools\n ];\n let probeError: unknown;\n try {\n while (snapshots.length < TOOLS_LIST_ORDER_PROBES) {\n const again = await conn.request('tools/list');\n snapshots.push(again.tools);\n }\n } catch (error) {\n probeError = error;\n }\n checks.push(\n probeError === undefined\n ? buildToolsListDeterministicOrderCheck(snapshots)\n : {\n ...untestableCheck(\n 'tools-list-deterministic-order',\n 'ToolsListDeterministicOrder',\n 'Consecutive tools/list requests return the same tools in the same order',\n `repeated tools/list request failed: ${probeError instanceof Error ? probeError.message : String(probeError)}`,\n TOOLS_LIST_ORDER_SPEC_REFS,\n 'WARNING'\n ),\n source: { introducedIn: '2026-07-28' }\n }\n );\n }\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'tools-list',\n name: 'ToolsList',\n description: 'Server lists available tools with valid structure',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#listing-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallSimpleTextScenario implements ClientScenario {\n name = 'tools-call-simple-text';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test calling a tool that returns simple text.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_simple_text\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"This is a simple text response for testing.\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('tools/call', {\n name: 'test_simple_text'\n /* omit arguments as it is not required in the schema */\n });\n\n // Validate response\n const errors: string[] = [];\n const content = (result as any).content;\n if (!content) errors.push('Missing content array');\n if (!Array.isArray(content)) errors.push('content is not an array');\n if (content && content.length === 0)\n errors.push('content array is empty');\n\n const textContent =\n content && content.find((c: any) => c.type === 'text');\n if (!textContent) errors.push('No text content found');\n if (textContent && !textContent.text)\n errors.push('Text content missing text field');\n\n checks.push({\n id: 'tools-call-simple-text',\n name: 'ToolsCallSimpleText',\n description: 'Tool returns simple text content',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ],\n details: {\n result\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-simple-text',\n name: 'ToolsCallSimpleText',\n description: 'Tool returns simple text content',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallImageScenario implements ClientScenario {\n name = 'tools-call-image';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test calling a tool that returns image content.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_image_content\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"image\",\n \"data\": \"\",\n \"mimeType\": \"image/png\"\n }\n ]\n}\n\\`\\`\\`\n\n**Implementation Note**: Use a minimal test image (e.g., 1x1 red pixel PNG)`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('tools/call', {\n name: 'test_image_content',\n arguments: {}\n });\n\n // Validate response\n const errors: string[] = [];\n const content = (result as any).content;\n if (!content) errors.push('Missing content array');\n\n const imageContent =\n content && content.find((c: any) => c.type === 'image');\n if (!imageContent) errors.push('No image content found');\n if (imageContent && !imageContent.data)\n errors.push('Image content missing data field');\n if (imageContent && !imageContent.mimeType)\n errors.push('Image content missing mimeType');\n\n checks.push({\n id: 'tools-call-image',\n name: 'ToolsCallImage',\n description: 'Tool returns image content',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ],\n details: {\n mimeType: imageContent?.mimeType,\n hasData: !!imageContent?.data\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-image',\n name: 'ToolsCallImage',\n description: 'Tool returns image content',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallMultipleContentTypesScenario implements ClientScenario {\n name = 'tools-call-mixed-content';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test tool returning multiple content types.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_multiple_content_types\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"Multiple content types test:\"\n },\n {\n \"type\": \"image\",\n \"data\": \"\",\n \"mimeType\": \"image/png\"\n },\n {\n \"type\": \"resource\",\n \"resource\": {\n \"uri\": \"test://mixed-content-resource\",\n \"mimeType\": \"application/json\",\n \"text\": \"{\"test\":\"data\",\"value\":123}\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('tools/call', {\n name: 'test_multiple_content_types',\n arguments: {}\n });\n\n // Validate response\n const errors: string[] = [];\n const content = (result as any).content;\n if (!content) errors.push('Missing content array');\n if (content && content.length < 2)\n errors.push('Expected multiple content items');\n\n const hasText = content && content.some((c: any) => c.type === 'text');\n const hasImage = content && content.some((c: any) => c.type === 'image');\n const hasResource =\n content && content.some((c: any) => c.type === 'resource');\n\n if (!hasText) errors.push('Missing text content');\n if (!hasImage) errors.push('Missing image content');\n if (!hasResource) errors.push('Missing resource content');\n\n checks.push({\n id: 'tools-call-mixed-content',\n name: 'ToolsCallMixedContent',\n description: 'Tool returns multiple content types',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ],\n details: {\n contentCount: content ? content.length : 0,\n contentTypes: content ? content.map((c: any) => c.type) : []\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-mixed-content',\n name: 'ToolsCallMixedContent',\n description: 'Tool returns multiple content types',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallWithLoggingScenario implements ClientScenario {\n name = 'tools-call-with-logging';\n readonly source = {\n introducedIn: '2025-06-18',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = `Test tool that sends log messages during execution.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_tool_with_logging\\` with no arguments.\n\n**Behavior**: During execution, send 3 log notifications at info level:\n1. \"Tool execution started\"\n2. \"Tool processing data\" (after ~50ms delay)\n3. \"Tool execution completed\" (after another ~50ms delay)\n\n**Returns**: Text content confirming execution\n\n**Implementation Note**: The delays are important to test that clients can receive multiple log notifications during tool execution`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl, {}, ctx.specVersion);\n const notifications = new NotificationCollector(connection.client);\n\n // Set logging level to debug\n await connection.client.setLoggingLevel('debug');\n\n await connection.client.callTool({\n name: 'test_tool_with_logging',\n arguments: {}\n });\n\n // Wait a bit for notifications to arrive\n await new Promise((resolve) => setTimeout(resolve, 200));\n\n // Check for log notifications from the NotificationCollector\n const logNotifications = notifications.getNotifications();\n\n const errors: string[] = [];\n if (logNotifications.length === 0) {\n errors.push('No log notifications received');\n } else if (logNotifications.length < 3) {\n errors.push(\n `Expected at least 3 log messages, got ${logNotifications.length}`\n );\n }\n\n checks.push({\n id: 'tools-call-with-logging',\n name: 'ToolsCallWithLogging',\n description: 'Tool sends log messages during execution',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Logging',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/logging'\n }\n ],\n details: {\n logCount: logNotifications.length,\n logs: logNotifications.map((n: any) => n.params)\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-with-logging',\n name: 'ToolsCallWithLogging',\n description: 'Tool sends log messages during execution',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Logging',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/logging'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallErrorScenario implements ClientScenario {\n name = 'tools-call-error';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test tool error reporting.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_error_handling\\` with no arguments.\n\n**Behavior**: Always throw an error\n\n**Returns**: JSON-RPC response with \\`isError: true\\`\n\n\\`\\`\\`json\n{\n \"isError\": true,\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"This tool intentionally returns an error for testing\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result: any = await conn.request('tools/call', {\n name: 'test_error_handling',\n arguments: {}\n });\n\n // Check if result has isError flag\n const hasIsError = result.isError === true;\n const hasContent = result.content && result.content.length > 0;\n const hasErrorMessage = hasContent && result.content[0].text;\n\n checks.push({\n id: 'tools-call-error',\n name: 'ToolsCallError',\n description: 'Tool returns error correctly',\n status: hasIsError && hasErrorMessage ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: !hasIsError\n ? 'Tool did not return isError: true'\n : !hasErrorMessage\n ? 'Error result missing error message'\n : undefined,\n specReferences: [\n {\n id: 'MCP-Error-Handling',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle'\n }\n ],\n details: {\n result\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-error',\n name: 'ToolsCallError',\n description: 'Tool returns error correctly',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Error-Handling',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallWithProgressScenario implements ClientScenario {\n name = 'tools-call-with-progress';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test tool that reports progress notifications.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_tool_with_progress\\` with no arguments.\n\n**Behavior**: If \\`_meta.progressToken\\` is provided in request:\n- Send progress notification: \\`0/100\\`\n- Wait ~50ms\n- Send progress notification: \\`50/100\\`\n- Wait ~50ms\n- Send progress notification: \\`100/100\\`\n\nIf no progress token provided, just execute with delays.\n\n**Returns**: Text content confirming execution\n\n**Progress Notification Format**:\n\n\\`\\`\\`json\n{\n \"method\": \"notifications/progress\",\n \"params\": {\n \"progressToken\": \"\",\n \"progress\": 50,\n \"total\": 100\n }\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n const result = await conn.request('tools/call', {\n name: 'test_tool_with_progress',\n arguments: {},\n _meta: {\n progressToken: 'progress-test-1'\n }\n });\n\n const progressUpdates = conn.notifications\n .filter((n) => n.method === 'notifications/progress')\n .map(\n (n) =>\n n.params as {\n progressToken?: string | number;\n progress: number;\n total?: number;\n }\n )\n // The server must echo the request's progressToken back; ignore\n // notifications for other tokens.\n .filter((p) => p.progressToken === 'progress-test-1');\n\n const errors: string[] = [];\n if (progressUpdates.length === 0) {\n errors.push('No progress notifications received');\n } else if (progressUpdates.length < 3) {\n errors.push(\n `Expected at least 3 progress notifications, got ${progressUpdates.length}`\n );\n }\n\n if (progressUpdates.length >= 3) {\n const progress0 = progressUpdates[0].progress;\n const progress1 = progressUpdates[1].progress;\n const progress2 = progressUpdates[2].progress;\n\n if (!(progress0 <= progress1 && progress1 <= progress2)) {\n errors.push('Progress values should be increasing');\n }\n }\n\n checks.push({\n id: 'tools-call-with-progress',\n name: 'ToolsCallWithProgress',\n description: 'Tool reports progress notifications',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Progress',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/progress'\n }\n ],\n details: {\n progressCount: progressUpdates.length,\n progressNotifications: progressUpdates,\n result\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-with-progress',\n name: 'ToolsCallWithProgress',\n description: 'Tool reports progress notifications',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Progress',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/progress'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallSamplingScenario implements ClientScenario {\n name = 'tools-call-sampling';\n readonly source = {\n introducedIn: '2025-06-18',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = `Test tool that requests LLM sampling from client.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_sampling\\` with argument:\n- \\`prompt\\` (string, required) - The prompt to send to the LLM\n\n**Behavior**: Request LLM sampling from the client using \\`sampling/createMessage\\`\n\n**Sampling Request**:\n\n\\`\\`\\`json\n{\n \"method\": \"sampling/createMessage\",\n \"params\": {\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"text\",\n \"text\": \"\"\n }\n }\n ],\n \"maxTokens\": 100\n }\n}\n\\`\\`\\`\n\n**Returns**: Text content with the LLM's response\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"LLM response: \"\n }\n ]\n}\n\\`\\`\\`\n\n**Implementation Note**: If the client doesn't support sampling (no \\`sampling\\` capability), return an error.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl, {}, ctx.specVersion);\n\n let samplingRequested = false;\n connection.client.setRequestHandler(\n CreateMessageRequestSchema,\n async (_request) => {\n samplingRequested = true;\n return {\n role: 'assistant',\n content: {\n type: 'text',\n text: 'This is a test response from the client'\n },\n model: 'test-model',\n stopReason: 'endTurn'\n };\n }\n );\n\n const result = await connection.client.callTool({\n name: 'test_sampling',\n arguments: {\n prompt: 'Test prompt for sampling'\n }\n });\n\n const errors: string[] = [];\n if (!samplingRequested) {\n errors.push('Server did not request sampling from client');\n }\n\n const content = (result as any).content;\n if (!content || content.length === 0) {\n errors.push('Tool did not return content');\n }\n\n checks.push({\n id: 'tools-call-sampling',\n name: 'ToolsCallSampling',\n description: 'Tool requests LLM sampling from client',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Sampling',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/sampling'\n }\n ],\n details: {\n samplingRequested,\n result\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-sampling',\n name: 'ToolsCallSampling',\n description: 'Tool requests LLM sampling from client',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Sampling',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/sampling'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallElicitationScenario implements ClientScenario {\n name = 'tools-call-elicitation';\n readonly source = {\n introducedIn: '2025-06-18',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = `Test tool that requests user input (elicitation) from client.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_elicitation\\` with argument:\n- \\`message\\` (string, required) - The message to show the user\n\n**Behavior**: Request user input from the client using \\`elicitation/create\\`\n\n**Elicitation Request**:\n\n\\`\\`\\`json\n{\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": {\n \"username\": {\n \"type\": \"string\",\n \"description\": \"User's response\"\n },\n \"email\": {\n \"type\": \"string\",\n \"description\": \"User's email address\"\n }\n },\n \"required\": [\"username\", \"email\"]\n }\n }\n}\n\\`\\`\\`\n\n**Returns**: Text content with the user's response\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"User response: \"\n }\n ]\n}\n\\`\\`\\`\n\n**Implementation Note**: If the client doesn't support elicitation (no \\`elicitation\\` capability), return an error.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl, {}, ctx.specVersion);\n\n let elicitationRequested = false;\n connection.client.setRequestHandler(\n ElicitRequestSchema,\n async (_request) => {\n elicitationRequested = true;\n return {\n action: 'accept',\n content: {\n username: 'testuser',\n email: 'test@example.com'\n }\n };\n }\n );\n\n const result = await connection.client.callTool({\n name: 'test_elicitation',\n arguments: {\n message: 'Please provide your information'\n }\n });\n\n const errors: string[] = [];\n if (!elicitationRequested) {\n errors.push('Server did not request elicitation from client');\n }\n\n const content = (result as any).content;\n if (!content || content.length === 0) {\n errors.push('Tool did not return content');\n }\n\n checks.push({\n id: 'tools-call-elicitation',\n name: 'ToolsCallElicitation',\n description: 'Tool requests user input from client',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Elicitation',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/elicitation'\n }\n ],\n details: {\n elicitationRequested,\n result\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-elicitation',\n name: 'ToolsCallElicitation',\n description: 'Tool requests user input from client',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Elicitation',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/elicitation'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallAudioScenario implements ClientScenario {\n name = 'tools-call-audio';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test calling a tool that returns audio content.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_audio_content\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"audio\",\n \"data\": \"\",\n \"mimeType\": \"audio/wav\"\n }\n ]\n}\n\\`\\`\\`\n\n**Implementation Note**: Use a minimal test audio file`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('tools/call', {\n name: 'test_audio_content',\n arguments: {}\n });\n\n // Validate response\n const errors: string[] = [];\n const content = (result as any).content;\n if (!content) errors.push('Missing content array');\n if (!Array.isArray(content)) errors.push('content is not an array');\n if (content && content.length === 0)\n errors.push('content array is empty');\n\n const audioContent =\n content && content.find((c: any) => c.type === 'audio');\n if (!audioContent) errors.push('No audio content found');\n if (audioContent && !audioContent.data)\n errors.push('Audio content missing data field');\n if (audioContent && !audioContent.mimeType)\n errors.push('Audio content missing mimeType field');\n if (audioContent && audioContent.mimeType !== 'audio/wav')\n errors.push(\n `Expected mimeType 'audio/wav', got '${audioContent.mimeType}'`\n );\n\n checks.push({\n id: 'tools-call-audio',\n name: 'ToolsCallAudio',\n description: 'Tool returns audio content',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ],\n details: {\n hasAudioContent: !!audioContent,\n audioDataLength: audioContent?.data?.length || 0\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-audio',\n name: 'ToolsCallAudio',\n description: 'Tool returns audio content',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallEmbeddedResourceScenario implements ClientScenario {\n name = 'tools-call-embedded-resource';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test calling a tool that returns embedded resource content.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_embedded_resource\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"resource\",\n \"resource\": {\n \"uri\": \"test://embedded-resource\",\n \"mimeType\": \"text/plain\",\n \"text\": \"This is an embedded resource content.\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('tools/call', {\n name: 'test_embedded_resource',\n arguments: {}\n });\n\n // Validate response\n const errors: string[] = [];\n const content = (result as any).content;\n if (!content) errors.push('Missing content array');\n if (!Array.isArray(content)) errors.push('content is not an array');\n if (content && content.length === 0)\n errors.push('content array is empty');\n\n const resourceContent =\n content && content.find((c: any) => c.type === 'resource');\n if (!resourceContent) errors.push('No resource content found');\n if (resourceContent && !resourceContent.resource)\n errors.push('Resource content missing resource field');\n if (resourceContent?.resource) {\n if (!resourceContent.resource.uri)\n errors.push('Resource missing uri field');\n if (!resourceContent.resource.mimeType)\n errors.push('Resource missing mimeType field');\n if (!resourceContent.resource.text && !resourceContent.resource.blob) {\n errors.push('Resource missing both text and blob fields');\n }\n }\n\n checks.push({\n id: 'tools-call-embedded-resource',\n name: 'ToolsCallEmbeddedResource',\n description: 'Tool returns embedded resource content',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ],\n details: {\n hasResourceContent: !!resourceContent,\n resourceUri: resourceContent?.resource?.uri\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-embedded-resource',\n name: 'ToolsCallEmbeddedResource',\n description: 'Tool returns embedded resource content',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,499,501],"30a72731-67f6-4026-beaf-33afedeea177","stateless.ts","dbff3f0e-ad13-11f1-8600-1607ee4eb77e",103,["D",1789046873004],"/**\n * Stateless MCP test scenarios for MCP servers (SEP-2575)\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport {\n buildStandardHeaders,\n readSseJsonRpcResponse,\n type RunContext\n} from '../../connection/index.ts';\nimport { notTestable } from '../untestable.ts';\n\nconst SPEC_REF = [\n {\n id: 'SEP-2575',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2575'\n }\n];\n\nexport class ServerStatelessScenario implements ClientScenario {\n name = 'server-stateless';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test stateless MCP server architecture (SEP-2575).\n\n**Server Implementation Requirements:**\n\n**Endpoints**:\n- \\`server/discover\\`: Returns supportedVersions and capabilities; SHOULD identify itself via \\`_meta['io.modelcontextprotocol/serverInfo']\\` (spec PR #3002).\n- \\`tools/call\\`: Implement structural test tools like \\`test_missing_capability\\` requiring explicit capabilities in \\`_meta\\`.\n\n**Grouped Specification Requirements**:\n\n1. **Per-Request _meta Validation (4 Checks)**\n - Rejects requests missing \\`_meta\\` or lacking structural required internal subfields (\\`protocolVersion\\`, \\`clientCapabilities\\`) with a JSON-RPC \\`-32602 Invalid params\\` error signature and an HTTP status code \\`400 Bad Request\\`.\n - Serves requests whose \\`_meta\\` omits \\`clientInfo\\` (a SHOULD since spec PR #3002 — servers MUST NOT require it).\n2. **Discovery & Capabilities (3 Checks)**\n - Implements \\`server/discover\\` mapping exact mandatory protocol elements.\n - Dynamically checks prompt capability declaration constraints, validates that active RPC handlers match advertised discovery capacities.\n3. **Version Negotiation & Headers (3 Checks)**\n - Mismatched or unknown protocol versions must return an \\`UnsupportedProtocolVersionError\\` (HTTP status code \\`400 Bad Request\\`) carrying precise version tracking arrays.\n - Absent or altered protocol version header metadata must trigger a \\`-32020 Header Mismatch\\` error with an HTTP 400 boundary state.\n4. **Client Capability Constraints (2 Checks)**\n - Accessing platform capabilities without explicit declaration drops requests with a \\`-32021 MissingRequiredClientCapabilityError\\` returning an HTTP status code \\`400 Bad Request\\`. Its \\`error.data.requiredCapabilities\\` is a \\`ClientCapabilities\\` object keyed by the missing capability (e.g. \\`{ \"sampling\": {} }\\`), not an array of names.\n5. **Methods & Routing Mechanics (5 Checks)**\n - Removed legacy endpoints (\\`initialize\\`, \\`ping\\`, \\`logging/setLevel\\`, etc.) or generic unknown methods must cleanly yield an HTTP status code \\`404 Not Found\\` alongside a JSON-RPC \\`-32601 Method not found\\` payload. All error returns must preserve original request ID mappings.\n - Validates response streams contain only \\`IncompleteResult\\` chunks and never independent top-level JSON-RPC requests, while enforcing that no log messages are emitted when \\`_meta.../logLevel\\` is omitted.\n6. **Subscription Streams & Filtering (3 Checks)**\n - Mandates that \\`notifications/subscriptions/acknowledged\\` is the first message on a \\`subscriptions/listen\\` stream, and that subsequent notifications carry a matching \\`_meta.../subscriptionId\\`.\n - Verifies strict containment where servers do not dispatch notification types that fall outside the client's explicit requested subscription filter list.\n7. **Dynamic List Mutations (2 Checks)**\n - Evaluates that list-changed capable servers notify active listen streams with \\`promptsListChanged: true\\` or \\`toolsListChanged: true\\` upon live configuration or capability modifications. `;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl, specVersion } = ctx;\n const checks: ConformanceCheck[] = [];\n const timestamp = new Date().toISOString();\n\n // Executes a validation rule and pushes the structural result metadata.\n async function runCheck(\n id: string,\n name: string,\n description: string,\n fn: () =>\n | Promise<{\n error?: string;\n warning?: boolean;\n skipped?: boolean;\n details?: any;\n } | void>\n | ({\n error?: string;\n warning?: boolean;\n skipped?: boolean;\n details?: any;\n } | void),\n fallbackDetails = {}\n ) {\n try {\n const result = await fn();\n const errorMessage = result?.error;\n // SHOULD-level requirements report WARNING rather than FAILURE\n // (severity follows the spec keyword).\n const status = errorMessage\n ? result?.warning\n ? 'WARNING'\n : 'FAILURE'\n : result?.skipped\n ? 'SKIPPED'\n : 'SUCCESS';\n\n checks.push({\n id,\n name,\n description,\n status,\n timestamp,\n errorMessage: errorMessage || undefined,\n specReferences: SPEC_REF,\n details: result?.details || fallbackDetails\n });\n } catch (e) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp,\n errorMessage: String(e),\n specReferences: SPEC_REF,\n details: fallbackDetails\n });\n }\n }\n\n // Every JSON-RPC error response observed anywhere in the scenario counts\n // toward the id-echo backfill's \"did we see any error at all\" condition.\n let errorResponsesObserved = 0;\n\n // Helper to send raw RPC requests via fetch\n const sendRpc = async (\n method: string,\n params?: any,\n headersOverrides?: Record,\n id: string | number | null = 1\n ) => {\n // The cross-cutting SEP-2243 headers (Mcp-Method, Mcp-Name, Accept,\n // MCP-Protocol-Version) are not what this scenario exercises, so they\n // are always sent conformantly; overrides only alter the dimension a\n // test case is about (issue #312).\n const headers = buildStandardHeaders(method, params, {\n headers: headersOverrides,\n specVersion\n });\n\n const body = JSON.stringify({\n jsonrpc: '2.0',\n id,\n method,\n ...(params !== undefined ? { params } : {})\n });\n\n const res = await fetch(serverUrl, { method: 'POST', headers, body });\n let data: any = null;\n // Servers may answer single requests over text/event-stream; pick the\n // JSON-RPC message matching this request id instead of failing to parse\n // the stream as JSON.\n const contentType =\n typeof res.headers?.get === 'function'\n ? (res.headers.get('content-type') ?? '')\n : '';\n if (contentType.includes('text/event-stream')) {\n const { body: matched } = await readSseJsonRpcResponse(res, id);\n data = matched ?? null;\n } else {\n try {\n data = await res.json();\n } catch {\n // Response might not be JSON\n }\n }\n if (data?.error !== undefined) errorResponsesObserved++;\n return { res, data };\n };\n\n // Helper to read multi-frame streaming endpoints (like subscriptions/listen).\n // `onFirstFrame` runs once after the first frame arrives (i.e. after the\n // server has acknowledged the subscription) so callers can trigger\n // side effects on a separate connection while this stream is still open.\n const listenToStream = async (\n method: string,\n params?: any,\n maxFrames = 3,\n timeoutMs = 1000,\n onFirstFrame?: () => Promise\n ): Promise => {\n const headers = buildStandardHeaders(method, params, { specVersion });\n\n const body = JSON.stringify({\n jsonrpc: '2.0',\n id: Date.now(),\n method,\n ...(params !== undefined ? { params } : {})\n });\n\n const controller = new AbortController();\n const timeoutId = setTimeout(() => {\n controller.abort();\n }, timeoutMs);\n\n try {\n const res = await fetch(serverUrl, {\n method: 'POST',\n headers,\n body,\n signal: controller.signal\n });\n\n if (!res.body) {\n clearTimeout(timeoutId);\n return [];\n }\n\n const reader = res.body.getReader();\n const decoder = new TextDecoder();\n const frames: any[] = [];\n let buffer = '';\n let firstFrameCallbackFired = false;\n const maybeFireFirstFrameCallback = async () => {\n if (firstFrameCallbackFired || frames.length === 0 || !onFirstFrame)\n return;\n firstFrameCallbackFired = true;\n try {\n await onFirstFrame();\n } catch {\n // The trigger failed; the caller inspects its own captured result.\n }\n };\n\n try {\n while (frames.length < maxFrames) {\n let value: Uint8Array | undefined;\n let done = false;\n try {\n ({ value, done } = await reader.read());\n } catch {\n // The stream was aborted (timeout) or dropped. A compliant\n // server holds a subscriptions/listen stream open indefinitely,\n // so hitting the timeout is the normal way these reads end —\n // return whatever frames arrived before it fired.\n break;\n }\n\n if (value) {\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(/\\r?\\n/);\n buffer = lines.pop() || '';\n\n for (const line of lines) {\n const cleanLine = line.trim();\n if (!cleanLine) continue;\n\n const jsonText = cleanLine.startsWith('data:')\n ? cleanLine.replace(/^data:\\s*/, '')\n : cleanLine;\n try {\n frames.push(JSON.parse(jsonText));\n } catch {\n // Keep segment buffering\n }\n }\n await maybeFireFirstFrameCallback();\n }\n\n if (done) {\n const finalLine = buffer.trim();\n if (finalLine) {\n const jsonText = finalLine.startsWith('data:')\n ? finalLine.replace(/^data:\\s*/, '')\n : finalLine;\n try {\n frames.push(JSON.parse(jsonText));\n } catch {\n // Trailing formatting mismatch\n }\n }\n break;\n }\n }\n } finally {\n reader.releaseLock();\n }\n\n clearTimeout(timeoutId);\n return frames;\n } catch {\n clearTimeout(timeoutId);\n return [];\n }\n };\n\n const validMeta = {\n 'io.modelcontextprotocol/protocolVersion': specVersion,\n 'io.modelcontextprotocol/clientInfo': {\n name: 'conformance-client',\n version: '1.0.0'\n },\n 'io.modelcontextprotocol/clientCapabilities': {}\n };\n\n // Helper to check JSON-RPC ID matching on error responses\n const checkErrorId = (data: any, expectedId: string | number) => {\n if (data && data.error) {\n if (data.id !== expectedId) {\n checks.push({\n id: 'sep-2575-http-server-error-jsonrpc-id',\n name: 'HttpServerErrorJsonrpcId',\n description: 'All error responses carry the request JSON-RPC id',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Expected error response id ${expectedId}, got ${data.id}`,\n specReferences: SPEC_REF\n });\n }\n }\n };\n\n // ==========================================\n // 1. Per-request _meta Validation (4 Checks)\n // ==========================================\n const metaValidationTestCases = [\n {\n slug: 'missing-meta',\n description:\n 'Rejects request with missing _meta with -32602 Invalid params',\n params: {},\n rpcId: 101\n },\n {\n slug: 'missing-protocol-version',\n description:\n 'Rejects request with _meta missing io.modelcontextprotocol/protocolVersion',\n params: {\n _meta: {\n 'io.modelcontextprotocol/clientInfo':\n validMeta['io.modelcontextprotocol/clientInfo'],\n 'io.modelcontextprotocol/clientCapabilities':\n validMeta['io.modelcontextprotocol/clientCapabilities']\n }\n },\n rpcId: 102\n },\n // No 'missing-client-info' case: spec PR #3002 demoted clientInfo to\n // SHOULD, so its absence is valid (asserted positively below).\n {\n slug: 'missing-client-capabilities',\n description:\n 'Rejects request with _meta missing io.modelcontextprotocol/clientCapabilities',\n params: {\n _meta: {\n 'io.modelcontextprotocol/protocolVersion':\n validMeta['io.modelcontextprotocol/protocolVersion'],\n 'io.modelcontextprotocol/clientInfo':\n validMeta['io.modelcontextprotocol/clientInfo']\n }\n },\n rpcId: 104\n }\n ];\n for (const testCase of metaValidationTestCases) {\n const metaProbe = await sendRpc(\n 'server/discover',\n testCase.params,\n undefined,\n testCase.rpcId\n ).catch(() => null);\n const metaRes: any = metaProbe?.res ?? null;\n const metaData: any = metaProbe?.data ?? null;\n if (metaData) checkErrorId(metaData, testCase.rpcId);\n\n await runCheck(\n `sep-2575-request-meta-invalid-${testCase.slug}`,\n 'RequestMetaInvalid',\n testCase.description,\n () => {\n if (!metaProbe)\n return { error: '_meta validation probe failed completely' };\n if (metaData?.error?.code !== -32602) {\n return {\n error: `Expected error code -32602, got ${metaData?.error?.code}`,\n details: { fieldIssue: testCase.slug, response: metaData }\n };\n }\n return { details: { fieldIssue: testCase.slug, response: metaData } };\n },\n { fieldIssue: testCase.slug }\n );\n\n // Companion HTTP-status check: a request missing a required _meta field\n // is malformed and, on HTTP, the rejection MUST use 400 Bad Request.\n await runCheck(\n 'sep-2575-http-server-meta-invalid-400',\n 'HttpServerMetaInvalid400',\n 'Rejections of requests missing required _meta fields use HTTP 400 Bad Request.',\n () => {\n if (!metaRes)\n return { error: '_meta validation probe failed completely' };\n if (metaRes.status !== 400) {\n return {\n error: `Expected HTTP 400 Bad Request, got status code ${metaRes.status}`,\n details: { fieldIssue: testCase.slug, response: metaData }\n };\n }\n return { details: { fieldIssue: testCase.slug, response: metaData } };\n },\n { fieldIssue: testCase.slug }\n );\n }\n\n // Positive companion (spec PR #3002): clientInfo is a SHOULD — a request\n // whose _meta omits it MUST be served, not rejected.\n const noClientInfoProbe = await sendRpc(\n 'server/discover',\n {\n _meta: {\n 'io.modelcontextprotocol/protocolVersion':\n validMeta['io.modelcontextprotocol/protocolVersion'],\n 'io.modelcontextprotocol/clientCapabilities':\n validMeta['io.modelcontextprotocol/clientCapabilities']\n }\n },\n undefined,\n 105\n ).catch(() => null);\n const noClientInfoData: any = noClientInfoProbe?.data;\n await runCheck(\n 'sep-2575-request-meta-client-info-optional',\n 'RequestMetaClientInfoOptional',\n 'Serves requests whose _meta omits io.modelcontextprotocol/clientInfo (clientInfo is a SHOULD).',\n () => {\n if (!noClientInfoProbe)\n return { error: 'clientInfo-less probe failed completely' };\n if (noClientInfoData?.error) {\n return {\n error: `Expected a result, got error ${noClientInfoData.error.code}: ${noClientInfoData.error.message}`,\n details: { response: noClientInfoData }\n };\n }\n if (noClientInfoProbe.res?.status !== 200) {\n return {\n error: `Expected HTTP 200, got status code ${noClientInfoProbe.res?.status}`,\n details: { response: noClientInfoData }\n };\n }\n return { details: { response: noClientInfoData } };\n }\n );\n\n // ==========================================\n // 2. Discovery & Capabilities (4 Checks)\n // ==========================================\n let discoverSupportedVersions: string[] = [];\n let discoverCapabilities: any = {};\n let discoverResult: any = null;\n let discoverRpcError: any = null;\n\n try {\n const { data } = await sendRpc(\n 'server/discover',\n { _meta: validMeta },\n undefined,\n 201\n );\n discoverResult = data?.result;\n\n if (Array.isArray(discoverResult?.supportedVersions)) {\n discoverSupportedVersions = discoverResult.supportedVersions;\n }\n if (\n discoverResult?.capabilities &&\n typeof discoverResult.capabilities === 'object'\n ) {\n discoverCapabilities = discoverResult.capabilities;\n }\n } catch (e) {\n discoverRpcError = e;\n }\n\n await runCheck(\n 'sep-2575-server-implements-discover',\n 'ServerImplementsDiscover',\n 'Servers MUST implement server/discover.',\n () => {\n if (discoverRpcError)\n return { error: `Discovery failed: ${discoverRpcError.message}` };\n // Mandatory body fields per the final revision (spec PR #3002 removed\n // body serverInfo — identity is a SHOULD in the result _meta, checked\n // separately below).\n if (\n !discoverResult?.supportedVersions ||\n !discoverResult?.capabilities\n ) {\n return {\n error: 'Missing mandatory fields in discover response setup',\n details: { result: discoverResult }\n };\n }\n return { details: { result: discoverResult } };\n }\n );\n\n await runCheck(\n 'sep-2575-server-identifies-in-result-meta',\n 'ServerIdentifiesInResultMeta',\n \"Servers SHOULD identify themselves via _meta['io.modelcontextprotocol/serverInfo'] on responses (spec PR #3002).\",\n () => {\n if (discoverRpcError)\n // Discover itself failed (already a FAILURE on the implements-\n // discover check): nothing is known about identity, so the gap\n // must not read as an intentional absence.\n return {\n skipped: true,\n details: {\n note: `Prerequisite missing: ${discoverRpcError.message}`\n }\n };\n const metaServerInfo =\n discoverResult?._meta?.['io.modelcontextprotocol/serverInfo'];\n if (!metaServerInfo?.name || !metaServerInfo?.version) {\n const bodyServerInfo = discoverResult?.serverInfo;\n return {\n // SHOULD-level: WARNING, never FAILURE.\n warning: true,\n error: bodyServerInfo\n ? 'serverInfo found only in the pre-#3002 result body, not in _meta'\n : 'No serverInfo in the discover result _meta',\n details: { result: discoverResult }\n };\n }\n return { details: { serverInfo: metaServerInfo } };\n }\n );\n\n await runCheck(\n 'sep-2575-server-declares-prompts-in-discover',\n 'ServerDeclaresPromptsInDiscover',\n 'Servers that support prompts MUST declare the prompts capability in their DiscoverResult.',\n async () => {\n if (discoverRpcError)\n return { error: `Prerequisite missing: ${discoverRpcError.message}` };\n const { data: promptsData } = await sendRpc(\n 'prompts/list',\n { _meta: validMeta },\n undefined,\n 203\n );\n const methodExists =\n promptsData?.result?.prompts || promptsData?.error?.code !== -32601;\n\n if (methodExists && !discoverCapabilities.prompts) {\n return {\n error:\n 'Server handles prompts but did not declare prompts capability in discover result',\n details: { discoverCapabilities }\n };\n }\n return { details: { discoverCapabilities, response: promptsData } };\n }\n );\n\n // Fetched once here and reused by the capability-constraint checks below\n // to tell a missing diagnostic tool apart from a genuine violation.\n const toolsListResponse = await sendRpc(\n 'tools/list',\n { _meta: validMeta },\n undefined,\n 202\n ).catch(() => null);\n const listedToolNames: string[] = Array.isArray(\n toolsListResponse?.data?.result?.tools\n )\n ? toolsListResponse.data.result.tools\n .map((t: any) => t?.name)\n .filter((n: any) => typeof n === 'string')\n : [];\n\n // Dynamic verification helper to check capability consistency against true handlers\n await runCheck(\n 'sep-2575-discover-capabilities-match-handlers',\n 'DiscoverCapabilitiesMatchHandlers',\n 'capabilities matches what the server honors on real RPC calls',\n async () => {\n if (discoverRpcError)\n return {\n error: `Discovery runtime check failed: ${discoverRpcError.message}`\n };\n if (!toolsListResponse)\n return { error: 'tools/list probe network hit failed' };\n const toolsData = toolsListResponse.data;\n\n if (discoverCapabilities.tools) {\n const toolsPassed = Array.isArray(toolsData?.result?.tools);\n if (!toolsPassed)\n return {\n error: 'Advertised tools capability but tools/list call failed',\n details: { response: toolsData }\n };\n } else {\n if (toolsData?.error?.code !== -32601)\n return {\n error:\n 'Did not advertise tools capability but tools/list did not yield -32601',\n details: { response: toolsData }\n };\n }\n return { details: { response: toolsData } };\n }\n );\n\n // ==========================================\n // 3. Version Negotiation & Headers (3 Checks)\n // ==========================================\n const requestedUnsupportedVersion = 'v999.0.0';\n const unsupportedMeta = {\n ...validMeta,\n 'io.modelcontextprotocol/protocolVersion': requestedUnsupportedVersion\n };\n const response301 = await sendRpc(\n 'server/discover',\n { _meta: unsupportedMeta },\n { 'MCP-Protocol-Version': requestedUnsupportedVersion },\n 301\n ).catch(() => null);\n const res301: any = response301?.res ?? null;\n const data301: any = response301?.data ?? null;\n if (data301) checkErrorId(data301, 301);\n\n await runCheck(\n 'sep-2575-server-unsupported-version-error',\n 'ServerUnsupportedVersionError',\n 'If the server does not implement the requested version (whether the version is unknown to the server, or is a known version the server has chosen not to support), it MUST respond with an UnsupportedProtocolVersionError listing the versions it does support; the error data carries the supported versions and echoes the requested version.',\n () => {\n if (!data301)\n return { error: 'Unsupported version invocation failed completely' };\n const errSupportedVersions = data301?.error?.data?.supported;\n const hasErrVersions =\n Array.isArray(errSupportedVersions) &&\n errSupportedVersions.length > 0;\n\n const validMatch =\n hasErrVersions &&\n errSupportedVersions.every((v: string) =>\n discoverSupportedVersions.includes(v)\n );\n if (!validMatch)\n return {\n error: `Returned supported versions data layout does not correlate to active server metrics: ${JSON.stringify(errSupportedVersions)}`\n };\n\n // UnsupportedProtocolVersionError data carries both required members:\n // `supported` (asserted above) and `requested`, which echoes the\n // version the request asked for.\n const requestedEcho = data301?.error?.data?.requested;\n if (requestedEcho !== requestedUnsupportedVersion) {\n return {\n error: `error.data.requested must echo the requested version '${requestedUnsupportedVersion}', got ${JSON.stringify(requestedEcho)}`,\n details: { response: data301 }\n };\n }\n return { details: { response: data301 } };\n }\n );\n\n await runCheck(\n 'sep-2575-http-server-unsupported-version-400',\n 'HttpServerUnsupportedVersion400',\n 'If the server does not implement the requested protocol version, it MUST respond with 400 Bad Request and an UnsupportedProtocolVersionError listing its supported versions.',\n () => {\n if (!res301)\n return { error: 'Network transaction context unavailable' };\n if (res301.status !== 400)\n return {\n error: `Expected HTTP 400 Bad Request, got status code ${res301.status}`\n };\n return { details: { response: data301 } };\n }\n );\n\n const headerMismatchMeta = {\n ...validMeta,\n 'io.modelcontextprotocol/protocolVersion': 'v999.0.0'\n };\n const responseAbsent = await sendRpc(\n 'server/discover',\n { _meta: headerMismatchMeta },\n { 'MCP-Protocol-Version': specVersion },\n 302\n ).catch(() => null);\n const resAbsent: any = responseAbsent?.res ?? null;\n const dataAbsent: any = responseAbsent?.data ?? null;\n\n await runCheck(\n 'sep-2575-http-server-header-mismatch-400',\n 'HttpServerHeaderMismatch400',\n 'If the values do not match, the server MUST reject the request with 400 Bad Request and a HeaderMismatch JSON-RPC error.',\n () => {\n if (!resAbsent)\n return { error: 'Header verification endpoint network hit failed' };\n if (resAbsent.status !== 400 || dataAbsent?.error?.code !== -32020) {\n return {\n error: `Expected HTTP 400 and JSON-RPC error -32020, got status ${resAbsent.status} with code ${dataAbsent?.error?.code}`\n };\n }\n return { details: { response: dataAbsent } };\n }\n );\n\n // ==========================================\n // 4. Client Capability Constraints (2 Checks)\n // ==========================================\n const response401 = await sendRpc(\n 'tools/call',\n { name: 'test_missing_capability', arguments: {}, _meta: validMeta },\n undefined,\n 401\n ).catch(() => null);\n const res401: any = response401?.res ?? null;\n const data401: any = response401?.data ?? null;\n if (data401) checkErrorId(data401, 401);\n\n // Determine if this server actively enforces client capabilities\n const serverRequiresCapability = data401?.error?.code === -32021;\n const capabilityToolListed = listedToolNames.includes(\n 'test_missing_capability'\n );\n\n await runCheck(\n 'sep-2575-server-rejects-undeclared-capability',\n 'ServerRejectsUndeclaredCapability',\n 'A server MUST NOT rely on capabilities the client has not declared. If processing a request requires a capability the client did not include in io.modelcontextprotocol/clientCapabilities, the server MUST return a MissingRequiredClientCapabilityError (-32021).',\n () => {\n if (!res401)\n return {\n error:\n 'Capability checking call sequence timed out or dropped connection'\n };\n\n if (!serverRequiresCapability) {\n // Distinguish a genuine violation from a fixture gap, strongest\n // evidence first: a result proves the tool executed (violation\n // regardless of whether tools/list mentioned it); a non--32021\n // error from a listed tool is the wrong code; an error from an\n // unlisted tool means the requirement could not be exercised.\n if (data401?.result !== undefined) {\n return {\n error:\n \"Server executed 'test_missing_capability' although the client did not declare the 'sampling' capability — it MUST reject with -32021\",\n details: { response: data401 }\n };\n }\n if (data401?.error && capabilityToolListed) {\n return {\n error: `Expected MissingRequiredClientCapabilityError (-32021), got error code ${data401.error.code}`,\n details: { response: data401 }\n };\n }\n return {\n error: notTestable(\n \"server does not list the diagnostic tool 'test_missing_capability' in tools/list and the probe call did not exercise it (required for the undeclared-capability rejection)\"\n ),\n details: { untestable: true, response: data401 }\n };\n }\n\n // If it DOES return -32021, strictly validate the requirement payload\n // structure. Per the schema's `MissingRequiredClientCapabilityError`,\n // `error.data.requiredCapabilities` is a `ClientCapabilities` OBJECT\n // keyed by the missing capability — not an array of capability names —\n // and each capability value is itself an object.\n const reqCaps = data401?.error?.data?.requiredCapabilities;\n const isPlainObject = (value: unknown): boolean =>\n typeof value === 'object' && value !== null && !Array.isArray(value);\n if (!isPlainObject(reqCaps) || !isPlainObject(reqCaps.sampling)) {\n return {\n error: `Server responded with error code -32021 but error.data.requiredCapabilities is not a ClientCapabilities object naming 'sampling' (the schema defines it as an object of capability objects, e.g. { \"sampling\": {} }, not an array)`,\n details: { response: data401 }\n };\n }\n\n return { details: { response: data401 } };\n }\n );\n\n await runCheck(\n 'sep-2575-missing-capability-http-400',\n 'MissingCapabilityHttp400',\n 'On HTTP, the response status MUST be 400 Bad Request [for MissingRequiredClientCapabilityError].',\n () => {\n if (!res401)\n return {\n error: 'Network transport layer layer context failed to instantiate'\n };\n\n if (!serverRequiresCapability) {\n // Same root cause as the previous check: either the diagnostic\n // tool is missing (untestable) or the server failed to emit the\n // -32021 this status requirement attaches to.\n return {\n error: notTestable(\n capabilityToolListed\n ? 'server did not return MissingRequiredClientCapabilityError, so its HTTP status could not be validated'\n : \"server does not list the diagnostic tool 'test_missing_capability' in tools/list, so the -32021 HTTP status could not be validated\"\n ),\n details: { untestable: true, httpStatus: res401.status }\n };\n }\n\n // If it did trigger the capability error, it MUST use HTTP 400\n if (res401.status !== 400) {\n return {\n error: `Expected HTTP status code 400 Bad Request for an undeclared capability error response, got ${res401.status}`,\n details: { response: data401 }\n };\n }\n\n return { details: { response: data401 } };\n }\n );\n\n // ==========================================\n // 5. Methods & Routing Mechanics (5 Checks)\n // ==========================================\n const expectedSlugs = [\n 'initialize',\n 'ping',\n 'logging/setLevel',\n 'resources/subscribe',\n 'resources/unsubscribe'\n ];\n for (const slug of expectedSlugs) {\n const cleanMethodParam = slug.toLowerCase().replace('/', '-');\n const response500 = await sendRpc(\n slug,\n { _meta: validMeta },\n undefined,\n 500\n ).catch(() => null);\n const res500: any = response500?.res ?? null;\n const data500: any = response500?.data ?? null;\n\n await runCheck(\n `sep-2575-http-server-method-not-found-404-${cleanMethodParam}`,\n `HttpServerMethodNotFound404${slug.replace('/', '')}`,\n `If the server does not implement the removed RPC method '${slug}', it MUST respond with 404 Not Found and a JSON-RPC error with code -32601 (Method not found).`,\n () => {\n if (!res500 || !data500)\n return {\n error:\n 'Removed method validation hit dropped connections unexpectedly'\n };\n if (res500.status !== 404 || data500?.error?.code !== -32601) {\n return {\n error: `Expected HTTP 404 and code -32601 for removed methods, got HTTP ${res500.status} and code ${data500?.error?.code}`\n };\n }\n return { details: { response: data500 } };\n }\n );\n }\n\n // Explicit generic unknown method fallback test\n const response601 = await sendRpc(\n 'unknown/method',\n { _meta: validMeta },\n undefined,\n 601\n ).catch(() => null);\n const res601: any = response601?.res ?? null;\n const data601: any = response601?.data ?? null;\n\n await runCheck(\n 'sep-2575-http-server-method-not-found-404',\n 'HttpServerMethodNotFound404',\n 'If the server does not implement the requested RPC method, it MUST respond with 404 Not Found and a JSON-RPC error with code -32601 (Method not found).',\n () => {\n if (!res601 || !data601)\n return {\n error: 'Unknown fallback test target returned an invalid layout'\n };\n if (res601.status !== 404 || data601?.error?.code !== -32601) {\n return {\n error: `Expected HTTP 404 and JSON-RPC error code -32601, got HTTP ${res601.status} and code ${data601?.error?.code}`\n };\n }\n return { details: { response: data601 } };\n }\n );\n\n await runCheck(\n 'sep-2575-http-server-no-independent-requests-on-stream',\n 'HttpServerNoIndependentRequestsOnStream',\n 'Request stream contains only IncompleteResult, never independent JSON-RPC requests',\n async () => {\n const frames = await listenToStream(\n 'tools/call',\n {\n name: 'test_streaming_elicitation',\n arguments: {},\n // The fixture legitimately needs the elicitation capability, so a\n // capability-enforcing server rejects the shared empty-capability\n // envelope with -32021 (the exact behavior\n // sep-2575-server-rejects-undeclared-capability requires) and the\n // stream could never be exercised. Declare it at the probe site\n // only — validMeta must stay empty for that sibling check.\n _meta: {\n ...validMeta,\n 'io.modelcontextprotocol/clientCapabilities': { elicitation: {} }\n }\n },\n 3,\n 600\n );\n\n if (frames.length === 0) {\n return {\n error:\n 'Failed to receive progressive stream chunk execution frames from tools/call handler endpoint'\n };\n }\n\n // If the call was rejected outright, nothing was streamed and the\n // requirement could not be exercised — fail with the cause rather\n // than reporting a vacuous SUCCESS or an invisible SKIPPED.\n if (frames.every((f) => f?.error !== undefined)) {\n return {\n error: notTestable(\n listedToolNames.includes('test_streaming_elicitation')\n ? `the 'test_streaming_elicitation' call was rejected (code ${frames[0]?.error?.code}), so the response stream could not be exercised`\n : \"server does not list the diagnostic tool 'test_streaming_elicitation' in tools/list, so the response stream could not be exercised\"\n ),\n details: { untestable: true, response: frames[0] }\n };\n }\n\n const hasIndependentRequest = frames.some(\n (f) => f.method && !f.method.startsWith('notifications/')\n );\n if (hasIndependentRequest) {\n return {\n error:\n 'Server emitted an independent standard request layout inside a response progress execution block stream context',\n details: { frames }\n };\n }\n return { details: { inspectedFramesCount: frames.length } };\n }\n );\n\n await runCheck(\n 'sep-2575-server-no-log-without-loglevel',\n 'ServerNoLogWithoutLogLevel',\n \"No notifications/message for requests that didn't set _meta.../logLevel\",\n async () => {\n const frames = await listenToStream(\n 'tools/call',\n { name: 'test_logging_tool', arguments: {}, _meta: validMeta },\n 3,\n 500\n );\n\n if (frames.length === 0) {\n return {\n error:\n 'Logging target endpoint context dropped or failed to yield frame structures'\n };\n }\n\n // If the call was rejected outright, the server never had anything\n // to log and the requirement could not be exercised — fail with the\n // cause rather than reporting a vacuous SUCCESS or invisible SKIPPED.\n if (frames.every((f) => f?.error !== undefined)) {\n return {\n error: notTestable(\n listedToolNames.includes('test_logging_tool')\n ? `the 'test_logging_tool' call was rejected (code ${frames[0]?.error?.code}), so the no-log-without-logLevel requirement could not be exercised`\n : \"server does not list the diagnostic tool 'test_logging_tool' in tools/list, so the no-log-without-logLevel requirement could not be exercised\"\n ),\n details: { untestable: true, response: frames[0] }\n };\n }\n\n const logFrame = frames.find(\n (f) => f.method === 'notifications/message'\n );\n if (logFrame) {\n return {\n error:\n 'Server dispatched a notifications/message payload chunk even though the client request did not authorize a log level context descriptor',\n details: { logFrame }\n };\n }\n return { details: { framesFound: frames.length } };\n }\n );\n\n // ==========================================\n // 6. Subscription Streams & Filtering (3 Checks)\n // ==========================================\n // A server that advertises no subscription-delivered capability has\n // nothing to serve on subscriptions/listen, so a -32601 there is a\n // legitimate feature absence (SKIPPED). A server that DOES advertise\n // listChanged/subscribe but rejects the method fails: it claims a\n // feature it does not serve.\n const advertisesSubscriptions = !!(\n discoverCapabilities?.tools?.listChanged ||\n discoverCapabilities?.prompts?.listChanged ||\n discoverCapabilities?.resources?.listChanged ||\n discoverCapabilities?.resources?.subscribe\n );\n // The legitimate skip requires an OBSERVED advertisement: when\n // server/discover itself failed, nothing is known about the server's\n // capabilities and the gap must not read as an intentional absence.\n const discoverObserved = !discoverRpcError && discoverResult != null;\n const listenRejected = (frames: any[]) => {\n if (frames[0]?.error?.code !== -32601) return null;\n if (discoverObserved && !advertisesSubscriptions) {\n return {\n skipped: true,\n details: {\n note: 'Server advertises no subscription-delivered capability; subscriptions/listen is not applicable.'\n }\n };\n }\n return {\n error: notTestable(\n advertisesSubscriptions\n ? 'server advertises listChanged/subscribe capabilities but answers subscriptions/listen with -32601 (Method not found)'\n : 'server/discover was not observed, so the -32601 on subscriptions/listen cannot be attributed to an intentionally absent capability'\n ),\n details: { untestable: true, response: frames[0] }\n };\n };\n\n const subscriptionParams = {\n _meta: validMeta,\n notifications: { toolsListChanged: true }\n };\n\n // Open a tools-filtered stream and (best-effort) trigger a tool-list\n // change once it is acknowledged, so the stream carries at least one\n // post-acknowledgment notification for the subscription-id check.\n let streamFrames: any[] = [];\n try {\n streamFrames = await listenToStream(\n 'subscriptions/listen',\n subscriptionParams,\n 2,\n 800,\n async () => {\n await sendRpc('tools/call', {\n name: 'test_trigger_tool_change',\n arguments: {},\n _meta: validMeta\n });\n }\n );\n } catch {\n // Stream pipeline tracking failed\n }\n\n await runCheck(\n 'sep-2575-server-sends-subscription-ack',\n 'ServerSendsSubscriptionAck',\n 'notifications/subscriptions/acknowledged is the first message on a subscriptions/listen stream',\n () => {\n const rejectedStream = listenRejected(streamFrames);\n if (rejectedStream) return rejectedStream;\n if (streamFrames.length === 0) {\n return {\n error:\n 'Failed to open or receive frames from the subscriptions/listen stream endpoint'\n };\n }\n const firstFrame = streamFrames[0];\n if (firstFrame?.method !== 'notifications/subscriptions/acknowledged') {\n return {\n error: `Expected first frame method to be 'notifications/subscriptions/acknowledged', got '${firstFrame?.method}'`,\n details: { firstFrame }\n };\n }\n return { details: { firstFrame } };\n }\n );\n\n await runCheck(\n 'sep-2575-server-tags-subscription-id',\n 'ServerTagsSubscriptionId',\n 'Listen-stream notifications carry _meta.../subscriptionId',\n () => {\n const rejectedStream = listenRejected(streamFrames);\n if (rejectedStream) return rejectedStream;\n if (streamFrames.length === 0) {\n return {\n error:\n 'Failed to open stream line or tracking frames are missing completely'\n };\n }\n\n // Every notification delivered on the stream (the acknowledgment and\n // anything after it) must carry the subscription id in params._meta.\n const notificationFrames = streamFrames.filter(\n (f) =>\n typeof f?.method === 'string' &&\n f.method.startsWith('notifications/')\n );\n if (notificationFrames.length === 0) {\n return {\n error:\n 'subscriptions/listen stream carried no notification frames to inspect',\n details: { streamFrames }\n };\n }\n\n const untaggedFrames = notificationFrames.filter(\n (f) => !f?.params?._meta?.['io.modelcontextprotocol/subscriptionId']\n );\n if (untaggedFrames.length > 0) {\n return {\n error: `${untaggedFrames.length} of ${notificationFrames.length} listen-stream notification(s) are missing io.modelcontextprotocol/subscriptionId in params._meta`,\n details: { untaggedFrames }\n };\n }\n\n const subId =\n notificationFrames[0]?.params?._meta?.[\n 'io.modelcontextprotocol/subscriptionId'\n ];\n return {\n details: {\n subscriptionId: subId,\n inspectedNotificationCount: notificationFrames.length\n }\n };\n }\n );\n\n await runCheck(\n 'sep-2575-server-honors-notification-filter',\n 'ServerHonorsNotificationFilter',\n \"Server doesn't send notification types the client didn't request\",\n async () => {\n const narrowParams = {\n _meta: validMeta,\n notifications: { promptsListChanged: true }\n };\n\n // Open a stream filtered to prompts only, then mutate the *tool* list\n // on a separate connection once the subscription is acknowledged. A\n // compliant server must not deliver the resulting tools notification\n // to this stream.\n const narrowFrames = await listenToStream(\n 'subscriptions/listen',\n narrowParams,\n 3,\n 1500,\n async () => {\n await sendRpc('tools/call', {\n name: 'test_trigger_tool_change',\n arguments: {},\n _meta: validMeta\n });\n }\n );\n\n const rejectedNarrow = listenRejected(narrowFrames);\n if (rejectedNarrow) return rejectedNarrow;\n if (narrowFrames.length === 0) {\n return {\n error:\n 'Strict subscription filtering line failed to return communication frames'\n };\n }\n\n const leakedToolFrame = narrowFrames.find(\n (f) => f?.method === 'notifications/tools/list_changed'\n );\n\n if (leakedToolFrame) {\n return {\n error:\n 'Server leaked a tools/list-changed notification over a stream explicitly filtered to prompts only',\n details: { leakedToolFrame }\n };\n }\n return { details: { narrowFramesCount: narrowFrames.length } };\n }\n );\n\n // ==========================================\n // 7. Dynamic List Mutations (2 Checks)\n // ==========================================\n await runCheck(\n 'sep-2575-server-sends-prompts-list-changed-on-subscription',\n 'ServerSendsPromptsListChangedOnSubscription',\n 'List-changed-capable servers notify listen streams with promptsListChanged: true (SHOULD)',\n async () => {\n // Automatically pass/skip if the server didn't declare this capability during discovery\n if (!discoverCapabilities?.prompts?.listChanged) {\n return {\n skipped: true,\n details: {\n note: 'Server did not declare prompts.listChanged capability in server/discover'\n }\n };\n }\n\n const promptsParams = {\n _meta: validMeta,\n notifications: { promptsListChanged: true }\n };\n\n // Open the subscription first; mutate the prompt list on a separate\n // connection once it is acknowledged. A compliant server only\n // notifies streams that are open at the time of the change.\n let trigger: any = null;\n const frames = await listenToStream(\n 'subscriptions/listen',\n promptsParams,\n 2,\n 1500,\n async () => {\n trigger = await sendRpc('tools/call', {\n name: 'test_trigger_prompt_change',\n arguments: {},\n _meta: validMeta\n });\n }\n );\n if (trigger?.data?.error?.code === -32601) {\n // SHOULD-level requirement, so the untestable report is a WARNING.\n return {\n warning: true,\n error: notTestable(\n \"server declares prompts.listChanged but does not expose the diagnostic hook 'test_trigger_prompt_change' to mutate the prompt list\"\n ),\n details: { untestable: true }\n };\n }\n\n if (frames.length === 0) {\n return {\n warning: true,\n error:\n 'Failed to open or receive frames from the subscriptions/listen stream endpoint'\n };\n }\n\n const changeFrame = frames.find(\n (f) => f.method === 'notifications/prompts/list_changed'\n );\n if (!changeFrame) {\n return {\n warning: true,\n error:\n 'Mutated the prompt list but no notifications/prompts/list_changed arrived on the open subscription stream. This is a SHOULD requirement.'\n };\n }\n return { details: { changeFrame } };\n }\n );\n\n await runCheck(\n 'sep-2575-server-sends-tools-list-changed-on-subscription',\n 'ServerSendsToolsListChangedOnSubscription',\n 'List-changed-capable servers notify listen streams with toolsListChanged: true (SHOULD)',\n async () => {\n // Automatically pass/skip if the server didn't declare this capability during discovery\n if (!discoverCapabilities?.tools?.listChanged) {\n return {\n skipped: true,\n details: {\n note: 'Server did not declare tools.listChanged capability in server/discover'\n }\n };\n }\n\n const toolsParams = {\n _meta: validMeta,\n notifications: { toolsListChanged: true }\n };\n\n // Open the subscription first; mutate the tool list on a separate\n // connection once it is acknowledged. A compliant server only\n // notifies streams that are open at the time of the change.\n let trigger: any = null;\n const frames = await listenToStream(\n 'subscriptions/listen',\n toolsParams,\n 2,\n 1500,\n async () => {\n trigger = await sendRpc('tools/call', {\n name: 'test_trigger_tool_change',\n arguments: {},\n _meta: validMeta\n });\n }\n );\n if (trigger?.data?.error?.code === -32601) {\n // SHOULD-level requirement, so the untestable report is a WARNING.\n return {\n warning: true,\n error: notTestable(\n \"server declares tools.listChanged but does not expose the diagnostic hook 'test_trigger_tool_change' to mutate the tool list\"\n ),\n details: { untestable: true }\n };\n }\n\n if (frames.length === 0) {\n return {\n warning: true,\n error:\n 'Failed to open or receive frames from the subscriptions/listen stream endpoint'\n };\n }\n\n const changeFrame = frames.find(\n (f) => f.method === 'notifications/tools/list_changed'\n );\n if (!changeFrame) {\n return {\n warning: true,\n error:\n 'Mutated the tool list but no notifications/tools/list_changed arrived on the open subscription stream. This is a SHOULD requirement.'\n };\n }\n return { details: { changeFrame } };\n }\n );\n\n if (!checks.some((c) => c.id === 'sep-2575-http-server-error-jsonrpc-id')) {\n // Only report SUCCESS when at least one error response was actually\n // observed; a server that never produced an error response (because it\n // wrongly accepted every invalid probe) must not collect a vacuous pass\n // for the id-echo requirement on top of its other failures.\n checks.push({\n id: 'sep-2575-http-server-error-jsonrpc-id',\n name: 'HttpServerErrorJsonrpcId',\n description: 'All error responses carry the request JSON-RPC id',\n status: errorResponsesObserved > 0 ? 'SUCCESS' : 'FAILURE',\n timestamp,\n errorMessage:\n errorResponsesObserved > 0\n ? undefined\n : notTestable(\n 'no error responses were observed across the probes, so the id-echo requirement could not be validated'\n ),\n details:\n errorResponsesObserved > 0\n ? { errorResponsesObserved }\n : { untestable: true, errorResponsesObserved },\n specReferences: SPEC_REF\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,499,509],"7f97a210-d9ce-4d5b-923c-869a93c01d44","stateless-client.ts","e465ce42-ad13-11f1-b34d-1607ee4eb77e",55,["D",1789043637239],"/**\n * Stateless request helpers for server scenarios (SEP-2575 + SEP-2243).\n *\n * Every request the harness sends to a server under test carries the\n * cross-cutting obligations regardless of what a scenario actually tests:\n * the standard headers (MCP-Protocol-Version, Mcp-Method, Mcp-Name, Accept)\n * and the `_meta` fields (protocolVersion, clientInfo, clientCapabilities),\n * pinned to `DRAFT_PROTOCOL_VERSION`. Scenarios exercising these SEPs MUST\n * build their requests through these helpers so a strictly-conformant server\n * never rejects harness traffic for reasons unrelated to the behaviour under\n * test (issues #311, #312, #315).\n */\n\nimport { DRAFT_PROTOCOL_VERSION } from '../../types.ts';\n\nexport interface JsonRpcResponse {\n jsonrpc: '2.0';\n id: number | string | null;\n result?: Record;\n error?: { code: number; message: string; data?: unknown };\n}\n\nexport const CONFORMANCE_CLIENT_INFO = {\n name: 'conformance-test-client',\n version: '1.0.0'\n} as const;\n\nexport const DEFAULT_CLIENT_CAPABILITIES = {\n sampling: {},\n elicitation: {},\n roots: { listChanged: true }\n} as const;\n\nexport interface StatelessResponse {\n status: number;\n headers: Headers;\n contentType?: string;\n /** The parsed JSON-RPC message (for SSE: the event matching the request id). */\n body?: JsonRpcResponse;\n /** All parsed events when the response was an SSE / chunked stream. */\n events?: unknown[];\n /** Raw response text when it could not be parsed as JSON. */\n text?: string;\n}\n\nlet nextRequestId = 1;\n\n/**\n * The `Mcp-Name` source field per SEP-2243: `params.name` for tools/call and\n * prompts/get, `params.uri` for resources/read; absent otherwise.\n */\nexport function mcpNameForRequest(\n method: string,\n params?: Record\n): string | undefined {\n if (method === 'tools/call' || method === 'prompts/get') {\n return typeof params?.name === 'string' ? params.name : undefined;\n }\n if (method === 'resources/read') {\n return typeof params?.uri === 'string' ? params.uri : undefined;\n }\n return undefined;\n}\n\n/**\n * Build the conformant header set for a stateless request: Content-Type,\n * Accept (both content types), MCP-Protocol-Version, Mcp-Method and (when the\n * method carries one) Mcp-Name. `options.headers` overrides or extends the\n * defaults, replacing any default whose name matches case-insensitively.\n */\nexport function buildStandardHeaders(\n method: string,\n params?: Record,\n options: { headers?: Record } = {}\n): Record {\n const headers: Record = {\n 'Content-Type': 'application/json',\n Accept: 'application/json, text/event-stream',\n 'MCP-Protocol-Version': DRAFT_PROTOCOL_VERSION,\n 'Mcp-Method': method\n };\n const name = mcpNameForRequest(method, params);\n if (name !== undefined) {\n headers['Mcp-Name'] = name;\n }\n\n if (options.headers) {\n for (const [key, value] of Object.entries(options.headers)) {\n // Replace any default that differs only by case, then set the override.\n for (const existing of Object.keys(headers)) {\n if (existing.toLowerCase() === key.toLowerCase()) {\n delete headers[existing];\n }\n }\n headers[key] = value;\n }\n }\n\n return headers;\n}\n\n/**\n * Merge params with the conformant `_meta` required on every stateless\n * request. Keys already present in `params._meta` win over the defaults.\n */\nexport function withRequestMeta(\n params?: Record\n): Record {\n return {\n ...params,\n _meta: {\n 'io.modelcontextprotocol/protocolVersion': DRAFT_PROTOCOL_VERSION,\n 'io.modelcontextprotocol/clientInfo': CONFORMANCE_CLIENT_INFO,\n 'io.modelcontextprotocol/clientCapabilities': DEFAULT_CLIENT_CAPABILITIES,\n ...(params?._meta as Record | undefined)\n }\n };\n}\n\nfunction isJsonRpcResponseShaped(event: unknown): event is JsonRpcResponse {\n return (\n typeof event === 'object' &&\n event !== null &&\n ('result' in event || 'error' in event)\n );\n}\n\nfunction parseSseLineInto(events: unknown[], rawLine: string): void {\n const line = rawLine.trim();\n if (!line) return;\n const jsonText = line.startsWith('data:')\n ? line.replace(/^data:\\s*/, '')\n : line;\n try {\n events.push(JSON.parse(jsonText));\n } catch {\n // Non-JSON line (comments, partial frames) — ignore.\n }\n}\n\n/**\n * Read an SSE / chunked-stream response incrementally and resolve as soon as\n * the JSON-RPC response matching `requestId` arrives, without waiting for the\n * stream to close. If the stream ends (or is aborted) first, returns whatever\n * events were parsed, with `body` set to the last response-shaped event.\n */\nexport async function readSseJsonRpcResponse(\n res: Response,\n requestId: number | string | null\n): Promise<{ events: unknown[]; body?: JsonRpcResponse }> {\n const events: unknown[] = [];\n const matchesRequest = (event: unknown): event is JsonRpcResponse =>\n isJsonRpcResponseShaped(event) && event.id === requestId;\n const finish = (): { events: unknown[]; body?: JsonRpcResponse } => {\n const match = events.find(matchesRequest);\n const lastResponseShaped = [...events]\n .reverse()\n .find(isJsonRpcResponseShaped);\n return { events, body: match ?? lastResponseShaped };\n };\n\n if (!res.body) return finish();\n\n const reader = res.body.getReader();\n const decoder = new TextDecoder();\n let buffer = '';\n\n try {\n for (;;) {\n let value: Uint8Array | undefined;\n let done = false;\n try {\n ({ value, done } = await reader.read());\n } catch {\n // The stream was aborted (timeout) or dropped — return what arrived.\n break;\n }\n\n if (value) {\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(/\\r?\\n/);\n buffer = lines.pop() ?? '';\n for (const line of lines) parseSseLineInto(events, line);\n\n if (events.some(matchesRequest)) {\n // The response we were waiting for arrived; stop reading the stream.\n await reader.cancel().catch(() => {});\n break;\n }\n }\n\n if (done) {\n parseSseLineInto(events, buffer);\n buffer = '';\n break;\n }\n }\n } finally {\n try {\n reader.releaseLock();\n } catch {\n // Lock already released (e.g. after cancel) — nothing to do.\n }\n }\n\n return finish();\n}\n\n/**\n * Send a single stateless JSON-RPC request with the full set of cross-cutting\n * headers and `_meta`. Handles both JSON and SSE responses.\n */\nexport async function sendStatelessRequest(\n serverUrl: string,\n method: string,\n params?: Record,\n options: { headers?: Record; timeoutMs?: number } = {}\n): Promise {\n const id = nextRequestId++;\n const headers = buildStandardHeaders(method, params, {\n headers: options.headers\n });\n const body = JSON.stringify({\n jsonrpc: '2.0',\n id,\n method,\n params: withRequestMeta(params)\n });\n\n const controller = new AbortController();\n const timeout = setTimeout(\n () => controller.abort(),\n options.timeoutMs ?? 10000\n );\n try {\n const res = await fetch(serverUrl, {\n method: 'POST',\n headers,\n body,\n signal: controller.signal\n });\n\n const contentType = res.headers.get('content-type') ?? undefined;\n\n if (contentType?.includes('text/event-stream')) {\n // Read the stream incrementally and resolve on the matching response —\n // a server that keeps the stream open must not stall the harness.\n const { events, body: matched } = await readSseJsonRpcResponse(res, id);\n return {\n status: res.status,\n headers: res.headers,\n contentType,\n events,\n body: matched\n };\n }\n\n const text = await res.text();\n try {\n return {\n status: res.status,\n headers: res.headers,\n contentType,\n body: text ? (JSON.parse(text) as JsonRpcResponse) : undefined\n };\n } catch {\n return { status: res.status, headers: res.headers, contentType, text };\n }\n } finally {\n clearTimeout(timeout);\n // Tear down any still-open SSE stream so sockets don't linger.\n controller.abort();\n }\n}\n",[],[142,474,499,517],"e4779131-7102-409d-aeea-312e80a8997b","sse-polling.ts","d97d6d6e-ad13-11f1-ad25-1607ee4eb77e",97,["D",1789046870411],"/**\n * SSE Polling conformance test scenarios for MCP servers (SEP-1699)\n *\n * Tests that servers properly implement SSE polling behavior including:\n * - Sending priming events with event ID and empty data on POST SSE streams\n * - Sending retry field in priming events when configured\n * - Closing SSE stream mid-operation and resuming after client reconnects\n * - Replaying events when client reconnects with Last-Event-ID\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport type { RunContext } from '../../connection/index.ts';\nimport { EventSourceParserStream } from 'npm:eventsource-parser@^3.0.8/stream';\nimport { Client } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/index.js';\nimport { StreamableHTTPClientTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/streamableHttp.js';\nimport { terminateSessionBestEffort } from '../../connection/sdk-client.ts';\n\nfunction createLoggingFetch(checks: ConformanceCheck[]) {\n return async (url: string, options: RequestInit): Promise => {\n const method = options.method || 'GET';\n let description = `Sending ${method} request`;\n if (options.body) {\n try {\n const body = JSON.parse(options.body as string);\n if (body.method) {\n description = `Sending ${method} ${body.method}`;\n }\n } catch {\n // Not JSON\n }\n }\n\n checks.push({\n id: 'outgoing-request',\n name: 'OutgoingRequest',\n description,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n method,\n url,\n headers: options.headers,\n body: options.body ? JSON.parse(options.body as string) : undefined\n }\n });\n\n const response = await fetch(url, options);\n\n const responseHeaders: Record = {};\n response.headers.forEach((value, key) => {\n responseHeaders[key] = value;\n });\n\n checks.push({\n id: 'incoming-response',\n name: 'IncomingResponse',\n description: `Received ${response.status} response for ${method}`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n statusCode: response.status,\n headers: responseHeaders\n }\n });\n\n return response;\n };\n}\n\nexport class ServerSSEPollingScenario implements ClientScenario {\n name = 'server-sse-polling';\n readonly source = {\n introducedIn: '2025-11-25',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description =\n 'Test server SSE polling via test_reconnection tool that closes stream mid-call (SEP-1699)';\n\n async run(ctx: RunContext): Promise {\n const { serverUrl, specVersion } = ctx;\n const checks: ConformanceCheck[] = [];\n\n let sessionId: string | undefined;\n let negotiatedProtocolVersion: string | undefined;\n let client: Client | undefined;\n let transport: StreamableHTTPClientTransport | undefined;\n\n try {\n // Step 1: Initialize session with the server\n client = new Client(\n {\n name: 'conformance-test-client',\n version: '1.0.0'\n },\n {\n capabilities: {\n sampling: {},\n elicitation: {}\n }\n }\n );\n\n transport = new StreamableHTTPClientTransport(new URL(serverUrl));\n await client.connect(transport);\n\n // Extract session ID and negotiated protocol version from transport\n sessionId = transport.sessionId;\n negotiatedProtocolVersion = transport.protocolVersion;\n\n if (!sessionId) {\n checks.push({\n id: 'server-sse-polling-session',\n name: 'ServerSSEPollingSession',\n description: 'Server provides session ID for SSE polling tests',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n message:\n 'Server did not provide session ID - SSE polling tests may not work correctly'\n }\n });\n }\n\n // Step 2: Call test_reconnection tool via raw fetch to observe SSE behavior\n // This tool should close the stream mid-call, requiring reconnection\n const loggingFetch = createLoggingFetch(checks);\n\n const postResponse = await loggingFetch(serverUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Accept: 'text/event-stream, application/json',\n ...(sessionId && { 'mcp-session-id': sessionId }),\n 'mcp-protocol-version': negotiatedProtocolVersion ?? specVersion\n },\n body: JSON.stringify({\n jsonrpc: '2.0',\n id: 1,\n method: 'tools/call',\n params: {\n name: 'test_reconnection',\n arguments: {}\n }\n })\n });\n\n if (!postResponse.ok) {\n // Check if tool doesn't exist (method not found or similar)\n if (postResponse.status === 400 || postResponse.status === 404) {\n checks.push({\n id: 'server-sse-test-reconnection-tool',\n name: 'ServerTestReconnectionTool',\n description:\n 'Server implements test_reconnection tool for SSE polling tests',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: `Server does not implement test_reconnection tool (HTTP ${postResponse.status}). This tool is recommended for testing SSE polling behavior.`,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ]\n });\n return checks;\n }\n\n checks.push({\n id: 'server-sse-post-request',\n name: 'ServerSSEPostRequest',\n description: 'Server accepts POST request with SSE stream response',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Server returned HTTP ${postResponse.status}`,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ]\n });\n return checks;\n }\n\n // Check if server returned SSE stream\n const contentType = postResponse.headers.get('content-type');\n if (!contentType?.includes('text/event-stream')) {\n checks.push({\n id: 'server-sse-content-type',\n name: 'ServerSSEContentType',\n description: 'Server returns text/event-stream for POST request',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n contentType,\n message:\n 'Server returned JSON instead of SSE stream - priming event tests not applicable'\n }\n });\n return checks;\n }\n\n // Step 3: Parse SSE stream for priming event and tool response\n let hasEventId = false;\n let hasPrimingEvent = false;\n let primingEventIsFirst = false;\n let hasRetryField = false;\n let retryValue: number | undefined;\n let lastEventId: string | undefined;\n let eventCount = 0;\n let receivedToolResponse = false;\n\n if (!postResponse.body) {\n checks.push({\n id: 'server-sse-polling-stream',\n name: 'ServerSSEPollingStream',\n description: 'Server provides SSE response body',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'Response body is null',\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ]\n });\n return checks;\n }\n\n const reader = postResponse.body\n .pipeThrough(new TextDecoderStream())\n .pipeThrough(\n new EventSourceParserStream({\n onRetry: (retryMs: number) => {\n hasRetryField = true;\n retryValue = retryMs;\n }\n })\n )\n .getReader();\n\n // Read events with timeout - expect stream to close before we get the response\n const timeout = setTimeout(() => {\n reader.cancel();\n }, 10000);\n\n try {\n while (true) {\n const { value: event, done } = await reader.read();\n\n if (done) {\n break;\n }\n\n eventCount++;\n\n // Track the last event ID for reconnection\n if (event.id) {\n hasEventId = true;\n lastEventId = event.id;\n\n // Check if this is a priming event (empty or minimal data)\n const isPriming =\n event.data === '' ||\n event.data === '{}' ||\n event.data.trim() === '';\n if (isPriming) {\n hasPrimingEvent = true;\n // Check if priming event is the first event\n if (eventCount === 1) {\n primingEventIsFirst = true;\n }\n }\n\n // Log the SSE event\n checks.push({\n id: 'incoming-sse-event',\n name: 'IncomingSseEvent',\n description: isPriming\n ? `Received SSE priming event (id: ${event.id})`\n : `Received SSE event (id: ${event.id})`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId: event.id,\n eventType: event.event || 'message',\n isPriming,\n hasRetryField,\n retryValue,\n data: event.data\n }\n });\n }\n\n // Check if this is the tool response\n if (event.data) {\n try {\n const parsed = JSON.parse(event.data);\n if (parsed.id === 1 && parsed.result) {\n receivedToolResponse = true;\n const isError = parsed.result?.isError === true;\n checks.push({\n id: 'incoming-sse-event',\n name: 'IncomingSseEvent',\n description: `Received tool response on POST stream`,\n status: isError ? 'FAILURE' : 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId: event.id,\n body: parsed\n },\n ...(isError && { errorMessage: `Tool call failed` })\n });\n }\n } catch {\n // Not JSON, ignore\n }\n }\n }\n } finally {\n clearTimeout(timeout);\n }\n\n // Log stream closure\n checks.push({\n id: 'stream-closed',\n name: 'StreamClosed',\n description: `POST SSE stream closed after ${eventCount} event(s)`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventCount,\n lastEventId,\n receivedToolResponse\n }\n });\n\n // Check 1: Server SHOULD send priming event with ID on POST SSE stream\n let primingStatus: 'SUCCESS' | 'WARNING' = 'SUCCESS';\n let primingErrorMessage: string | undefined;\n\n if (!hasPrimingEvent) {\n primingStatus = 'WARNING';\n primingErrorMessage =\n 'Server did not send priming event with id and empty data on POST SSE stream. This is recommended for resumability.';\n } else if (!primingEventIsFirst) {\n primingStatus = 'WARNING';\n primingErrorMessage =\n 'Priming event was not sent first. It should be sent immediately when the SSE stream is established.';\n }\n\n checks.push({\n id: 'server-sse-priming-event',\n name: 'ServerSendsPrimingEvent',\n description:\n 'Server SHOULD send priming event with id and empty data on POST SSE streams',\n status: primingStatus,\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n hasPrimingEvent,\n primingEventIsFirst,\n hasEventId,\n lastEventId,\n eventCount\n },\n errorMessage: primingErrorMessage\n });\n\n // Check 2: Server SHOULD send retry field in priming event\n checks.push({\n id: 'server-sse-retry-field',\n name: 'ServerSendsRetryField',\n description:\n 'Server SHOULD send retry field to control client reconnection timing',\n status: hasRetryField ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n hasRetryField,\n retryValue\n },\n errorMessage: !hasRetryField\n ? 'Server did not send retry field. This is recommended for controlling client reconnection timing.'\n : undefined\n });\n\n // Step 4: If tool response wasn't received, reconnect with Last-Event-ID\n if (!receivedToolResponse && lastEventId && sessionId) {\n // Make a GET request with Last-Event-ID to get the tool response\n const getResponse = await loggingFetch(serverUrl, {\n method: 'GET',\n headers: {\n Accept: 'text/event-stream',\n 'mcp-session-id': sessionId,\n 'mcp-protocol-version': negotiatedProtocolVersion ?? specVersion,\n 'last-event-id': lastEventId\n }\n });\n\n if (getResponse.ok && getResponse.body) {\n const reconnectReader = getResponse.body\n .pipeThrough(new TextDecoderStream())\n .pipeThrough(new EventSourceParserStream())\n .getReader();\n\n const reconnectTimeout = setTimeout(() => {\n reconnectReader.cancel();\n }, 5000);\n\n try {\n while (true) {\n const { value: event, done } = await reconnectReader.read();\n if (done) break;\n\n // Log each event received on GET stream\n checks.push({\n id: 'incoming-sse-event',\n name: 'IncomingSseEvent',\n description: `Received SSE event on GET reconnection stream (id: ${event.id || 'none'})`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId: event.id,\n eventType: event.event || 'message',\n data: event.data\n }\n });\n\n // Check if this is the tool response\n if (event.data) {\n try {\n const parsed = JSON.parse(event.data);\n if (parsed.id === 1 && parsed.result) {\n receivedToolResponse = true;\n break;\n }\n } catch {\n // Not JSON, ignore\n }\n }\n }\n } finally {\n clearTimeout(reconnectTimeout);\n }\n\n checks.push({\n id: 'server-sse-disconnect-resume',\n name: 'ServerDisconnectResume',\n description:\n 'Server closes SSE stream mid-call and resumes after client reconnects with Last-Event-ID',\n status: receivedToolResponse ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n lastEventIdUsed: lastEventId,\n receivedToolResponse,\n message: receivedToolResponse\n ? 'Successfully received tool response after reconnection'\n : 'Tool response not received after reconnection'\n },\n errorMessage: !receivedToolResponse\n ? 'Server did not send tool response after client reconnected with Last-Event-ID'\n : undefined\n });\n } else {\n // Check if server doesn't support standalone GET streams\n if (getResponse.status === 405) {\n checks.push({\n id: 'server-sse-disconnect-resume',\n name: 'ServerDisconnectResume',\n description:\n 'Server supports GET reconnection with Last-Event-ID',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n statusCode: getResponse.status,\n message:\n 'Server does not support standalone GET SSE endpoint (405 Method Not Allowed)'\n }\n });\n } else {\n checks.push({\n id: 'server-sse-disconnect-resume',\n name: 'ServerDisconnectResume',\n description:\n 'Server supports GET reconnection with Last-Event-ID',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n statusCode: getResponse.status,\n lastEventIdUsed: lastEventId,\n message: `Server returned ${getResponse.status} for GET request with Last-Event-ID`\n },\n errorMessage: `Server did not accept reconnection with Last-Event-ID (HTTP ${getResponse.status})`\n });\n }\n }\n } else if (receivedToolResponse) {\n // Tool response was received on the initial POST stream (server didn't disconnect)\n checks.push({\n id: 'server-sse-disconnect-resume',\n name: 'ServerDisconnectResume',\n description:\n 'Server closes SSE stream mid-call and resumes after reconnection',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n receivedToolResponse: true,\n message:\n 'Tool response received on initial POST stream - server did not disconnect mid-call. The test_reconnection tool should close the stream before sending the result.'\n }\n });\n } else {\n checks.push({\n id: 'server-sse-disconnect-resume',\n name: 'ServerDisconnectResume',\n description:\n 'Server closes SSE stream mid-call and resumes after reconnection',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n lastEventId,\n sessionId,\n message:\n 'Could not test disconnect/resume - no last event ID or session ID available'\n }\n });\n }\n } catch (error) {\n checks.push({\n id: 'server-sse-polling-error',\n name: 'ServerSSEPollingTest',\n description: 'Test server SSE polling behavior',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Error: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ]\n });\n } finally {\n // Clean up: terminate the session before closing the client so the\n // server is left hermetic.\n if (transport) {\n await terminateSessionBestEffort(transport, serverUrl);\n }\n if (client) {\n try {\n await client.close();\n } catch {\n // Ignore cleanup errors\n }\n }\n }\n\n return checks;\n }\n}\n",[],[142,474,499,525],"166889dc-c4b2-4fde-9146-2f94988d9c09","sse-multiple-streams.ts","d937efaa-ad13-11f1-b329-1607ee4eb77e",96,["D",1789046869605],"/**\n * SSE Multiple Streams conformance test scenarios for MCP servers (SEP-1699)\n *\n * Tests that servers properly support multiple concurrent SSE streams:\n * - Accepting multiple POST requests that return SSE streams simultaneously\n * - Each POST request gets its own stream with unique stream ID\n *\n * Note: The standalone GET stream (without Last-Event-ID) is limited to one per session.\n * Multiple concurrent streams are achieved via POST requests, each getting their own stream.\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport { buildStandardHeaders, type RunContext } from '../../connection/index.ts';\nimport { EventSourceParserStream } from 'npm:eventsource-parser@^3.0.8/stream';\nimport { Client } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/index.js';\nimport { StreamableHTTPClientTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/streamableHttp.js';\nimport { terminateSessionBestEffort } from '../../connection/sdk-client.ts';\n\nexport class ServerSSEMultipleStreamsScenario implements ClientScenario {\n name = 'server-sse-multiple-streams';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Test server supports multiple concurrent POST SSE streams (SEP-1699)';\n\n async run(ctx: RunContext): Promise {\n const { serverUrl, specVersion } = ctx;\n const checks: ConformanceCheck[] = [];\n\n // Concurrent POSTs (each answered with JSON or its own SSE stream) are\n // core transport behavior in every spec version. Only the request\n // scaffolding differs: the stateful lifecycle needs a session id from an\n // initialize handshake, the stateless lifecycle carries _meta + the\n // MCP-Protocol-Version header on each request instead.\n const stateless = specVersion === DRAFT_PROTOCOL_VERSION;\n\n let sessionId: string | undefined;\n let negotiatedProtocolVersion: string | undefined;\n let client: Client | undefined;\n let transport: StreamableHTTPClientTransport | undefined;\n\n try {\n if (!stateless) {\n // Step 1 (stateful): Initialize session with the server\n client = new Client(\n {\n name: 'conformance-test-client',\n version: '1.0.0'\n },\n {\n capabilities: {\n sampling: {},\n elicitation: {}\n }\n }\n );\n\n transport = new StreamableHTTPClientTransport(new URL(serverUrl));\n await client.connect(transport);\n\n // Extract session ID and negotiated protocol version from transport\n sessionId = (transport as unknown as { sessionId?: string }).sessionId;\n negotiatedProtocolVersion = transport.protocolVersion;\n\n if (!sessionId) {\n checks.push({\n id: 'server-sse-multiple-streams-session',\n name: 'ServerSSEMultipleStreamsSession',\n description: 'Server provides session ID for multiple streams test',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n message:\n 'Server did not provide session ID - multiple streams test may not work correctly'\n }\n });\n return checks;\n }\n }\n\n // Stateless requests carry the full SEP-2243 header set (Mcp-Method,\n // MCP-Protocol-Version, ...) so a strictly-conformant server doesn't\n // reject them before the multi-stream behaviour under test is exercised.\n const requestHeaders: Record = stateless\n ? buildStandardHeaders('tools/list', undefined, {\n headers: { Accept: 'text/event-stream, application/json' },\n specVersion\n })\n : {\n 'Content-Type': 'application/json',\n Accept: 'text/event-stream, application/json',\n 'mcp-session-id': sessionId!,\n 'mcp-protocol-version': negotiatedProtocolVersion ?? specVersion\n };\n const requestParams = stateless\n ? {\n _meta: {\n 'io.modelcontextprotocol/protocolVersion': DRAFT_PROTOCOL_VERSION,\n 'io.modelcontextprotocol/clientInfo': {\n name: 'conformance-test-client',\n version: '1.0.0'\n },\n 'io.modelcontextprotocol/clientCapabilities': {}\n }\n }\n : {};\n\n // Step 2: Open multiple POST SSE streams concurrently\n // Each POST request gets its own stream with unique streamId\n // Spec says: \"The client MAY remain connected to multiple SSE streams simultaneously\"\n const streamResponses: Response[] = [];\n const numStreams = 3;\n\n // Launch all POST requests concurrently\n const postPromises = [];\n for (let i = 0; i < numStreams; i++) {\n const promise = fetch(serverUrl, {\n method: 'POST',\n headers: requestHeaders,\n body: JSON.stringify({\n jsonrpc: '2.0',\n id: 1000 + i, // Different request IDs for each stream\n method: 'tools/list',\n params: requestParams\n })\n });\n postPromises.push(promise);\n }\n\n // Wait for all responses\n const responses = await Promise.all(postPromises);\n streamResponses.push(...responses);\n\n // Check that all streams were accepted (HTTP 200)\n const allAccepted = streamResponses.every((r) => r.ok);\n const statuses = streamResponses.map((r) => r.status);\n const contentTypes = streamResponses.map((r) =>\n r.headers.get('content-type')\n );\n\n // Count how many returned SSE streams vs JSON\n const sseStreams = contentTypes.filter((ct) =>\n ct?.includes('text/event-stream')\n ).length;\n\n checks.push({\n id: 'server-accepts-multiple-post-streams',\n name: 'ServerAcceptsMultiplePostStreams',\n description:\n 'Server allows multiple concurrent POST requests (each may return SSE or JSON)',\n status: allAccepted ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n numStreamsAttempted: numStreams,\n numStreamsAccepted: statuses.filter((s) => s === 200).length,\n numSseStreams: sseStreams,\n statuses,\n contentTypes\n },\n errorMessage: !allAccepted\n ? `Server rejected some requests. Statuses: ${statuses.join(', ')}`\n : undefined\n });\n\n // Step 3: Verify SSE streams are functional by reading events\n // Only test streams that returned SSE content-type\n const eventResults = await Promise.all(\n streamResponses.map(async (response, index) => {\n const contentType = response.headers.get('content-type');\n\n // Skip non-SSE responses (JSON responses are also valid)\n if (!contentType?.includes('text/event-stream')) {\n return { index, type: 'json', skipped: true };\n }\n\n if (!response.ok || !response.body) {\n return { index, type: 'sse', error: 'Stream not available' };\n }\n\n try {\n const reader = response.body\n .pipeThrough(new TextDecoderStream())\n .pipeThrough(new EventSourceParserStream())\n .getReader();\n\n // Wait for one event with timeout\n const timeoutPromise = new Promise((resolve) =>\n setTimeout(() => resolve(null), 2000)\n );\n\n const eventPromise = reader.read().then(({ value }) => value);\n\n const event = await Promise.race([eventPromise, timeoutPromise]);\n\n // Cancel reader\n await reader.cancel();\n\n return { index, type: 'sse', event };\n } catch (error) {\n return {\n index,\n type: 'sse',\n error: error instanceof Error ? error.message : String(error)\n };\n }\n })\n );\n\n // Count functional SSE streams (received event or timed out waiting - both are valid)\n const sseResults = eventResults.filter((r) => r.type === 'sse');\n const functionalSseStreams = sseResults.filter(\n (r) => !('error' in r)\n ).length;\n\n // If server returned SSE streams, they should be functional\n if (sseStreams > 0) {\n checks.push({\n id: 'server-sse-streams-functional',\n name: 'ServerSSEStreamsFunctional',\n description: 'Multiple POST SSE streams should be functional',\n status:\n functionalSseStreams === sseStreams\n ? 'SUCCESS'\n : functionalSseStreams > 0\n ? 'WARNING'\n : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n numSseStreams: sseStreams,\n functionalSseStreams,\n results: eventResults\n },\n errorMessage:\n functionalSseStreams < sseStreams\n ? `Only ${functionalSseStreams}/${sseStreams} SSE streams were functional`\n : undefined\n });\n } else {\n // Server returned JSON for all requests - this is valid but worth noting\n checks.push({\n id: 'server-sse-streams-functional',\n name: 'ServerSSEStreamsFunctional',\n description: 'Server returned JSON responses (SSE streams optional)',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n numSseStreams: 0,\n message:\n 'Server returned JSON for all requests - SSE streaming is optional',\n results: eventResults\n }\n });\n }\n } catch (error) {\n checks.push({\n id: 'server-sse-multiple-streams-error',\n name: 'ServerSSEMultipleStreamsTest',\n description: 'Test server multiple SSE streams behavior',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Error: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ]\n });\n } finally {\n // Clean up: terminate the session before closing the client so the\n // server is left hermetic.\n if (transport) {\n await terminateSessionBestEffort(transport, serverUrl);\n }\n if (client) {\n try {\n await client.close();\n } catch {\n // Ignore cleanup errors\n }\n }\n }\n\n return checks;\n }\n}\n",[],[142,474,499,533],"b81afe4b-8447-4979-8208-b2c7bb088f0e","session-lifecycle.ts","6d8a35b2-ad1b-11f1-a7bc-1607ee4eb77e",104,["D",1789046873853],"/**\n * Session lifecycle conformance test scenario for MCP servers.\n *\n * Verifies the two server-side guarantees the Streamable HTTP transport spec\n * places on session termination:\n *\n * 1. The server accepts an HTTP DELETE that carries the issued session ID.\n * 2. After such a DELETE, a subsequent request bearing the terminated\n * session ID is rejected with HTTP 404 Not Found.\n *\n * See https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#session-management\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport { readSseJsonRpcResponse, type RunContext } from '../../connection/index.ts';\n\nconst SPEC_REFERENCES = [\n {\n id: 'MCP-Session-Management',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#session-management'\n }\n];\n\nconst INITIALIZE_REQUEST_ID = 1;\n\n/**\n * How long to wait for the initialize result body before giving up on\n * extracting the negotiated protocol version. A server that answers the\n * initialize POST with a long-lived SSE stream and never emits the response\n * must not hang the run; on timeout the caller falls back to the requested\n * spec version.\n */\nconst NEGOTIATED_VERSION_TIMEOUT_MS = 5_000;\n\nconst TOOLS_LIST_BODY = {\n jsonrpc: '2.0',\n id: 2,\n method: 'tools/list',\n params: {}\n};\n\ninterface CheckDef {\n id: string;\n name: string;\n description: string;\n}\n\nconst LIFECYCLE_ERROR: CheckDef = {\n id: 'server-session-lifecycle-error',\n name: 'SessionLifecycleError',\n description: 'Session lifecycle test execution'\n};\n\nconst INITIALIZED_ACCEPTED: CheckDef = {\n id: 'server-session-initialized-accepted',\n name: 'SessionInitializedAccepted',\n description:\n 'Server accepts the initialized notification on the issued session ID with a 2xx response'\n};\n\nconst DELETE_ACCEPTED: CheckDef = {\n id: 'server-session-delete-accepted',\n name: 'SessionDeleteAccepted',\n description: 'Server accepts HTTP DELETE on the issued session ID'\n};\n\nconst TERMINATED_RETURNS_404: CheckDef = {\n id: 'server-session-terminated-returns-404',\n name: 'SessionTerminatedReturns404',\n description:\n 'Server returns HTTP 404 for requests bearing a terminated session ID'\n};\n\nfunction check(\n def: CheckDef,\n status: ConformanceCheck['status'],\n extras: Pick, 'errorMessage' | 'details'> = {}\n): ConformanceCheck {\n return {\n ...def,\n status,\n timestamp: new Date().toISOString(),\n specReferences: SPEC_REFERENCES,\n ...extras\n };\n}\n\n/**\n * Extract the protocol version the server negotiated in its initialize\n * result. Returns undefined when the body cannot be parsed or does not\n * arrive within the timeout; the caller falls back to the requested spec\n * version.\n */\nasync function negotiatedProtocolVersion(\n initResponse: Response\n): Promise {\n const parse = async (): Promise => {\n const contentType = initResponse.headers.get('content-type') ?? '';\n let body: unknown;\n if (contentType.includes('text/event-stream')) {\n body = (await readSseJsonRpcResponse(initResponse, INITIALIZE_REQUEST_ID))\n .body;\n } else {\n body = await initResponse.json();\n }\n const result = (body as { result?: { protocolVersion?: unknown } } | null)\n ?.result;\n return typeof result?.protocolVersion === 'string'\n ? result.protocolVersion\n : undefined;\n };\n\n let timer: NodeJS.Timeout | undefined;\n try {\n return await Promise.race([\n parse(),\n new Promise((resolve) => {\n timer = setTimeout(\n () => resolve(undefined),\n NEGOTIATED_VERSION_TIMEOUT_MS\n );\n })\n ]);\n } catch {\n return undefined;\n } finally {\n clearTimeout(timer);\n }\n}\n\nexport class SessionLifecycleScenario implements ClientScenario {\n name = 'server-session-lifecycle';\n // Sessions were removed entirely from the draft spec (SEP-2575), so the\n // lifecycle checks only apply to the dated stateful versions.\n readonly source = {\n introducedIn: '2025-03-26',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = `Verify the server honours the streamable-HTTP session\ntermination contract.\n\n**Server Implementation Requirements:**\n\n- Accept an HTTP DELETE to the MCP endpoint that carries the issued\n \\`Mcp-Session-Id\\` header (or respond 405 if the server does not support\n explicit termination). The spec does not pin a success status, so any\n other response is reported as a warning rather than a failure.\n- After such a DELETE, return HTTP 404 Not Found for subsequent requests\n bearing the terminated session ID.\n\nServers without session management (stateless) are reported as SKIPPED.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl, specVersion } = ctx;\n const checks: ConformanceCheck[] = [];\n\n // Every fetch in this scenario shares one AbortController: cancel() on\n // a body whose reader is still locked rejects, so aborting the fetch is\n // the only reliable way to drop a never-ending SSE stream (initialize\n // or any follow-up response) once the scenario finishes.\n const abort = new AbortController();\n\n try {\n // initialize MUST NOT carry MCP-Protocol-Version (the version is being\n // negotiated by the initialize handshake itself).\n const initResponse = await fetch(serverUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Accept: 'application/json, text/event-stream'\n },\n body: JSON.stringify({\n jsonrpc: '2.0',\n id: INITIALIZE_REQUEST_ID,\n method: 'initialize',\n params: {\n protocolVersion: specVersion,\n capabilities: {},\n clientInfo: {\n name: 'conformance-session-lifecycle-test',\n version: '1.0.0'\n }\n }\n }),\n signal: abort.signal\n });\n\n if (!initResponse.ok) {\n checks.push(\n check(LIFECYCLE_ERROR, 'FAILURE', {\n errorMessage: `initialize failed with HTTP ${initResponse.status}; cannot exercise session lifecycle`,\n details: { statusCode: initResponse.status }\n })\n );\n return checks;\n }\n\n const sessionId = initResponse.headers.get('mcp-session-id');\n\n if (!sessionId) {\n checks.push(\n check(\n {\n id: 'server-session-lifecycle-skipped',\n name: 'SessionLifecycleSkipped',\n description:\n 'Server is stateless (no MCP-Session-Id) — lifecycle checks not applicable'\n },\n 'INFO',\n {\n details: {\n message:\n 'Server did not return an MCP-Session-Id header; session lifecycle does not apply.'\n }\n }\n )\n );\n return checks;\n }\n\n // Follow-up requests carry the version the server actually negotiated\n // (2025-06-18+ says the client SHOULD send the negotiated version, and\n // servers MAY reject versions they don't support with 400), falling\n // back to the requested spec version. Hardcoding a newer version here\n // would false-fail servers that negotiated an older one.\n const protocolVersion =\n (await negotiatedProtocolVersion(initResponse)) ?? specVersion;\n\n // Complete the handshake so the server treats the session as live.\n const initializedResponse = await fetch(serverUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Accept: 'application/json, text/event-stream',\n 'MCP-Protocol-Version': protocolVersion,\n 'mcp-session-id': sessionId\n },\n body: JSON.stringify({\n jsonrpc: '2.0',\n method: 'notifications/initialized'\n }),\n signal: abort.signal\n });\n\n if (!initializedResponse.ok) {\n // The session never became live, so the termination checks would be\n // meaningless.\n checks.push(\n check(INITIALIZED_ACCEPTED, 'FAILURE', {\n errorMessage: `Expected 2xx for notifications/initialized, got ${initializedResponse.status}`,\n details: { statusCode: initializedResponse.status }\n }),\n skipped(\n DELETE_ACCEPTED,\n 'Skipped because the initialized notification was rejected; the session never became live.'\n ),\n skipped(\n TERMINATED_RETURNS_404,\n 'Skipped because the initialized notification was rejected; the session never became live.'\n )\n );\n return checks;\n }\n\n checks.push(\n check(INITIALIZED_ACCEPTED, 'SUCCESS', {\n details: { statusCode: initializedResponse.status }\n })\n );\n\n // Step 1: DELETE the session.\n const deleteResponse = await fetch(serverUrl, {\n method: 'DELETE',\n headers: {\n 'mcp-session-id': sessionId,\n 'MCP-Protocol-Version': protocolVersion\n },\n signal: abort.signal\n });\n\n const deleteAccepted =\n deleteResponse.status >= 200 && deleteResponse.status < 300;\n const deleteNotSupported = deleteResponse.status === 405;\n // A 404 could mean the server already considers the session terminated\n // (e.g. it expired between initialize and DELETE) — or that the server\n // simply has no DELETE route. The follow-up request below tells the\n // two apart.\n const deleteReturned404 = deleteResponse.status === 404;\n\n if (deleteNotSupported) {\n // If the server refused DELETE, the terminated-returns-404 check has\n // nothing to assert against.\n checks.push(\n check(DELETE_ACCEPTED, 'SKIPPED', {\n details: {\n statusCode: 405,\n message:\n 'Server returned 405 Method Not Allowed; spec permits servers to refuse explicit DELETE.'\n }\n }),\n skipped(\n TERMINATED_RETURNS_404,\n 'Skipped because the server does not support explicit session termination (405 on DELETE).'\n )\n );\n return checks;\n }\n\n if (!deleteAccepted && !deleteReturned404) {\n // The spec only says the client SHOULD send DELETE and the server\n // MAY respond 405; it never pins a success status, so an unexpected\n // status is a warning rather than a failure. Without a confirmed\n // termination the terminated-returns-404 check would be misleading.\n const warningMessage = `Expected 2xx, 404, or 405 for DELETE, got ${deleteResponse.status}. The spec does not pin a success status for session termination, so this is reported as a warning.`;\n checks.push(\n check(DELETE_ACCEPTED, 'WARNING', {\n errorMessage: warningMessage,\n details: {\n statusCode: deleteResponse.status,\n message: warningMessage\n }\n }),\n skipped(\n TERMINATED_RETURNS_404,\n 'Skipped because the preceding DELETE did not clearly terminate the session; cannot verify 404 behaviour.'\n )\n );\n return checks;\n }\n\n // Step 2: Re-send a request with the terminated session ID and expect 404.\n const afterTerminationResponse = await fetch(serverUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Accept: 'application/json, text/event-stream',\n 'MCP-Protocol-Version': protocolVersion,\n 'mcp-session-id': sessionId\n },\n body: JSON.stringify(TOOLS_LIST_BODY),\n signal: abort.signal\n });\n const terminated404 = afterTerminationResponse.status === 404;\n\n if (deleteReturned404 && !terminated404) {\n // The 404 on DELETE was not a termination: the session still\n // answers. Most likely the server has no DELETE route (it should\n // return 405 in that case).\n const warningMessage = `DELETE returned 404 but the session still responds (HTTP ${afterTerminationResponse.status} on a follow-up request). A server without explicit termination support should return 405.`;\n checks.push(\n check(DELETE_ACCEPTED, 'WARNING', {\n errorMessage: warningMessage,\n details: { statusCode: 404, message: warningMessage }\n }),\n skipped(\n TERMINATED_RETURNS_404,\n 'Skipped because the preceding DELETE did not terminate the session; cannot verify 404 behaviour.'\n )\n );\n return checks;\n }\n\n checks.push(\n check(DELETE_ACCEPTED, 'SUCCESS', {\n details: deleteReturned404\n ? {\n statusCode: 404,\n message:\n 'Server returned 404 for DELETE and the session no longer responds; treating it as already terminated.'\n }\n : { statusCode: deleteResponse.status }\n })\n );\n\n if (terminated404) {\n checks.push(\n check(TERMINATED_RETURNS_404, 'SUCCESS', {\n details: { statusCode: 404 }\n })\n );\n } else {\n checks.push(\n check(TERMINATED_RETURNS_404, 'FAILURE', {\n errorMessage: `Expected 404 on terminated session ID, got ${afterTerminationResponse.status}`,\n details: { statusCode: afterTerminationResponse.status }\n })\n );\n }\n } catch (error) {\n checks.push(\n check(LIFECYCLE_ERROR, 'FAILURE', {\n errorMessage: `Failed to exercise session lifecycle: ${\n error instanceof Error ? error.message : String(error)\n }`\n })\n );\n } finally {\n // Drop whatever is left of any response (e.g. a still-open SSE\n // stream after the negotiation timeout, or an unread follow-up body)\n // so it cannot keep the connection alive after the scenario ends. A\n // no-op for bodies that were fully consumed.\n abort.abort();\n }\n\n return checks;\n }\n}\n\nfunction skipped(def: CheckDef, message: string): ConformanceCheck {\n return check(def, 'SKIPPED', { details: { message } });\n}\n",[],[142,474,499,541],"aa616835-7004-4646-a541-2c530e797254","resources.ts","d8f2080a-ad13-11f1-9be5-1607ee4eb77e",95,["D",1789046868576],"/**\n * Resources test scenarios for MCP servers\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport { JsonRpcError, type RunContext } from '../../connection/index.ts';\nimport type {\n ListResourcesResult,\n ReadResourceResult,\n TextResourceContents,\n BlobResourceContents,\n EmptyResult\n} from '../../spec-types/2025-06-18.ts';\n\nexport class ResourcesListScenario implements ClientScenario {\n name = 'resources-list';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test listing available resources.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`resources/list\\`\n\n**Requirements**:\n- Return array of all available **direct resources** (not templates)\n- Each resource MUST have:\n - \\`uri\\` (string)\n - \\`name\\` (string)\n - \\`description\\` (string)\n - \\`mimeType\\` (string, optional)`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('resources/list');\n\n // Validate response structure\n const errors: string[] = [];\n if (!result.resources) {\n errors.push('Missing resources array');\n } else {\n if (!Array.isArray(result.resources)) {\n errors.push('resources is not an array');\n }\n\n result.resources.forEach((resource, index) => {\n if (!resource.uri) errors.push(`Resource ${index}: missing uri`);\n if (!resource.name) errors.push(`Resource ${index}: missing name`);\n });\n }\n\n checks.push({\n id: 'resources-list',\n name: 'ResourcesList',\n description: 'Server lists available resources with valid structure',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Resources-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#listing-resources'\n }\n ],\n details: {\n resourceCount: result.resources?.length || 0,\n resources: result.resources?.map((r) => r.uri)\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'resources-list',\n name: 'ResourcesList',\n description: 'Server lists available resources with valid structure',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#listing-resources'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ResourcesReadTextScenario implements ClientScenario {\n name = 'resources-read-text';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test reading text resource.\n\n**Server Implementation Requirements:**\n\nImplement resource \\`test://static-text\\` that returns:\n\n\\`\\`\\`json\n{\n \"contents\": [\n {\n \"uri\": \"test://static-text\",\n \"mimeType\": \"text/plain\",\n \"text\": \"This is the content of the static text resource.\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('resources/read', {\n uri: 'test://static-text'\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.contents) errors.push('Missing contents array');\n if (!Array.isArray(result.contents))\n errors.push('contents is not an array');\n if (result.contents.length === 0) errors.push('contents array is empty');\n\n const content = result.contents[0] as TextResourceContents | undefined;\n if (content) {\n if (!content.uri) errors.push('Content missing uri');\n if (!content.mimeType) errors.push('Content missing mimeType');\n if (!content.text) errors.push('Content missing text field');\n }\n\n checks.push({\n id: 'resources-read-text',\n name: 'ResourcesReadText',\n description: 'Read text resource successfully',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Resources-Read',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#reading-resources'\n }\n ],\n details: {\n uri: content?.uri,\n mimeType: content?.mimeType,\n hasText: !!content?.text\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'resources-read-text',\n name: 'ResourcesReadText',\n description: 'Read text resource successfully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-Read',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#reading-resources'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ResourcesReadBinaryScenario implements ClientScenario {\n name = 'resources-read-binary';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test reading binary resource.\n\n**Server Implementation Requirements:**\n\nImplement resource \\`test://static-binary\\` that returns:\n\n\\`\\`\\`json\n{\n \"contents\": [\n {\n \"uri\": \"test://static-binary\",\n \"mimeType\": \"image/png\",\n \"blob\": \"\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('resources/read', {\n uri: 'test://static-binary'\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.contents) errors.push('Missing contents array');\n if (result.contents.length === 0) errors.push('contents array is empty');\n\n const content = result.contents[0] as BlobResourceContents | undefined;\n if (content) {\n if (!content.uri) errors.push('Content missing uri');\n if (!content.mimeType) errors.push('Content missing mimeType');\n if (!content.blob) errors.push('Content missing blob field');\n }\n\n checks.push({\n id: 'resources-read-binary',\n name: 'ResourcesReadBinary',\n description: 'Read binary resource successfully',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Resources-Read',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#reading-resources'\n }\n ],\n details: {\n uri: content?.uri,\n mimeType: content?.mimeType,\n hasBlob: !!content?.blob\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'resources-read-binary',\n name: 'ResourcesReadBinary',\n description: 'Read binary resource successfully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-Read',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#reading-resources'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ResourcesTemplateReadScenario implements ClientScenario {\n name = 'resources-templates-read';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test reading resource from template.\n\n**Server Implementation Requirements:**\n\nImplement resource template \\`test://template/{id}/data\\` that substitutes parameters.\n\n**Behavior**: When client requests \\`test://template/123/data\\`, substitute \\`{id}\\` with \\`123\\`\n\nReturns (for \\`uri: \"test://template/123/data\"\\`):\n\n\\`\\`\\`json\n{\n \"contents\": [\n {\n \"uri\": \"test://template/123/data\",\n \"mimeType\": \"application/json\",\n \"text\": \"{\"id\":\"123\",\"templateTest\":true,\"data\":\"Data for ID: 123\"}\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('resources/read', {\n uri: 'test://template/123/data'\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.contents) errors.push('Missing contents array');\n if (result.contents.length === 0) errors.push('contents array is empty');\n\n const content = result.contents[0];\n if (content) {\n if (!content.uri) errors.push('Content missing uri');\n const hasText = 'text' in content;\n const hasBlob = 'blob' in content;\n if (!hasText && !hasBlob) errors.push('Content missing text or blob');\n\n const text = hasText\n ? (content as TextResourceContents).text\n : hasBlob\n ? '[binary]'\n : '';\n if (typeof text === 'string' && !text.includes('123')) {\n errors.push('Parameter substitution not reflected in content');\n }\n }\n\n checks.push({\n id: 'resources-templates-read',\n name: 'ResourcesTemplateRead',\n description: 'Read resource from template with parameter substitution',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Resources-Templates',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#resource-templates'\n }\n ],\n details: {\n uri: content?.uri,\n content: content\n ? 'text' in content\n ? (content as TextResourceContents).text\n : (content as BlobResourceContents).blob\n : undefined\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'resources-templates-read',\n name: 'ResourcesTemplateRead',\n description: 'Read resource from template with parameter substitution',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-Templates',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#resource-templates'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ResourcesSubscribeScenario implements ClientScenario {\n name = 'resources-subscribe';\n readonly source = {\n introducedIn: '2025-06-18',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = `Test subscribing to resource updates.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`resources/subscribe\\`\n\n**Requirements**:\n- Accept subscription request with URI\n- Track subscribed URIs\n- Return empty object \\`{}\\`\n\nExample request:\n\n\\`\\`\\`json\n{\n \"method\": \"resources/subscribe\",\n \"params\": {\n \"uri\": \"test://watched-resource\"\n }\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n await conn.request('resources/subscribe', {\n uri: 'test://watched-resource'\n });\n\n checks.push({\n id: 'resources-subscribe',\n name: 'ResourcesSubscribe',\n description: 'Subscribe to resource successfully',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Resources-Subscribe',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#resource-subscriptions'\n }\n ]\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'resources-subscribe',\n name: 'ResourcesSubscribe',\n description: 'Subscribe to resource successfully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-Subscribe',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#resource-subscriptions'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ResourcesNotFoundErrorScenario implements ClientScenario {\n name = 'sep-2164-resource-not-found';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test error handling for non-existent resources (SEP-2164).\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`resources/read\\`\n\nWhen a client requests a URI that does not correspond to any resource, the server:\n\n- **MUST NOT** return a result with an empty \\`contents\\` array\n- **SHOULD** return a JSON-RPC error with code \\`-32602\\` (Invalid Params)\n- **SHOULD** include the requested \\`uri\\` in the error \\`data\\` field\n\nExample error response:\n\n\\`\\`\\`json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": 2,\n \"error\": {\n \"code\": -32602,\n \"message\": \"Resource not found\",\n \"data\": {\n \"uri\": \"test://nonexistent-resource-for-conformance-testing\"\n }\n }\n}\n\\`\\`\\`\n\nThis scenario does not require the server to register any specific resource — it tests behavior when reading a URI the server does not recognize.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n const nonexistentUri =\n 'test://nonexistent-resource-for-conformance-testing';\n const specReferences = [\n {\n id: 'SEP-2164',\n url: 'https://modelcontextprotocol.io/specification/draft/server/resources#error-handling'\n }\n ];\n\n // SEP-2164 is a draft-spec requirement; under --spec-version draft the\n // RunContext-provided connect() resolves to the stateless impl, so the\n // request goes out with the draft protocol version and _meta/headers.\n let conn;\n try {\n conn = await ctx.connect();\n } catch (error) {\n checks.push({\n id: 'sep-2164-error-code',\n name: 'ResourcesNotFoundErrorCode',\n description:\n 'Server returns -32602 (Invalid Params) for non-existent resource',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `resources/read request failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences\n });\n return checks;\n }\n\n let caughtError: unknown;\n let result: { contents: unknown[] } | undefined;\n try {\n result = await conn.request('resources/read', {\n uri: nonexistentUri\n });\n } catch (error) {\n caughtError = error;\n }\n\n // Check 1: MUST NOT return an empty contents array\n const returnedEmptyContents =\n result !== undefined && (result.contents?.length ?? 0) === 0;\n checks.push({\n id: 'sep-2164-no-empty-contents',\n name: 'ResourcesNotFoundNoEmptyContents',\n description:\n 'Server does not return an empty contents array for a non-existent resource',\n status: returnedEmptyContents ? 'FAILURE' : 'SUCCESS',\n timestamp: new Date().toISOString(),\n errorMessage: returnedEmptyContents\n ? 'Server returned a result with an empty contents array. Servers MUST NOT return an empty contents array for non-existent resources.'\n : undefined,\n specReferences,\n details: {\n requestedUri: nonexistentUri,\n receivedResult: result !== undefined,\n contentsLength: result?.contents?.length\n }\n });\n\n // Check 2: SHOULD return JSON-RPC error with code -32602\n const rpcError =\n caughtError instanceof JsonRpcError ? caughtError : undefined;\n const errorCode = rpcError?.code;\n let errorCodeMessage: string | undefined;\n if (result !== undefined) {\n errorCodeMessage = `Server returned a result instead of an error (contents length: ${result.contents?.length ?? 'undefined'}). Servers SHOULD return a JSON-RPC error for non-existent resources.`;\n } else if (rpcError === undefined) {\n errorCodeMessage = `Expected a JSON-RPC error, got: ${caughtError instanceof Error ? caughtError.message : String(caughtError)}`;\n } else if (errorCode !== -32602) {\n errorCodeMessage =\n `Expected error code -32602 (Invalid Params), got ${errorCode}. ` +\n (errorCode === -32002\n ? 'Code -32002 was used in earlier spec versions but SEP-2164 standardizes on -32602.'\n : '');\n }\n\n checks.push({\n id: 'sep-2164-error-code',\n name: 'ResourcesNotFoundErrorCode',\n description:\n 'Server returns -32602 (Invalid Params) for non-existent resource (SHOULD)',\n status: errorCodeMessage === undefined ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: errorCodeMessage,\n specReferences,\n details: {\n requestedUri: nonexistentUri,\n receivedErrorCode: errorCode,\n receivedResult: result !== undefined\n }\n });\n\n // Check 3: SHOULD include uri in error data field\n const errorData = rpcError?.data as { uri?: string } | undefined;\n const dataUriMatches = errorData?.uri === nonexistentUri;\n\n checks.push({\n id: 'sep-2164-data-uri',\n name: 'ResourcesNotFoundDataUri',\n description:\n 'Server includes the requested URI in the error data field (SHOULD)',\n status: rpcError ? (dataUriMatches ? 'SUCCESS' : 'WARNING') : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: rpcError\n ? dataUriMatches\n ? undefined\n : `Error data.uri is ${JSON.stringify(errorData?.uri)}, expected \"${nonexistentUri}\". This is a SHOULD requirement.`\n : 'No JSON-RPC error received; cannot evaluate data field.',\n specReferences,\n details: {\n requestedUri: nonexistentUri,\n receivedDataUri: errorData?.uri\n }\n });\n\n await conn.close();\n return checks;\n }\n}\n\nexport class ResourcesUnsubscribeScenario implements ClientScenario {\n name = 'resources-unsubscribe';\n readonly source = {\n introducedIn: '2025-06-18',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = `Test unsubscribing from resource.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`resources/unsubscribe\\`\n\n**Requirements**:\n- Accept unsubscribe request with URI\n- Remove URI from subscriptions\n- Stop sending update notifications for that URI\n- Return empty object \\`{}\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n // First subscribe\n await conn.request('resources/subscribe', {\n uri: 'test://watched-resource'\n });\n\n // Then unsubscribe\n await conn.request('resources/unsubscribe', {\n uri: 'test://watched-resource'\n });\n\n checks.push({\n id: 'resources-unsubscribe',\n name: 'ResourcesUnsubscribe',\n description: 'Unsubscribe from resource successfully',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Resources-Subscribe',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/schema#unsubscriberequest'\n }\n ]\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'resources-unsubscribe',\n name: 'ResourcesUnsubscribe',\n description: 'Unsubscribe from resource successfully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-Subscribe',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#resource-subscriptions'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,499,549],"387dbb57-b48e-4d71-9726-b51774beee66","prompts.ts","d8a2b69c-ad13-11f1-b329-1607ee4eb77e",94,["D",1789046868148],"/**\n * Prompts test scenarios for MCP servers\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../types.ts';\nimport type { RunContext } from '../../connection/index.ts';\nimport type {\n ListPromptsResult,\n GetPromptResult\n} from '../../spec-types/2025-06-18.ts';\n\nexport class PromptsListScenario implements ClientScenario {\n name = 'prompts-list';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test listing available prompts.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`prompts/list\\`\n\n**Requirements**:\n- Return array of all available prompts\n- Each prompt MUST have:\n - \\`name\\` (string)\n - \\`description\\` (string)\n - \\`arguments\\` (array, optional) - list of required arguments`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('prompts/list');\n\n // Validate response structure\n const errors: string[] = [];\n if (!result.prompts) {\n errors.push('Missing prompts array');\n } else {\n if (!Array.isArray(result.prompts)) {\n errors.push('prompts is not an array');\n }\n\n result.prompts.forEach((prompt, index) => {\n if (!prompt.name) errors.push(`Prompt ${index}: missing name`);\n if (!prompt.description)\n errors.push(`Prompt ${index}: missing description`);\n });\n }\n\n checks.push({\n id: 'prompts-list',\n name: 'PromptsList',\n description: 'Server lists available prompts with valid structure',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Prompts-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#listing-prompts'\n }\n ],\n details: {\n promptCount: result.prompts?.length || 0,\n prompts: result.prompts?.map((p) => p.name)\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'prompts-list',\n name: 'PromptsList',\n description: 'Server lists available prompts with valid structure',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Prompts-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#listing-prompts'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class PromptsGetSimpleScenario implements ClientScenario {\n name = 'prompts-get-simple';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test getting a simple prompt without arguments.\n\n**Server Implementation Requirements:**\n\nImplement a prompt named \\`test_simple_prompt\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"text\",\n \"text\": \"This is a simple prompt for testing.\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('prompts/get', {\n name: 'test_simple_prompt'\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.messages) errors.push('Missing messages array');\n if (!Array.isArray(result.messages))\n errors.push('messages is not an array');\n if (result.messages.length === 0) errors.push('messages array is empty');\n\n result.messages.forEach((message: any, index: number) => {\n if (!message.role) errors.push(`Message ${index}: missing role`);\n if (!message.content) errors.push(`Message ${index}: missing content`);\n });\n\n checks.push({\n id: 'prompts-get-simple',\n name: 'PromptsGetSimple',\n description: 'Get simple prompt successfully',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Prompts-Get',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#getting-prompts'\n }\n ],\n details: {\n messageCount: result.messages?.length || 0\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'prompts-get-simple',\n name: 'PromptsGetSimple',\n description: 'Get simple prompt successfully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Prompts-Get',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#getting-prompts'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class PromptsGetWithArgsScenario implements ClientScenario {\n name = 'prompts-get-with-args';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test parameterized prompt.\n\n**Server Implementation Requirements:**\n\nImplement a prompt named \\`test_prompt_with_arguments\\` with arguments:\n- \\`arg1\\` (string, required) - First test argument\n- \\`arg2\\` (string, required) - Second test argument\n\nReturns (with args \\`{arg1: \"hello\", arg2: \"world\"}\\`):\n\n\\`\\`\\`json\n{\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"text\",\n \"text\": \"Prompt with arguments: arg1='hello', arg2='world'\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('prompts/get', {\n name: 'test_prompt_with_arguments',\n arguments: {\n arg1: 'testValue1',\n arg2: 'testValue2'\n }\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.messages) errors.push('Missing messages array');\n if (result.messages.length === 0) errors.push('messages array is empty');\n\n // Check if arguments were substituted\n const messageText = JSON.stringify(result.messages);\n if (!messageText.includes('testValue1')) {\n errors.push('arg1 not substituted in prompt');\n }\n if (!messageText.includes('testValue2')) {\n errors.push('arg2 not substituted in prompt');\n }\n\n checks.push({\n id: 'prompts-get-with-args',\n name: 'PromptsGetWithArgs',\n description: 'Get parameterized prompt with argument substitution',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Prompts-Get',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#getting-prompts'\n }\n ],\n details: {\n messageCount: result.messages?.length || 0,\n messages: result.messages\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'prompts-get-with-args',\n name: 'PromptsGetWithArgs',\n description: 'Get parameterized prompt with argument substitution',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Prompts-Get',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#getting-prompts'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class PromptsGetEmbeddedResourceScenario implements ClientScenario {\n name = 'prompts-get-embedded-resource';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test prompt with embedded resource content.\n\n**Server Implementation Requirements:**\n\nImplement a prompt named \\`test_prompt_with_embedded_resource\\` with argument:\n- \\`resourceUri\\` (string, required) - URI of the resource to embed\n\nReturns:\n\n\\`\\`\\`json\n{\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"resource\",\n \"resource\": {\n \"uri\": \"\",\n \"mimeType\": \"text/plain\",\n \"text\": \"Embedded resource content for testing.\"\n }\n }\n },\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"text\",\n \"text\": \"Please process the embedded resource above.\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('prompts/get', {\n name: 'test_prompt_with_embedded_resource',\n arguments: {\n resourceUri: 'test://example-resource'\n }\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.messages) errors.push('Missing messages array');\n\n // Look for resource content\n const hasResourceContent = result.messages.some(\n (msg: any) =>\n msg.content?.type === 'resource' ||\n msg.content?.resource !== undefined\n );\n\n if (!hasResourceContent) {\n errors.push('No embedded resource found in prompt');\n }\n\n checks.push({\n id: 'prompts-get-embedded-resource',\n name: 'PromptsGetEmbeddedResource',\n description: 'Get prompt with embedded resource',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Prompts-Embedded-Resources',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#embedded-resources'\n }\n ],\n details: {\n messageCount: result.messages?.length || 0,\n messages: result.messages\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'prompts-get-embedded-resource',\n name: 'PromptsGetEmbeddedResource',\n description: 'Get prompt with embedded resource',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Prompts-Embedded-Resources',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#embedded-resources'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class PromptsGetWithImageScenario implements ClientScenario {\n name = 'prompts-get-with-image';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test prompt with image content.\n\n**Server Implementation Requirements:**\n\nImplement a prompt named \\`test_prompt_with_image\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"image\",\n \"data\": \"\",\n \"mimeType\": \"image/png\"\n }\n },\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"text\",\n \"text\": \"Please analyze the image above.\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const conn = await ctx.connect();\n\n const result = await conn.request('prompts/get', {\n name: 'test_prompt_with_image'\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.messages) errors.push('Missing messages array');\n\n // Look for image content\n const hasImageContent = result.messages.some(\n (msg: any) =>\n msg.content?.type === 'image' &&\n msg.content?.data &&\n msg.content?.mimeType\n );\n\n if (!hasImageContent) {\n errors.push('No image content found in prompt');\n }\n\n checks.push({\n id: 'prompts-get-with-image',\n name: 'PromptsGetWithImage',\n description: 'Get prompt with image content',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Prompts-Image',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#image-content'\n }\n ],\n details: {\n messageCount: result.messages?.length || 0\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'prompts-get-with-image',\n name: 'PromptsGetWithImage',\n description: 'Get prompt with image content',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Prompts-Image',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#image-content'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,499,557],"a266345b-b257-4734-8d88-645e9dcb20e2","lifecycle.ts","dc5479ba-ad13-11f1-8f33-1607ee4eb77e",105,["D",1789046874187],"/**\n * Lifecycle test scenarios for MCP servers\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport type { RunContext } from '../../connection/index.ts';\nimport {\n connectToServer,\n terminateSessionRaw\n} from '../../connection/sdk-client.ts';\n\nconst VISIBLE_ASCII_REGEX = /^[\\x21-\\x7E]+$/;\n\n// The session-id probe only needs the response header. Bound the request so a\n// server that accepts the connection and never answers fails this check\n// instead of hanging the scenario before teardown ever runs.\nconst SESSION_ID_PROBE_TIMEOUT_MS = 5000;\n\nconst SESSION_SPEC_REFERENCES = [\n {\n id: 'MCP-Session-Management',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#session-management'\n }\n];\n\nexport class ServerInitializeScenario implements ClientScenario {\n name = 'server-initialize';\n readonly source = {\n introducedIn: '2025-06-18',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = `Test basic server initialization handshake.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`initialize\\`\n\n**Requirements**:\n- Accept \\`initialize\\` request with client info and capabilities\n- Return valid initialize response with server info, protocol version, and capabilities\n- Accept \\`initialized\\` notification from client after handshake\n- If a session ID is assigned, it MUST only contain visible ASCII characters (0x21 to 0x7E)\n\nThis test verifies the server can complete the two-phase initialization handshake successfully,\nand validates session ID format if one is assigned.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl, {}, ctx.specVersion);\n\n // The connection process already does initialization\n // Check that we have a connected client\n checks.push({\n id: 'server-initialize',\n name: 'ServerInitialize',\n description:\n 'Server responds to initialize request with valid structure',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Initialize',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle#initialization'\n }\n ],\n details: {\n serverUrl,\n connected: true\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'server-initialize',\n name: 'ServerInitialize',\n description:\n 'Server responds to initialize request with valid structure',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to initialize: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Initialize',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle#initialization'\n }\n ]\n });\n return checks;\n }\n\n // Check: Session ID visible ASCII validation\n // Use a raw fetch to inspect the MCP-Session-Id response header,\n // since the SDK client transport does not expose it.\n let rawSessionId: string | null = null;\n try {\n const response = await fetch(serverUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Accept: 'application/json, text/event-stream',\n 'mcp-protocol-version': ctx.specVersion\n },\n body: JSON.stringify({\n jsonrpc: '2.0',\n id: 1,\n method: 'initialize',\n params: {\n protocolVersion: ctx.specVersion,\n capabilities: {},\n clientInfo: {\n name: 'conformance-session-id-test',\n version: '1.0.0'\n }\n }\n }),\n signal: AbortSignal.timeout(SESSION_ID_PROBE_TIMEOUT_MS)\n });\n\n const sessionId = response.headers.get('mcp-session-id');\n rawSessionId = sessionId;\n\n // Only the header is needed. `Accept` includes `text/event-stream`, so a\n // server answering with an open SSE stream would otherwise leave this\n // body unconsumed and leak the connection for the rest of the run.\n await response.body?.cancel();\n\n if (!sessionId) {\n checks.push({\n id: 'server-session-id-visible-ascii',\n name: 'ServerSessionIdVisibleAscii',\n description:\n 'Server-provided session ID uses only visible ASCII characters',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: SESSION_SPEC_REFERENCES,\n details: {\n message:\n 'Server did not provide an MCP-Session-Id header (session ID is optional)'\n }\n });\n } else if (VISIBLE_ASCII_REGEX.test(sessionId)) {\n checks.push({\n id: 'server-session-id-visible-ascii',\n name: 'ServerSessionIdVisibleAscii',\n description:\n 'Server-provided session ID uses only visible ASCII characters',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: SESSION_SPEC_REFERENCES,\n details: {\n sessionId\n }\n });\n } else {\n checks.push({\n id: 'server-session-id-visible-ascii',\n name: 'ServerSessionIdVisibleAscii',\n description:\n 'Server-provided session ID uses only visible ASCII characters',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Session ID contains characters outside visible ASCII range (0x21-0x7E)',\n specReferences: SESSION_SPEC_REFERENCES,\n details: {\n sessionId\n }\n });\n }\n } catch (error) {\n checks.push({\n id: 'server-session-id-visible-ascii',\n name: 'ServerSessionIdVisibleAscii',\n description:\n 'Server-provided session ID uses only visible ASCII characters',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to send initialize request for session ID check: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: SESSION_SPEC_REFERENCES\n });\n } finally {\n if (rawSessionId) {\n await terminateSessionRaw(serverUrl, rawSessionId, ctx.specVersion);\n }\n }\n\n return checks;\n }\n}\n",[],[142,474,499,565],"100d1e44-6ed3-4b43-a8c7-5e8f4486ca51","json-schema-2020-12.ts","dacdc330-ad13-11f1-9be5-1607ee4eb77e",100,["D",1789046871638],"/**\n * JSON Schema 2020-12 conformance test scenario (SEP-1613, SEP-2106)\n *\n * Validates that MCP servers correctly preserve JSON Schema 2020-12 keywords\n * in tool definitions, ensuring implementations don't strip $schema, $defs,\n * or additionalProperties fields (SEP-1613).\n *\n * SEP-2106 broadened inputSchema to permit the full JSON Schema 2020-12\n * vocabulary alongside the required root `type: \"object\"`. This scenario also\n * verifies that composition (allOf/anyOf), conditional (if/then/else), and\n * reference ($anchor) keywords survive tools/list rather than being stripped.\n */\n\nimport {\n CheckStatus,\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport type { RunContext } from '../../connection/index.ts';\nimport type { ListToolsResult } from '../../spec-types/2025-11-25.ts';\n\nexport const EXPECTED_TOOL_NAME = 'json_schema_2020_12_tool';\nexport const EXPECTED_SCHEMA_DIALECT =\n 'https://json-schema.org/draft/2020-12/schema';\n\n/**\n * Canonical focal `inputSchema` used by both the server-side\n * `json-schema-2020-12` scenario (as the schema servers under test are\n * expected to emit) and the client-side `json-schema-2020-12-preservation`\n * scenario (as the schema the mock server actually emits on the wire).\n *\n * Keeping a single source of truth ensures the documented requirements and\n * the runtime test fixture stay in sync.\n */\nexport const JSON_SCHEMA_2020_12_FIXTURE = {\n $schema: EXPECTED_SCHEMA_DIALECT,\n type: 'object',\n $defs: {\n address: {\n $anchor: 'addressDef',\n type: 'object',\n properties: {\n street: { type: 'string' },\n city: { type: 'string' }\n }\n }\n },\n properties: {\n name: { type: 'string' },\n address: { $ref: '#/$defs/address' },\n contactMethod: { type: 'string', enum: ['phone', 'email'] },\n phone: { type: 'string' },\n email: { type: 'string' }\n },\n allOf: [{ anyOf: [{ required: ['phone'] }, { required: ['email'] }] }],\n if: {\n properties: { contactMethod: { const: 'phone' } },\n required: ['contactMethod']\n },\n then: { required: ['phone'] },\n else: { required: ['email'] },\n additionalProperties: false\n} as const;\n\n/**\n * Soft version gate for the SEP-2106 keyword-preservation checks.\n *\n * Preserving the broader JSON Schema 2020-12 vocabulary is good behavior at\n * any protocol version, so a server that preserves the keywords gets SUCCESS\n * regardless. Stripping them is only a conformance FAILURE when the run\n * targets a protocol version that includes SEP-2106 (the draft); when\n * targeting an earlier dated version the requirement does not apply, so the\n * check is SKIPPED rather than failed.\n */\nexport function sep2106KeywordCheckStatus(\n preserved: boolean,\n targetProtocolVersion: string\n): CheckStatus {\n if (preserved) {\n return 'SUCCESS';\n }\n return targetProtocolVersion === DRAFT_PROTOCOL_VERSION\n ? 'FAILURE'\n : 'SKIPPED';\n}\n\nexport class JsonSchema2020_12Scenario implements ClientScenario {\n name = 'json-schema-2020-12';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description = `Validates JSON Schema 2020-12 keyword preservation (SEP-1613, SEP-2106).\n\n**Server Implementation Requirements:**\n\nImplement tool \\`${EXPECTED_TOOL_NAME}\\` with inputSchema containing JSON Schema 2020-12 features, including the broader vocabulary permitted by SEP-2106 (an \\`$anchor\\` inside \\`$defs\\`, composition keywords \\`allOf\\`/\\`anyOf\\`, and conditional keywords \\`if\\`/\\`then\\`/\\`else\\`):\n\n\\`\\`\\`json\n${JSON.stringify(\n {\n name: EXPECTED_TOOL_NAME,\n description: 'Tool with JSON Schema 2020-12 features',\n inputSchema: JSON_SCHEMA_2020_12_FIXTURE\n },\n null,\n 2\n)}\n\\`\\`\\`\n\n**Verification**: The test verifies that \\`$schema\\`, \\`$defs\\`, and \\`additionalProperties\\` are preserved (SEP-1613), and that the composition (\\`allOf\\`/\\`anyOf\\`), conditional (\\`if\\`/\\`then\\`/\\`else\\`), and \\`$anchor\\` keywords are preserved (SEP-2106), in the tool listing response.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n const specReferences = [\n {\n id: 'SEP-1613',\n url: 'https://github.com/modelcontextprotocol/specification/pull/655'\n }\n ];\n const sep2106References = [\n {\n id: 'SEP-2106',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2106'\n }\n ];\n\n try {\n const conn = await ctx.connect();\n // Spec version this run is targeting; used to soft-gate the SEP-2106\n // checks below.\n const targetVersion = ctx.specVersion;\n const result = await conn.request('tools/list');\n\n // Find the test tool\n const tool = result.tools?.find((t) => t.name === EXPECTED_TOOL_NAME);\n\n // Check 1: Tool exists\n checks.push({\n id: 'json-schema-2020-12-tool-found',\n name: 'JsonSchema2020_12ToolFound',\n description: `Server advertises tool '${EXPECTED_TOOL_NAME}'`,\n status: tool ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: tool\n ? undefined\n : `Tool '${EXPECTED_TOOL_NAME}' not found. Available tools: ${result.tools?.map((t) => t.name).join(', ') || 'none'}`,\n specReferences,\n details: {\n toolFound: !!tool,\n availableTools: result.tools?.map((t) => t.name) || []\n }\n });\n\n if (!tool) {\n await conn.close();\n return checks;\n }\n\n const inputSchema = tool.inputSchema as Record;\n\n // Check 2: $schema field preserved\n const hasSchema = '$schema' in inputSchema;\n const schemaValue = inputSchema['$schema'];\n const schemaCorrect = schemaValue === EXPECTED_SCHEMA_DIALECT;\n\n checks.push({\n id: 'json-schema-2020-12-$schema',\n name: 'JsonSchema2020_12$Schema',\n description: `inputSchema.$schema field preserved with value '${EXPECTED_SCHEMA_DIALECT}'`,\n status: hasSchema && schemaCorrect ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: !hasSchema\n ? '$schema field missing from inputSchema - field was likely stripped'\n : !schemaCorrect\n ? `$schema has unexpected value: ${JSON.stringify(schemaValue)}`\n : undefined,\n specReferences,\n details: {\n hasSchema,\n schemaValue,\n expected: EXPECTED_SCHEMA_DIALECT\n }\n });\n\n // Check 3: $defs field preserved\n const hasDefs = '$defs' in inputSchema;\n const defsValue = inputSchema['$defs'] as\n | Record\n | undefined;\n const defsHasAddress = defsValue && 'address' in defsValue;\n\n checks.push({\n id: 'json-schema-2020-12-$defs',\n name: 'JsonSchema2020_12$Defs',\n description:\n 'inputSchema.$defs field preserved with expected structure',\n status: hasDefs && defsHasAddress ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: !hasDefs\n ? '$defs field missing from inputSchema - field was likely stripped'\n : !defsHasAddress\n ? '$defs exists but missing expected \"address\" definition'\n : undefined,\n specReferences,\n details: {\n hasDefs,\n defsKeys: defsValue ? Object.keys(defsValue) : [],\n defsValue\n }\n });\n\n // Check 4: additionalProperties field preserved\n const hasAdditionalProps = 'additionalProperties' in inputSchema;\n const additionalPropsValue = inputSchema['additionalProperties'];\n const additionalPropsCorrect = additionalPropsValue === false;\n\n checks.push({\n id: 'json-schema-2020-12-additionalProperties',\n name: 'JsonSchema2020_12AdditionalProperties',\n description: 'inputSchema.additionalProperties field preserved',\n status:\n hasAdditionalProps && additionalPropsCorrect ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: !hasAdditionalProps\n ? 'additionalProperties field missing from inputSchema - field was likely stripped'\n : !additionalPropsCorrect\n ? `additionalProperties has unexpected value: ${JSON.stringify(additionalPropsValue)}, expected: false`\n : undefined,\n specReferences,\n details: {\n hasAdditionalProps,\n additionalPropsValue,\n expected: false\n }\n });\n\n // SEP-2106: the full JSON Schema 2020-12 vocabulary is permitted in\n // inputSchema and must survive tools/list rather than being stripped to\n // properties/required. These checks are soft-gated on the protocol\n // version this run targets (see sep2106KeywordCheckStatus): stripping\n // the keywords is only a FAILURE when targeting the draft version, and\n // SKIPPED otherwise.\n const skippedSuffix = ` (run targets protocol version ${targetVersion}; SEP-2106 applies from ${DRAFT_PROTOCOL_VERSION})`;\n\n // Check 5: composition keywords (allOf / anyOf) preserved\n const allOf = inputSchema['allOf'];\n const hasAllOf = Array.isArray(allOf) && allOf.length > 0;\n const hasNestedAnyOf =\n Array.isArray(allOf) &&\n allOf.some(\n (sub) =>\n typeof sub === 'object' &&\n sub !== null &&\n Array.isArray((sub as Record)['anyOf'])\n );\n const compositionPreserved = hasAllOf && hasNestedAnyOf;\n const compositionStatus = sep2106KeywordCheckStatus(\n compositionPreserved,\n targetVersion\n );\n\n checks.push({\n id: 'sep-2106-composition-keywords-preserved',\n name: 'JsonSchema2020_12CompositionKeywords',\n description:\n 'inputSchema composition keywords (allOf/anyOf) preserved (SEP-2106)',\n status: compositionStatus,\n timestamp: new Date().toISOString(),\n errorMessage: compositionPreserved\n ? undefined\n : (!hasAllOf\n ? 'allOf keyword missing from inputSchema - composition keyword was likely stripped'\n : 'nested anyOf missing from allOf - composition keyword was likely stripped') +\n (compositionStatus === 'SKIPPED' ? skippedSuffix : ''),\n specReferences: sep2106References,\n details: {\n hasAllOf,\n hasNestedAnyOf,\n targetProtocolVersion: targetVersion\n }\n });\n\n // Check 6: conditional keywords (if / then / else) preserved\n const hasIf = 'if' in inputSchema;\n const hasThen = 'then' in inputSchema;\n const hasElse = 'else' in inputSchema;\n const conditionalPreserved = hasIf && hasThen && hasElse;\n const conditionalStatus = sep2106KeywordCheckStatus(\n conditionalPreserved,\n targetVersion\n );\n\n checks.push({\n id: 'sep-2106-conditional-keywords-preserved',\n name: 'JsonSchema2020_12ConditionalKeywords',\n description:\n 'inputSchema conditional keywords (if/then/else) preserved (SEP-2106)',\n status: conditionalStatus,\n timestamp: new Date().toISOString(),\n errorMessage: conditionalPreserved\n ? undefined\n : `Conditional keywords missing (if=${hasIf}, then=${hasThen}, else=${hasElse}) - likely stripped` +\n (conditionalStatus === 'SKIPPED' ? skippedSuffix : ''),\n specReferences: sep2106References,\n details: {\n hasIf,\n hasThen,\n hasElse,\n targetProtocolVersion: targetVersion\n }\n });\n\n // Check 7: reference keyword ($anchor) preserved within $defs.address\n const addressDef = defsValue?.['address'] as\n | Record\n | undefined;\n const hasAnchor = !!addressDef && '$anchor' in addressDef;\n const anchorStatus = sep2106KeywordCheckStatus(hasAnchor, targetVersion);\n\n checks.push({\n id: 'sep-2106-anchor-keyword-preserved',\n name: 'JsonSchema2020_12AnchorKeyword',\n description:\n 'inputSchema reference keyword ($anchor) preserved in $defs (SEP-2106)',\n status: anchorStatus,\n timestamp: new Date().toISOString(),\n errorMessage: hasAnchor\n ? undefined\n : '$anchor missing from $defs.address - reference keyword was likely stripped' +\n (anchorStatus === 'SKIPPED' ? skippedSuffix : ''),\n specReferences: sep2106References,\n details: {\n hasAnchor,\n anchorValue: addressDef?.['$anchor']\n }\n });\n\n await conn.close();\n } catch (error) {\n checks.push({\n id: 'json-schema-2020-12-error',\n name: 'JsonSchema2020_12Error',\n description: 'JSON Schema 2020-12 conformance test',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,499,573],"3049ab7d-f5d5-4487-946d-f6611f7bf166","input-required-result.ts","d7b87e42-ad13-11f1-8e58-1607ee4eb77e",91,["D",1789046867075],"/**\n * SEP-2322: InputRequiredResult - Ephemeral Workflow Tests\n *\n * Tests the ephemeral (stateless) workflow where servers respond with\n * InputRequiredResult containing inputRequests and/or requestState, and\n * clients retry with inputResponses and echoed requestState.\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION,\n SpecVersion\n} from '../../types.ts';\nimport type { RunContext } from '../../connection/index.ts';\nimport {\n sendRpc,\n isInputRequiredResult,\n isCompleteResult,\n mockElicitResponse,\n mockSamplingResponse,\n mockListRootsResponse,\n MRTR_SPEC_REFERENCES\n} from './input-required-result-helpers.ts';\nimport { notTestable } from '../untestable.ts';\n\n// ─── A1: Basic Elicitation ────────────────────────────────────────────────────\n\nexport class InputRequiredResultBasicElicitationScenario implements ClientScenario {\n name = 'input-required-result-basic-elicitation';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test basic ephemeral InputRequiredResult flow with a single elicitation input request (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_elicitation\\` (no arguments required).\n\n**Behavior (Round 1):** When called without \\`inputResponses\\`, return an \\`InputRequiredResult\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"user_name\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"What is your name?\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": {\n \"name\": { \"type\": \"string\" }\n },\n \"required\": [\"name\"]\n }\n }\n }\n }\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` containing the key \\`\"user_name\"\\`, return a complete result:\n\n\\`\\`\\`json\n{\n \"content\": [{ \"type\": \"text\", \"text\": \"Hello, !\" }]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1: Initial call — expect InputRequiredResult\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result) {\n r1Errors.push('No result in response');\n } else if (!isInputRequiredResult(r1Result)) {\n r1Errors.push(\n 'Expected InputRequiredResult but got a complete result. ' +\n 'Server should return resultType: \"input_required\" with inputRequests.'\n );\n } else {\n if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n } else if (!r1Result.inputRequests['user_name']) {\n r1Errors.push('inputRequests missing expected key \"user_name\"');\n } else {\n const req = r1Result.inputRequests['user_name'];\n if (req.method !== 'elicitation/create') {\n r1Errors.push(\n `Expected method \"elicitation/create\", got \"${req.method}\"`\n );\n }\n }\n }\n\n checks.push({\n id: 'sep-2322-elicitation-incomplete',\n name: 'InputRequiredResultElicitationIncomplete',\n description:\n 'Server returns InputRequiredResult with elicitation inputRequest',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Retry with inputResponses — expect complete result\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {},\n inputResponses: {\n user_name: mockElicitResponse({ name: 'Alice' })\n },\n ...(r1Result.requestState !== undefined\n ? { requestState: r1Result.requestState }\n : {})\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push(\n 'Expected complete result after retry with inputResponses'\n );\n } else {\n const content = r2Result.content as\n | Array<{ type: string; text?: string }>\n | undefined;\n if (!content || !Array.isArray(content) || content.length === 0) {\n r2Errors.push('Complete result missing content array');\n }\n }\n\n checks.push({\n id: 'sep-2322-elicitation-complete',\n name: 'InputRequiredResultElicitationComplete',\n description:\n 'Server returns complete result after retry with inputResponses',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-elicitation-incomplete',\n name: 'InputRequiredResultElicitationIncomplete',\n description:\n 'Server returns InputRequiredResult with elicitation inputRequest',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A2: Basic Sampling ──────────────────────────────────────────────────────\n\nexport class InputRequiredResultBasicSamplingScenario implements ClientScenario {\n name = 'input-required-result-basic-sampling';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test basic ephemeral InputRequiredResult flow with a single sampling input request (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_sampling\\` (no arguments required).\n\n**Behavior (Round 1):** When called without \\`inputResponses\\`, return an \\`InputRequiredResult\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"capital_question\": {\n \"method\": \"sampling/createMessage\",\n \"params\": {\n \"messages\": [{\n \"role\": \"user\",\n \"content\": { \"type\": \"text\", \"text\": \"What is the capital of France?\" }\n }],\n \"maxTokens\": 100\n }\n }\n }\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` containing the key \\`\"capital_question\"\\`, return a complete result with the sampling response text.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1: Initial call\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_sampling',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result) {\n r1Errors.push('No result in response');\n } else if (!isInputRequiredResult(r1Result)) {\n r1Errors.push(\n 'Expected InputRequiredResult with sampling inputRequest'\n );\n } else {\n if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n } else {\n const key = Object.keys(r1Result.inputRequests)[0];\n if (!key) {\n r1Errors.push('inputRequests map is empty');\n } else {\n const req = r1Result.inputRequests[key];\n if (req.method !== 'sampling/createMessage') {\n r1Errors.push(\n `Expected method \"sampling/createMessage\", got \"${req.method}\"`\n );\n }\n }\n }\n }\n\n checks.push({\n id: 'sep-2322-sampling-incomplete',\n name: 'InputRequiredResultSamplingIncomplete',\n description:\n 'Server returns InputRequiredResult with sampling inputRequest',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Retry with inputResponses\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const inputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_sampling',\n arguments: {},\n inputResponses: {\n [inputKey]: mockSamplingResponse('The capital of France is Paris.')\n },\n ...(r1Result.requestState !== undefined\n ? { requestState: r1Result.requestState }\n : {})\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push(\n 'Expected complete result after retry with sampling response'\n );\n }\n\n checks.push({\n id: 'sep-2322-sampling-complete',\n name: 'InputRequiredResultSamplingComplete',\n description:\n 'Server returns complete result after retry with sampling response',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-sampling-incomplete',\n name: 'InputRequiredResultSamplingIncomplete',\n description:\n 'Server returns InputRequiredResult with sampling inputRequest',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A3: Basic ListRoots ─────────────────────────────────────────────────────\n\nexport class InputRequiredResultBasicListRootsScenario implements ClientScenario {\n name = 'input-required-result-basic-list-roots';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test basic ephemeral InputRequiredResult flow with a single roots/list input request (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_list_roots\\` (no arguments required).\n\n**Behavior (Round 1):** When called without \\`inputResponses\\`, return an \\`InputRequiredResult\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"client_roots\": {\n \"method\": \"roots/list\",\n \"params\": {}\n }\n }\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` containing the key \\`\"client_roots\"\\` (a ListRootsResult with a \\`roots\\` array), return a complete result that references the provided roots.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1: Initial call\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_list_roots',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result) {\n r1Errors.push('No result in response');\n } else if (!isInputRequiredResult(r1Result)) {\n r1Errors.push(\n 'Expected InputRequiredResult with roots/list inputRequest'\n );\n } else {\n if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n } else {\n const key = Object.keys(r1Result.inputRequests)[0];\n if (!key) {\n r1Errors.push('inputRequests map is empty');\n } else {\n const req = r1Result.inputRequests[key];\n if (req.method !== 'roots/list') {\n r1Errors.push(\n `Expected method \"roots/list\", got \"${req.method}\"`\n );\n }\n }\n }\n }\n\n checks.push({\n id: 'sep-2322-list-roots-incomplete',\n name: 'InputRequiredResultListRootsIncomplete',\n description:\n 'Server returns InputRequiredResult with roots/list inputRequest',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Retry with inputResponses\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const inputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_list_roots',\n arguments: {},\n inputResponses: {\n [inputKey]: mockListRootsResponse()\n },\n ...(r1Result.requestState !== undefined\n ? { requestState: r1Result.requestState }\n : {})\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push(\n 'Expected complete result after retry with roots response'\n );\n }\n\n checks.push({\n id: 'sep-2322-list-roots-complete',\n name: 'InputRequiredResultListRootsComplete',\n description:\n 'Server returns complete result after retry with roots response',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-list-roots-incomplete',\n name: 'InputRequiredResultListRootsIncomplete',\n description:\n 'Server returns InputRequiredResult with roots/list inputRequest',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A4: Request State ──────────────────────────────────────────────────────\n\nexport class InputRequiredResultRequestStateScenario implements ClientScenario {\n name = 'input-required-result-request-state';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that requestState is correctly round-tripped in ephemeral InputRequiredResult flow (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_request_state\\` (no arguments required).\n\n**Behavior (Round 1):** Return an \\`InputRequiredResult\\` with both \\`inputRequests\\` and \\`requestState\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"confirm\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"Please confirm\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": { \"ok\": { \"type\": \"boolean\" } },\n \"required\": [\"ok\"]\n }\n }\n }\n },\n \"requestState\": \"\"\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` AND the echoed \\`requestState\\`, validate the state and return a complete result. The text content MUST include the word \"state-ok\" to confirm the server received and validated the requestState.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_request_state',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result || !isInputRequiredResult(r1Result)) {\n r1Errors.push('Expected InputRequiredResult');\n } else {\n if (!r1Result.requestState) {\n r1Errors.push('InputRequiredResult missing requestState');\n }\n if (typeof r1Result.requestState !== 'string') {\n r1Errors.push('requestState must be a string');\n }\n if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n }\n }\n\n checks.push({\n id: 'sep-2322-request-state-incomplete',\n name: 'InputRequiredResultRequestStateIncomplete',\n description:\n 'Server returns InputRequiredResult with both inputRequests and requestState',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Retry with inputResponses + requestState\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const inputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_request_state',\n arguments: {},\n inputResponses: {\n [inputKey]: mockElicitResponse({ ok: true })\n },\n requestState: r1Result.requestState\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push(\n 'Expected complete result after retry with requestState'\n );\n }\n\n checks.push({\n id: 'sep-2322-request-state-complete',\n name: 'InputRequiredResultRequestStateComplete',\n description:\n 'Server validates echoed requestState and returns complete result',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-request-state-incomplete',\n name: 'InputRequiredResultRequestStateIncomplete',\n description:\n 'Server returns InputRequiredResult with both inputRequests and requestState',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A5: Multiple Input Requests ─────────────────────────────────────────────\n\nexport class InputRequiredResultMultipleInputRequestsScenario implements ClientScenario {\n name = 'input-required-result-multiple-input-requests';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test multiple input requests in a single InputRequiredResult (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_multiple_inputs\\` (no arguments required).\n\n**Behavior (Round 1):** Return an \\`InputRequiredResult\\` with multiple \\`inputRequests\\` — elicitation, sampling, and roots/list — plus \\`requestState\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"user_name\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"What is your name?\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": { \"name\": { \"type\": \"string\" } },\n \"required\": [\"name\"]\n }\n }\n },\n \"greeting\": {\n \"method\": \"sampling/createMessage\",\n \"params\": {\n \"messages\": [{ \"role\": \"user\", \"content\": { \"type\": \"text\", \"text\": \"Generate a greeting\" } }],\n \"maxTokens\": 50\n }\n },\n \"client_roots\": {\n \"method\": \"roots/list\",\n \"params\": {}\n }\n },\n \"requestState\": \"\"\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` containing ALL keys and the echoed \\`requestState\\`, return a complete result.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_multiple_inputs',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result || !isInputRequiredResult(r1Result)) {\n r1Errors.push('Expected InputRequiredResult');\n } else if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n } else {\n if (!r1Result.requestState) {\n r1Errors.push('InputRequiredResult missing requestState');\n }\n\n const keys = Object.keys(r1Result.inputRequests);\n if (keys.length < 3) {\n r1Errors.push(\n `Expected at least 3 inputRequests, got ${keys.length}`\n );\n }\n\n // Check that required method types are present\n const methods = new Set(\n keys.map((k) => r1Result.inputRequests![k].method)\n );\n if (!methods.has('elicitation/create')) {\n r1Errors.push('Expected an elicitation/create inputRequest');\n }\n if (!methods.has('sampling/createMessage')) {\n r1Errors.push('Expected a sampling/createMessage inputRequest');\n }\n if (!methods.has('roots/list')) {\n r1Errors.push('Expected a roots/list inputRequest');\n }\n if (methods.size < 3) {\n r1Errors.push(\n 'Expected inputRequests with different method types (elicitation + sampling + roots/list)'\n );\n }\n }\n\n checks.push({\n id: 'sep-2322-multiple-inputs-incomplete',\n name: 'InputRequiredResultMultipleInputsIncomplete',\n description:\n 'Server returns InputRequiredResult with multiple inputRequests of different types',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Respond to all input requests\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const inputResponses: Record = {};\n for (const [key, req] of Object.entries(r1Result.inputRequests!)) {\n if (req.method === 'elicitation/create') {\n inputResponses[key] = mockElicitResponse({ name: 'Alice' });\n } else if (req.method === 'sampling/createMessage') {\n inputResponses[key] = mockSamplingResponse('Hello there!');\n } else if (req.method === 'roots/list') {\n inputResponses[key] = mockListRootsResponse();\n }\n }\n\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_multiple_inputs',\n arguments: {},\n inputResponses,\n ...(r1Result.requestState !== undefined\n ? { requestState: r1Result.requestState }\n : {})\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push(\n 'Expected complete result after providing all inputResponses'\n );\n }\n\n checks.push({\n id: 'sep-2322-multiple-inputs-complete',\n name: 'InputRequiredResultMultipleInputsComplete',\n description:\n 'Server returns complete result after all inputResponses are provided',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-multiple-inputs-incomplete',\n name: 'InputRequiredResultMultipleInputsIncomplete',\n description:\n 'Server returns InputRequiredResult with multiple inputRequests of different types',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A6: Multi-Round ─────────────────────────────────────────────────────────\n\nexport class InputRequiredResultMultiRoundScenario implements ClientScenario {\n name = 'input-required-result-multi-round';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test multi-round ephemeral InputRequiredResult flow with evolving requestState (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_multi_round\\` (no arguments required).\n\n**Behavior (Round 1):** Return an \\`InputRequiredResult\\` with an elicitation request and \\`requestState\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"step1\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"Step 1: What is your name?\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": { \"name\": { \"type\": \"string\" } },\n \"required\": [\"name\"]\n }\n }\n }\n },\n \"requestState\": \"\"\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` for step1 + requestState, return ANOTHER \\`InputRequiredResult\\` with a new elicitation and updated requestState:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"step2\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"Step 2: What is your favorite color?\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": { \"color\": { \"type\": \"string\" } },\n \"required\": [\"color\"]\n }\n }\n }\n },\n \"requestState\": \"\"\n}\n\\`\\`\\`\n\n**Behavior (Round 3):** When called with \\`inputResponses\\` for step2 + updated requestState, return a complete result.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_multi_round',\n arguments: {}\n });\n\n const r1Result = r1.result;\n let round1Complete = false;\n\n if (\n !r1.error &&\n r1Result &&\n isInputRequiredResult(r1Result) &&\n r1Result.inputRequests &&\n r1Result.requestState\n ) {\n round1Complete = true;\n }\n\n checks.push({\n id: 'sep-2322-multi-round-r1',\n name: 'InputRequiredResultMultiRoundR1',\n description:\n 'Round 1: Server returns InputRequiredResult with requestState',\n status: round1Complete ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: round1Complete\n ? undefined\n : 'Expected InputRequiredResult with inputRequests and requestState',\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n if (!round1Complete || !isInputRequiredResult(r1Result)) return checks;\n\n // Round 2: Retry — expect another InputRequiredResult\n const r1InputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_multi_round',\n arguments: {},\n inputResponses: {\n [r1InputKey]: mockElicitResponse({ name: 'Alice' })\n },\n requestState: r1Result.requestState\n });\n\n const r2Result = r2.result;\n let round2Complete = false;\n\n if (\n !r2.error &&\n r2Result &&\n isInputRequiredResult(r2Result) &&\n r2Result.inputRequests &&\n r2Result.requestState\n ) {\n // requestState should have changed\n if (r2Result.requestState !== r1Result.requestState) {\n round2Complete = true;\n }\n }\n\n checks.push({\n id: 'sep-2322-multi-round-r2',\n name: 'InputRequiredResultMultiRoundR2',\n description:\n 'Round 2: Server returns another InputRequiredResult with updated requestState',\n status: round2Complete ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: round2Complete\n ? undefined\n : 'Expected new InputRequiredResult with different requestState',\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n\n if (!round2Complete || !isInputRequiredResult(r2Result)) return checks;\n\n // Round 3: Final retry — expect complete result\n const r2InputKey = Object.keys(r2Result.inputRequests!)[0];\n const r3 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_multi_round',\n arguments: {},\n inputResponses: {\n [r2InputKey]: mockElicitResponse({ color: 'blue' })\n },\n requestState: r2Result.requestState\n });\n\n const r3Result = r3.result;\n const round3Complete =\n !r3.error && r3Result != null && isCompleteResult(r3Result);\n\n checks.push({\n id: 'sep-2322-multi-round-r3',\n name: 'InputRequiredResultMultiRoundR3',\n description: 'Round 3: Server returns complete result',\n status: round3Complete ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: round3Complete\n ? undefined\n : 'Expected complete result after final retry',\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r3Result }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-multi-round-r1',\n name: 'InputRequiredResultMultiRoundR1',\n description:\n 'Round 1: Server returns InputRequiredResult with requestState',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A7: Missing Input Response ──────────────────────────────────────────────\n\nexport class InputRequiredResultMissingInputResponseScenario implements ClientScenario {\n name = 'input-required-result-missing-input-response';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test error handling when client sends wrong/missing inputResponses (SEP-2322).\n\n**Server Implementation Requirements:**\n\nUse the same tool as A1: \\`test_input_required_result_elicitation\\`.\n\n**Behavior:** When the client retries with \\`inputResponses\\` that are missing required keys or contain wrong keys, the server SHOULD respond with a new \\`InputRequiredResult\\` re-requesting the missing information (NOT a JSON-RPC error).`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1: Send wrong inputResponses (wrong key)\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {},\n inputResponses: {\n wrong_key: mockElicitResponse({ data: 'wrong' })\n }\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n // A JSON-RPC error is acceptable but the SEP prefers re-requesting\n r1Errors.push(\n 'Server returned JSON-RPC error instead of re-requesting via InputRequiredResult. ' +\n 'SEP-2322 recommends servers re-request missing information.'\n );\n } else if (!r1Result) {\n r1Errors.push('No result in response');\n } else if (!isInputRequiredResult(r1Result)) {\n r1Errors.push(\n 'Expected InputRequiredResult re-requesting missing information, ' +\n 'but got a complete result'\n );\n }\n\n checks.push({\n id: 'sep-2322-missing-response-rerequests',\n name: 'InputRequiredResultMissingResponseRerequests',\n description:\n 'Server re-requests missing inputResponses via new InputRequiredResult',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-missing-response-rerequests',\n name: 'InputRequiredResultMissingResponseRerequests',\n description:\n 'Server re-requests missing inputResponses via new InputRequiredResult',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A9: Non-Tool Request (prompts/get) ──────────────────────────────────────\n\nexport class InputRequiredResultNonToolRequestScenario implements ClientScenario {\n name = 'input-required-result-non-tool-request';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test InputRequiredResult on a non-tool request (prompts/get) to verify InputRequiredResult is universal (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a prompt named \\`test_input_required_result_prompt\\` that requires elicitation input.\n\n**Behavior (Round 1):** When \\`prompts/get\\` is called for \\`test_input_required_result_prompt\\` without \\`inputResponses\\`, return an \\`InputRequiredResult\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"user_context\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"What context should the prompt use?\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": { \"context\": { \"type\": \"string\" } },\n \"required\": [\"context\"]\n }\n }\n }\n }\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\`, return a complete \\`GetPromptResult\\`.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1\n const r1 = await sendRpc(serverUrl, 'prompts/get', {\n name: 'test_input_required_result_prompt'\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result || !isInputRequiredResult(r1Result)) {\n r1Errors.push('Expected InputRequiredResult from prompts/get');\n } else if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n }\n\n checks.push({\n id: 'sep-2322-non-tool-incomplete',\n name: 'InputRequiredResultNonToolIncomplete',\n description:\n 'prompts/get returns InputRequiredResult with inputRequests',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Retry with inputResponses\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const inputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'prompts/get', {\n name: 'test_input_required_result_prompt',\n inputResponses: {\n [inputKey]: mockElicitResponse({ context: 'test context' })\n },\n ...(r1Result.requestState !== undefined\n ? { requestState: r1Result.requestState }\n : {})\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push('Expected complete GetPromptResult after retry');\n } else if (!r2Result.messages) {\n r2Errors.push(\n 'Complete result missing messages (expected GetPromptResult)'\n );\n }\n\n checks.push({\n id: 'sep-2322-non-tool-complete',\n name: 'InputRequiredResultNonToolComplete',\n description:\n 'prompts/get returns complete GetPromptResult after retry with inputResponses',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-non-tool-incomplete',\n name: 'InputRequiredResultNonToolIncomplete',\n description:\n 'prompts/get returns InputRequiredResult with inputRequests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A10: ResultType Included ────────────────────────────────────────────────\n\nexport class InputRequiredResultResultTypeScenario implements ClientScenario {\n name = 'input-required-result-result-type';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server explicitly includes resultType field in InputRequiredResult responses (SEP-2322).\n\n**Server Implementation Requirements:**\n\nUses the same tool as A1: \\`test_input_required_result_elicitation\\`.\n\nThis scenario verifies that the resultType field is explicitly present in the response (not just inferred).`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const errors: string[] = [];\n\n if (r1.error) {\n errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result) {\n errors.push('No result in response');\n } else if (!('resultType' in r1Result)) {\n errors.push(\n 'resultType field is missing from response. Servers MUST include resultType to indicate the type of the result.'\n );\n } else if (r1Result.resultType !== 'input_required') {\n errors.push(\n `Expected resultType \"input_required\", got \"${r1Result.resultType}\"`\n );\n }\n\n checks.push({\n id: 'sep-2322-result-type-included',\n name: 'ResultTypeIncluded',\n description:\n 'Server includes resultType field in InputRequiredResult response',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-result-type-included',\n name: 'ResultTypeIncluded',\n description:\n 'Server includes resultType field in InputRequiredResult response',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A11: Unsupported Methods ────────────────────────────────────────────────\n\nexport class InputRequiredResultUnsupportedMethodsScenario implements ClientScenario {\n name = 'input-required-result-unsupported-methods';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server does NOT return InputRequiredResult on unsupported methods (SEP-2322).\n\nServers MUST NOT send InputRequiredResult responses on any client requests other than the supported ones (prompts/get, resources/read, tools/call, tasks/result).`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n const errors: string[] = [];\n\n const unsupportedMethods = ['tools/list', 'prompts/list'];\n\n try {\n for (const method of unsupportedMethods) {\n const resp = await sendRpc(serverUrl, method, {});\n if (\n resp.result &&\n (resp.result as Record).resultType ===\n 'input_required'\n ) {\n errors.push(\n `${method} returned InputRequiredResult, but it is not a supported method for MRTR`\n );\n }\n }\n\n checks.push({\n id: 'sep-2322-not-on-unsupported-requests',\n name: 'NotOnUnsupportedRequests',\n description:\n 'Server does not return InputRequiredResult on unsupported methods',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-not-on-unsupported-requests',\n name: 'NotOnUnsupportedRequests',\n description:\n 'Server does not return InputRequiredResult on unsupported methods',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A12: Tampered State Rejection ───────────────────────────────────────────\n\nexport class InputRequiredResultTamperedStateScenario implements ClientScenario {\n name = 'input-required-result-tampered-state';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server rejects tampered requestState (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_tampered_state\\` (no arguments required).\n\n**Behavior (Round 1):** When called without inputResponses, return an InputRequiredResult with\nintegrity-protected requestState (e.g. HMAC-signed).\n\n**Behavior (Round 2 - tampered):** When called with a modified/tampered requestState, return a\nJSON-RPC error (code -32602 or similar) indicating integrity check failure.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1: Get valid InputRequiredResult with signed requestState\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_tampered_state',\n arguments: {}\n });\n\n const r1Result = r1.result;\n if (r1.error || !r1Result || !isInputRequiredResult(r1Result)) {\n checks.push({\n id: 'sep-2322-reject-tampered-state',\n name: 'RejectTamperedState',\n description: 'Server rejects tampered requestState with error',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Prerequisite failed: could not get initial InputRequiredResult with requestState',\n specReferences: MRTR_SPEC_REFERENCES\n });\n return checks;\n }\n\n if (!r1Result.requestState) {\n checks.push({\n id: 'sep-2322-reject-tampered-state',\n name: 'RejectTamperedState',\n description: 'Server rejects tampered requestState with error',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Server did not include requestState in InputRequiredResult',\n specReferences: MRTR_SPEC_REFERENCES\n });\n return checks;\n }\n\n // Round 2: Tamper with the requestState and retry\n const tamperedState = r1Result.requestState + '-TAMPERED';\n const inputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_tampered_state',\n arguments: {},\n inputResponses: {\n [inputKey]: mockElicitResponse({ ok: true })\n },\n requestState: tamperedState\n });\n\n const errors: string[] = [];\n\n if (!r2.error) {\n // The only acceptable response to tampered state is a JSON-RPC error.\n // Returning a complete result OR re-prompting (InputRequiredResult) both\n // indicate the server did not reject the tampered state.\n if (r2.result && isCompleteResult(r2.result)) {\n errors.push(\n 'Server accepted tampered requestState and returned complete result. ' +\n 'Servers MUST reject state that fails integrity verification.'\n );\n } else {\n errors.push(\n 'Server did not return a JSON-RPC error for tampered requestState. ' +\n 'Servers MUST reject state that fails integrity verification.'\n );\n }\n }\n\n checks.push({\n id: 'sep-2322-reject-tampered-state',\n name: 'RejectTamperedState',\n description: 'Server rejects tampered requestState with error',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { tamperedResponse: r2.result ?? r2.error }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-reject-tampered-state',\n name: 'RejectTamperedState',\n description: 'Server rejects tampered requestState with error',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A13: Respect Client Capabilities ────────────────────────────────────────\n\nexport class InputRequiredResultCapabilityCheckScenario implements ClientScenario {\n name = 'input-required-result-capability-check';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server only sends inputRequests for capabilities the client declared (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_capabilities\\` (no arguments required).\n\n**Behavior:** Read client capabilities from \\`_meta['io.modelcontextprotocol/clientCapabilities']\\`.\nOnly include inputRequests for methods the client supports. For example, if the client declares\n\\`sampling: {}\\` but NOT \\`elicitation\\`, only include \\`sampling/createMessage\\` inputRequests.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Send request with only sampling capability (no elicitation)\n const resp = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_capabilities',\n arguments: {},\n _meta: {\n 'io.modelcontextprotocol/clientCapabilities': {\n sampling: {}\n // deliberately omitting elicitation\n }\n }\n });\n\n const result = resp.result;\n const errors: string[] = [];\n let untestable = false;\n\n if (resp.error) {\n errors.push(`JSON-RPC error: ${resp.error.message}`);\n } else if (!result) {\n errors.push('No result in response');\n } else if (isInputRequiredResult(result)) {\n const inputRequests = Object.entries(result.inputRequests ?? {});\n // `inputRequests` is optional (a result carrying only `requestState` is\n // still valid), so naming none does not violate the MUST NOT this check\n // scores — but it leaves nothing to scan, and the loop below would then\n // record no error at all, scoring SUCCESS without having verified it.\n if (inputRequests.length === 0) {\n untestable = true;\n errors.push(\n notTestable(\n 'server returned no inputRequests, so the capability restriction was never exercised'\n )\n );\n }\n // Check that no elicitation requests are included (client didn't declare it)\n for (const [key, req] of inputRequests) {\n if (req.method === 'elicitation/create') {\n errors.push(\n `Server included elicitation/create inputRequest (key: \"${key}\") ` +\n 'but client did not declare elicitation capability'\n );\n }\n }\n } else if (isCompleteResult(result)) {\n errors.push(\n 'Server returned complete result; expected InputRequiredResult with sampling-only inputRequests'\n );\n }\n\n checks.push({\n id: 'sep-2322-respect-client-capabilities',\n name: 'RespectClientCapabilities',\n description:\n 'Server only includes inputRequests for declared client capabilities',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: untestable ? { result, untestable: true } : { result }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-respect-client-capabilities',\n name: 'RespectClientCapabilities',\n description:\n 'Server only includes inputRequests for declared client capabilities',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A14: Ignore Unexpected Params ───────────────────────────────────────────\n\nexport class InputRequiredResultIgnoreExtraParamsScenario implements ClientScenario {\n name = 'input-required-result-ignore-extra-params';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server ignores unexpected extra parameters in InputResponses (SEP-2322).\n\n**Server Implementation Requirements:**\n\nUses the same tool as A1: \\`test_input_required_result_elicitation\\`.\n\nThis scenario sends correct inputResponses PLUS extra unrecognized keys. The server SHOULD ignore\nthe extra keys and complete normally.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Send retry with correct inputResponses + extra unknown keys\n const resp = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {},\n inputResponses: {\n user_name: mockElicitResponse({ name: 'Alice' }),\n unknown_extra_key: { action: 'accept', content: { foo: 'bar' } },\n another_unexpected: { action: 'accept', content: { baz: 123 } }\n }\n });\n\n const result = resp.result;\n const errors: string[] = [];\n\n if (resp.error) {\n errors.push(\n `Server returned JSON-RPC error when extra params were included: ${resp.error.message}. ` +\n 'Servers SHOULD ignore unrecognized information.'\n );\n } else if (!result) {\n errors.push('No result in response');\n } else if (!isCompleteResult(result)) {\n errors.push(\n 'Server did not return complete result when valid inputResponses were provided alongside extra keys. ' +\n 'Servers SHOULD ignore information they do not recognize.'\n );\n }\n\n checks.push({\n id: 'sep-2322-ignore-unexpected-params',\n name: 'IgnoreUnexpectedParams',\n description: 'Server ignores extra unrecognized keys in inputResponses',\n status: errors.length === 0 ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-ignore-unexpected-params',\n name: 'IgnoreUnexpectedParams',\n description: 'Server ignores extra unrecognized keys in inputResponses',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A15: Validate InputResponses ────────────────────────────────────────────\n\nexport class InputRequiredResultValidateInputScenario implements ClientScenario {\n name = 'input-required-result-validate-input';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server validates InputResponses and returns appropriate errors (SEP-2322).\n\n**Server Implementation Requirements:**\n\nUses the same tool as A1: \\`test_input_required_result_elicitation\\`.\n\nThis scenario sends completely invalid inputResponses structures. The server SHOULD validate them\nand return a JSON-RPC error or a new InputRequiredResult.`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Send inputResponses with invalid structure (number instead of object\n // for the response). Deliberately schema-invalid, so wire-schema\n // validation is skipped for this call.\n const resp = await sendRpc(\n serverUrl,\n 'tools/call',\n {\n name: 'test_input_required_result_elicitation',\n arguments: {},\n inputResponses: {\n user_name: 12345 as unknown as Record\n }\n },\n { skipValidation: true }\n );\n\n const validateErrors: string[] = [];\n\n // Server should either error or re-request — NOT return a complete result\n // with the invalid data silently accepted\n if (!resp.error && resp.result && isCompleteResult(resp.result)) {\n validateErrors.push(\n 'Server accepted invalid inputResponses (number instead of object) and returned complete result. ' +\n 'Servers SHOULD validate InputResponses data.'\n );\n }\n\n checks.push({\n id: 'sep-2322-validate-input-responses',\n name: 'ValidateInputResponses',\n description: 'Server validates InputResponses structure',\n status: validateErrors.length === 0 ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage:\n validateErrors.length > 0 ? validateErrors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: resp.result, error: resp.error }\n });\n\n // Also test: send completely malformed inputResponses (null).\n // Deliberately schema-invalid; skip wire-schema validation.\n const resp2 = await sendRpc(\n serverUrl,\n 'tools/call',\n {\n name: 'test_input_required_result_elicitation',\n arguments: {},\n inputResponses: null as unknown as Record\n },\n { skipValidation: true }\n );\n\n const protocolErrors: string[] = [];\n\n if (!resp2.error && resp2.result && isCompleteResult(resp2.result)) {\n protocolErrors.push(\n 'Server accepted null inputResponses and returned complete result. ' +\n 'Protocol errors SHOULD return a JSON-RPC error response.'\n );\n }\n\n checks.push({\n id: 'sep-2322-error-on-protocol-error',\n name: 'ErrorOnProtocolError',\n description:\n 'Server returns JSON-RPC error for protocol-level input errors',\n status: protocolErrors.length === 0 ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage:\n protocolErrors.length > 0 ? protocolErrors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: resp2.result, error: resp2.error }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-validate-input-responses',\n name: 'ValidateInputResponses',\n description: 'Server validates InputResponses structure',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,499,581],"7f0ba2cb-2f3d-40c4-9242-0b214141604d","input-required-result-helpers.ts","e4b57406-ad13-11f1-8b1a-1607ee4eb77e",143,["D",1789047263129],"/**\n * Helpers for SEP-2322 conformance tests.\n *\n * Provides InputRequiredResult-specific type guards, mock response builders,\n * and a stateless JSON-RPC transport helper.\n */\n\n// ─── JSON-RPC Types ──────────────────────────────────────────────────────────\n\nexport type { JsonRpcResponse } from '../../connection/index.ts';\n\n// ─── Stateless RPC Helper ────────────────────────────────────────────────────\n\nimport { sendStatelessRequest, JsonRpcResponse } from '../../connection/index.ts';\n\n/**\n * Send a stateless JSON-RPC request (SEP-2575 pattern).\n * The shared stateless helper injects the cross-cutting requirements: _meta\n * (protocolVersion, clientInfo, clientCapabilities) and the standard\n * MCP-Protocol-Version / Mcp-Method / Mcp-Name headers (SEP-2243).\n */\nexport async function sendRpc(\n serverUrl: string,\n method: string,\n params?: Record,\n options?: { skipValidation?: boolean }\n): Promise {\n const response = await sendStatelessRequest(serverUrl, method, params, {\n skipValidation: options?.skipValidation\n });\n if (!response.body) {\n throw new Error(\n `Expected a JSON-RPC response for ${method}, got HTTP ${response.status} (${response.contentType ?? 'no content-type'})`\n );\n }\n return response.body as JsonRpcResponse;\n}\n\n// ─── InputRequiredResult Types ───────────────────────────────────────────────\n\nexport interface InputRequiredResultData {\n resultType?: 'input_required';\n inputRequests?: Record;\n requestState?: string;\n _meta?: Record;\n [key: string]: unknown;\n}\n\nexport interface InputRequestObject {\n method: string;\n params?: Record;\n}\n\n// ─── Type Guards ─────────────────────────────────────────────────────────────\n\n/**\n * Check if a JSON-RPC result is an InputRequiredResult.\n */\nexport function isInputRequiredResult(\n result: Record | undefined\n): result is InputRequiredResultData {\n if (!result) return false;\n if (result.resultType === 'input_required') return true;\n return false;\n}\n\n/**\n * Check if a JSON-RPC result is a complete result (not input_required).\n * complete is the default so if resultType is missing we assume it's complete.\n */\nexport function isCompleteResult(\n result: Record | undefined\n): boolean {\n if (!result) return false;\n if (result.resultType === 'input_required') return false;\n return true;\n}\n\n/**\n * Extract inputRequests from an InputRequiredResult.\n */\nexport function getInputRequests(\n result: InputRequiredResultData\n): Record | undefined {\n return result.inputRequests;\n}\n\n// ─── Mock Response Builders ──────────────────────────────────────────────────\n\n/**\n * Build a mock elicitation response (ElicitResult).\n */\nexport function mockElicitResponse(\n content: Record\n): Record {\n return {\n action: 'accept',\n content\n };\n}\n\n/**\n * Build a mock sampling response (CreateMessageResult).\n */\nexport function mockSamplingResponse(text: string): Record {\n return {\n role: 'assistant',\n content: {\n type: 'text',\n text\n },\n model: 'test-model',\n stopReason: 'endTurn'\n };\n}\n\n/**\n * Build a mock list roots response (ListRootsResult).\n */\nexport function mockListRootsResponse(): Record {\n return {\n roots: [\n {\n uri: 'file:///test/root',\n name: 'Test Root'\n }\n ]\n };\n}\n\n// ─── Spec References ─────────────────────────────────────────────────────────\n\n/**\n * SEP reference for InputRequiredResult / MRTR tests.\n */\nexport const MRTR_SPEC_REFERENCES = [\n {\n id: 'SEP-2322',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/utilities/mrtr'\n }\n];\n",[],[142,474,499,589],"0b87acf8-5171-4e20-8da6-f147a8cc3032","http-standard-headers.ts","d7695966-ad13-11f1-b337-1607ee4eb77e",80,["D",1789046854039],"/**\n * HTTP Standard Headers server validation test scenarios (SEP-2243)\n *\n * Tests that servers properly validate the standard MCP request headers:\n * - Reject requests where Mcp-Method header doesn't match the body\n * - Reject requests where Mcp-Name header doesn't match the body\n * - Accept case variations of header names (case-insensitive)\n * - Reject case variations of header values (case-sensitive)\n * - Handle whitespace trimming per HTTP spec\n * - Validate Base64-encoded custom header values\n * - Return 400 Bad Request with error code -32020 (HeaderMismatch)\n *\n * This is a ClientScenario (connects to a server under test and validates\n * its behavior).\n */\n\nimport http from 'node:http';\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport {\n withRequestMeta,\n sendStatelessRequest,\n type RunContext\n} from '../../connection/index.ts';\nimport { HEADER_MISMATCH } from '../../spec-types/draft.ts';\nimport { untestableCheck } from '../untestable.ts';\n\nconst SPEC_REFERENCE = {\n id: 'SEP-2243-Server-Validation',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#server-validation'\n};\n\nconst SPEC_REFERENCE_CASE = {\n id: 'SEP-2243-Case-Sensitivity',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#case-sensitivity'\n};\n\n// OWS handling is an RFC 9110 §5.5 MUST (\"a field parsing implementation MUST\n// exclude such whitespace prior to evaluating the field value\"), not a\n// SEP-2243 requirement. Kept as a check because a server stack that fails it\n// has a real HTTP-layer bug that will manifest as header-mismatch rejections.\nconst SPEC_REFERENCE_RFC9110_OWS = {\n id: 'RFC-9110-5.5-Field-Values',\n url: 'https://www.rfc-editor.org/rfc/rfc9110#section-5.5'\n};\n\nconst SPEC_REFERENCE_BASE64 = {\n id: 'SEP-2243-Value-Encoding',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#value-encoding'\n};\n\nconst SPEC_REFERENCE_CUSTOM = {\n id: 'SEP-2243-Custom-Headers',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#server-behavior-for-custom-headers'\n};\n\nconst HEADER_MISMATCH_ERROR_CODE = HEADER_MISMATCH;\n\n// Coarse, requirement-level check IDs (SEP-2243) for STANDARD-header\n// rejections. Every standard-header rejection case emits this same pair of IDs;\n// the per-case name/description carry the detail of which case was exercised,\n// matching the repo's \"same id, vary status/message\" convention.\nconst REJECT_STATUS_CHECK_ID = 'sep-2243-server-reject-invalid-headers';\nconst REJECT_ERROR_CODE_CHECK_ID = 'sep-2243-server-reject-error-code';\n\n// CUSTOM-header (Mcp-Param-*) rejections map to the param-validation\n// requirements instead. The -32020 error-code half of every custom-header\n// rejection is the \"reject with 400 + JSON-RPC error code -32020 if any\n// validation fails\" requirement.\nconst PARAM_REJECT_ERROR_CODE_CHECK_ID =\n 'sep-2243-server-reject-param-mismatch';\n\n/**\n * Every requirement-level check ID HttpCustomHeaderServerValidationScenario\n * can emit (SEP-2243). When the server under test exposes no x-mcp-header\n * tool the scenario cannot exercise these, but it still emits one SKIPPED row\n * per ID so the traceability manifest sees that a scenario exists for each\n * requirement (the manifest joins on emitted IDs regardless of status).\n */\nexport const CUSTOM_HEADER_SERVER_DECLARED_CHECK_IDS = [\n 'sep-2243-server-decode-base64',\n 'sep-2243-server-validate-param-match',\n 'sep-2243-server-reject-invalid-param-chars',\n 'sep-2243-server-reject-param-mismatch'\n] as const;\n\n/**\n * The three Mcp-Name validation cases need a callable tool. They are emitted\n * from two places: as live test cases when the server lists a tool, and as\n * untestable failures (issue #248) when it does not — keep the identities in\n * one table so the two paths cannot drift.\n */\nconst MCP_NAME_CASES = [\n {\n id: REJECT_STATUS_CHECK_ID,\n name: 'ServerRejectsMismatchedNameHeader',\n description:\n 'Server rejects tools/call where Mcp-Name does not match body params.name',\n specRef: SPEC_REFERENCE\n },\n {\n id: 'sep-2243-server-accepts-whitespace-header-value',\n name: 'ServerAcceptsWhitespaceHeaderValue',\n description:\n 'Server MUST accept leading/trailing whitespace in Mcp-Name value (RFC 9110 §5.5: field parsing MUST exclude OWS before evaluating)',\n specRef: SPEC_REFERENCE_RFC9110_OWS\n },\n {\n id: REJECT_STATUS_CHECK_ID,\n name: 'ServerRejectsMissingNameHeader',\n description:\n 'Server MUST reject tools/call with missing Mcp-Name header when body has params.name',\n specRef: SPEC_REFERENCE\n }\n] as const;\n\n/** Emit the Mcp-Name cases as untestable failures naming the cause. */\nfunction untestableMcpNameCases(checks: ConformanceCheck[], reason: string) {\n for (const c of MCP_NAME_CASES) {\n checks.push(\n untestableCheck(c.id, c.name, c.description, reason, [c.specRef])\n );\n }\n}\n\n/**\n * Helper to send a raw HTTP POST request with custom headers.\n * Uses Node.js http.request to preserve exact header casing and values,\n * avoiding normalization that fetch()/Headers may apply.\n */\nasync function sendRawRequest(\n serverUrl: string,\n body: object,\n headers: Record = {}\n): Promise<{ status: number; body: any; headers: http.IncomingHttpHeaders }> {\n const url = new URL(serverUrl);\n const bodyStr = JSON.stringify(body);\n\n return new Promise((resolve, reject) => {\n const req = http.request(\n {\n hostname: url.hostname,\n port: url.port,\n path: url.pathname,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Accept: 'application/json, text/event-stream',\n 'Content-Length': Buffer.byteLength(bodyStr),\n ...headers\n }\n },\n (res) => {\n res.setEncoding('utf8');\n let data = '';\n res.on('data', (chunk) => {\n data += chunk;\n });\n res.on('end', () => {\n let responseBody: any;\n const contentType = res.headers['content-type'];\n if (contentType?.includes('application/json')) {\n try {\n responseBody = JSON.parse(data);\n } catch {\n responseBody = data;\n }\n } else {\n responseBody = data;\n }\n resolve({\n status: res.statusCode || 0,\n body: responseBody,\n headers: res.headers\n });\n });\n }\n );\n\n req.on('error', reject);\n req.write(bodyStr);\n req.end();\n });\n}\n\n/**\n * Builds two checks for a rejection case: one for the HTTP 400 status, one for\n * the -32020 JSON-RPC error code. Per SEP-2243 §Server Validation, 400 is MUST\n * but -32020 is SHOULD for *standard* headers (and MUST for *custom* headers,\n * §Server Behavior for Custom Headers) — so a server returning 400 with a\n * different error code is compliant for standard headers and must not FAIL.\n *\n * The two emitted check IDs are supplied explicitly by the caller: standard-\n * header callers pass the coarse REJECT_STATUS_CHECK_ID/REJECT_ERROR_CODE_CHECK_ID\n * pair, while custom-header/Base64 callers pass the param-validation\n * requirement that case exercises plus PARAM_REJECT_ERROR_CODE_CHECK_ID. The\n * per-case `name`/`description` distinguish which rejection case was\n * exercised.\n */\nfunction createRejectionChecks(\n statusId: string,\n errorCodeId: string,\n name: string,\n description: string,\n response: { status: number; body: any },\n specRef: { id: string; url: string },\n details: Record,\n opts: { errorCodeSeverity: 'FAILURE' | 'WARNING' }\n): ConformanceCheck[] {\n const fullDetails = {\n ...details,\n responseStatus: response.status,\n responseBody: response.body\n };\n const ts = new Date().toISOString();\n\n const statusOk = response.status === 400;\n const codeOk = response.body?.error?.code === HEADER_MISMATCH_ERROR_CODE;\n\n return [\n {\n id: statusId,\n name,\n description,\n status: statusOk ? 'SUCCESS' : 'FAILURE',\n timestamp: ts,\n errorMessage: statusOk\n ? undefined\n : `Expected HTTP 400, got ${response.status}. Server MUST reject with 400 Bad Request.`,\n specReferences: [specRef],\n details: fullDetails\n },\n {\n id: errorCodeId,\n name: `${name}ErrorCode`,\n description: `${description} — uses JSON-RPC error code -32020 (HeaderMismatch)`,\n status: codeOk ? 'SUCCESS' : opts.errorCodeSeverity,\n timestamp: ts,\n errorMessage: codeOk\n ? undefined\n : `Expected JSON-RPC error code ${HEADER_MISMATCH_ERROR_CODE} (HeaderMismatch), got ${response.body?.error?.code ?? '(missing)'}.`,\n specReferences: [specRef],\n details: fullDetails\n }\n ];\n}\n\nfunction createAcceptanceCheck(\n id: string,\n name: string,\n description: string,\n response: { status: number; body: any },\n specRef: { id: string; url: string },\n details: Record\n): ConformanceCheck {\n const errors: string[] = [];\n if (response.status >= 400) {\n errors.push(\n `Expected successful response, got HTTP ${response.status}. Server MUST accept this request.`\n );\n }\n // A server can return HTTP 200 with a JSON-RPC error in the body. Without\n // this assertion that case would pass as \"accepted\".\n if (\n response.body &&\n typeof response.body === 'object' &&\n 'error' in response.body\n ) {\n errors.push(\n `Expected successful response, but body contains JSON-RPC error ${JSON.stringify(response.body.error)}.`\n );\n }\n return {\n id,\n name,\n description,\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [specRef],\n details: {\n ...details,\n responseStatus: response.status,\n responseBody: response.body\n }\n };\n}\n\nexport class HttpHeaderValidationScenario implements ClientScenario {\n name = 'http-header-validation';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test server validation of standard MCP request headers (SEP-2243).\n\n**Server Implementation Requirements:**\n\n**Endpoint**: Streamable HTTP\n\n**Requirements**:\n- Server MUST reject requests where Mcp-Method header doesn't match the body method\n- Server MUST reject requests where Mcp-Name header doesn't match the body params.name/uri\n- Server MUST accept header names case-insensitively\n- Server MUST reject case-mismatched header values (method values are case-sensitive)\n- Server MUST accept extra whitespace around header values (per HTTP spec)\n- Server MUST return HTTP 400 Bad Request for validation failures\n- Server MUST return JSON-RPC error with code -32020 (HeaderMismatch)`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Discover the server's tools with a fully-conformant stateless request\n // (SEP-2575) — that wire protocol has no initialize handshake or sessions.\n const toolsResponse = await sendStatelessRequest(serverUrl, 'tools/list');\n if (!toolsResponse.body?.result) {\n // The server under test could not even answer a conformant tools/list:\n // report a single explicit setup failure instead of misleading\n // per-case results against a broken server.\n const rpcError = toolsResponse.body?.error;\n checks.push({\n id: 'sep-2243-server-standard-setup',\n name: 'HttpHeaderValidationSetup',\n description: 'Setup for header validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n `tools/list discovery failed: HTTP ${toolsResponse.status}` +\n (rpcError\n ? `, JSON-RPC error ${rpcError.code}: ${rpcError.message}`\n : ', no result in response body'),\n specReferences: [SPEC_REFERENCE],\n details: { httpStatus: toolsResponse.status, error: rpcError }\n });\n untestableMcpNameCases(\n checks,\n 'tools/list discovery failed, so the Mcp-Name header-validation cases could not be exercised'\n );\n return checks;\n }\n const toolsResult = toolsResponse.body.result as {\n tools?: Array<{ name: string; inputSchema?: unknown }>;\n };\n\n const baseHeaders: Record = {\n 'MCP-Protocol-Version': DRAFT_PROTOCOL_VERSION\n };\n\n let idCounter = 100;\n const nextId = () => idCounter++;\n\n // --- Header/Body Mismatch Tests ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMismatchedMethodHeader',\n 'Server rejects requests where Mcp-Method header does not match body method',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'Mcp-Method': 'prompts/list' },\n SPEC_REFERENCE,\n { requestBodyMethod: 'tools/list', mcpMethodHeader: 'prompts/list' }\n );\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMissingMethodHeader',\n 'Server rejects requests with missing Mcp-Method header',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n {},\n SPEC_REFERENCE,\n { requestBodyMethod: 'tools/list', mcpMethodHeader: '(missing)' }\n );\n\n if (toolsResult.tools && toolsResult.tools.length > 0) {\n const toolName = toolsResult.tools[0].name;\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMismatchedNameHeader',\n 'Server rejects tools/call where Mcp-Name does not match body params.name',\n {\n jsonrpc: '2.0',\n id: 0,\n method: 'tools/call',\n params: { name: toolName, arguments: {} }\n },\n { 'Mcp-Method': 'tools/call', 'Mcp-Name': 'wrong_tool_name' },\n SPEC_REFERENCE,\n { requestBodyName: toolName, mcpNameHeader: 'wrong_tool_name' }\n );\n\n // --- Whitespace Test ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-accepts-whitespace-header-value',\n 'ServerAcceptsWhitespaceHeaderValue',\n 'Server MUST accept leading/trailing whitespace in Mcp-Name value (RFC 9110 §5.5: field parsing MUST exclude OWS before evaluating)',\n {\n jsonrpc: '2.0',\n id: 0,\n method: 'tools/call',\n params: { name: toolName, arguments: {} }\n },\n {\n 'Mcp-Method': 'tools/call',\n 'Mcp-Name': ` ${toolName} `\n },\n SPEC_REFERENCE_RFC9110_OWS,\n {\n headerValue: ` ${toolName} `,\n bodyValue: toolName,\n reason: 'HTTP spec requires trimming OWS around field values'\n }\n );\n\n // --- Missing Standard Header with Value in Body (Case 47) ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMissingNameHeader',\n 'Server MUST reject tools/call with missing Mcp-Name header when body has params.name',\n {\n jsonrpc: '2.0',\n id: 0,\n method: 'tools/call',\n params: { name: toolName, arguments: {} }\n },\n { 'Mcp-Method': 'tools/call' },\n SPEC_REFERENCE,\n {\n requestBodyName: toolName,\n mcpNameHeader: '(missing)',\n reason:\n 'Standard header omitted but value present in body → MUST reject'\n }\n );\n } else {\n // No tools to exercise the Mcp-Name dimension: these MUST cases were\n // previously omitted without a trace. Emit untestable failures so\n // the gap is visible (issue #248).\n untestableMcpNameCases(\n checks,\n 'server lists no tools, so the Mcp-Name header-validation cases could not be exercised'\n );\n }\n\n // --- Case Sensitivity Tests ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-header-name-case-insensitive',\n 'ServerAcceptsLowercaseHeaderName',\n 'Server MUST accept lowercase header name (mcp-method)',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'mcp-method': 'tools/list' },\n SPEC_REFERENCE_CASE,\n { headerNameUsed: 'mcp-method' }\n );\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-header-name-case-insensitive',\n 'ServerAcceptsUppercaseHeaderName',\n 'Server MUST accept uppercase header name (MCP-METHOD)',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'MCP-METHOD': 'tools/list' },\n SPEC_REFERENCE_CASE,\n { headerNameUsed: 'MCP-METHOD' }\n );\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsCaseMismatchValue',\n 'Server MUST reject uppercase method value (TOOLS/LIST) since values are case-sensitive',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'Mcp-Method': 'TOOLS/LIST' },\n SPEC_REFERENCE_CASE,\n { headerValue: 'TOOLS/LIST', bodyValue: 'tools/list' }\n );\n } catch (error) {\n checks.push({\n id: 'sep-2243-server-standard-setup',\n name: 'HttpHeaderValidationSetup',\n description: 'Setup for header validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to set up tests: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE]\n });\n }\n\n return checks;\n }\n\n private async testCase(\n checks: ConformanceCheck[],\n serverUrl: string,\n baseHeaders: Record,\n nextId: () => number,\n expectation: 'accept' | 'reject',\n checkId: string,\n checkName: string,\n description: string,\n body: any,\n extraHeaders: Record,\n specRef: { id: string; url: string },\n details: Record\n ): Promise {\n try {\n // Issue #311: every raw request carries the SEP-2575 _meta fields — the\n // header-validation cases only mangle headers, never the body metadata.\n const requestBody = {\n ...body,\n id: body.id === 0 ? nextId() : body.id,\n params: withRequestMeta(body.params)\n };\n const response = await sendRawRequest(serverUrl, requestBody, {\n ...baseHeaders,\n ...extraHeaders\n });\n if (expectation === 'reject') {\n // Standard-header rejection: 400 is MUST, -32020 is SHOULD. All\n // standard-header rejection cases collapse onto the coarse requirement\n // ids; checkId/checkName still distinguish the case via name/details.\n checks.push(\n ...createRejectionChecks(\n REJECT_STATUS_CHECK_ID,\n REJECT_ERROR_CODE_CHECK_ID,\n checkName,\n description,\n response,\n specRef,\n details,\n { errorCodeSeverity: 'WARNING' }\n )\n );\n } else {\n checks.push(\n createAcceptanceCheck(\n checkId,\n checkName,\n description,\n response,\n specRef,\n details\n )\n );\n }\n } catch (error) {\n checks.push({\n id: checkId,\n name: checkName,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [specRef]\n });\n }\n }\n}\n\nexport class HttpCustomHeaderServerValidationScenario implements ClientScenario {\n name = 'http-custom-header-server-validation';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test server validation of custom Mcp-Param headers and Base64 encoding (SEP-2243).\n\n**Server Implementation Requirements:**\n\n**Endpoint**: Streamable HTTP with at least one tool using \\`x-mcp-header\\`\n\n**Requirements**:\n- Server MUST validate Base64-encoded header values\n- Server MUST reject requests with invalid Base64 padding or characters\n- Server MUST treat values without =?base64?...?= wrapper as literal\n- Server MUST reject requests where custom header is omitted but value is in body`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n // Discover the server's tools with a fully-conformant stateless request\n // (SEP-2575) — that wire protocol has no initialize handshake or sessions.\n const toolsResponse = await sendStatelessRequest(serverUrl, 'tools/list');\n if (!toolsResponse.body?.result) {\n // The server under test could not even answer a conformant tools/list:\n // report a single explicit setup failure (and backfill the declared\n // checks, mirroring the catch path) instead of pretending the\n // requirements are not applicable to a broken server.\n const rpcError = toolsResponse.body?.error;\n checks.push({\n id: 'sep-2243-server-custom-setup',\n name: 'HttpCustomHeaderServerValidationSetup',\n description: 'Setup for custom header server validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n `tools/list discovery failed: HTTP ${toolsResponse.status}` +\n (rpcError\n ? `, JSON-RPC error ${rpcError.code}: ${rpcError.message}`\n : ', no result in response body'),\n specReferences: [SPEC_REFERENCE_CUSTOM],\n details: { httpStatus: toolsResponse.status, error: rpcError }\n });\n this.failDeclaredChecks(checks);\n return checks;\n }\n const toolsResult = toolsResponse.body.result as {\n tools?: Array<{ name: string; inputSchema?: unknown }>;\n };\n\n // Find a tool with x-mcp-header annotations\n const xMcpTool = toolsResult.tools?.find((tool) => {\n const schema = tool.inputSchema as any;\n if (!schema?.properties) return false;\n return Object.values(schema.properties).some(\n (prop: any) => prop['x-mcp-header'] !== undefined\n );\n });\n\n if (!xMcpTool) {\n checks.push(\n untestableCheck(\n 'sep-2243-server-no-xmcp-tool',\n 'HttpCustomHeaderServerNoTool',\n 'Server has no tools with x-mcp-header annotations to test',\n 'server exposes no tool with x-mcp-header annotations, so none of the custom-header validation requirements could be exercised',\n [SPEC_REFERENCE_CUSTOM]\n )\n );\n this.untestableDeclaredChecks(\n checks,\n 'server exposes no tool with x-mcp-header annotations'\n );\n return checks;\n }\n\n const baseHeaders: Record = {\n 'MCP-Protocol-Version': DRAFT_PROTOCOL_VERSION\n };\n\n // Find the first x-mcp-header annotated STRING property\n // that is callable with minimal arguments to avoid schema validation failures\n const schema = xMcpTool.inputSchema as any;\n const annotatedEntry = Object.entries(schema.properties).find(\n ([, def]: [string, any]) =>\n def['x-mcp-header'] !== undefined && (def as any).type === 'string'\n );\n if (!annotatedEntry) {\n checks.push(\n untestableCheck(\n 'sep-2243-server-no-string-param',\n 'HttpCustomHeaderServerNoStringParam',\n 'Server has no string-typed x-mcp-header parameter to test',\n 'server exposes no string-typed x-mcp-header parameter, so the custom-header validation requirements could not be exercised',\n [SPEC_REFERENCE_CUSTOM]\n )\n );\n this.untestableDeclaredChecks(\n checks,\n 'server exposes no string-typed x-mcp-header parameter'\n );\n return checks;\n }\n const [paramName, paramDef] = annotatedEntry as [string, any];\n const headerSuffix = paramDef['x-mcp-header'];\n\n // Build default arguments for all required params to avoid schema validation errors.\n // These go in the JSON body, so number/boolean must be the real types —\n // sending '0' or 'false' as strings makes the server reject on JSON-schema\n // grounds and the header-validation checks below would false-pass on that 400.\n const requiredParams: string[] = schema.required || [];\n const defaultArgs: Record = {};\n const defaultHeaders: Record = {};\n for (const rp of requiredParams) {\n if (rp !== paramName) {\n const rpDef = schema.properties[rp];\n const rpType = rpDef?.type || 'string';\n if (rpType === 'number' || rpType === 'integer') {\n defaultArgs[rp] = 0;\n } else if (rpType === 'boolean') {\n defaultArgs[rp] = false;\n } else {\n defaultArgs[rp] = 'test-default';\n }\n // If this required param also has x-mcp-header, include its header too\n if (rpDef?.['x-mcp-header']) {\n defaultHeaders[`Mcp-Param-${rpDef['x-mcp-header']}`] = String(\n defaultArgs[rp]\n );\n }\n }\n }\n\n let idCounter = 200;\n const nextId = () => idCounter++;\n\n // --- Base64 Decoding Tests ---\n\n const validBase64Value = Buffer.from('Hello').toString('base64');\n\n // Valid Base64 - server decodes and validates\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-decode-base64',\n 'ServerAcceptsValidBase64',\n 'Server decodes valid Base64 header value and validates against body',\n xMcpTool.name,\n paramName,\n 'Hello',\n headerSuffix,\n `=?base64?${validBase64Value}?=`,\n defaultArgs,\n defaultHeaders\n );\n\n // Invalid Base64 padding — FAILURE per the SEP-2243 conformance-test-case\n // table, which is the approved source of truth for these cases. The spec\n // body says only \"MUST decode them accordingly\", but the table specifies\n // strict rejection. SDKs whose stdlib decoders are lenient (Node\n // Buffer.from, browser atob) will need to validate before decoding; if\n // that proves burdensome we'll revisit.\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n 'sep-2243-server-reject-invalid-param-chars',\n 'ServerRejectsInvalidBase64Padding',\n 'Server MUST reject Mcp-Param header with invalid Base64 padding (per SEP-2243 test-case table)',\n xMcpTool.name,\n paramName,\n 'Hello',\n headerSuffix,\n '=?base64?SGVsbG8?=',\n defaultArgs,\n defaultHeaders\n );\n\n // Invalid Base64 characters — FAILURE for the same reason as padding.\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n 'sep-2243-server-reject-invalid-param-chars',\n 'ServerRejectsInvalidBase64Chars',\n 'Server MUST reject Mcp-Param header with non-alphabet Base64 characters (per SEP-2243 test-case table)',\n xMcpTool.name,\n paramName,\n 'Hello',\n headerSuffix,\n '=?base64?SGVs!!!bG8=?=',\n defaultArgs,\n defaultHeaders\n );\n\n // Missing prefix - server treats as literal value\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-validate-param-match',\n 'ServerLiteralMissingBase64Prefix',\n 'Server treats value without =?base64? prefix as literal (not Base64)',\n xMcpTool.name,\n paramName,\n validBase64Value,\n headerSuffix,\n validBase64Value,\n defaultArgs,\n defaultHeaders\n );\n\n // Missing suffix - server treats as literal value\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-validate-param-match',\n 'ServerLiteralMissingBase64Suffix',\n 'Server treats value without ?= suffix as literal (not Base64)',\n xMcpTool.name,\n paramName,\n `=?base64?${validBase64Value}`,\n headerSuffix,\n `=?base64?${validBase64Value}`,\n defaultArgs,\n defaultHeaders\n );\n\n // --- Missing Custom Header with Value in Body ---\n\n await this.testMissingCustomHeader(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n xMcpTool.name,\n paramName,\n headerSuffix,\n defaultArgs,\n defaultHeaders\n );\n } catch (error) {\n checks.push({\n id: 'sep-2243-server-custom-setup',\n name: 'HttpCustomHeaderServerValidationSetup',\n description: 'Setup for custom header server validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n\n // Declared-but-unemitted -> FAILURE. Reached only when setup threw partway\n // through (the gate-out paths emit untestable FAILURE rows and the happy path emits\n // every declared ID).\n this.failDeclaredChecks(checks);\n\n return checks;\n }\n\n /**\n * Backfill every declared-but-unemitted check ID as FAILURE when setup\n * failed before the cases could run, keeping the emitted ID set stable.\n */\n private failDeclaredChecks(checks: ConformanceCheck[]): void {\n for (const id of CUSTOM_HEADER_SERVER_DECLARED_CHECK_IDS) {\n if (checks.some((c) => c.id === id)) continue;\n checks.push({\n id,\n name: 'NotObserved',\n description: `Declared check ${id} was never emitted`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Check was not observed: custom-header validation setup failed before this case ran.',\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n }\n\n /**\n * Emit one untestable FAILURE row per declared requirement check when the\n * scenario cannot run against this server (no x-mcp-header tool). These\n * are MUST requirements, so a missing fixture must read red, not green\n * (issue #248); the IDs still reach checks.json so the traceability\n * manifest records that a scenario exists for each requirement.\n */\n private untestableDeclaredChecks(\n checks: ConformanceCheck[],\n reason: string\n ): void {\n for (const id of CUSTOM_HEADER_SERVER_DECLARED_CHECK_IDS) {\n if (checks.some((c) => c.id === id)) continue;\n checks.push(\n untestableCheck(\n id,\n 'NotTestable',\n `Declared check ${id} is not testable against this server`,\n reason,\n [SPEC_REFERENCE_CUSTOM]\n )\n );\n }\n }\n\n private async testBase64Case(\n checks: ConformanceCheck[],\n serverUrl: string,\n baseHeaders: Record,\n nextId: () => number,\n expectation: 'accept' | 'reject',\n checkId: string,\n checkName: string,\n description: string,\n toolName: string,\n paramName: string,\n bodyValue: string,\n headerSuffix: string,\n headerValue: string,\n defaultArgs: Record,\n defaultHeaders: Record\n ): Promise {\n try {\n const response = await sendRawRequest(\n serverUrl,\n {\n jsonrpc: '2.0',\n id: nextId(),\n method: 'tools/call',\n // Issue #311: the body always carries the SEP-2575 _meta fields —\n // these cases only vary the Mcp-Param header value.\n params: withRequestMeta({\n name: toolName,\n arguments: { ...defaultArgs, [paramName]: bodyValue }\n })\n },\n {\n ...baseHeaders,\n ...defaultHeaders,\n 'Mcp-Method': 'tools/call',\n 'Mcp-Name': toolName,\n [`Mcp-Param-${headerSuffix}`]: headerValue\n }\n );\n\n const details = {\n toolName,\n paramName,\n bodyValue,\n headerSuffix,\n headerValue\n };\n\n if (expectation === 'accept') {\n checks.push(\n createAcceptanceCheck(\n checkId,\n checkName,\n description,\n response,\n SPEC_REFERENCE_BASE64,\n details\n )\n );\n } else {\n // Custom-header rejection: both 400 and -32020 are MUST per\n // §Server Behavior for Custom Headers. The status half maps to the\n // param-validation requirement this case exercises (checkId); the\n // error-code half is the \"400 + -32020 if any validation fails\"\n // requirement.\n checks.push(\n ...createRejectionChecks(\n checkId,\n PARAM_REJECT_ERROR_CODE_CHECK_ID,\n checkName,\n description,\n response,\n SPEC_REFERENCE_BASE64,\n details,\n { errorCodeSeverity: 'FAILURE' }\n )\n );\n }\n } catch (error) {\n checks.push({\n id: checkId,\n name: checkName,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE_BASE64]\n });\n }\n }\n\n private async testMissingCustomHeader(\n checks: ConformanceCheck[],\n serverUrl: string,\n baseHeaders: Record,\n nextId: () => number,\n toolName: string,\n paramName: string,\n headerSuffix: string,\n defaultArgs: Record,\n defaultHeaders: Record\n ): Promise {\n try {\n // Send tools/call with value in body but NO Mcp-Param header\n const response = await sendRawRequest(\n serverUrl,\n {\n jsonrpc: '2.0',\n id: nextId(),\n method: 'tools/call',\n // Issue #311: the body always carries the SEP-2575 _meta fields —\n // this case only omits the Mcp-Param header.\n params: withRequestMeta({\n name: toolName,\n arguments: { ...defaultArgs, [paramName]: 'test-value' }\n })\n },\n {\n ...baseHeaders,\n ...defaultHeaders,\n 'Mcp-Method': 'tools/call',\n 'Mcp-Name': toolName\n // Deliberately omit Mcp-Param-{headerSuffix} header\n }\n );\n\n // Custom-header rejection: both 400 and -32020 are MUST. A header\n // omitted while the body carries a value is a header/body mismatch, so\n // the status half maps to the validate-param-match requirement.\n checks.push(\n ...createRejectionChecks(\n 'sep-2243-server-validate-param-match',\n PARAM_REJECT_ERROR_CODE_CHECK_ID,\n 'ServerRejectsMissingCustomHeader',\n 'Server MUST reject request where custom header is omitted but value is present in body',\n response,\n SPEC_REFERENCE_CUSTOM,\n {\n toolName,\n paramName,\n bodyValue: 'test-value',\n expectedHeader: `Mcp-Param-${headerSuffix}`,\n mcpParamHeader: '(missing)'\n },\n { errorCodeSeverity: 'FAILURE' }\n )\n );\n } catch (error) {\n checks.push({\n id: 'sep-2243-server-validate-param-match',\n name: 'ServerRejectsMissingCustomHeader',\n description:\n 'Server MUST reject request where custom header is omitted but value is present in body',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n }\n}\n",[],[142,474,499,597],"69895459-ed77-4d8d-b64f-0ddfe6b6fb54","elicitation-enums.ts","d9d14c54-ad13-11f1-92d3-1607ee4eb77e",98,["D",1789046870985],"/**\n * SEP-1330: Elicitation enum schema improvements test scenarios for MCP servers\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport type { RunContext } from '../../connection/index.ts';\nimport { connectToServer } from '../../connection/sdk-client.ts';\nimport { ElicitRequestSchema } from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\n\nexport class ElicitationEnumsScenario implements ClientScenario {\n name = 'elicitation-sep1330-enums';\n readonly source = {\n introducedIn: '2025-11-25',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = `Test elicitation with enum schema improvements (SEP-1330).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_elicitation_sep1330_enums\\` (no arguments) that requests \\`elicitation/create\\` from the client with a schema containing all 5 enum variants:\n\n1. **Untitled single-select**: \\`{ type: \"string\", enum: [\"option1\", \"option2\", \"option3\"] }\\`\n2. **Titled single-select**: \\`{ type: \"string\", oneOf: [{ const: \"value1\", title: \"First Option\" }, ...] }\\`\n3. **Legacy titled (deprecated)**: \\`{ type: \"string\", enum: [\"opt1\", \"opt2\", \"opt3\"], enumNames: [\"Option One\", \"Option Two\", \"Option Three\"] }\\`\n4. **Untitled multi-select**: \\`{ type: \"array\", items: { type: \"string\", enum: [\"option1\", \"option2\", \"option3\"] } }\\`\n5. **Titled multi-select**: \\`{ type: \"array\", items: { anyOf: [{ const: \"value1\", title: \"First Choice\" }, ...] } }\\`\n\n**Returns**: Text content with the elicitation result\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"Elicitation completed: action=, content={...}\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl, {}, ctx.specVersion);\n\n let capturedRequest: any = null;\n connection.client.setRequestHandler(\n ElicitRequestSchema,\n async (request) => {\n capturedRequest = request;\n // Return mock data for all enum types\n return {\n action: 'accept',\n content: {\n untitledSingle: 'option1',\n titledSingle: 'value1',\n legacyEnum: 'opt1',\n untitledMulti: ['option1', 'option2'],\n titledMulti: ['value1', 'value2']\n }\n };\n }\n );\n\n await connection.client.callTool({\n name: 'test_elicitation_sep1330_enums',\n arguments: {}\n });\n\n // Validate that elicitation was requested\n if (!capturedRequest) {\n checks.push({\n id: 'elicitation-sep1330-general',\n name: 'ElicitationSEP1330General',\n description: 'Server requests elicitation with enum schemas',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'Server did not request elicitation from client',\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ]\n });\n await connection.close();\n return checks;\n }\n\n const schema = capturedRequest.params?.requestedSchema;\n const properties = schema?.properties;\n\n // Validate untitled single-select enum\n const untitledSingleErrors: string[] = [];\n if (!properties?.untitledSingle) {\n untitledSingleErrors.push(\n 'Missing untitled single-select enum field \"untitledSingle\"'\n );\n } else {\n if (properties.untitledSingle.type !== 'string') {\n untitledSingleErrors.push(\n `Expected type \"string\", got \"${properties.untitledSingle.type}\"`\n );\n }\n if (\n !properties.untitledSingle.enum ||\n !Array.isArray(properties.untitledSingle.enum)\n ) {\n untitledSingleErrors.push('Missing or invalid enum array');\n }\n if (properties.untitledSingle.oneOf) {\n untitledSingleErrors.push(\n 'Untitled enum should not have oneOf property'\n );\n }\n if (properties.untitledSingle.enumNames) {\n untitledSingleErrors.push(\n 'Untitled enum should not have enumNames property'\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1330-untitled-single',\n name: 'ElicitationSEP1330UntitledSingle',\n description: 'Untitled single-select enum schema uses enum array',\n status: untitledSingleErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n untitledSingleErrors.length > 0\n ? untitledSingleErrors.join('; ')\n : undefined,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ],\n details: {\n field: 'untitledSingle',\n schema: properties?.untitledSingle\n }\n });\n\n // Validate titled single-select enum (using oneOf with const/title)\n const titledSingleErrors: string[] = [];\n if (!properties?.titledSingle) {\n titledSingleErrors.push(\n 'Missing titled single-select enum field \"titledSingle\"'\n );\n } else {\n if (properties.titledSingle.type !== 'string') {\n titledSingleErrors.push(\n `Expected type \"string\", got \"${properties.titledSingle.type}\"`\n );\n }\n if (\n !properties.titledSingle.oneOf ||\n !Array.isArray(properties.titledSingle.oneOf)\n ) {\n titledSingleErrors.push(\n 'Missing or invalid oneOf array for titled enum'\n );\n } else {\n // Validate oneOf structure has const/title pairs\n const invalidItems = properties.titledSingle.oneOf.filter(\n (item: any) =>\n typeof item.const !== 'string' || typeof item.title !== 'string'\n );\n if (invalidItems.length > 0) {\n titledSingleErrors.push(\n `oneOf items must have \"const\" (string) and \"title\" (string) properties`\n );\n }\n }\n if (properties.titledSingle.enum) {\n titledSingleErrors.push(\n 'Titled enum should use oneOf instead of enum array'\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1330-titled-single',\n name: 'ElicitationSEP1330TitledSingle',\n description:\n 'Titled single-select enum schema uses oneOf with const/title',\n status: titledSingleErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n titledSingleErrors.length > 0\n ? titledSingleErrors.join('; ')\n : undefined,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ],\n details: {\n field: 'titledSingle',\n schema: properties?.titledSingle\n }\n });\n\n // Validate legacy titled enum (using enumNames - deprecated)\n const legacyEnumErrors: string[] = [];\n if (!properties?.legacyEnum) {\n legacyEnumErrors.push('Missing legacy titled enum field \"legacyEnum\"');\n } else {\n if (properties.legacyEnum.type !== 'string') {\n legacyEnumErrors.push(\n `Expected type \"string\", got \"${properties.legacyEnum.type}\"`\n );\n }\n if (\n !properties.legacyEnum.enum ||\n !Array.isArray(properties.legacyEnum.enum)\n ) {\n legacyEnumErrors.push('Missing or invalid enum array');\n }\n if (\n !properties.legacyEnum.enumNames ||\n !Array.isArray(properties.legacyEnum.enumNames)\n ) {\n legacyEnumErrors.push(\n 'Missing or invalid enumNames array for legacy titled enum'\n );\n } else if (\n properties.legacyEnum.enum &&\n properties.legacyEnum.enumNames.length !==\n properties.legacyEnum.enum.length\n ) {\n legacyEnumErrors.push(\n `enumNames length (${properties.legacyEnum.enumNames.length}) must match enum length (${properties.legacyEnum.enum.length})`\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1330-legacy-enumnames',\n name: 'ElicitationSEP1330LegacyEnumNames',\n description: 'Legacy titled enum schema uses enumNames (deprecated)',\n status: legacyEnumErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n legacyEnumErrors.length > 0 ? legacyEnumErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ],\n details: {\n field: 'legacyEnum',\n schema: properties?.legacyEnum\n }\n });\n\n // Validate untitled multi-select enum\n const untitledMultiErrors: string[] = [];\n if (!properties?.untitledMulti) {\n untitledMultiErrors.push(\n 'Missing untitled multi-select enum field \"untitledMulti\"'\n );\n } else {\n if (properties.untitledMulti.type !== 'array') {\n untitledMultiErrors.push(\n `Expected type \"array\", got \"${properties.untitledMulti.type}\"`\n );\n }\n if (!properties.untitledMulti.items) {\n untitledMultiErrors.push('Missing items property for array type');\n } else {\n if (properties.untitledMulti.items.type !== 'string') {\n untitledMultiErrors.push(\n `Expected items.type \"string\", got \"${properties.untitledMulti.items.type}\"`\n );\n }\n if (\n !properties.untitledMulti.items.enum ||\n !Array.isArray(properties.untitledMulti.items.enum)\n ) {\n untitledMultiErrors.push('Missing or invalid items.enum array');\n }\n if (properties.untitledMulti.items.anyOf) {\n untitledMultiErrors.push(\n 'Untitled multi-select should use items.enum, not items.anyOf'\n );\n }\n }\n }\n\n checks.push({\n id: 'elicitation-sep1330-untitled-multi',\n name: 'ElicitationSEP1330UntitledMulti',\n description:\n 'Untitled multi-select enum schema uses array with items.enum',\n status: untitledMultiErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n untitledMultiErrors.length > 0\n ? untitledMultiErrors.join('; ')\n : undefined,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ],\n details: {\n field: 'untitledMulti',\n schema: properties?.untitledMulti\n }\n });\n\n // Validate titled multi-select enum (using items.anyOf with const/title)\n const titledMultiErrors: string[] = [];\n if (!properties?.titledMulti) {\n titledMultiErrors.push(\n 'Missing titled multi-select enum field \"titledMulti\"'\n );\n } else {\n if (properties.titledMulti.type !== 'array') {\n titledMultiErrors.push(\n `Expected type \"array\", got \"${properties.titledMulti.type}\"`\n );\n }\n if (!properties.titledMulti.items) {\n titledMultiErrors.push('Missing items property for array type');\n } else {\n if (\n !properties.titledMulti.items.anyOf ||\n !Array.isArray(properties.titledMulti.items.anyOf)\n ) {\n titledMultiErrors.push(\n 'Missing or invalid items.anyOf array for titled multi-select'\n );\n } else {\n // Validate anyOf structure has const/title pairs\n const invalidItems = properties.titledMulti.items.anyOf.filter(\n (item: any) =>\n typeof item.const !== 'string' || typeof item.title !== 'string'\n );\n if (invalidItems.length > 0) {\n titledMultiErrors.push(\n `items.anyOf entries must have \"const\" (string) and \"title\" (string) properties`\n );\n }\n }\n if (properties.titledMulti.items.enum) {\n titledMultiErrors.push(\n 'Titled multi-select should use items.anyOf, not items.enum'\n );\n }\n }\n }\n\n checks.push({\n id: 'elicitation-sep1330-titled-multi',\n name: 'ElicitationSEP1330TitledMulti',\n description:\n 'Titled multi-select enum schema uses array with items.anyOf',\n status: titledMultiErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n titledMultiErrors.length > 0\n ? titledMultiErrors.join('; ')\n : undefined,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ],\n details: {\n field: 'titledMulti',\n schema: properties?.titledMulti\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'elicitation-sep1330-general',\n name: 'ElicitationSEP1330General',\n description: 'Server requests elicitation with enum schemas',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,499,605],"f7c6f0d2-607c-48d2-9f65-0d2748abe2f7","elicitation-defaults.ts","da902eb2-ad13-11f1-b34d-1607ee4eb77e",99,["D",1789046871291],"/**\n * SEP-1034: Elicitation default values test scenarios for MCP servers\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport type { RunContext } from '../../connection/index.ts';\nimport { connectToServer } from '../../connection/sdk-client.ts';\nimport { ElicitRequestSchema } from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\n\nexport class ElicitationDefaultsScenario implements ClientScenario {\n name = 'elicitation-sep1034-defaults';\n readonly source = {\n introducedIn: '2025-11-25',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = `Test elicitation with default values for all primitive types (SEP-1034).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_elicitation_sep1034_defaults\\` (no arguments) that requests \\`elicitation/create\\` from the client with a schema containing default values for all primitive types:\n- \\`name\\` (string): default \"John Doe\"\n- \\`age\\` (integer): default 30\n- \\`score\\` (number): default 95.5\n- \\`status\\` (string enum: [\"active\", \"inactive\", \"pending\"]): default \"active\"\n- \\`verified\\` (boolean): default true\n\n**Returns**: Text content with the elicitation result\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"Elicitation completed: action=, content={...}\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl } = ctx;\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl, {}, ctx.specVersion);\n\n let capturedRequest: any = null;\n connection.client.setRequestHandler(\n ElicitRequestSchema,\n async (request) => {\n capturedRequest = request;\n return {\n action: 'accept',\n content: {\n name: 'Jane Smith',\n age: 25,\n score: 88.0,\n status: 'inactive',\n verified: false\n }\n };\n }\n );\n\n await connection.client.callTool({\n name: 'test_elicitation_sep1034_defaults',\n arguments: {}\n });\n\n // Validate that elicitation was requested\n if (!capturedRequest) {\n checks.push({\n id: 'elicitation-sep1034-general',\n name: 'ElicitationSEP1034General',\n description: 'Server requests elicitation with default values',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'Server did not request elicitation from client',\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ]\n });\n await connection.close();\n return checks;\n }\n\n const schema = capturedRequest.params?.requestedSchema;\n const properties = schema?.properties;\n\n // Validate string default\n const stringErrors: string[] = [];\n if (!properties?.name) {\n stringErrors.push('Missing string field \"name\"');\n } else {\n if (properties.name.type !== 'string') {\n stringErrors.push(\n `Expected type \"string\", got \"${properties.name.type}\"`\n );\n }\n if (!('default' in properties.name)) {\n stringErrors.push('Missing default field');\n } else if (properties.name.default !== 'John Doe') {\n stringErrors.push(\n `Expected default \"John Doe\", got \"${properties.name.default}\"`\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1034-string-default',\n name: 'ElicitationSEP1034StringDefault',\n description: 'String schema includes default value',\n status: stringErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n stringErrors.length > 0 ? stringErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'name',\n schema: properties?.name\n }\n });\n\n // Validate integer default\n const integerErrors: string[] = [];\n if (!properties?.age) {\n integerErrors.push('Missing integer field \"age\"');\n } else {\n if (properties.age.type !== 'integer') {\n integerErrors.push(\n `Expected type \"integer\", got \"${properties.age.type}\"`\n );\n }\n if (!('default' in properties.age)) {\n integerErrors.push('Missing default field');\n } else if (properties.age.default !== 30) {\n integerErrors.push(\n `Expected default 30, got ${properties.age.default}`\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1034-integer-default',\n name: 'ElicitationSEP1034IntegerDefault',\n description: 'Integer schema includes default value',\n status: integerErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n integerErrors.length > 0 ? integerErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'age',\n schema: properties?.age\n }\n });\n\n // Validate number default\n const numberErrors: string[] = [];\n if (!properties?.score) {\n numberErrors.push('Missing number field \"score\"');\n } else {\n if (properties.score.type !== 'number') {\n numberErrors.push(\n `Expected type \"number\", got \"${properties.score.type}\"`\n );\n }\n if (!('default' in properties.score)) {\n numberErrors.push('Missing default field');\n } else if (properties.score.default !== 95.5) {\n numberErrors.push(\n `Expected default 95.5, got ${properties.score.default}`\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1034-number-default',\n name: 'ElicitationSEP1034NumberDefault',\n description: 'Number schema includes default value',\n status: numberErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n numberErrors.length > 0 ? numberErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'score',\n schema: properties?.score\n }\n });\n\n // Validate enum default\n const enumErrors: string[] = [];\n if (!properties?.status) {\n enumErrors.push('Missing enum field \"status\"');\n } else {\n if (properties.status.type !== 'string') {\n enumErrors.push(\n `Expected type \"string\", got \"${properties.status.type}\"`\n );\n }\n if (!properties.status.enum || !Array.isArray(properties.status.enum)) {\n enumErrors.push('Missing or invalid enum array');\n }\n if (!('default' in properties.status)) {\n enumErrors.push('Missing default field');\n } else {\n if (properties.status.default !== 'active') {\n enumErrors.push(\n `Expected default \"active\", got \"${properties.status.default}\"`\n );\n }\n if (\n properties.status.enum &&\n !properties.status.enum.includes(properties.status.default)\n ) {\n enumErrors.push(\n `Default value \"${properties.status.default}\" is not a valid enum member`\n );\n }\n }\n }\n\n checks.push({\n id: 'elicitation-sep1034-enum-default',\n name: 'ElicitationSEP1034EnumDefault',\n description: 'Enum schema includes valid default value',\n status: enumErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: enumErrors.length > 0 ? enumErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'status',\n schema: properties?.status\n }\n });\n\n // Validate boolean default (regression test - already supported)\n const booleanErrors: string[] = [];\n if (!properties?.verified) {\n booleanErrors.push('Missing boolean field \"verified\"');\n } else {\n if (properties.verified.type !== 'boolean') {\n booleanErrors.push(\n `Expected type \"boolean\", got \"${properties.verified.type}\"`\n );\n }\n if (!('default' in properties.verified)) {\n booleanErrors.push('Missing default field');\n } else if (properties.verified.default !== true) {\n booleanErrors.push(\n `Expected default true, got ${properties.verified.default}`\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1034-boolean-default',\n name: 'ElicitationSEP1034BooleanDefault',\n description: 'Boolean schema includes default value',\n status: booleanErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n booleanErrors.length > 0 ? booleanErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'verified',\n schema: properties?.verified\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'elicitation-sep1034-general',\n name: 'ElicitationSEP1034General',\n description: 'Server requests elicitation with default values',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,499,613],"f7f7080a-6d9b-455d-a8ca-1d67d4cb8ff1","dns-rebinding.ts","d851ca7a-ad13-11f1-84e1-1607ee4eb77e",93,["D",1789046867849],"/**\n * DNS Rebinding Protection test scenarios for MCP servers\n *\n * Tests that localhost MCP servers properly validate Host or Origin headers\n * to prevent DNS rebinding attacks. See GHSA-w48q-cv73-mx4w for details.\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport { buildStandardHeaders, type RunContext } from '../../connection/index.ts';\nimport { request } from 'npm:undici@^7.25.0';\n\nconst SPEC_REFERENCES = [\n {\n id: 'MCP-DNS-Rebinding-Protection',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices#local-mcp-server-compromise'\n },\n {\n id: 'MCP-Transport-Security',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#security-warning'\n }\n];\n\n/**\n * Check if URL is a localhost URL\n */\nfunction isLocalhostUrl(serverUrl: string): boolean {\n const url = new URL(serverUrl);\n const hostname = url.hostname.toLowerCase();\n return (\n hostname === 'localhost' ||\n hostname === '127.0.0.1' ||\n hostname === '[::1]' ||\n hostname === '::1'\n );\n}\n\n/**\n * Get the host header value from a URL (hostname:port)\n */\nfunction getHostFromUrl(serverUrl: string): string {\n const url = new URL(serverUrl);\n return url.host; // includes port if present\n}\n\n/**\n * Build a request body that any server for the given spec version should\n * accept without prior setup (initialize for the stateful lifecycle,\n * server/discover with _meta for the stateless lifecycle).\n */\nfunction probeBody(specVersion: string): {\n jsonrpc: '2.0';\n id: number;\n method: string;\n params: Record;\n} {\n const clientInfo = {\n name: 'conformance-dns-rebinding-test',\n version: '1.0.0'\n };\n if (specVersion === DRAFT_PROTOCOL_VERSION) {\n return {\n jsonrpc: '2.0',\n id: 1,\n method: 'server/discover',\n params: {\n _meta: {\n 'io.modelcontextprotocol/protocolVersion': specVersion,\n 'io.modelcontextprotocol/clientInfo': clientInfo,\n 'io.modelcontextprotocol/clientCapabilities': {}\n }\n }\n };\n }\n return {\n jsonrpc: '2.0',\n id: 1,\n method: 'initialize',\n params: {\n protocolVersion: specVersion,\n capabilities: {},\n clientInfo\n }\n };\n}\n\nfunction getResponseHeader(\n headers: Record,\n name: string\n): string | undefined {\n const value = headers[name] ?? headers[name.toLowerCase()];\n if (Array.isArray(value)) return value[0];\n return value;\n}\n\n/**\n * Send an MCP request with custom Host and Origin headers.\n * Both headers are set to the same value so that servers checking either\n * Host or Origin will properly detect the rebinding attempt.\n */\nasync function sendRequestWithHostAndOrigin(\n serverUrl: string,\n hostOrOrigin: string,\n specVersion: string\n): Promise<{ statusCode: number; body: unknown; sessionId?: string }> {\n // Build the SEP-2243 standard headers (Mcp-Method, Accept, ...) for the\n // probe's JSON-RPC method so a strictly-conformant server only rejects the\n // request for the Host/Origin values under test, then layer the\n // scenario-specific headers on top.\n const probe = probeBody(specVersion);\n const response = await request(serverUrl, {\n method: 'POST',\n headers: buildStandardHeaders(probe.method, probe.params, {\n headers: {\n Host: hostOrOrigin,\n Origin: `http://${hostOrOrigin}`,\n 'MCP-Protocol-Version': specVersion\n }\n }),\n body: JSON.stringify(probe)\n });\n\n let body: unknown;\n try {\n body = await response.body.json();\n } catch {\n body = null;\n }\n\n return {\n statusCode: response.statusCode,\n body,\n sessionId: getResponseHeader(response.headers, 'mcp-session-id')\n };\n}\n\nasync function sendInitializedNotification(\n serverUrl: string,\n hostOrOrigin: string,\n specVersion: string,\n sessionId?: string\n): Promise<{ statusCode: number; body: unknown }> {\n const method = 'notifications/initialized';\n const response = await request(serverUrl, {\n method: 'POST',\n headers: buildStandardHeaders(method, undefined, {\n headers: {\n Host: hostOrOrigin,\n Origin: `http://${hostOrOrigin}`,\n 'MCP-Protocol-Version': specVersion,\n ...(sessionId ? { 'Mcp-Session-Id': sessionId } : {})\n }\n }),\n body: JSON.stringify({\n jsonrpc: '2.0',\n method\n })\n });\n\n let body: unknown;\n try {\n body = await response.body.json();\n } catch {\n body = null;\n }\n\n return {\n statusCode: response.statusCode,\n body\n };\n}\n\nexport class DNSRebindingProtectionScenario implements ClientScenario {\n name = 'dns-rebinding-protection';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description = `Test DNS rebinding protection for localhost servers.\n\n**Scope:** This test applies to localhost MCP servers running without HTTPS and without\nauthentication. These servers are vulnerable to DNS rebinding attacks where a malicious\nwebsite tricks a user's browser into making requests to the local server.\n\n**Attack scenario:**\n1. User visits malicious website (e.g., evil.com)\n2. evil.com's DNS is configured to resolve to 127.0.0.1\n3. Browser makes request to evil.com which actually goes to localhost\n4. Without Host/Origin header validation, the local MCP server processes the request\n\n**Requirements:**\n- Server **MUST** validate the Host or Origin header on incoming requests\n- Server **MUST** reject requests with non-localhost Host/Origin headers (HTTP 4xx)\n- Server **MUST** accept requests with valid localhost Host/Origin headers\n\n**Valid localhost values:** \\`localhost\\`, \\`127.0.0.1\\`, \\`[::1]\\` (with optional port)\n\n**Note:** This test requires a localhost server URL. Non-localhost URLs will fail.\n\nSee: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-w48q-cv73-mx4w`;\n\n async run(ctx: RunContext): Promise {\n const { serverUrl, specVersion } = ctx;\n const checks: ConformanceCheck[] = [];\n const timestamp = new Date().toISOString();\n\n // Common check properties\n const rejectedCheckBase = {\n id: 'localhost-host-rebinding-rejected',\n name: 'DNSRebindingRejected',\n description:\n 'Server rejects requests with non-localhost Host/Origin headers',\n timestamp,\n specReferences: SPEC_REFERENCES\n };\n\n const acceptedCheckBase = {\n id: 'localhost-host-valid-accepted',\n name: 'LocalhostHostAccepted',\n description:\n 'Server accepts requests with valid localhost Host/Origin headers',\n timestamp,\n specReferences: SPEC_REFERENCES\n };\n\n // First check: Is this a localhost URL?\n if (!isLocalhostUrl(serverUrl)) {\n const errorMessage =\n 'DNS rebinding tests require a localhost server URL (localhost, 127.0.0.1, or [::1])';\n const details = { serverUrl, reason: 'non-localhost-url' };\n\n checks.push({\n ...rejectedCheckBase,\n status: 'FAILURE',\n errorMessage,\n details\n });\n checks.push({\n ...acceptedCheckBase,\n status: 'FAILURE',\n errorMessage,\n details\n });\n return checks;\n }\n\n const validHost = getHostFromUrl(serverUrl);\n const attackerHost = 'evil.example.com';\n\n // Check 1: Invalid Host/Origin headers should be rejected with a 4xx error\n try {\n const response = await sendRequestWithHostAndOrigin(\n serverUrl,\n attackerHost,\n specVersion\n );\n const isRejected =\n response.statusCode >= 400 && response.statusCode < 500;\n\n const details = {\n hostHeader: attackerHost,\n originHeader: `http://${attackerHost}`,\n statusCode: response.statusCode,\n body: response.body\n };\n\n if (isRejected) {\n checks.push({\n ...rejectedCheckBase,\n status: 'SUCCESS',\n details\n });\n } else {\n checks.push({\n ...rejectedCheckBase,\n status: 'FAILURE',\n errorMessage: `Expected HTTP 4xx for invalid Host/Origin headers, got ${response.statusCode}`,\n details\n });\n }\n } catch (error) {\n checks.push({\n ...rejectedCheckBase,\n status: 'FAILURE',\n errorMessage: `Request failed: ${error instanceof Error ? error.message : String(error)}`,\n details: {\n hostHeader: attackerHost,\n originHeader: `http://${attackerHost}`\n }\n });\n }\n\n // Check 2: Valid localhost Host/Origin headers should be accepted (2xx response)\n try {\n const response = await sendRequestWithHostAndOrigin(\n serverUrl,\n validHost,\n specVersion\n );\n const isAccepted =\n response.statusCode >= 200 && response.statusCode < 300;\n const initializedNotification =\n isAccepted && specVersion !== DRAFT_PROTOCOL_VERSION\n ? await sendInitializedNotification(\n serverUrl,\n validHost,\n specVersion,\n response.sessionId\n )\n : undefined;\n const initializedAccepted =\n !initializedNotification ||\n (initializedNotification.statusCode >= 200 &&\n initializedNotification.statusCode < 300);\n\n const details = {\n hostHeader: validHost,\n originHeader: `http://${validHost}`,\n statusCode: response.statusCode,\n body: response.body,\n ...(initializedNotification\n ? {\n initializedNotification: {\n statusCode: initializedNotification.statusCode,\n body: initializedNotification.body,\n sessionIdSent: response.sessionId ?? null\n }\n }\n : {})\n };\n\n if (isAccepted && initializedAccepted) {\n checks.push({\n ...acceptedCheckBase,\n status: 'SUCCESS',\n details\n });\n } else {\n const errorMessage = !isAccepted\n ? `Expected HTTP 2xx for valid localhost Host/Origin headers, got ${response.statusCode}`\n : `Expected HTTP 2xx for initialized notification after valid localhost initialize, got ${initializedNotification?.statusCode}`;\n checks.push({\n ...acceptedCheckBase,\n status: 'FAILURE',\n errorMessage,\n details\n });\n }\n } catch (error) {\n checks.push({\n ...acceptedCheckBase,\n status: 'FAILURE',\n errorMessage: `Request failed: ${error instanceof Error ? error.message : String(error)}`,\n details: { hostHeader: validHost, originHeader: `http://${validHost}` }\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,499,621],"169ae74f-b3d6-4f72-8ae3-4d6141bec3c5","client-helper.ts","e4fc33d2-ad13-11f1-8258-1607ee4eb77e",57,["D",1789043638254],"/**\n * Helper utilities for creating MCP clients to test servers\n */\n\nimport { Client } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/index.js';\nimport { StreamableHTTPClientTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/streamableHttp.js';\nimport {\n LoggingMessageNotificationSchema,\n ProgressNotificationSchema\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\n\nexport interface MCPClientConnection {\n client: Client;\n close: () => Promise;\n}\n\n/**\n * Create and connect an MCP client to a server\n */\nexport async function connectToServer(\n serverUrl: string\n): Promise {\n const client = new Client(\n {\n name: 'conformance-test-client',\n version: '1.0.0'\n },\n {\n capabilities: {\n // Client capabilities\n sampling: {},\n elicitation: {}\n }\n }\n );\n\n const transport = new StreamableHTTPClientTransport(new URL(serverUrl));\n\n await client.connect(transport);\n\n return {\n client,\n close: async () => {\n await client.close();\n }\n };\n}\n\n/**\n * Helper to collect notifications (logging and progress)\n */\nexport class NotificationCollector {\n private loggingNotifications: any[] = [];\n private progressNotifications: any[] = [];\n\n constructor(client: Client) {\n // Set up notification handler for logging messages\n client.setNotificationHandler(\n LoggingMessageNotificationSchema,\n (notification) => {\n this.loggingNotifications.push(notification);\n }\n );\n\n // Set up notification handler for progress notifications\n client.setNotificationHandler(\n ProgressNotificationSchema,\n (notification) => {\n this.progressNotifications.push(notification);\n }\n );\n }\n\n /**\n * Get all collected logging notifications\n */\n getLoggingNotifications(): any[] {\n return this.loggingNotifications;\n }\n\n /**\n * Get all collected progress notifications\n */\n getProgressNotifications(): any[] {\n return this.progressNotifications;\n }\n\n /**\n * Get all notifications (for backward compatibility)\n */\n getNotifications(): any[] {\n return this.loggingNotifications;\n }\n}\n",[],[142,474,499,629],"d246bcfd-c61b-442e-a8af-83e117a57898","caching.ts","d809883c-ad13-11f1-b01d-1607ee4eb77e",92,["D",1789046867482],"/**\n * Caching (SEP-2549) test scenario for MCP servers\n *\n * Tests that servers include ttlMs and cacheScope on cacheable results:\n * tools/list, prompts/list, resources/list, resources/templates/list, resources/read\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport {\n JsonRpcError,\n type Connection,\n type RunContext\n} from '../../connection/index.ts';\nimport type { CacheableResult } from '../../spec-types/draft.ts';\n\nconst SPEC_REFS = [\n {\n id: 'MCP-Caching',\n url: 'https://modelcontextprotocol.io/specification/draft/server/utilities/caching'\n },\n {\n id: 'SEP-2549',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2549'\n }\n];\n\ninterface CachingFields {\n ttlMs: unknown;\n cacheScope: unknown;\n hasTtlMs: boolean;\n hasCacheScope: boolean;\n}\n\nfunction extractCachingFields(result: Partial): CachingFields {\n const hasTtlMs = 'ttlMs' in result;\n const hasCacheScope = 'cacheScope' in result;\n return {\n ttlMs: result.ttlMs,\n cacheScope: result.cacheScope,\n hasTtlMs,\n hasCacheScope\n };\n}\n\nfunction buildPresenceCheck(\n id: string,\n name: string,\n endpoint: string,\n fields: CachingFields\n): ConformanceCheck {\n const errors: string[] = [];\n\n if (!fields.hasTtlMs) {\n errors.push(`${endpoint} response missing ttlMs`);\n }\n if (!fields.hasCacheScope) {\n errors.push(`${endpoint} response missing cacheScope`);\n }\n\n return {\n id,\n name,\n description: `${endpoint} response includes ttlMs and cacheScope caching hints`,\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: SPEC_REFS,\n details: {\n ttlMs: fields.ttlMs,\n cacheScope: fields.cacheScope,\n hasTtlMs: fields.hasTtlMs,\n hasCacheScope: fields.hasCacheScope\n }\n };\n}\n\nexport class CachingScenario implements ClientScenario {\n name = 'caching';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test that servers include caching hints (ttlMs and cacheScope) on cacheable results (SEP-2549).\n\n**Server Implementation Requirements:**\n\nServers MUST include \\`ttlMs\\` (integer >= 0) and \\`cacheScope\\` (\"public\" or \"private\") on results from:\n- \\`tools/list\\`\n- \\`prompts/list\\`\n- \\`resources/list\\`\n- \\`resources/templates/list\\`\n- \\`resources/read\\``;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n const allFields: Array<{ endpoint: string; fields: CachingFields }> = [];\n\n // SEP-2549 only exists in the draft spec, so each cacheable endpoint is\n // queried over the version-appropriate connection. Under --spec-version\n // draft that resolves to the stateless impl (SEP-2575): protocolVersion\n // 2026-07-28 plus the cross-cutting _meta and standard headers\n // (issue #315).\n let conn: Connection;\n try {\n conn = await ctx.connect();\n } catch (error) {\n checks.push({\n id: 'sep-2549-caching-connection',\n name: 'CachingConnection',\n description: 'Caching hints scenario failed to connect',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Connection failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: SPEC_REFS\n });\n return checks;\n }\n\n const queryEndpoint = async (\n checkId: string,\n checkName: string,\n endpoint: string,\n params?: Record\n ): Promise<(CacheableResult & Record) | undefined> => {\n const description = `${endpoint} response includes ttlMs and cacheScope caching hints`;\n try {\n const result = await conn.request<\n CacheableResult & Record\n >(endpoint, params);\n const fields = extractCachingFields(result);\n allFields.push({ endpoint, fields });\n checks.push(buildPresenceCheck(checkId, checkName, endpoint, fields));\n return result;\n } catch (error) {\n const rpcError = error instanceof JsonRpcError ? error : undefined;\n checks.push({\n id: checkId,\n name: checkName,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: rpcError\n ? `${endpoint} returned JSON-RPC error ${rpcError.code}: ${rpcError.message}`\n : `${endpoint} request failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: SPEC_REFS,\n details: rpcError\n ? { error: { code: rpcError.code, message: rpcError.message } }\n : undefined\n });\n return undefined;\n }\n };\n\n // 1. tools/list\n await queryEndpoint(\n 'sep-2549-tools-list-caching-hints',\n 'ToolsListCachingHints',\n 'tools/list'\n );\n\n // 2. prompts/list\n await queryEndpoint(\n 'sep-2549-prompts-list-caching-hints',\n 'PromptsListCachingHints',\n 'prompts/list'\n );\n\n // 3. resources/list\n const resourcesResult = await queryEndpoint(\n 'sep-2549-resources-list-caching-hints',\n 'ResourcesListCachingHints',\n 'resources/list'\n );\n\n // 4. resources/templates/list\n await queryEndpoint(\n 'sep-2549-resources-templates-list-caching-hints',\n 'ResourcesTemplatesListCachingHints',\n 'resources/templates/list'\n );\n\n // 5. resources/read — use first resource from resources/list\n const resources = resourcesResult?.resources as\n | Array<{ uri?: string }>\n | undefined;\n const firstResourceUri = resources?.[0]?.uri;\n if (firstResourceUri) {\n await queryEndpoint(\n 'sep-2549-resources-read-caching-hints',\n 'ResourcesReadCachingHints',\n 'resources/read',\n { uri: firstResourceUri }\n );\n } else {\n // Keep the emitted check-ID set stable even when there is nothing to\n // read (resources/list failed or the server exposes no resources).\n checks.push({\n id: 'sep-2549-resources-read-caching-hints',\n name: 'ResourcesReadCachingHints',\n description:\n 'resources/read response includes ttlMs and cacheScope caching hints',\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'resources/read was not exercised: resources/list failed or returned no resources.',\n specReferences: SPEC_REFS\n });\n }\n\n await conn.close();\n\n // 6. Aggregate: ttlMs must be a non-negative integer\n const ttlErrors: string[] = [];\n const endpointsWithTtl = allFields.filter((f) => f.fields.hasTtlMs);\n if (endpointsWithTtl.length === 0) {\n ttlErrors.push('no endpoints returned ttlMs');\n } else {\n for (const { endpoint, fields } of endpointsWithTtl) {\n const val = fields.ttlMs;\n if (typeof val !== 'number') {\n ttlErrors.push(\n `${endpoint}: ttlMs is ${typeof val}, expected number`\n );\n } else if (!Number.isInteger(val)) {\n ttlErrors.push(`${endpoint}: ttlMs is ${val}, expected integer`);\n } else if (val < 0) {\n ttlErrors.push(`${endpoint}: ttlMs is ${val}, must be >= 0`);\n }\n }\n }\n\n checks.push({\n id: 'sep-2549-ttl-non-negative',\n name: 'TtlNonNegative',\n description: 'All ttlMs values are non-negative integers',\n status: ttlErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: ttlErrors.length > 0 ? ttlErrors.join('; ') : undefined,\n specReferences: SPEC_REFS,\n details: {\n endpoints: allFields.map((f) => ({\n endpoint: f.endpoint,\n ttlMs: f.fields.ttlMs\n }))\n }\n });\n\n // 7. Aggregate: cacheScope must be \"public\" or \"private\"\n const scopeErrors: string[] = [];\n const endpointsWithScope = allFields.filter((f) => f.fields.hasCacheScope);\n if (endpointsWithScope.length === 0) {\n scopeErrors.push('no endpoints returned cacheScope');\n } else {\n for (const { endpoint, fields } of endpointsWithScope) {\n const val = fields.cacheScope;\n if (val !== 'public' && val !== 'private') {\n scopeErrors.push(\n `${endpoint}: cacheScope is ${JSON.stringify(val)}, expected \"public\" or \"private\"`\n );\n }\n }\n }\n\n checks.push({\n id: 'sep-2549-cache-scope-valid',\n name: 'CacheScopeValid',\n description: 'All cacheScope values are \"public\" or \"private\"',\n status: scopeErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: scopeErrors.length > 0 ? scopeErrors.join('; ') : undefined,\n specReferences: SPEC_REFS,\n details: {\n endpoints: allFields.map((f) => ({\n endpoint: f.endpoint,\n cacheScope: f.fields.cacheScope\n }))\n }\n });\n\n return checks;\n }\n}\n",[],[142,474,499,637],"87d71876-38dd-4ee5-9634-d77c70095ede","wire-fields.ts","66ce1cfc-ad1b-11f1-8a32-1607ee4eb77e","3c9f56b3-ac91-4445-b670-2873de46dbc2",88,["D",1789046862482],"/**\n * SEP-2663 Tasks Extension — wire-format / TTL conformance.\n *\n * Tests the renamed wire fields (ttlMs, pollIntervalMs),\n * the no-early-TTL-expiry rule, and confirms the v1 `related-task` _meta\n * key is absent on tasks/get's inlined result (taskId is at root level\n * already, so the metadata is redundant).\n *\n * Required server fixtures:\n * - slow_compute — task-supporting, sleeps N seconds\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport type { Connection, RunContext } from '../../../connection/index.ts';\nimport { SEP_2663_REF } from './mrtr-helpers.ts';\nimport { errMsg, failureCheck } from './mrtr-helpers.ts';\nimport { TASKS_EXTENSION_ID, waitForTerminal } from './helpers.ts';\nimport { untestableCheck } from '../../untestable.ts';\n\nexport class TasksWireFieldsScenario implements ClientScenario {\n name = 'tasks-wire-fields';\n readonly source = { extensionId: 'io.modelcontextprotocol/tasks' } as const;\n description = `Test SEP-2663 wire-field renames + TTL semantics.\n\n**Server Implementation Requirements:**\n\n**Wire-field renames (SEP-2663):**\n- The TTL field is named \\`ttlMs\\` on the wire (the v1 \\`ttl\\` key was\n in milliseconds-by-convention; SEP-2663 puts the unit in the field\n name and standardised on the \\`Ms\\` suffix for all duration fields).\n- The poll-interval field is named \\`pollIntervalMs\\` (v1 used\n \\`pollInterval\\`).\n- A \\`CreateTaskResult\\` MUST NOT carry the legacy \\`ttl\\` or\n \\`pollInterval\\` keys — clients keying off v1 names on a v2 server\n would silently miss the TTL guidance.\n- Both \\`ttlMs\\` and \\`pollIntervalMs\\` are integer milliseconds.\n Servers MUST NOT emit fractional values.\n\n**TTL non-expiry (SEP-2663):**\n- A task MUST remain accessible via \\`tasks/get\\` for the duration of\n its \\`ttlMs\\`; a server MUST NOT expire it earlier.\n\n**Inlined-result \\`_meta\\` (SEP-2663):**\n- The v1 \\`io.modelcontextprotocol/related-task\\` \\`_meta\\` key MUST NOT\n appear on tasks/get's inlined \\`result\\` — the \\`taskId\\` is already\n at the root level of the \\`tasks/get\\` response, so the metadata is\n redundant.\n\n**Required server fixtures (\\`tools/list\\` MUST include all):**\n- \\`slow_compute\\` — task-supporting, \\`seconds\\`-second sleep then a\n result.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n let conn: Connection;\n try {\n conn = await ctx.connect({\n capabilities: {\n extensions: { [TASKS_EXTENSION_ID]: {} }\n }\n });\n } catch (error) {\n checks.push({\n id: 'tasks-wire-fields-bootstrap',\n name: 'TasksWireFieldsBootstrap',\n description:\n 'Initialize handshake declaring io.modelcontextprotocol/tasks extension succeeds',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to initialize: ${errMsg(error)}`,\n specReferences: [SEP_2663_REF]\n });\n return checks;\n }\n\n // Check 1: ttlMs + pollIntervalMs wire shape.\n let createdTaskId: string | undefined;\n {\n const id = 'tasks-wire-field-renames';\n const name = 'TasksWireFieldRenames';\n const description =\n 'CreateTaskResult uses ttlMs + pollIntervalMs (integer milliseconds); legacy ttl / pollInterval keys absent';\n try {\n const result = (await conn.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 1, label: 'wire-fields' }\n })) as any;\n createdTaskId = result.taskId;\n const errs: string[] = [];\n // ttlMs — required, positive integer milliseconds (or null =\n // unlimited; treat either as well-formed). Legacy `ttl` MUST\n // be absent.\n if (!('ttlMs' in result)) {\n errs.push(\n 'CreateTaskResult MUST carry ttlMs (renamed from v1 `ttl`)'\n );\n } else if (\n result.ttlMs !== null &&\n (typeof result.ttlMs !== 'number' ||\n !Number.isInteger(result.ttlMs) ||\n result.ttlMs <= 0)\n ) {\n errs.push(\n `ttlMs MUST be null or a positive integer (milliseconds); got ${JSON.stringify(result.ttlMs)}`\n );\n }\n if ('ttl' in result) {\n errs.push(\n 'CreateTaskResult MUST NOT carry the v1 `ttl` key (use ttlMs)'\n );\n }\n // pollIntervalMs — optional. When present it MUST be a positive\n // integer (milliseconds), and the legacy `pollInterval` key MUST\n // NOT appear.\n if (\n result.pollIntervalMs !== undefined &&\n (typeof result.pollIntervalMs !== 'number' ||\n !Number.isInteger(result.pollIntervalMs) ||\n result.pollIntervalMs <= 0)\n ) {\n errs.push(\n `pollIntervalMs MUST be a positive integer when present; got ${JSON.stringify(result.pollIntervalMs)}`\n );\n }\n if ('pollInterval' in result) {\n errs.push(\n 'CreateTaskResult MUST NOT carry the v1 `pollInterval` key (use pollIntervalMs)'\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF],\n details: {\n ttlMs: result.ttlMs,\n pollIntervalMs: result.pollIntervalMs,\n hasLegacyTtl: 'ttl' in result,\n hasLegacyPollInterval: 'pollInterval' in result\n }\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n // Check 2: task accessible before TTL elapses.\n {\n const id = 'tasks-no-early-ttl-expiry';\n const name = 'TasksNoEarlyTtlExpiry';\n const description =\n 'Task remains accessible via tasks/get for the duration of its ttlMs';\n if (!createdTaskId) {\n checks.push(\n untestableCheck(\n id,\n name,\n description,\n 'no task was created by the preceding step, so this check could not be exercised',\n [SEP_2663_REF]\n )\n );\n } else {\n try {\n await waitForTerminal(conn, createdTaskId);\n // Sanity probe well before TTL elapses. ttlMs is integer\n // milliseconds and servers typically pick order-of-minutes\n // defaults, so a 500ms wait is comfortably inside any sane TTL.\n await new Promise((r) => setTimeout(r, 500));\n const after = (await conn.request('tasks/get', {\n taskId: createdTaskId\n })) as any;\n const errs: string[] = [];\n if (after.taskId !== createdTaskId) {\n errs.push(\n `task MUST still be accessible before TTL; got taskId=${after.taskId}`\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF]\n });\n } catch (error) {\n checks.push(\n failureCheck(id, name, description, error, [SEP_2663_REF])\n );\n }\n }\n }\n\n // Check 3: no related-task _meta on inlined result.\n {\n const id = 'tasks-no-related-task-meta-on-inlined-result';\n const name = 'TasksNoRelatedTaskMetaOnInlinedResult';\n const description =\n 'tasks/get inlined result MUST NOT include the v1 io.modelcontextprotocol/related-task _meta key (taskId is at the root)';\n try {\n const created = (await conn.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 1, label: 'wire-fields-meta' }\n })) as any;\n const taskId = created.taskId;\n if (!taskId) {\n checks.push(\n untestableCheck(\n id,\n name,\n description,\n 'no task was created by the preceding step, so this check could not be exercised',\n [SEP_2663_REF]\n )\n );\n } else {\n const terminal = await waitForTerminal(conn, taskId);\n const errs: string[] = [];\n const meta = terminal.result?._meta;\n if (meta && meta['io.modelcontextprotocol/related-task']) {\n errs.push(\n 'related-task _meta MUST NOT appear on tasks/get inlined result'\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF],\n details: {\n hasMeta: Boolean(meta),\n hasRelatedTask: Boolean(\n meta?.['io.modelcontextprotocol/related-task']\n )\n }\n });\n }\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n await conn.close().catch(() => {});\n return checks;\n }\n}\n",[],[142,474,499,653,645],"tasks","08f53e4f-0869-4d90-bce1-514eb0de1118","required-task-error.ts","62673040-ad1b-11f1-97d4-1607ee4eb77e",82,["D",1789046855166],"/**\n * SEP-2663 Tasks Extension — required-task error conformance.\n *\n * SEP-2575 (Stateless MCP) §\"Missing Required Capabilities\" defines\n * the `MissingRequiredClientCapability` JSON-RPC error code (-32021) for\n * the case where a server cannot service a request without a client\n * capability the client did not declare. SEP-2663 §\"Required\n * Capabilities\" applies that rule to the tasks extension: if a tool's\n * declared task support is \"required\" and the client did not declare\n * `io.modelcontextprotocol/tasks` during `initialize`, the server MUST\n * reject with that error. The error data\n * SHOULD carry a `requiredCapabilities` object whose shape mirrors the\n * `InitializeRequest` capabilities, so the client can self-describe\n * what to add without needing out-of-band documentation.\n *\n * This scenario verifies the failure path:\n * 1. Initialize a session WITHOUT declaring the tasks extension.\n * 2. Call a tool whose task support is `required`.\n * 3. Expect a JSON-RPC error with `code: -32021` and\n * `data.requiredCapabilities.extensions[\"io.modelcontextprotocol/tasks\"]`\n * present.\n *\n * Required server fixtures:\n * - failing_job — a tool registered with task support declared as\n * `required`. The tool's payload behaviour is\n * irrelevant; only the registration-time declaration\n * matters because the error is returned by the\n * middleware before the handler runs.\n */\n\nimport { McpError } from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport type { Connection, RunContext } from '../../../connection/index.ts';\nimport { MISSING_REQUIRED_CLIENT_CAPABILITY } from '../../../spec-types/draft.ts';\nimport { SEP_2575_REF, SEP_2663_REF } from './mrtr-helpers.ts';\nimport { errMsg } from './mrtr-helpers.ts';\nimport { TASKS_EXTENSION_ID } from './helpers.ts';\n\nconst REQUIRED_TASK_TOOL = 'failing_job';\n\nexport class TasksRequiredTaskErrorScenario implements ClientScenario {\n name = 'tasks-required-task-error';\n readonly source = { extensionId: 'io.modelcontextprotocol/tasks' } as const;\n description = `Verify the -32021 error path for required-task tools when the\nclient has not negotiated the io.modelcontextprotocol/tasks extension.\n\n**Server Implementation Requirements:**\n\nPer SEP-2575 §\"Missing Required Capabilities\" and SEP-2663 §\"Required\nCapabilities\":\n\n> If a server is unable to service a request to a client that does not\n> declare this extension capability without returning \\`CreateTaskResult\\`,\n> the server MUST return an error with the code \\`-32021\\` (Missing\n> Required Client Capability), indicating the required extension in the\n> error response.\n\nThe error data SHOULD include a \\`requiredCapabilities\\` object whose\nshape mirrors \\`InitializeRequest.capabilities\\`, e.g.\n\n\\`\\`\\`json\n{\n \"requiredCapabilities\": {\n \"extensions\": {\n \"io.modelcontextprotocol/tasks\": {}\n }\n }\n}\n\\`\\`\\`\n\nThe scenario calls \\`tools/call\\` for a tool registered with task support\n\\`required\\` from a client that did NOT declare the extension. A\nconformant server MUST reject with \\`-32021\\`.\n\n**Required server fixtures (\\`tools/list\\` MUST include all):**\n- \\`failing_job\\` — registered with task support declared as \\`required\\`.\n The tool's payload behavior is irrelevant; only the registration-time\n declaration matters, because the error is returned by the middleware\n before the handler runs.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n let conn: Connection;\n try {\n // Intentionally declare NO capabilities — the point of the test is\n // to exercise the \"did not negotiate the tasks extension\" path.\n conn = await ctx.connect({\n capabilities: {}\n });\n } catch (error) {\n checks.push({\n id: 'tasks-required-error-bootstrap',\n name: 'TasksRequiredErrorBootstrap',\n description:\n 'Initialize handshake without the tasks extension capability succeeds',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to initialize: ${errMsg(error)}`,\n specReferences: [SEP_2575_REF, SEP_2663_REF]\n });\n return checks;\n }\n\n // Check 1: tools/call for a required-task tool returns the\n // MissingRequiredClientCapability error.\n const id = 'sep-2663-server-returns-missing-capability-when-required';\n const name = 'Sep2663ServerReturnsMissingCapabilityWhenRequired';\n const description = `tools/call for a TaskSupport=required tool MUST reject with code ${MISSING_REQUIRED_CLIENT_CAPABILITY} (Missing Required Client Capability) when the client did not declare ${TASKS_EXTENSION_ID}`;\n\n let observed: { code?: number; data?: unknown } = {};\n let errored = false;\n try {\n await conn.request('tools/call', {\n name: REQUIRED_TASK_TOOL,\n arguments: {}\n });\n } catch (error) {\n errored = true;\n if (error instanceof McpError) {\n observed = { code: error.code, data: error.data };\n } else if (error && typeof error === 'object') {\n const anyErr = error as any;\n observed = {\n code: typeof anyErr.code === 'number' ? anyErr.code : undefined,\n data: anyErr.data\n };\n }\n }\n\n if (!errored) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `tools/call for ${REQUIRED_TASK_TOOL} returned a successful response from a client that did not declare ${TASKS_EXTENSION_ID}; spec requires ${MISSING_REQUIRED_CLIENT_CAPABILITY} rejection in this case.`,\n specReferences: [SEP_2575_REF, SEP_2663_REF]\n });\n await conn.close().catch(() => {});\n return checks;\n }\n\n if (observed.code !== MISSING_REQUIRED_CLIENT_CAPABILITY) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `tools/call for ${REQUIRED_TASK_TOOL} returned error code ${observed.code ?? '(unknown)'}; spec requires ${MISSING_REQUIRED_CLIENT_CAPABILITY}.`,\n specReferences: [SEP_2575_REF, SEP_2663_REF],\n details: { observedCode: observed.code }\n });\n await conn.close().catch(() => {});\n return checks;\n }\n\n checks.push({\n id,\n name,\n description,\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SEP_2575_REF, SEP_2663_REF]\n });\n\n // Check 2: the error data carries the structured `requiredCapabilities`\n // payload so a client can self-describe what to add. SHOULD, but the\n // canonical error example in the spec shows this shape; flag a\n // FAILURE only when the field shape is broken, not when it's absent.\n {\n const id2 = 'sep-2663-server-returns-missing-capability-data-shape';\n const name2 = 'Sep2663ServerReturnsMissingCapabilityDataShape';\n const description2 = `Error data for ${MISSING_REQUIRED_CLIENT_CAPABILITY} SHOULD carry data.requiredCapabilities.extensions[\"${TASKS_EXTENSION_ID}\"]`;\n const data = observed.data as any;\n if (data === undefined || data === null) {\n checks.push({\n id: id2,\n name: name2,\n description: description2,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n errorMessage: `Error returned ${MISSING_REQUIRED_CLIENT_CAPABILITY} but carried no \\`data\\` field; the spec example shows requiredCapabilities, but data is SHOULD.`,\n specReferences: [SEP_2575_REF, SEP_2663_REF]\n });\n } else if (\n typeof data !== 'object' ||\n Array.isArray(data) ||\n !data.requiredCapabilities ||\n typeof data.requiredCapabilities !== 'object' ||\n !data.requiredCapabilities.extensions ||\n typeof data.requiredCapabilities.extensions !== 'object' ||\n data.requiredCapabilities.extensions[TASKS_EXTENSION_ID] === undefined\n ) {\n checks.push({\n id: id2,\n name: name2,\n description: description2,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Error data shape does not include requiredCapabilities.extensions[\"${TASKS_EXTENSION_ID}\"]; got data = ${JSON.stringify(data)}`,\n specReferences: [SEP_2575_REF, SEP_2663_REF]\n });\n } else {\n checks.push({\n id: id2,\n name: name2,\n description: description2,\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SEP_2575_REF, SEP_2663_REF]\n });\n }\n }\n\n await conn.close().catch(() => {});\n return checks;\n }\n}\n",[],[142,474,499,653,655],"0d56ba88-224a-45d2-8f12-dd2d4dfc4216","request-state.ts","656ae700-ad1b-11f1-b98a-1607ee4eb77e",87,["D",1789046859949],"/**\n * SEP-2663 Tasks Extension — `requestState` absence on the tasks-v2 wire.\n *\n * SEP-2663 does not define a `requestState` field on the tasks-v2 wire.\n * This scenario asserts the absence on the two task-bearing message\n * shapes that a server can populate at task creation and during polling:\n *\n * - `CreateTaskResult` MUST NOT carry `requestState`.\n * - `DetailedTask` (tasks/get response) MUST NOT carry `requestState`,\n * regardless of status.\n *\n * Why a negative test exists for a field the spec never defines:\n * SEP-2322 (MRTR) places `requestState` on `InputRequiredResult` — the\n * same JSON shape slot a fresh implementer might also reach for on the\n * tasks-v2 `DetailedTask` while reading the two SEPs together. The\n * absence-assert here catches that cross-SEP confusion. SEP-2322's\n * `InputRequiredResult.requestState` is unrelated to the tasks-v2 wire\n * and is exercised by mrtr-input.ts.\n *\n * Required server fixtures:\n * - slow_compute — task-supporting, sleeps N seconds\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport type { Connection, RunContext } from '../../../connection/index.ts';\nimport { SEP_2663_REF } from './mrtr-helpers.ts';\nimport { errMsg, failureCheck } from './mrtr-helpers.ts';\nimport { TASKS_EXTENSION_ID } from './helpers.ts';\n\nexport class TasksRequestStateRemovalScenario implements ClientScenario {\n name = 'tasks-request-state-removal';\n readonly source = { extensionId: 'io.modelcontextprotocol/tasks' } as const;\n description = `Verify the absence of \\`requestState\\` on the tasks-v2 wire.\n\n**Server Implementation Requirements:**\n\nSEP-2663 does not define a \\`requestState\\` field on the \\`Task\\` base\ninterface, so:\n\n- \\`CreateTaskResult\\` MUST NOT carry \\`requestState\\` on the\n \\`tools/call\\` response that creates a task.\n- The \\`tasks/get\\` response (DetailedTask) MUST NOT carry\n \\`requestState\\` for any status (\\`working\\` / \\`input_required\\` /\n \\`completed\\` / \\`cancelled\\` / \\`failed\\`).\n\nSEP-2322's \\`InputRequiredResult\\` does carry \\`requestState\\` — that is\nthe MRTR multi-round-trip surface, unrelated to the tasks-v2 wire, and\nis exercised by mrtr-input.ts. This scenario exists because the two\nSEPs put \\`requestState\\` in lexically adjacent positions, making\naccidental copy-paste from the MRTR shape into the tasks-v2 shape a\nforeseeable mistake for fresh implementations.\n\n**Required server fixtures (\\`tools/list\\` MUST include all):**\n- \\`slow_compute\\` — task-supporting, \\`seconds\\`-second sleep then a\n result.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n let conn: Connection;\n try {\n conn = await ctx.connect({\n capabilities: { extensions: { [TASKS_EXTENSION_ID]: {} } }\n });\n } catch (error) {\n checks.push({\n id: 'tasks-request-state-bootstrap',\n name: 'TasksRequestStateBootstrap',\n description:\n 'Initialize handshake declaring io.modelcontextprotocol/tasks extension succeeds',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to initialize: ${errMsg(error)}`,\n specReferences: [SEP_2663_REF]\n });\n return checks;\n }\n\n // Drive a long-running task so we can interrogate `tasks/get` while\n // the task is still in `working`. A terminal-only sample would miss\n // any field a server populated only during the in-flight window.\n let taskId: string | undefined;\n let createdTask: any;\n try {\n createdTask = (await conn.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 60, label: 'request-state-removal' }\n })) as any;\n taskId = createdTask?.taskId;\n } catch (error) {\n checks.push(\n failureCheck(\n 'tasks-request-state-removal-setup',\n 'TasksRequestStateRemovalSetup',\n 'Failed to create a long-running task to exercise the absence-asserts',\n error,\n [SEP_2663_REF]\n )\n );\n await conn.close().catch(() => {});\n return checks;\n }\n if (!taskId) {\n checks.push({\n id: 'tasks-request-state-removal-setup',\n name: 'TasksRequestStateRemovalSetup',\n description:\n 'slow_compute did not return a CreateTaskResult; cannot exercise absence-asserts',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'no taskId in tools/call response',\n specReferences: [SEP_2663_REF]\n });\n await conn.close().catch(() => {});\n return checks;\n }\n\n // Check 1: CreateTaskResult MUST NOT carry requestState.\n {\n const id = 'tasks-create-result-no-request-state';\n const name = 'TasksCreateResultNoRequestState';\n const description =\n 'CreateTaskResult MUST NOT carry `requestState` (SEP-2663 does not define the field on the Task base interface)';\n const has = Object.prototype.hasOwnProperty.call(\n createdTask,\n 'requestState'\n );\n checks.push({\n id,\n name,\n description,\n status: has ? 'FAILURE' : 'SUCCESS',\n timestamp: new Date().toISOString(),\n errorMessage: has\n ? `CreateTaskResult carries requestState = ${JSON.stringify(createdTask.requestState)}; SEP-2663 does not define this field on the tasks-v2 wire.`\n : undefined,\n specReferences: [SEP_2663_REF]\n });\n }\n\n // Check 2: tasks/get response (DetailedTask) MUST NOT carry requestState.\n {\n const id = 'tasks-get-detailed-no-request-state';\n const name = 'TasksGetDetailedNoRequestState';\n const description =\n 'tasks/get response (DetailedTask) MUST NOT carry `requestState` for any status (per SEP-2663)';\n try {\n const detailed = (await conn.request('tasks/get', {\n taskId\n })) as any;\n const has = Object.prototype.hasOwnProperty.call(\n detailed,\n 'requestState'\n );\n checks.push({\n id,\n name,\n description,\n status: has ? 'FAILURE' : 'SUCCESS',\n timestamp: new Date().toISOString(),\n errorMessage: has\n ? `DetailedTask carries requestState = ${JSON.stringify(detailed.requestState)} (status=${detailed.status}); SEP-2663 does not define this field on the tasks-v2 wire.`\n : undefined,\n specReferences: [SEP_2663_REF],\n details: { observedStatus: detailed.status }\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n try {\n await conn.request('tasks/cancel', { taskId });\n } catch {\n /* swallow */\n }\n\n await conn.close().catch(() => {});\n return checks;\n }\n}\n",[],[142,474,499,653,663],"fc08ce62-7a7c-41ca-bc02-09a8e3e87925","notifications.ts","62b7c6d6-ad1b-11f1-99e6-1607ee4eb77e",83,["D",1789046855688],"/**\n * SEP-2663 Tasks Extension — status notifications conformance.\n *\n * **SKIPPED — pending subscriptions/listen rewrite.** SEP-2663 delivers\n * `notifications/tasks` over the `subscriptions/listen` stream defined\n * by SEP-2575, not over the POST SSE response of `tools/call`. This\n * scenario's harness reads SSE frames off the `tools/call` POST\n * response, so its observation point misses notifications on servers\n * that follow the spec — they emit on a stream this harness never\n * opens.\n *\n * The scenario is preserved here as a reference point; rewriting the\n * harness against subscriptions/listen is tracked as a follow-up.\n *\n * Required server fixtures (for the future re-enabled scenario):\n * - slow_compute — task-supporting, sleeps N seconds.\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport type { RunContext } from '../../../connection/index.ts';\nimport { SEP_2663_REF } from './mrtr-helpers.ts';\nimport { skipCheck } from './mrtr-helpers.ts';\n\nexport class TasksStatusNotificationsScenario implements ClientScenario {\n name = 'tasks-status-notifications';\n readonly source = { extensionId: 'io.modelcontextprotocol/tasks' } as const;\n description = `Test SEP-2663 status notifications (optional).\n\n**Server Implementation Requirements:**\n\nServers MAY emit \\`notifications/tasks\\` on the subscriptions/listen\nstream to inform clients of task state changes without polling.\nNotifications are optional — a server is conformant whether it sends\nthem or not. When sent, the notification params MUST carry:\n\n- \\`taskId\\`: the task the notification refers to.\n- \\`status\\`: the new task status.\n- For terminal statuses (\\`completed\\`/\\`failed\\`/\\`cancelled\\`),\n notifications MAY inline the corresponding \\`result\\` or \\`error\\`\n per the SEP-2663 DetailedTask shape.`;\n\n async run(_ctx: RunContext): Promise {\n // Prior implementation (POST-SSE observation harness on tools/call)\n // was removed in this commit; see git blame for the working code to\n // adapt when rewriting against subscriptions/listen.\n return [\n skipCheck(\n 'tasks-status-notifications',\n 'TasksStatusNotificationsScenario',\n 'Status notifications conformance, pending subscriptions/listen rewrite.',\n 'SEP-2663 delivers notifications/tasks via the SEP-2575 subscriptions/listen stream, not via the tools/call POST SSE response that the prior harness observed. The harness needs a rewrite against the new channel; tracked as a follow-up.',\n [SEP_2663_REF]\n )\n ];\n }\n}\n",[],[142,474,499,653,671],"13c2e48b-95ba-4ff7-915c-e04db24ff79e","mrtr-input.ts","6411b924-ad1b-11f1-8c6f-1607ee4eb77e",86,["D",1789046857966],"/**\n * SEP-2322 / SEP-2663 — MRTR input flow on the tasks surface.\n *\n * Tests the input_required → tasks/update → resume loop, including\n * partial inputResponses fulfillment when a tool fans out multiple\n * simultaneous input requests.\n *\n * Required server fixtures:\n * - confirm_delete — task-supporting, calls TaskElicit once\n * - multi_input — task-supporting, fans out two TaskElicits in\n * parallel so two keys are pending at once\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport type { Connection, RunContext } from '../../../connection/index.ts';\nimport { SEP_2322_REF, SEP_2663_REF } from './mrtr-helpers.ts';\nimport { errMsg, failureCheck } from './mrtr-helpers.ts';\nimport { TASKS_EXTENSION_ID, waitForStatus, waitForTerminal } from './helpers.ts';\n\nexport class TasksMRTRInputScenario implements ClientScenario {\n name = 'tasks-mrtr-input';\n readonly source = { extensionId: 'io.modelcontextprotocol/tasks' } as const;\n description = `Test SEP-2322 MRTR input flow on the tasks surface.\n\n**Server Implementation Requirements:**\n\n**Surfacing inputRequests (SEP-2322):**\n- A task waiting on client input MUST report \\`status:\"input_required\"\\`\n on tasks/get and surface a non-empty \\`inputRequests\\` map keyed by\n server-minted opaque ids. Each entry carries the underlying request\n (\\`elicitation/create\\`, \\`sampling/createMessage\\`, etc.).\n\n**Resuming via tasks/update (SEP-2663):**\n- The client delivers responses through \\`tasks/update\\` with\n \\`inputResponses\\` keyed to match the server-emitted ids. The server\n MUST return an empty \\`{resultType:\"complete\"}\\` ack on the\n tasks/update response — the resulting task state is observed via the\n next tasks/get.\n- After the response is delivered, the task MUST resume execution and\n proceed to a terminal state (or back to input_required for another\n round).\n\n**Partial fulfillment (SEP-2663):**\n- A tool that emits multiple simultaneous input requests parks the task\n with multiple keys in \\`inputRequests\\`. A client MAY answer them one\n at a time:\n - tasks/update with a subset of keys MUST be acked.\n - The task MUST stay in \\`input_required\\` until every pending request\n has been answered.\n - tasks/get after a partial update MUST surface only the still-pending\n keys; the answered key MUST be removed.\n\n**Required server fixtures (\\`tools/list\\` MUST include all):**\n- \\`confirm_delete\\` — task-supporting, emits a single\n \\`elicitation/create\\` inputRequest then completes when the response\n arrives.\n- \\`multi_input\\` — task-supporting, fans out two \\`elicitation/create\\`\n inputRequests in parallel so two keys are pending at once (used by\n the partial-fulfillment check).`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n let conn: Connection;\n try {\n conn = await ctx.connect({\n capabilities: {\n elicitation: {},\n sampling: {},\n extensions: { [TASKS_EXTENSION_ID]: {} }\n }\n });\n } catch (error) {\n checks.push({\n id: 'tasks-mrtr-input-bootstrap',\n name: 'TasksMrtrInputBootstrap',\n description:\n 'Initialize handshake declaring io.modelcontextprotocol/tasks extension succeeds',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to initialize: ${errMsg(error)}`,\n specReferences: [SEP_2322_REF]\n });\n return checks;\n }\n\n // Check 1: tasks/get surfaces inputRequests when status=input_required.\n {\n const id = 'sep-2663-tasks-get-status-input-required';\n const name = 'TasksMRTRInputRequestsOnTasksGet';\n const description =\n 'tasks/get on an input_required task MUST surface a non-empty inputRequests map';\n try {\n const created = (await conn.request('tools/call', {\n name: 'confirm_delete',\n arguments: { filename: 'mrtr-input.txt' }\n })) as any;\n const taskId = created.taskId;\n if (!taskId) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'confirm_delete did not create a task',\n specReferences: [SEP_2322_REF]\n });\n } else {\n const task = await waitForStatus(\n conn,\n taskId,\n 'input_required',\n 5_000\n );\n const errs: string[] = [];\n if (task.status !== 'input_required') {\n errs.push(\n `expected status:\"input_required\"; got ${JSON.stringify(task.status)}`\n );\n }\n if (\n !task.inputRequests ||\n typeof task.inputRequests !== 'object' ||\n Array.isArray(task.inputRequests)\n ) {\n errs.push('inputRequests MUST be a non-null object (map)');\n } else {\n const keys = Object.keys(task.inputRequests);\n if (keys.length === 0) {\n errs.push('inputRequests MUST have at least one entry');\n } else {\n const firstReq = task.inputRequests[keys[0]];\n if (!firstReq?.method) {\n errs.push(\n 'each inputRequest MUST carry a `method` (e.g., elicitation/create)'\n );\n }\n }\n }\n // Cancel so we don't leave the task parked.\n try {\n await conn.request('tasks/cancel', { taskId });\n } catch {\n /* swallow */\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2322_REF, SEP_2663_REF]\n });\n }\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2322_REF]));\n }\n }\n\n // Check 2: tasks/update delivers inputResponses + resumes the task.\n {\n const id = 'tasks-mrtr-tasks-update-resumes';\n const name = 'TasksMRTRTasksUpdateResumes';\n const description =\n 'tasks/update with matching inputResponses MUST be acked with {resultType:\"complete\"} and resume the task to a terminal state';\n try {\n const created = (await conn.request('tools/call', {\n name: 'confirm_delete',\n arguments: { filename: 'mrtr-resume.txt' }\n })) as any;\n const taskId = created.taskId;\n if (!taskId) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'confirm_delete did not create a task',\n specReferences: [SEP_2322_REF, SEP_2663_REF]\n });\n } else {\n const inputTask = await waitForStatus(\n conn,\n taskId,\n 'input_required',\n 5_000\n );\n const errs: string[] = [];\n const responses: Record = {};\n for (const key of Object.keys(inputTask.inputRequests ?? {})) {\n responses[key] = {\n action: 'accept',\n content: { confirm: true }\n };\n }\n const ack = (await conn.request('tasks/update', {\n taskId,\n inputResponses: responses\n })) as any;\n if (ack?.resultType !== 'complete') {\n errs.push(\n `tasks/update ack MUST carry resultType:\"complete\"; got resultType=${ack?.resultType}`\n );\n }\n const updateAckOffenders = (\n ['taskId', 'status', 'result', 'error', 'inputRequests'] as const\n ).filter((f) => f in ack);\n if (updateAckOffenders.length > 0) {\n errs.push(\n `tasks/update ack MUST NOT carry task-envelope fields; got: ${updateAckOffenders.join(', ')}`\n );\n }\n const terminal = await waitForTerminal(conn, taskId);\n if (terminal.status !== 'completed') {\n errs.push(\n `task MUST resume to completed after tasks/update; got status ${JSON.stringify(terminal.status)}`\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2322_REF, SEP_2663_REF]\n });\n }\n } catch (error) {\n checks.push(\n failureCheck(id, name, description, error, [\n SEP_2322_REF,\n SEP_2663_REF\n ])\n );\n }\n }\n\n // Check 3: partial inputResponses fulfillment leaves the rest pending.\n {\n const id = 'tasks-mrtr-partial-fulfillment';\n const name = 'TasksMRTRPartialFulfillment';\n const description =\n 'tasks/update with a subset of keys MUST keep the task in input_required with only the unanswered key remaining';\n try {\n const created = (await conn.request('tools/call', {\n name: 'multi_input',\n arguments: {}\n })) as any;\n const taskId = created.taskId;\n if (!taskId) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'multi_input did not create a task',\n specReferences: [SEP_2663_REF]\n });\n } else {\n // Wait until two keys are pending (the fan-out tool races two\n // TaskElicits, so we may briefly see one before the second).\n let inputTask: any;\n const start = Date.now();\n while (Date.now() - start < 5_000) {\n inputTask = (await conn.request('tasks/get', { taskId })) as any;\n if (\n inputTask.status === 'input_required' &&\n inputTask.inputRequests &&\n Object.keys(inputTask.inputRequests).length >= 2\n ) {\n break;\n }\n await new Promise((r) => setTimeout(r, 100));\n }\n const errs: string[] = [];\n if (inputTask.status !== 'input_required') {\n errs.push(\n `task with two parallel elicits MUST be input_required; got ${JSON.stringify(inputTask.status)}`\n );\n }\n const keys = Object.keys(inputTask.inputRequests ?? {});\n if (keys.length < 2) {\n errs.push(\n `multi_input MUST surface 2 inputRequests; got ${keys.length}`\n );\n } else {\n const [firstKey, secondKey] = keys;\n\n // Answer first key only.\n const firstAck = (await conn.request('tasks/update', {\n taskId,\n inputResponses: {\n [firstKey]: {\n action: 'accept',\n content: { name: 'partial-1', confirm: true }\n }\n }\n })) as any;\n if (firstAck.resultType !== 'complete') {\n errs.push(\n `partial tasks/update ack MUST carry resultType:\"complete\"; got ${JSON.stringify(firstAck)}`\n );\n }\n\n // Status MUST still be input_required with only the second\n // key remaining.\n const afterFirst = (await conn.request('tasks/get', {\n taskId\n })) as any;\n if (afterFirst.status !== 'input_required') {\n errs.push(\n `task MUST stay input_required while another input is still pending; got ${JSON.stringify(afterFirst.status)}`\n );\n }\n const remaining = Object.keys(afterFirst.inputRequests ?? {});\n if (!remaining.includes(secondKey)) {\n errs.push(\n `unanswered key MUST remain in inputRequests; got ${JSON.stringify(remaining)}`\n );\n }\n if (remaining.includes(firstKey)) {\n errs.push(\n `answered key MUST be removed from inputRequests; still saw ${firstKey}`\n );\n }\n\n // Answer second key — task resumes and finishes.\n await conn.request('tasks/update', {\n taskId,\n inputResponses: {\n [secondKey]: {\n action: 'accept',\n content: { name: 'partial-2', confirm: true }\n }\n }\n });\n const terminal = await waitForTerminal(conn, taskId);\n if (terminal.status !== 'completed') {\n errs.push(\n `task MUST complete after both inputs are satisfied; got ${JSON.stringify(terminal.status)}`\n );\n }\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2322_REF, SEP_2663_REF]\n });\n }\n } catch (error) {\n checks.push(\n failureCheck(id, name, description, error, [\n SEP_2322_REF,\n SEP_2663_REF\n ])\n );\n }\n }\n\n await conn.close().catch(() => {});\n return checks;\n }\n}\n",[],[142,474,499,653,679],"1dbc9955-9d7b-4a2d-93dd-bdc033436f18","mrtr-helpers.ts","560e0c00-ad1c-11f1-a9a7-1607ee4eb77e",144,["D",1789047263935],"/**\n * Generic conformance-check helpers shared by the SEP-2663 `tasks/*`\n * scenarios. Pure: no I/O, no scenario-specific state.\n *\n * Split from `helpers.ts` (which holds tasks-specific helpers like\n * `validTasksParams` and the polling loops) so that the SEP references\n * and the FAILURE/SKIPPED check builders can be reused by any future\n * extension scenario without dragging tasks-domain types along.\n */\n\nimport type { ConformanceCheck, SpecReference } from '../../../types.ts';\nimport { MRTR_SPEC_REFERENCES } from '../input-required-result-helpers.ts';\n\n// ────────────────────────────────────────────────────────────────────────\n// Check builders\n// ────────────────────────────────────────────────────────────────────────\n\nexport function errMsg(error: unknown): string {\n return error instanceof Error ? error.message : String(error);\n}\n\n/** Build a FAILURE check from a thrown error, preserving id/name/description. */\nexport function failureCheck(\n id: string,\n name: string,\n description: string,\n error: unknown,\n specReferences: SpecReference[]\n): ConformanceCheck {\n return {\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errMsg(error),\n specReferences\n };\n}\n\n/**\n * Build a SKIPPED check (preserves id stability so Ctrl+F still finds it).\n *\n * Use ONLY for checks that are legitimately not applicable (e.g. a harness\n * gap the suite itself tracks). A check whose prerequisite is missing on the\n * server under test must use untestableCheck from src/scenarios/untestable.ts\n * instead — SKIPPED reads as green in every consumer (issue #248).\n */\nexport function skipCheck(\n id: string,\n name: string,\n description: string,\n reason: string,\n specReferences: SpecReference[]\n): ConformanceCheck {\n return {\n id,\n name,\n description,\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n errorMessage: `Skipped: ${reason}`,\n specReferences\n };\n}\n\n// ────────────────────────────────────────────────────────────────────────\n// SEP references\n// ────────────────────────────────────────────────────────────────────────\n\nexport const SEP_2243_REF: SpecReference = {\n id: 'SEP-2243',\n url: 'https://modelcontextprotocol.io/seps/2243-http-standardization'\n};\n\n/**\n * SEP-2322 (MRTR). Imported from `input-required-result-helpers` so the\n * codebase holds a single URL per SEP — the rendered spec page absorbs\n * post-merge amendments and `MRTR_SPEC_REFERENCES` is already the\n * traceability anchor for SEP-2322 elsewhere in `server/`.\n */\nexport const SEP_2322_REF: SpecReference = MRTR_SPEC_REFERENCES[0];\n\nexport const SEP_2575_REF: SpecReference = {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/seps/2575-stateless-mcp'\n};\n\nexport const SEP_2663_REF: SpecReference = {\n id: 'SEP-2663',\n url: 'https://modelcontextprotocol.io/seps/2663-tasks-extension'\n};\n\n// ────────────────────────────────────────────────────────────────────────\n// Wire-format predicates\n// ────────────────────────────────────────────────────────────────────────\n\n/**\n * ISO-8601 timestamp prefix (YYYY-MM-DDThh:mm:ss). Tolerant about the\n * timezone tail (`Z`, `+00:00`, `+0000`) and sub-second precision —\n * matches what real servers emit (Go `time.RFC3339Nano`, Python\n * `datetime.isoformat()`, JavaScript `toISOString()`).\n *\n * A regex over `Date.parse` (too permissive, accepts RFC-2822, \"May 4\n * 2026\") / `new Date(s).toISOString() === s` (too strict, rejects\n * valid `+00:00` offsets that don't survive the canonical `Z`\n * round-trip) / `Temporal.Instant.from` (Node 24+ experimental).\n */\nexport const ISO_8601_PATTERN = /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}/;\n\n/** Returns true when the input is a string matching ISO-8601 prefix. */\nexport function isIso8601(s: unknown): boolean {\n return typeof s === 'string' && ISO_8601_PATTERN.test(s);\n}\n",[],[142,474,499,653,687],"59e6a8c5-3a26-4fc5-8029-fe5405170bbc","6936d27c-ad1b-11f1-a2d5-1607ee4eb77e",90,["D",1789046866570],"/**\n * SEP-2663 Tasks Extension — server lifecycle conformance.\n *\n * Tests a server that implements the io.modelcontextprotocol/tasks\n * extension end-to-end: sync vs async dispatch, DetailedTask shape on\n * tasks/get, tool errors vs protocol errors, and cancellation\n * semantics.\n *\n * Required server fixtures (tools/list output must include all):\n * - greet — sync-only, returns \"Hello, {name}!\"\n * - slow_compute — task-supporting, sleeps N seconds\n * - failing_job — task-supporting, returns a tool error\n * - protocol_error_job — task-supporting, panics into a protocol error\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport type { Connection, RunContext } from '../../../connection/index.ts';\nimport { SEP_2322_REF, SEP_2663_REF } from './mrtr-helpers.ts';\nimport { errMsg, failureCheck } from './mrtr-helpers.ts';\nimport { TASKS_EXTENSION_ID, waitForTerminal } from './helpers.ts';\nimport { untestableCheck } from '../../untestable.ts';\nimport { isIso8601 } from './mrtr-helpers.ts';\n\nexport class TasksLifecycleScenario implements ClientScenario {\n name = 'tasks-lifecycle';\n readonly source = { extensionId: 'io.modelcontextprotocol/tasks' } as const;\n description = `Test SEP-2663 Tasks extension lifecycle on the server.\n\n**Server Implementation Requirements (SEP-2663):**\n\nThe server MUST advertise \\`io.modelcontextprotocol/tasks\\` under\n\\`capabilities.extensions\\` and gate the task surface on negotiation.\n\n**Sync dispatch (no task created):**\n- A \\`tools/call\\` against a sync-only tool MUST return a flat\n \\`ToolResult\\` with \\`resultType:\"complete\"\\` and a \\`content[]\\` array.\n- It MUST NOT carry \\`taskId\\` at the top level (that would imply a\n CreateTaskResult).\n\n**Server-directed task creation:**\n- For task-supporting tools, the server decides whether to create a task —\n the client MUST NOT need to opt in via a request param.\n- The response MUST be a \\`CreateTaskResult\\` — a flat \\`Result & Task\\`\n intersection: \\`resultType:\"task\"\\`, plus \\`taskId\\` / \\`status\\` /\n \\`createdAt\\` / \\`lastUpdatedAt\\` / \\`ttlMs\\` at the top level.\n There MUST NOT be a nested \\`task\\` wrapper key.\n\n**tasks/get DetailedTask:**\n- Working tasks return \\`status\\` and basic metadata; result/error are\n absent.\n- Completed tasks MUST inline the original tool result under \\`result\\`\n with \\`content[]\\`. There is no separate \\`tasks/result\\` method.\n\n**Tool errors vs protocol errors (SEP-2663 §error-semantics):**\n- A tool that ran but reported an error MUST surface as\n \\`status:\"completed\"\\` with \\`result.isError:true\\`. The status\n \\`\"failed\"\\` is reserved for protocol-level errors.\n- A protocol-level error (server crash, internal failure) MUST surface\n as \\`status:\"failed\"\\` with an inlined \\`error\\` object (JSON-RPC\n error shape: code/message/data) and MUST NOT carry \\`result\\`.\n\n**Cancellation:**\n- \\`tasks/cancel\\` MUST return an empty\n \\`{resultType:\"complete\"}\\` ack — no task envelope (SEP-2322\n discriminator). The cancelled status is observed via the next\n \\`tasks/get\\`.\n- \\`tasks/cancel\\` against a terminal task returns the same empty ack\n (idempotent) — the spec reserves \\`-32602\\` for unknown taskIds only.\n\n**Required server fixtures (\\`tools/list\\` MUST include all):**\n- \\`greet\\` — sync-only, returns \\`Hello, {name}!\\`.\n- \\`slow_compute\\` — task-supporting, \\`seconds\\`-second sleep then a\n result. \\`seconds: 0\\` for the immediate path. MUST settle to\n \\`cancelled\\` (not \\`completed\\`/\\`failed\\`) when \\`tasks/cancel\\`\n arrives while running, so the lifecycle cancel check has a\n deterministic terminal status.\n- \\`failing_job\\` — task-supporting, always returns a tool execution\n error after ~1s.\n- \\`protocol_error_job\\` — task-supporting, panics into a protocol\n error.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n let conn: Connection;\n try {\n conn = await ctx.connect({\n capabilities: {\n elicitation: {},\n sampling: {},\n extensions: { [TASKS_EXTENSION_ID]: {} }\n }\n });\n } catch (error) {\n checks.push({\n id: 'tasks-lifecycle-bootstrap',\n name: 'TasksLifecycleBootstrap',\n description:\n 'Initialize handshake declaring io.modelcontextprotocol/tasks extension succeeds',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to initialize: ${errMsg(error)}`,\n specReferences: [SEP_2663_REF]\n });\n return checks;\n }\n\n // Check 1: sync tool call returns ToolResult, no task creation.\n {\n const id = 'tasks-sync-tool-call';\n const name = 'TasksSyncToolCall';\n const description =\n 'Sync tool returns ToolResult (resultType:\"complete\"), no taskId at top level';\n try {\n const result = (await conn.request('tools/call', {\n name: 'greet',\n arguments: { name: 'World' }\n })) as any;\n const errs: string[] = [];\n if (result.resultType === 'task') {\n errs.push('sync tool result MUST NOT carry resultType:\"task\"');\n }\n if (result.taskId) {\n errs.push(\n `sync tool result MUST NOT carry top-level taskId; got ${result.taskId}`\n );\n }\n if (!Array.isArray(result.content) || result.content.length === 0) {\n errs.push('sync tool result MUST carry a non-empty content[] array');\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF, SEP_2322_REF],\n details: {\n resultType: result.resultType,\n hasTaskId: Boolean(result.taskId),\n contentLength: result.content?.length\n }\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n // Check 2: server-directed task creation produces flat CreateTaskResult.\n let workingTaskId: string | undefined;\n {\n const id = 'sep-2663-result-type-task-on-create';\n const name = 'TasksServerTaskCreation';\n const description =\n 'Task-supporting tool returns flat CreateTaskResult (no nested `task` wrapper)';\n try {\n const result = (await conn.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 2, label: 'lifecycle-create' }\n })) as any;\n const errs: string[] = [];\n if (result.resultType !== 'task') {\n errs.push(\n `expected resultType:\"task\"; got ${JSON.stringify(result.resultType)}`\n );\n }\n if (result.task) {\n errs.push(\n 'CreateTaskResult MUST be flat (Result & Task); there must be no nested `task` wrapper key'\n );\n }\n if (!result.taskId) {\n errs.push('CreateTaskResult MUST carry top-level taskId');\n }\n if (!result.status) {\n errs.push('CreateTaskResult MUST carry top-level status');\n }\n if ('result' in result) {\n errs.push(\n 'CreateTaskResult MUST NOT carry `result` (lives on tasks/get DetailedTask)'\n );\n }\n if ('error' in result) {\n errs.push(\n 'CreateTaskResult MUST NOT carry `error` (lives on tasks/get DetailedTask)'\n );\n }\n if ('inputRequests' in result) {\n errs.push(\n 'CreateTaskResult MUST NOT carry `inputRequests` (lives on tasks/get DetailedTask)'\n );\n }\n // Timestamps — both keys present, both ISO-8601 formatted. Per\n // SEP-2663 these are required on every TaskInfoV2. See\n // `mrtr-helpers.ts` for the regex rationale.\n if (!isIso8601(result.createdAt)) {\n errs.push(\n `createdAt MUST be an ISO-8601 string; got ${JSON.stringify(result.createdAt)}`\n );\n }\n if (!isIso8601(result.lastUpdatedAt)) {\n errs.push(\n `lastUpdatedAt MUST be an ISO-8601 string; got ${JSON.stringify(result.lastUpdatedAt)}`\n );\n }\n if (result.taskId) workingTaskId = result.taskId;\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF],\n details: {\n resultType: result.resultType,\n taskId: result.taskId,\n status: result.status\n }\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n // Check 3: tasks/get during working state returns status + metadata.\n {\n const id = 'sep-2663-tasks-get-status-working';\n const name = 'TasksGetDuringWorking';\n const description =\n 'tasks/get returns status + metadata for an active task';\n if (!workingTaskId) {\n checks.push(\n untestableCheck(\n id,\n name,\n description,\n 'no task was created by the preceding step, so this check could not be exercised',\n [SEP_2663_REF]\n )\n );\n } else {\n try {\n const task = (await conn.request('tasks/get', {\n taskId: workingTaskId\n })) as any;\n const errs: string[] = [];\n if (task.taskId !== workingTaskId) {\n errs.push(\n `taskId mismatch: expected ${workingTaskId}, got ${task.taskId}`\n );\n }\n if (!task.status) errs.push('tasks/get response MUST carry status');\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF],\n details: { status: task.status }\n });\n } catch (error) {\n checks.push(\n failureCheck(id, name, description, error, [SEP_2663_REF])\n );\n }\n }\n }\n\n // Check 4: terminal tasks/get inlines result with content[].\n {\n const id = 'sep-2663-tasks-get-status-completed';\n const name = 'TasksGetTerminalInlinedResult';\n const description =\n 'Completed task tasks/get inlines result with content[] (no separate tasks/result method)';\n if (!workingTaskId) {\n checks.push(\n untestableCheck(\n id,\n name,\n description,\n 'no task was created by the preceding step, so this check could not be exercised',\n [SEP_2663_REF]\n )\n );\n } else {\n try {\n const terminal = await waitForTerminal(conn, workingTaskId);\n const errs: string[] = [];\n if (terminal.status !== 'completed') {\n errs.push(\n `expected status:\"completed\"; got ${JSON.stringify(terminal.status)}`\n );\n }\n if (!terminal.result) {\n errs.push('completed task MUST inline `result`');\n } else if (\n !Array.isArray(terminal.result.content) ||\n terminal.result.content.length === 0\n ) {\n errs.push(\n 'completed task `result.content[]` MUST be a non-empty array'\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF],\n details: {\n status: terminal.status,\n hasResult: Boolean(terminal.result),\n contentLength: terminal.result?.content?.length\n }\n });\n } catch (error) {\n checks.push(\n failureCheck(id, name, description, error, [SEP_2663_REF])\n );\n }\n }\n }\n\n // Check 5: tool execution error → completed with isError:true.\n {\n const id = 'sep-2663-tool-error-uses-completed-status';\n const name = 'TasksToolErrorCompletedIsError';\n const description =\n 'Tool execution error reports as completed + result.isError (NOT failed)';\n try {\n const created = (await conn.request('tools/call', {\n name: 'failing_job',\n arguments: {}\n })) as any;\n const errs: string[] = [];\n if (!created.taskId) {\n errs.push('failing_job MUST create a task');\n } else {\n const terminal = await waitForTerminal(conn, created.taskId);\n if (terminal.status !== 'completed') {\n errs.push(\n `tool error MUST surface as completed (not \"${terminal.status}\")`\n );\n }\n if (!terminal.result) {\n errs.push('completed task with tool error MUST carry `result`');\n } else if (terminal.result.isError !== true) {\n errs.push('result.isError MUST be true for tool execution errors');\n }\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF]\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n // Check 6: protocol-level error → failed with inlined error, no result.\n {\n const id = 'sep-2663-tasks-get-status-failed';\n const name = 'TasksProtocolErrorFailedShape';\n const description =\n 'Protocol-level error reports as failed + inlined error{code,message}, no result';\n try {\n const created = (await conn.request('tools/call', {\n name: 'protocol_error_job',\n arguments: {}\n })) as any;\n const errs: string[] = [];\n if (!created.taskId) {\n errs.push('protocol_error_job MUST create a task');\n } else {\n const terminal = await waitForTerminal(conn, created.taskId);\n if (terminal.status !== 'failed') {\n errs.push(\n `protocol error MUST surface as failed (not \"${terminal.status}\")`\n );\n }\n if (!terminal.error) {\n errs.push('failed task MUST carry inlined `error`');\n } else {\n if (typeof terminal.error.code !== 'number') {\n errs.push('failed task error MUST carry numeric `code`');\n }\n if (typeof terminal.error.message !== 'string') {\n errs.push('failed task error MUST carry string `message`');\n }\n }\n if (terminal.result) {\n errs.push('failed task MUST NOT carry `result`');\n }\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF]\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n // Check 7: tasks/cancel returns empty {resultType:\"complete\"} ack;\n // status settles to cancelled.\n {\n const id = 'sep-2663-cancel-ack-empty-result';\n const name = 'TasksCancelEmptyAck';\n const description =\n 'tasks/cancel returns {resultType:\"complete\"} ack; status settles to cancelled';\n let cancelTaskId: string | undefined;\n try {\n const created = (await conn.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 60, label: 'lifecycle-cancel' }\n })) as any;\n cancelTaskId = created.taskId;\n if (!cancelTaskId) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'slow_compute did not create a task',\n specReferences: [SEP_2663_REF, SEP_2322_REF]\n });\n } else {\n const ack = (await conn.request('tasks/cancel', {\n taskId: cancelTaskId\n })) as any;\n const errs: string[] = [];\n if (ack?.resultType !== 'complete') {\n errs.push(\n `cancel ack MUST carry resultType:\"complete\"; got resultType=${ack?.resultType}`\n );\n }\n // Task-envelope fields MUST NOT appear on the ack; _meta and\n // other result-shape metadata are permitted.\n const ackOffenders = (\n ['taskId', 'status', 'result', 'error', 'inputRequests'] as const\n ).filter((f) => f in ack);\n if (ackOffenders.length > 0) {\n errs.push(\n `cancel ack MUST NOT carry task-envelope fields; got: ${ackOffenders.join(', ')}`\n );\n }\n // SEP-2663 §Task Cancellation: transition to `cancelled` is not\n // guaranteed; record the settled status as diagnostic detail only.\n const after = await waitForTerminal(conn, cancelTaskId);\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF, SEP_2322_REF],\n details: { cancelAck: ack, statusAfterCancel: after.status }\n });\n }\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n // Check 8: tasks/cancel on a terminal task is idempotent — returns\n // the same {resultType:\"complete\"} empty-ack as on an active task,\n // rather than -32602. Required so clients don't have to handle the\n // race where a task terminates between observation and the cancel\n // request.\n {\n const id = 'tasks-cancel-terminal-idempotent-ack';\n const name = 'TasksCancelTerminalIdempotentAck';\n const description =\n 'tasks/cancel on a terminal task returns the same empty-ack as on an active task (idempotent)';\n try {\n const created = (await conn.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 1, label: 'lifecycle-cancel-terminal' }\n })) as any;\n const completedTaskId = created.taskId;\n if (!completedTaskId) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'slow_compute did not create a task',\n specReferences: [SEP_2663_REF]\n });\n } else {\n await waitForTerminal(conn, completedTaskId);\n const ack = (await conn.request('tasks/cancel', {\n taskId: completedTaskId\n })) as any;\n const errs: string[] = [];\n if (ack?.resultType !== 'complete') {\n errs.push(\n `idempotent cancel ack MUST carry resultType:\"complete\"; got resultType=${ack?.resultType}`\n );\n }\n const ackOffenders = (\n ['taskId', 'status', 'result', 'error', 'inputRequests'] as const\n ).filter((f) => f in ack);\n if (ackOffenders.length > 0) {\n errs.push(\n `idempotent cancel ack MUST NOT carry task-envelope fields; got: ${ackOffenders.join(', ')}`\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF],\n details: { cancelAck: ack }\n });\n }\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n await conn.close();\n return checks;\n }\n}\n",[],[142,474,499,653,565],"9e5d25a6-0d20-4e02-a6b1-ec465a700e64","helpers.ts","5554a9e0-ad1c-11f1-bcc6-1607ee4eb77e",142,["D",1789047262739],"/**\n * Tasks-specific helpers for SEP-2663 server-conformance scenarios.\n *\n * - `TASKS_EXTENSION_ID`: the extension identifier scenarios assert\n * when checking server capabilities.\n * - `validTasksParams`: well-formed body shapes for negative-path\n * checks that need to isolate a single failure dimension.\n * - `waitForTerminal` / `waitForStatus`: tasks/get polling loops.\n */\n\nimport type { Connection } from '../../../connection/index.ts';\n\nexport const TASKS_EXTENSION_ID = 'io.modelcontextprotocol/tasks';\n\n/**\n * Baseline \"otherwise well-formed\" params for a tasks-namespace\n * method, used by negative-path checks that need to isolate a single\n * failure dimension.\n *\n * When a check asserts a specific JSON-RPC error code (e.g. -32601\n * for a removed method, -32602 for an unknown taskId), the rest of\n * the request MUST be valid — otherwise a spec-compliant server can\n * reject for a different reason (missing routing headers, missing\n * `_meta`, malformed params) and the assertion fires on the wrong\n * dimension, producing misleading conformance results.\n *\n * The Connection already auto-populates SEP-2243 routing headers\n * and the SEP-2322 `_meta` envelope based on the method and params,\n * so this helper's job is to supply a sensible *body* — a params\n * object whose shape would be acceptable on the v1 surface — and\n * let the caller mutate exactly the field under test.\n *\n * Example:\n *\n * // tasks/result is removed in v2; everything else is valid, so\n * // -32601 is the only error that can fire on a compliant server.\n * await conn.request('tasks/result', validTasksParams('tasks/result'));\n *\n * // tasks/get with an unknown taskId — the taskId is the property\n * // under test; the rest of the envelope is valid.\n * await conn.request(\n * 'tasks/get',\n * validTasksParams('tasks/get', { taskId: 'nonexistent-12345' })\n * );\n */\nexport function validTasksParams(\n method: string,\n overrides?: Record\n): Record {\n const probeTaskId = 'tasks-conformance-isolation-probe';\n let base: Record;\n switch (method) {\n case 'tasks/result': // v1 shape: { taskId }\n case 'tasks/get':\n case 'tasks/cancel':\n base = { taskId: probeTaskId };\n break;\n case 'tasks/update':\n base = { taskId: probeTaskId, inputResponses: {} };\n break;\n case 'tasks/list': // v1 shape: optional { cursor? }\n base = {};\n break;\n default:\n base = {};\n }\n return { ...base, ...(overrides ?? {}) };\n}\n\n/** Poll tasks/get until the task reaches a terminal state. */\nexport async function waitForTerminal(\n conn: Connection,\n taskId: string,\n timeoutMs = 10_000\n): Promise {\n const start = Date.now();\n while (Date.now() - start < timeoutMs) {\n const task = (await conn.request('tasks/get', { taskId })) as any;\n if (['completed', 'failed', 'cancelled'].includes(task.status)) {\n return task;\n }\n await new Promise((r) => setTimeout(r, 200));\n }\n throw new Error(\n `Task ${taskId} did not reach terminal state within ${timeoutMs}ms`\n );\n}\n\n/** Poll tasks/get until a specific status (or any terminal state). */\nexport async function waitForStatus(\n conn: Connection,\n taskId: string,\n status: string,\n timeoutMs = 10_000\n): Promise {\n const start = Date.now();\n while (Date.now() - start < timeoutMs) {\n const task = (await conn.request('tasks/get', { taskId })) as any;\n if (\n task.status === status ||\n ['completed', 'failed', 'cancelled'].includes(task.status)\n ) {\n return task;\n }\n await new Promise((r) => setTimeout(r, 200));\n }\n throw new Error(\n `Task ${taskId} did not reach status ${status} within ${timeoutMs}ms`\n );\n}\n",[],[142,474,499,653,702],"6b6721cb-db0c-40a7-bf0e-adb70bceff5e","headers.ts","639506ea-ad1b-11f1-9bd0-1607ee4eb77e",85,["D",1789046857130],"/**\n * SEP-2243 Mcp-Method / Mcp-Name request-header validation, tasks\n * surface.\n *\n * SEP-2243 defines Mcp-Method and Mcp-Name as REQUEST headers (client →\n * server) used by HTTP infrastructure (proxies, gateways, observability)\n * to route or shape JSON-RPC traffic without parsing the body. The\n * server MUST reject requests where the routing headers disagree with\n * (or are missing for a name-carrying body) the JSON-RPC envelope, with\n * HTTP 400 + JSON-RPC `-32020 HeaderMismatch`.\n *\n * This scenario exercises the validation on the tasks surface\n * specifically — the upstream `http-header-validation` scenario covers\n * the general case; here we verify mcpkit's tasks/* methods route\n * through the same validator (matched headers → success; mismatched\n * header → -32020).\n *\n * Required server fixtures:\n * - greet — sync-only, returns \"Hello, {name}!\"\n * - slow_compute — task-supporting, sleeps N seconds\n */\n\nimport { McpError } from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport type { Connection, RunContext } from '../../../connection/index.ts';\nimport { HEADER_MISMATCH } from '../../../spec-types/draft.ts';\nimport { SEP_2243_REF, SEP_2663_REF } from './mrtr-helpers.ts';\nimport { errMsg, failureCheck } from './mrtr-helpers.ts';\nimport { TASKS_EXTENSION_ID } from './helpers.ts';\n\nconst HEADER_MISMATCH_ERROR_CODE = HEADER_MISMATCH;\n\nexport class TasksRequestHeadersScenario implements ClientScenario {\n name = 'tasks-request-headers';\n readonly source = { extensionId: 'io.modelcontextprotocol/tasks' } as const;\n description = `Test SEP-2243 Mcp-Method / Mcp-Name request-header validation, tasks surface.\n\n**Server Implementation Requirements:**\n\nSEP-2243 defines two required request headers that mirror body fields\ninto the HTTP layer for routing intermediaries:\n\n- \\`Mcp-Method: \\` — REQUIRED on every JSON-RPC request,\n matching the body \\`method\\`.\n- \\`Mcp-Name: \\` — REQUIRED on requests with a\n name-shaped body field. Per SEP-2243 §\"Standard Headers\" this covers\n \\`tools/call\\` (\\`params.name\\`), \\`resources/read\\` (\\`params.uri\\`), and\n \\`prompts/get\\` (\\`params.name\\`). SEP-2663 §\"Streamable HTTP: Routing\n Headers\" extends the requirement to tasks-namespace methods:\n \\`tasks/get\\`, \\`tasks/update\\`, and \\`tasks/cancel\\` MUST carry\n \\`Mcp-Name: \\` matching \\`params.taskId\\`.\n\nPer SEP-2243 §\"Server Behavior\", servers that process the request body\nMUST validate that header values match the body. Per its \"Validation\nFailure Conditions\", both missing required headers and mismatched\nvalues trigger rejection with JSON-RPC error code \\`-32020\\`\n(HeaderMismatch) and HTTP 400.\n\n**Required server fixtures (\\`tools/list\\` MUST include all):**\n- \\`greet\\` — sync-only, returns \\`Hello, {name}!\\`.\n- \\`slow_compute\\` — task-supporting, \\`seconds\\`-second sleep then a\n result.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n let conn: Connection;\n try {\n conn = await ctx.connect({\n capabilities: { extensions: { [TASKS_EXTENSION_ID]: {} } }\n });\n } catch (error) {\n checks.push({\n id: 'tasks-headers-bootstrap',\n name: 'TasksHeadersBootstrap',\n description:\n 'Initialize handshake declaring io.modelcontextprotocol/tasks extension succeeds',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to initialize: ${errMsg(error)}`,\n specReferences: [SEP_2243_REF]\n });\n return checks;\n }\n\n // Check 1: Mcp-Method on tools/call against a sync tool.\n {\n const id = 'tasks-headers-tolerate-mcp-method-on-tools-call';\n const name = 'TasksHeadersTolerateMcpMethodOnToolsCall';\n const description =\n 'Server tolerates Mcp-Method request header on tools/call (sync tool dispatch unaffected)';\n try {\n const result = (await conn.request(\n 'tools/call',\n { name: 'greet', arguments: { name: 'sep-2243' } },\n { 'Mcp-Method': 'tools/call' }\n )) as any;\n const errs: string[] = [];\n if (result.resultType !== 'complete') {\n errs.push(\n `sync ToolResult.resultType MUST be \"complete\" regardless of routing header; got ${JSON.stringify(result.resultType)}`\n );\n }\n if (\n !Array.isArray(result.content) ||\n result.content.length === 0 ||\n result.content[0]?.text !== 'Hello, sep-2243!'\n ) {\n errs.push(\n 'tool result content MUST be unaffected by the Mcp-Method header'\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2243_REF]\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2243_REF]));\n }\n }\n\n // Check 2: Mcp-Method + Mcp-Name on tasks/get (drive a task first\n // so we have a real taskId to route on). With matched routing\n // headers the server MUST dispatch normally; this is the positive\n // case complementing the negative-path mismatch checks below.\n let routingTaskId: string | undefined;\n {\n const id = 'sep-2663-routing-headers-accepted-on-tasks-get';\n const name = 'Sep2663RoutingHeadersAcceptedOnTasksGet';\n const description =\n 'Server accepts matched Mcp-Method + Mcp-Name request headers on tasks/get and dispatches normally';\n try {\n const created = (await conn.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 60, label: 'headers-tasks-get' }\n })) as any;\n routingTaskId = created.taskId;\n if (!routingTaskId) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'slow_compute did not create a task',\n specReferences: [SEP_2243_REF]\n });\n } else {\n const got = (await conn.request(\n 'tasks/get',\n { taskId: routingTaskId },\n {\n 'Mcp-Method': 'tasks/get',\n 'Mcp-Name': routingTaskId\n }\n )) as any;\n const errs: string[] = [];\n if (got.taskId !== routingTaskId) {\n errs.push(\n `tasks/get MUST resolve body taskId regardless of routing headers; got ${got.taskId}`\n );\n }\n if (!got.status) {\n errs.push(\n 'tasks/get MUST still return status when routing headers are set'\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2243_REF]\n });\n }\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2243_REF]));\n }\n }\n\n // Check 3: Mismatched Mcp-Method header is rejected on the tasks\n // surface (SEP-2243 §Server Validation, tasks dispatch path).\n {\n const id = 'tasks-headers-reject-mismatched-method';\n const name = 'TasksHeadersRejectMismatchedMethod';\n const description = `When Mcp-Method header disagrees with body on a tools/call, server MUST reject with ${HEADER_MISMATCH_ERROR_CODE} HeaderMismatch (SEP-2243 §Server Validation)`;\n try {\n await conn.request(\n 'tools/call',\n { name: 'greet', arguments: { name: 'header-mismatch' } },\n { 'Mcp-Method': 'tasks/get' }\n );\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `tools/call with Mcp-Method: tasks/get returned a successful response; SEP-2243 requires ${HEADER_MISMATCH_ERROR_CODE} rejection`,\n specReferences: [SEP_2243_REF]\n });\n } catch (error) {\n const code =\n error instanceof McpError ? error.code : (error as any)?.code;\n if (code === HEADER_MISMATCH_ERROR_CODE) {\n checks.push({\n id,\n name,\n description,\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SEP_2243_REF]\n });\n } else {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `expected ${HEADER_MISMATCH_ERROR_CODE} HeaderMismatch; got ${code ?? errMsg(error)}`,\n specReferences: [SEP_2243_REF]\n });\n }\n }\n }\n\n // Check 4: Mismatched Mcp-Name header on tasks/get is rejected.\n // Per SEP-2663 §\"Streamable HTTP: Routing Headers\" the client MUST\n // set Mcp-Name to params.taskId on tasks/get / tasks/update /\n // tasks/cancel; per SEP-2243 §\"Server Behavior\" the server MUST\n // reject any header that disagrees with the body. tasks/get is the\n // representative probe — the same rule applies to update/cancel by\n // extension. Confirmed by SEP-2663 author on conformance#262.\n {\n const id = 'sep-2663-server-rejects-mismatched-mcp-name-on-tasks-get';\n const name = 'Sep2663ServerRejectsMismatchedMcpNameOnTasksGet';\n const description = `When Mcp-Name header disagrees with params.taskId on tasks/get, server MUST reject with ${HEADER_MISMATCH_ERROR_CODE} HeaderMismatch`;\n if (!routingTaskId) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'routing-task fixture from Check 2 unavailable; cannot drive negative-path probe',\n specReferences: [SEP_2243_REF, SEP_2663_REF]\n });\n } else {\n try {\n await conn.request(\n 'tasks/get',\n { taskId: routingTaskId },\n { 'Mcp-Name': 'sep-2663-wrong-task-id-for-routing-header-mismatch' }\n );\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `tasks/get with mismatched Mcp-Name returned a result; SEP-2243 requires ${HEADER_MISMATCH_ERROR_CODE} rejection`,\n specReferences: [SEP_2243_REF, SEP_2663_REF]\n });\n } catch (error) {\n const code =\n error instanceof McpError ? error.code : (error as any)?.code;\n if (code === HEADER_MISMATCH_ERROR_CODE) {\n checks.push({\n id,\n name,\n description,\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SEP_2243_REF, SEP_2663_REF]\n });\n } else {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `expected ${HEADER_MISMATCH_ERROR_CODE} HeaderMismatch; got ${code ?? errMsg(error)}`,\n specReferences: [SEP_2243_REF, SEP_2663_REF]\n });\n }\n }\n }\n }\n\n // Cleanup the long-lived task.\n if (routingTaskId) {\n try {\n await conn.request('tasks/cancel', { taskId: routingTaskId });\n } catch {\n /* swallow */\n }\n }\n\n await conn.close().catch(() => {});\n return checks;\n }\n}\n",[],[142,474,499,653,710],"9d784403-df3e-47ba-86f4-cfa0f43e1ddb","dispatch.ts","6332f6ee-ad1b-11f1-82ae-1607ee4eb77e",84,["D",1789046856473],"/**\n * SEP-2663 Tasks Extension — dispatch + envelope conformance.\n *\n * Bundles a number of small, related checks under one scenario:\n * - Removed v1 methods (tasks/result, tasks/list) reject as -32601.\n * - Server-directed task creation works without a client `task` hint\n * param; legacy v1 `task` param on tools/call is tolerated and\n * ignored on sync tools.\n * - Immediate-result shortcut: a fast operation MAY skip task creation\n * and return a sync ToolResult.\n * - SEP-2322 resultType:\"complete\" discriminator on every non-task\n * response (sync tools/call, tasks/get, tasks/update, tasks/cancel).\n * - Strong consistency: tasks/get immediately after CreateTaskResult\n * MUST resolve.\n * - tasks/get with an unknown taskId MUST return -32602.\n *\n * Required server fixtures:\n * - greet — sync-only\n * - slow_compute — task-supporting (seconds:0 = instant)\n * - confirm_delete — task-supporting, parks for elicitation\n * - failing_job — task-supporting, returns tool error\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport type { Connection, RunContext } from '../../../connection/index.ts';\nimport { SEP_2322_REF, SEP_2663_REF } from './mrtr-helpers.ts';\nimport { errMsg, failureCheck } from './mrtr-helpers.ts';\nimport {\n TASKS_EXTENSION_ID,\n validTasksParams,\n waitForStatus,\n waitForTerminal\n} from './helpers.ts';\n\n/**\n * Diagnostic suffix for negative-path checks. When a server returns\n * the wrong JSON-RPC error code, the most common cause (per the\n * SEP-2663 review on conformance#262) is that the server validated\n * some other dimension of the request first — routing headers,\n * `_meta`, params shape — and short-circuited before reaching the\n * code path the check is actually probing. The check fixture\n * already sends an otherwise-valid envelope via `validTasksParams`\n * + raw-session auto-headers, so a wrong code here usually means\n * either the server has a different validation order than expected\n * or the fixture envelope is still missing something this server\n * requires. Mention both possibilities so the failure is debuggable.\n */\nconst ISOLATION_HINT =\n '(if the server is otherwise compliant, verify it does not validate other dimensions — routing headers, _meta, params shape — before method dispatch)';\n\nexport class TasksDispatchScenario implements ClientScenario {\n name = 'tasks-dispatch-and-envelope';\n readonly source = { extensionId: 'io.modelcontextprotocol/tasks' } as const;\n description = `Test SEP-2663 dispatch / envelope rules across the tasks surface.\n\n**Server Implementation Requirements:**\n\n**Removed v1 methods (SEP-2663):**\n- \\`tasks/result\\` is removed in v2 — the result is inlined on\n \\`tasks/get\\`. Servers MUST reject the method with JSON-RPC \\`-32601\\`.\n- \\`tasks/list\\` is removed in v2. Servers MUST reject it with\n \\`-32601\\`.\n\n**Server-directed task creation (SEP-2663):**\n- The client does NOT send a \\`task\\` hint param. The server alone\n decides whether to create a task. A \\`tools/call\\` against a\n task-supporting tool MUST produce \\`CreateTaskResult\\` even with no\n client hint.\n\n**Legacy \\`task\\` param tolerated (SEP-2663):**\n- A v1 client may still send \\`task: { ttl, pollInterval }\\` on\n \\`tools/call\\`. The server MUST tolerate it (no error) AND MUST NOT\n promote a sync-only tool to a task on its presence. The body\n arguments + tool registration are authoritative.\n\n**Immediate-result shortcut (SEP-2663):**\n- A server MAY return a sync \\`ToolResult\\` for task-supporting tools\n when the operation completes fast enough. Either return a\n \\`CreateTaskResult\\` (with \\`resultType:\"task\"\\`) or a sync\n \\`ToolResult\\` (with \\`resultType:\"complete\"\\`); both are valid.\n\n**resultType:\"complete\" on non-task responses (SEP-2322):**\n- Every JSON-RPC response on the tools+tasks surface other than a\n CreateTaskResult MUST carry \\`resultType:\"complete\"\\`. This applies\n to: sync \\`tools/call\\`, \\`tasks/get\\`, \\`tasks/update\\` ack,\n \\`tasks/cancel\\` ack.\n\n**Strong consistency / durable create (SEP-2663):**\n- A server MUST NOT return \\`CreateTaskResult\\` until the task is\n durably created — that is, until a \\`tasks/get\\` for the returned\n \\`taskId\\` would resolve. Issuing \\`tasks/get\\` immediately after the\n CreateTaskResult arrives MUST succeed, not -32602.\n\n**Unknown taskId on tasks/get (SEP-2663):**\n- \\`tasks/get\\` for a taskId the server doesn't recognize MUST return\n JSON-RPC \\`-32602\\` (InvalidParams). Mirrors the same rule for\n \\`tasks/cancel\\` (clarified upstream in spec commit d963ad0).\n\n**Required server fixtures (\\`tools/list\\` MUST include all):**\n- \\`greet\\` — sync-only.\n- \\`slow_compute\\` — task-supporting (\\`seconds: 0\\` for the immediate\n shortcut path).\n- \\`confirm_delete\\` — task-supporting, parks for elicitation.\n- \\`failing_job\\` — task-supporting, returns a tool execution error.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n let conn: Connection;\n try {\n conn = await ctx.connect({\n capabilities: {\n elicitation: {},\n sampling: {},\n extensions: { [TASKS_EXTENSION_ID]: {} }\n }\n });\n } catch (error) {\n checks.push({\n id: 'tasks-dispatch-bootstrap',\n name: 'TasksDispatchBootstrap',\n description:\n 'Initialize handshake declaring io.modelcontextprotocol/tasks extension succeeds',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to initialize: ${errMsg(error)}`,\n specReferences: [SEP_2663_REF]\n });\n return checks;\n }\n\n // Check 1: tasks/result removed.\n //\n // Isolation: the request body uses a v1-shaped { taskId } via\n // validTasksParams, and the raw-session emits Mcp-Method +\n // Mcp-Name routing headers and the standard _meta envelope. The\n // ONLY thing the server should object to is the method name.\n {\n const id = 'sep-2663-tasks-result-removed-method-not-found';\n const name = 'TasksRemovedTasksResult';\n const description =\n 'tasks/result is removed in v2 and MUST reject with -32601';\n try {\n await conn.request('tasks/result', validTasksParams('tasks/result'));\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'tasks/result returned a result instead of -32601',\n specReferences: [SEP_2663_REF]\n });\n } catch (e: any) {\n const errs: string[] = [];\n if (e.code !== -32601) {\n errs.push(\n `expected -32601; got ${e.code ?? ''} ${ISOLATION_HINT}`\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF]\n });\n }\n }\n\n // Check 2: tasks/list removed.\n //\n // Isolation: v1 tasks/list took no required params; the empty\n // body is fully valid. Routing headers + _meta come from raw-\n // conn. Only the method name itself is wrong.\n {\n const id = 'tasks-removed-tasks-list';\n const name = 'TasksRemovedTasksList';\n const description =\n 'tasks/list is removed in v2 and MUST reject with -32601';\n try {\n await conn.request('tasks/list', validTasksParams('tasks/list'));\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'tasks/list returned a result instead of -32601',\n specReferences: [SEP_2663_REF]\n });\n } catch (e: any) {\n const errs: string[] = [];\n if (e.code !== -32601) {\n errs.push(\n `expected -32601; got ${e.code ?? ''} ${ISOLATION_HINT}`\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF]\n });\n }\n }\n\n // Check 3: server-directed task creation without client hint.\n {\n const id = 'tasks-server-directed-creation-no-hint';\n const name = 'TasksServerDirectedCreationNoHint';\n const description =\n 'tools/call with no client `task` hint param MUST still produce CreateTaskResult for task-supporting tools';\n try {\n const result = (await conn.request('tools/call', {\n name: 'failing_job',\n arguments: {}\n })) as any;\n const errs: string[] = [];\n if (result.resultType !== 'task' || !result.taskId) {\n errs.push(\n `expected CreateTaskResult; got resultType=${JSON.stringify(result.resultType)}, taskId=${JSON.stringify(result.taskId)}`\n );\n }\n // Best-effort wait so we don't leak.\n if (result.taskId) {\n try {\n await waitForTerminal(conn, result.taskId);\n } catch {\n /* swallow */\n }\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF]\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n // Check 4: legacy `task` param tolerated + ignored on sync tool.\n {\n const id = 'sep-2663-legacy-task-param-ignored';\n const name = 'TasksLegacyTaskParamIgnored';\n const description =\n 'tools/call with legacy `task` param against a sync tool MUST NOT error and MUST NOT be promoted to a task';\n try {\n const result = (await conn.request('tools/call', {\n name: 'greet',\n arguments: { name: 'legacy-hint' },\n // Legacy v1 hint that the server MUST ignore.\n task: { ttl: 60_000, pollInterval: 100 }\n })) as any;\n const errs: string[] = [];\n if (result.resultType === 'task') {\n errs.push(\n 'legacy `task` param MUST NOT promote a sync tool to a task'\n );\n }\n if (result.taskId) {\n errs.push(\n `sync tool with legacy hint MUST NOT carry top-level taskId; got ${result.taskId}`\n );\n }\n if (!Array.isArray(result.content) || result.content.length === 0) {\n errs.push('sync tool MUST still return content[]');\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF]\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n // Check 5: immediate-result shortcut. Either CreateTaskResult OR\n // sync ToolResult is acceptable for an instant operation.\n {\n const id = 'tasks-immediate-result-shortcut';\n const name = 'TasksImmediateResultShortcut';\n const description =\n 'For a fast operation, a task-supporting tool MAY skip task creation and return a sync ToolResult; either path is valid';\n try {\n const result = (await conn.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 0, label: 'instant' }\n })) as any;\n const errs: string[] = [];\n if (result.resultType === 'task') {\n if (!result.taskId) {\n errs.push(\n 'task-path response MUST carry top-level taskId on CreateTaskResult'\n );\n }\n } else {\n // Sync path\n if (!Array.isArray(result.content)) {\n errs.push(\n 'sync-path response MUST carry content[] for the immediate ToolResult'\n );\n }\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF],\n details: { resultType: result.resultType }\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n // Check 6: resultType:\"complete\" on every non-task response.\n {\n const id = 'tasks-result-type-complete-on-non-task-responses';\n const name = 'TasksResultTypeCompleteOnNonTaskResponses';\n const description =\n 'Sync tools/call, tasks/get, tasks/update ack, and tasks/cancel ack MUST all carry resultType:\"complete\"';\n const errs: string[] = [];\n try {\n // Sync tools/call.\n const sync = (await conn.request('tools/call', {\n name: 'greet',\n arguments: { name: 'rt' }\n })) as any;\n if (sync.resultType !== 'complete') {\n errs.push(\n `sync tools/call resultType = ${JSON.stringify(sync.resultType)}, want \"complete\"`\n );\n }\n\n // tasks/get against a fresh task.\n const created = (await conn.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 0, label: 'rt-get' }\n })) as any;\n const taskIdForGet = created.taskId;\n if (taskIdForGet) {\n await waitForTerminal(conn, taskIdForGet);\n const got = (await conn.request('tasks/get', {\n taskId: taskIdForGet\n })) as any;\n if (got.resultType !== 'complete') {\n errs.push(\n `tasks/get resultType = ${JSON.stringify(got.resultType)}, want \"complete\"`\n );\n }\n }\n\n // tasks/cancel ack on a fresh long-running task.\n const longLived = (await conn.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 60, label: 'rt-cancel' }\n })) as any;\n if (longLived.taskId) {\n const cancelAck = (await conn.request('tasks/cancel', {\n taskId: longLived.taskId\n })) as any;\n if (cancelAck.resultType !== 'complete') {\n errs.push(\n `tasks/cancel ack resultType = ${JSON.stringify(cancelAck.resultType)}, want \"complete\"`\n );\n }\n }\n\n // tasks/update ack on a parked elicitation task.\n const elicit = (await conn.request('tools/call', {\n name: 'confirm_delete',\n arguments: { filename: 'rt.txt' }\n })) as any;\n const elicitTaskId = elicit.taskId;\n if (elicitTaskId) {\n await waitForStatus(conn, elicitTaskId, 'input_required', 5_000);\n const updateAck = (await conn.request('tasks/update', {\n taskId: elicitTaskId,\n inputResponses: { 'unknown-key': { ignored: true } }\n })) as any;\n if (updateAck.resultType !== 'complete') {\n errs.push(\n `tasks/update ack resultType = ${JSON.stringify(updateAck.resultType)}, want \"complete\"`\n );\n }\n try {\n await conn.request('tasks/cancel', { taskId: elicitTaskId });\n } catch {\n /* swallow */\n }\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2322_REF, SEP_2663_REF]\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2322_REF]));\n }\n }\n\n // Check 7: strong consistency — immediate tasks/get after CreateTaskResult.\n {\n const id = 'sep-2663-durable-create-strong-consistency';\n const name = 'TasksStrongConsistencyImmediateGet';\n const description =\n 'tasks/get issued immediately after CreateTaskResult arrives MUST resolve (server MUST NOT return CreateTaskResult before the task is durably created)';\n try {\n const created = (await conn.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 60, label: 'consistency' }\n })) as any;\n const taskId = created.taskId;\n if (!taskId) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'slow_compute did not create a task',\n specReferences: [SEP_2663_REF]\n });\n } else {\n // No await/sleep between create and get — codifies the\n // strong-consistency ordering.\n const got = (await conn.request('tasks/get', { taskId })) as any;\n const errs: string[] = [];\n if (got.taskId !== taskId) {\n errs.push(\n `immediate tasks/get MUST resolve the same taskId; got ${got.taskId}`\n );\n }\n // Cleanup.\n try {\n await conn.request('tasks/cancel', { taskId });\n } catch {\n /* swallow */\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF]\n });\n }\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n // Check 8: tasks/get with unknown taskId returns -32602.\n //\n // Isolation: tasks/get is a supported method; the taskId is the\n // single property under test. The unknown taskId appears in both\n // body and Mcp-Name header (raw-session mirrors it) so a server\n // that validates routing headers first will route to tasks/get\n // and reject for \"unknown taskId\" specifically — not for header\n // mismatch.\n {\n const id = 'sep-2663-tasks-get-invalid-task-id-32602';\n const name = 'TasksGetUnknownTaskIdRejected';\n const description =\n 'tasks/get for a taskId the server does not recognize MUST return -32602';\n try {\n await conn.request(\n 'tasks/get',\n validTasksParams('tasks/get', {\n taskId: 'tasks-conformance-nonexistent-12345'\n })\n );\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'tasks/get with unknown taskId returned a result',\n specReferences: [SEP_2663_REF]\n });\n } catch (e: any) {\n const errs: string[] = [];\n if (e.code !== -32602) {\n errs.push(\n `expected -32602; got ${e.code ?? ''} ${ISOLATION_HINT}`\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF]\n });\n }\n }\n\n await conn.close().catch(() => {});\n return checks;\n }\n}\n",[],[142,474,499,653,718],"a0d26cba-838e-4891-b26f-ec5f91c4aebf","composition.ts","62101f58-ad1b-11f1-8c08-1607ee4eb77e",81,["D",1789046854602],"/**\n * SEP-2663 + SEP-2322 — MRTR → Tasks composition.\n *\n * Tests the composition path made normative by SEP-2663 commit 451f5e1:\n * a tool gathers input via the SEP-2322 MRTR loop on `tools/call`, then\n * the handler escalates to async on the final round and the server\n * returns a `CreateTaskResult`. The inlined result of the eventual task\n * MUST reflect the answer gathered during the MRTR phase, so an\n * implementation that wires MRTR and tasks as independent surfaces\n * fails this end-to-end check.\n *\n * The SEP-2322 ephemeral-MRTR contract (round 1 InputRequiredResult →\n * round 2 ToolResult) is covered exhaustively by the `input-required-*`\n * scenarios; only the composition with `CreateTaskResult` on the final\n * round is SEP-2663-specific, which is why this is the only check in\n * the tasks suite that drives the MRTR loop end-to-end.\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport type { Connection, RunContext } from '../../../connection/index.ts';\nimport { SEP_2322_REF, SEP_2663_REF, failureCheck } from './mrtr-helpers.ts';\nimport {\n isInputRequiredResult,\n mockElicitResponse\n} from '../input-required-result-helpers.ts';\nimport { TASKS_EXTENSION_ID, waitForTerminal } from './helpers.ts';\n\nconst MRTR_INPUT_REQUIRED_RESULT_TYPE = 'input_required';\n\nexport class TasksMrtrCompositionScenario implements ClientScenario {\n name = 'tasks-mrtr-composition';\n readonly source = { extensionId: 'io.modelcontextprotocol/tasks' } as const;\n description = `Test SEP-2663 MRTR → Tasks composition (SEP-2663 commit 451f5e1).\n\n**Server Implementation Requirements:**\n\nA tool that gathers input via the SEP-2322 MRTR loop and then escalates\nto async on the final round MUST return a \\`CreateTaskResult\\` on that\nfinal round, NOT a sync \\`ToolResult\\`. The composition is what makes\nthe two surfaces interoperate — clients should not need to choose one\nor the other up front.\n\n**Spec separation that MUST stay observable:**\n\n1. Round 1 (MRTR) carries \\`inputRequests\\` + (optionally) \\`requestState\\`\n and MUST NOT carry \\`taskId\\`.\n2. Round 2 (CreateTaskResult) carries \\`taskId\\` + \\`status\\` and MUST\n NOT carry \\`requestState\\` — SEP-2663 removed it from the v2 wire\n shape, so the MRTR phase's \\`requestState\\` does not leak into the\n task envelope and clients don't have to deduplicate across flows.\n3. The final task \\`result\\` (inlined on \\`tasks/get\\` once terminal)\n MUST reflect the answer gathered during the MRTR phase, end-to-end.\n\n**Required server fixtures (\\`tools/list\\` MUST include all):**\n- \\`test_tool_with_task\\` — registered with \\`taskSupport=required\\`.\n Round 1: returns \\`InputRequiredResult\\` asking for \\`user_name\\`.\n Round 2: with the elicit response echoed back, escalates to async\n and returns \\`CreateTaskResult\\`. The task's eventual result text MUST\n contain the gathered \\`user_name\\` so the round-trip is observable.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n const id = 'sep-2663-mrtr-synchronous-before-task-creation';\n const name = 'Sep2663MrtrSynchronousBeforeTaskCreation';\n const description =\n 'MRTR loop gathers input then escalates to a task on the final round (SEP-2322 + SEP-2663 451f5e1).';\n const specRefs = [SEP_2322_REF, SEP_2663_REF];\n\n let conn: Connection | undefined;\n try {\n // Round 2's CreateTaskResult requires the client to declare\n // io.modelcontextprotocol/tasks (SEP-2663) at session bootstrap;\n // elicitation is needed for the MRTR round.\n conn = await ctx.connect({\n capabilities: {\n elicitation: {},\n extensions: { [TASKS_EXTENSION_ID]: {} }\n }\n });\n\n // Round 1: MRTR — no inputResponses. Expect InputRequiredResult.\n const r1 = (await conn.request('tools/call', {\n name: 'test_tool_with_task',\n arguments: {}\n })) as any;\n const errs: string[] = [];\n if (!isInputRequiredResult(r1)) {\n errs.push(\n `round 1 MUST be InputRequiredResult; got ${JSON.stringify(r1)}`\n );\n }\n if (r1?.resultType !== MRTR_INPUT_REQUIRED_RESULT_TYPE) {\n errs.push(\n `round 1 resultType MUST be \"${MRTR_INPUT_REQUIRED_RESULT_TYPE}\"; got ${JSON.stringify(r1?.resultType)}`\n );\n }\n if (r1 && 'taskId' in r1) {\n errs.push(\n 'round 1 (MRTR) MUST NOT carry taskId — task is only minted on the final round'\n );\n }\n const key = Object.keys(r1?.inputRequests ?? {})[0];\n if (!key) {\n errs.push('round 1 missing inputRequests; cannot drive round 2');\n }\n\n // Round 2: MRTR retry with the elicit response. The handler now\n // returns GoAsync, so the server MUST return CreateTaskResult.\n let taskId: string | undefined;\n let r2: any;\n if (key) {\n r2 = (await conn.request('tools/call', {\n name: 'test_tool_with_task',\n arguments: {},\n inputResponses: {\n [key]: mockElicitResponse({ name: 'Alice' })\n },\n ...(r1.requestState !== undefined\n ? { requestState: r1.requestState }\n : {})\n })) as any;\n if (r2?.resultType !== 'task') {\n errs.push(\n `round 2 MUST be CreateTaskResult (resultType:\"task\"); got ${JSON.stringify(r2?.resultType)}`\n );\n }\n if (!r2?.taskId) {\n errs.push('round 2 CreateTaskResult MUST carry top-level taskId');\n } else {\n taskId = r2.taskId;\n }\n if (r2 && 'requestState' in r2) {\n errs.push(\n 'round 2 CreateTaskResult MUST NOT carry requestState (SEP-2663 spec separation — MRTR requestState does not leak into the task envelope)'\n );\n }\n if (r2 && 'inputRequests' in r2) {\n errs.push(\n 'round 2 CreateTaskResult MUST NOT carry inputRequests (those belong on DetailedTask returned by tasks/get)'\n );\n }\n }\n\n // Round 3: poll tasks/get until terminal; assert the inlined result\n // reflects the answer gathered in the MRTR phase.\n if (taskId) {\n const terminal = await waitForTerminal(conn, taskId);\n if (terminal.status !== 'completed') {\n errs.push(\n `final task status MUST be \"completed\"; got ${JSON.stringify(terminal.status)}`\n );\n }\n const text = terminal?.result?.content?.[0]?.text ?? '';\n if (!/Alice/.test(text)) {\n errs.push(\n `final task result MUST reflect the user_name gathered during the MRTR phase (expected \"Alice\"); got ${JSON.stringify(text)}`\n );\n }\n }\n\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: specRefs\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, specRefs));\n } finally {\n await conn?.close().catch(() => {});\n }\n\n return checks;\n }\n}\n",[],[142,474,499,653,726],"117ce95d-8594-44db-a3c0-0dfce2a8dcf8","capability.ts","673fdf18-ad1b-11f1-9c03-1607ee4eb77e",89,["D",1789046863293],"/**\n * SEP-2663 Tasks Extension — capability negotiation conformance.\n *\n * Tests that the server advertises the io.modelcontextprotocol/tasks\n * extension correctly, gates the v2 task surface on negotiation, and\n * supports SEP-2575 per-request capability overrides.\n *\n * Required server fixtures:\n * - greet — sync-only, returns \"Hello, {name}!\"\n * - slow_compute — task-supporting, sleeps N seconds\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport type { Connection, RunContext } from '../../../connection/index.ts';\nimport { MISSING_REQUIRED_CLIENT_CAPABILITY } from '../../../spec-types/draft.ts';\nimport { SEP_2575_REF, SEP_2663_REF } from './mrtr-helpers.ts';\nimport { errMsg, failureCheck } from './mrtr-helpers.ts';\nimport { TASKS_EXTENSION_ID } from './helpers.ts';\n\nexport class TasksCapabilityNegotiationScenario implements ClientScenario {\n name = 'tasks-capability-negotiation';\n readonly source = { extensionId: 'io.modelcontextprotocol/tasks' } as const;\n description = `Test SEP-2663 capability negotiation for the tasks extension.\n\n**Server Implementation Requirements:**\n\n**Capability advertisement (SEP-2663):**\n- The server MUST advertise \\`io.modelcontextprotocol/tasks\\` under\n \\`capabilities.extensions\\` in its \\`server/discover\\` response.\n- It MUST NOT use a v1-style \\`capabilities.tasks\\` slot (the v1 surface\n is replaced by the extension).\n\n**Gating without negotiation (SEP-2663):**\n- For requests that do NOT carry the \\`io.modelcontextprotocol/tasks\\`\n extension in \\`_meta.clientCapabilities\\`, the server MUST reject\n \\`tasks/get\\`, \\`tasks/update\\`, and \\`tasks/cancel\\` with a\n \\`MissingRequiredClientCapability\\` error.\n- A \\`tools/call\\` from such a session MUST NOT return\n \\`CreateTaskResult\\`. Task-supporting tools fall through to synchronous\n execution and return a plain \\`ToolResult\\` with\n \\`resultType:\"complete\"\\`.\n\n**Per-request opt-in (SEP-2575):**\n- A session that did not declare the extension at session level can\n opt into task creation for a single \\`tools/call\\` by including the\n extension under \\`_meta.io.modelcontextprotocol/clientCapabilities.extensions\\`.\n The server MUST honor the per-request opt-in and produce a\n \\`CreateTaskResult\\` for that call.\n\n**Required server fixtures (\\`tools/list\\` MUST include all):**\n- \\`greet\\` — sync-only, returns \\`Hello, {name}!\\`.\n- \\`slow_compute\\` — task-supporting, \\`seconds\\`-second sleep then a\n result.`;\n\n async run(ctx: RunContext): Promise {\n const checks: ConformanceCheck[] = [];\n\n // Two parallel sessions: one declares the extension, one does NOT.\n let withExt: Connection;\n let withoutExt: Connection;\n try {\n withExt = await ctx.connect({\n capabilities: {\n elicitation: {},\n sampling: {},\n extensions: { [TASKS_EXTENSION_ID]: {} }\n }\n });\n withoutExt = await ctx.connect({\n capabilities: {}\n });\n } catch (error) {\n checks.push({\n id: 'tasks-capability-bootstrap',\n name: 'TasksCapabilityBootstrap',\n description: 'Initialize handshakes (with + without extension) succeed',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to initialize: ${errMsg(error)}`,\n specReferences: [SEP_2663_REF]\n });\n return checks;\n }\n\n // Check 1: server advertises extension under capabilities.extensions.\n {\n const id = 'tasks-extension-advertised';\n const name = 'TasksExtensionAdvertised';\n const description = `Server advertises ${TASKS_EXTENSION_ID} under capabilities.extensions (and not capabilities.tasks)`;\n const discovered = await withExt.discover();\n const caps: any = (discovered.capabilities as any) ?? {};\n const errs: string[] = [];\n if (caps.tasks) {\n errs.push(\n 'v1-style capabilities.tasks slot MUST NOT be used; tasks lives under capabilities.extensions'\n );\n }\n if (!caps.extensions) {\n errs.push('capabilities.extensions MUST be advertised');\n } else if (!caps.extensions[TASKS_EXTENSION_ID]) {\n errs.push(\n `capabilities.extensions[\"${TASKS_EXTENSION_ID}\"] MUST be present`\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF],\n details: {\n hasExtensions: Boolean(caps.extensions),\n hasTasksExtension: Boolean(caps.extensions?.[TASKS_EXTENSION_ID]),\n hasV1TasksSlot: Boolean(caps.tasks)\n }\n });\n }\n\n // Check 2: tasks/* methods rejected with the\n // MissingRequiredClientCapability error when the client did not\n // negotiate the tasks extension. Follows the SEP-2575 §\"Missing\n // Required Capabilities\" pattern — same code path as the\n // required-task-error scenario and (when implemented)\n // subscriptions/listen for tasks.\n {\n const id = 'sep-2663-tasks-methods-non-declaring';\n const name = 'TasksMethodsGatedWithoutExtension';\n const description = `tasks/get, tasks/update, tasks/cancel return ${MISSING_REQUIRED_CLIENT_CAPABILITY} when the client did not negotiate the tasks extension (SEP-2575 Missing Required Capabilities)`;\n const cases: Array<{ method: string; params: any }> = [\n { method: 'tasks/get', params: { taskId: 'gate-test' } },\n {\n method: 'tasks/update',\n params: { taskId: 'gate-test', inputResponses: {} }\n },\n { method: 'tasks/cancel', params: { taskId: 'gate-test' } }\n ];\n const errs: string[] = [];\n for (const tc of cases) {\n try {\n await withoutExt.request(tc.method, tc.params);\n errs.push(`${tc.method} MUST reject (it returned a result)`);\n } catch (e: any) {\n if (e.code !== MISSING_REQUIRED_CLIENT_CAPABILITY) {\n errs.push(\n `${tc.method} MUST return ${MISSING_REQUIRED_CLIENT_CAPABILITY}; got ${e.code ?? ''}`\n );\n }\n }\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2575_REF, SEP_2663_REF]\n });\n }\n\n // Check 3: tools/call without extension returns sync ToolResult, not task.\n {\n const id = 'sep-2663-server-rejects-undeclared-client';\n const name = 'TasksToolsCallWithoutExtensionSync';\n const description =\n 'tools/call from a session without the extension MUST fall through to sync (no CreateTaskResult, even for task-supporting tools)';\n try {\n const result = (await withoutExt.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 0, label: 'capability-no-ext' }\n })) as any;\n const errs: string[] = [];\n if (result.resultType === 'task') {\n errs.push(\n 'tools/call without extension MUST NOT return resultType:\"task\"'\n );\n }\n if (result.taskId) {\n errs.push(\n `tools/call without extension MUST NOT carry top-level taskId; got ${result.taskId}`\n );\n }\n if (result.task) {\n errs.push(\n 'tools/call without extension MUST NOT carry the v1-style nested `task` envelope'\n );\n }\n if (!result.content) {\n errs.push(\n 'tools/call without extension MUST return sync ToolResult with content[]'\n );\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2663_REF],\n details: {\n resultType: result.resultType,\n hasTaskId: Boolean(result.taskId)\n }\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2663_REF]));\n }\n }\n\n // Check 4: SEP-2575 per-request _meta opt-in produces CreateTaskResult.\n {\n const id = 'tasks-per-request-meta-opt-in';\n const name = 'TasksPerRequestMetaOptIn';\n const description =\n 'tools/call with extension declared in _meta.io.modelcontextprotocol/clientCapabilities produces a CreateTaskResult even when the session did not negotiate the extension';\n try {\n const result = (await withoutExt.request('tools/call', {\n name: 'slow_compute',\n arguments: { seconds: 1, label: 'capability-meta-opt' },\n _meta: {\n 'io.modelcontextprotocol/clientCapabilities': {\n extensions: { [TASKS_EXTENSION_ID]: {} }\n }\n }\n })) as any;\n const errs: string[] = [];\n if (result.resultType !== 'task') {\n errs.push(\n `expected resultType:\"task\" via per-request opt-in; got ${JSON.stringify(result.resultType)}`\n );\n }\n if (!result.taskId) {\n errs.push(\n 'per-request opt-in MUST produce a CreateTaskResult with top-level taskId'\n );\n }\n if (result.task) {\n errs.push(\n 'CreateTaskResult MUST be flat (no nested `task` wrapper) even on per-request opt-in path'\n );\n }\n // Best-effort cleanup: cancel the task so we don't leak a 1s\n // background goroutine on the server.\n if (result.taskId) {\n try {\n await withExt.request('tasks/cancel', { taskId: result.taskId });\n } catch {\n /* swallow — cleanup best-effort */\n }\n }\n checks.push({\n id,\n name,\n description,\n status: errs.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errs.length > 0 ? errs.join('; ') : undefined,\n specReferences: [SEP_2575_REF, SEP_2663_REF],\n details: {\n resultType: result.resultType,\n taskId: result.taskId\n }\n });\n } catch (error) {\n checks.push(failureCheck(id, name, description, error, [SEP_2575_REF]));\n }\n }\n\n await withExt.close().catch(() => {});\n await withoutExt.close().catch(() => {});\n return checks;\n }\n}\n",[],[142,474,499,653,734],"515b4250-81f2-4dd3-9173-15efdc4d0ca5",["D",1789046854602],[259,260,261,262,263,264,265,266,267,268,269,270],[142,474,499,653],"12eb13b8-6d02-4f7f-935f-98424756ec80","manifest.ts","b79f1434-ae14-11f1-ad67-1607ee4eb77e","1c742940-41f3-4821-b71e-e95273d6a26e",179,["D",1789153942827],"/**\n * SEP-2640 Skills extension — the `SKILL.md` manifest resource.\n *\n * One scenario, many checks (per AGENTS.md \"fewer scenarios, more checks\").\n * Each check's verbatim spec quote lives next to its check ID in\n * src/seps/sep-2640.yaml.\n *\n * Discovery is dynamic and brand-neutral: the scenario finds a `skill-md`\n * skill's `SKILL.md` resource from `resources/list` (preferred — it carries the\n * Resource `name`/`description` metadata) or falls back to the first `skill-md`\n * entry in `skills/list`, hardcoding no fixture skill. Undeclared\n * extension SKIPs; a declared extension with no discoverable `SKILL.md` reports\n * the missing prerequisite via untestableCheck (issue #248), never a silent\n * green.\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport { JsonRpcError, type RunContext } from '../../../connection/index.ts';\nimport { untestableCheck } from '../../untestable.ts';\nimport {\n SKILLS_EXTENSION_ID,\n SKILLS_META_PREFIX,\n SEP_2640_REF,\n type SkillResource,\n skillsCapability,\n skillsCheck,\n listAllResources,\n skillsListAll,\n readResourceText,\n skillNameFromManifestUri,\n parseFrontmatter\n} from './helpers.ts';\n\nconst MIMETYPE_ID = 'sep-2640-skillmd-mimetype';\nconst METADATA_NAME_ID = 'sep-2640-skillmd-metadata-name';\nconst METADATA_DESCRIPTION_ID = 'sep-2640-skillmd-metadata-description';\nconst FINAL_SEGMENT_ID = 'sep-2640-final-segment-equals-name';\nconst META_PREFIX_ID = 'sep-2640-meta-prefix';\n\nconst MARKDOWN_MIME = 'text/markdown';\n\n/** A SKILL.md resource URI is skill:///SKILL.md. */\nfunction isManifestUri(uri: string): boolean {\n return skillNameFromManifestUri(uri) !== undefined;\n}\n\n/** A `_meta` key that already carries a reverse-domain namespace (`vendor.tld/…`). */\nfunction isNamespacedMetaKey(key: string): boolean {\n return /^[a-z0-9-]+(\\.[a-z0-9-]+)+\\//i.test(key);\n}\n\nexport class SkillsManifestScenario implements ClientScenario {\n name = 'sep-2640-skills-manifest';\n readonly source = { extensionId: SKILLS_EXTENSION_ID } as const;\n description = `SEP-2640 Skills extension: the \\`SKILL.md\\` manifest resource.\n\n**Resource**: \\`skill:///SKILL.md\\` (read via \\`resources/read\\`)\n\n**Requirements covered** (each check carries a verbatim spec excerpt in src/seps/sep-2640.yaml):\n\n- \\`sep-2640-skillmd-mimetype\\` — the SKILL.md resource \\`mimeType\\` SHOULD be \\`text/markdown\\`\n- \\`sep-2640-skillmd-metadata-name\\` — the resource \\`name\\` SHOULD be the frontmatter \\`name\\`\n- \\`sep-2640-skillmd-metadata-description\\` — the resource \\`description\\` SHOULD be the frontmatter \\`description\\`\n- \\`sep-2640-final-segment-equals-name\\` — the final \\`\\` segment MUST equal the frontmatter \\`name\\`\n- \\`sep-2640-meta-prefix\\` — un-namespaced skill \\`_meta\\` keys SHOULD use the \\`io.modelcontextprotocol.skills/\\` prefix\n\n**Discovery is dynamic**: the scenario picks the first \\`skill-md\\` skill it finds. Undeclared extension SKIPs; a declared extension with no discoverable SKILL.md reports the missing prerequisite (not a silent skip).`;\n\n async run(ctx: RunContext): Promise {\n const conn = await ctx.connect();\n try {\n const skills = await skillsCapability(conn);\n const allIds = [\n MIMETYPE_ID,\n METADATA_NAME_ID,\n METADATA_DESCRIPTION_ID,\n FINAL_SEGMENT_ID,\n META_PREFIX_ID\n ];\n if (!skills) {\n const reason =\n 'Server did not declare the io.modelcontextprotocol/skills extension; SKILL.md checks not applicable.';\n return allIds.map((id) =>\n skillsCheck(id, reason, 'SKIPPED', { errorMessage: reason })\n );\n }\n\n // === Dynamic discovery: resources/list first (carries Resource\n // metadata), then skills/list. ===\n const resources = await listAllResources(conn);\n const manifestResource: SkillResource | undefined = resources.find((r) =>\n isManifestUri(r.uri)\n );\n let manifestUri = manifestResource?.uri;\n if (!manifestUri) {\n const listed = await skillsListAll(conn);\n if (!('error' in listed)) {\n const entry = listed.entries.find(\n (e) => typeof e.uri === 'string' && isManifestUri(e.uri)\n );\n manifestUri = entry?.uri as string | undefined;\n }\n }\n\n if (!manifestUri) {\n const reason =\n 'no skill:///SKILL.md resource found via resources/list or skills/list';\n return [\n untestableCheck(\n MIMETYPE_ID,\n MIMETYPE_ID,\n 'SKILL.md resource mimeType SHOULD be text/markdown.',\n reason,\n [SEP_2640_REF],\n 'WARNING'\n ),\n untestableCheck(\n METADATA_NAME_ID,\n METADATA_NAME_ID,\n 'SKILL.md resource name SHOULD match the frontmatter name.',\n reason,\n [SEP_2640_REF],\n 'WARNING'\n ),\n untestableCheck(\n METADATA_DESCRIPTION_ID,\n METADATA_DESCRIPTION_ID,\n 'SKILL.md resource description SHOULD match the frontmatter description.',\n reason,\n [SEP_2640_REF],\n 'WARNING'\n ),\n untestableCheck(\n FINAL_SEGMENT_ID,\n FINAL_SEGMENT_ID,\n 'The final segment MUST equal the frontmatter name.',\n reason,\n [SEP_2640_REF],\n 'FAILURE'\n ),\n untestableCheck(\n META_PREFIX_ID,\n META_PREFIX_ID,\n 'Skill _meta keys SHOULD use the io.modelcontextprotocol.skills/ prefix.',\n reason,\n [SEP_2640_REF],\n 'WARNING'\n )\n ];\n }\n\n const checks: ConformanceCheck[] = [];\n\n // Read the manifest content (for mimeType, frontmatter, and _meta).\n let content:\n | { text: string; mimeType?: string; meta?: Record }\n | undefined;\n let readError: string | undefined;\n try {\n content = await readResourceText(conn, manifestUri);\n if (!content) readError = 'resources/read returned no text content';\n } catch (e) {\n readError =\n e instanceof JsonRpcError\n ? `resources/read failed: code ${e.code}: ${e.message}`\n : e instanceof Error\n ? e.message\n : String(e);\n }\n\n // === skillmd-mimetype (SHOULD) ===\n // Prefer the read content's mimeType; fall back to the resources/list\n // Resource metadata mimeType.\n const mimeType = content?.mimeType ?? manifestResource?.mimeType;\n if (mimeType === undefined) {\n checks.push(\n untestableCheck(\n MIMETYPE_ID,\n MIMETYPE_ID,\n 'SKILL.md resource mimeType SHOULD be text/markdown.',\n `no mimeType observable for ${manifestUri}${readError ? ` (${readError})` : ''}`,\n [SEP_2640_REF],\n 'WARNING'\n )\n );\n } else {\n checks.push(\n skillsCheck(\n MIMETYPE_ID,\n 'SKILL.md resource mimeType SHOULD be text/markdown.',\n mimeType === MARKDOWN_MIME ? 'SUCCESS' : 'WARNING',\n mimeType === MARKDOWN_MIME\n ? { details: { uri: manifestUri, mimeType } }\n : {\n errorMessage: `expected mimeType \"${MARKDOWN_MIME}\", got ${JSON.stringify(mimeType)}`\n }\n )\n );\n }\n\n // Parse the frontmatter once for the name/description/final-segment checks.\n const frontmatter = content ? parseFrontmatter(content.text) : undefined;\n const fmName =\n typeof frontmatter?.name === 'string' ? frontmatter.name : undefined;\n const fmDescription =\n typeof frontmatter?.description === 'string'\n ? frontmatter.description\n : undefined;\n\n // === final-segment-equals-name (MUST) ===\n const uriName = skillNameFromManifestUri(manifestUri);\n if (fmName === undefined || uriName === undefined) {\n const missing =\n fmName === undefined\n ? `SKILL.md frontmatter has no string \"name\"${readError ? ` (${readError})` : ''}`\n : `could not derive the skill name from URI ${manifestUri}`;\n checks.push(\n untestableCheck(\n FINAL_SEGMENT_ID,\n FINAL_SEGMENT_ID,\n 'The final segment MUST equal the frontmatter name.',\n missing,\n [SEP_2640_REF],\n 'FAILURE'\n )\n );\n } else {\n checks.push(\n skillsCheck(\n FINAL_SEGMENT_ID,\n 'The final segment of the SKILL.md URI MUST equal the frontmatter name.',\n uriName === fmName ? 'SUCCESS' : 'FAILURE',\n uriName === fmName\n ? { details: { uri: manifestUri, name: fmName } }\n : {\n errorMessage: `final path segment \"${uriName}\" != frontmatter name \"${fmName}\"`\n }\n )\n );\n }\n\n // === skillmd-metadata-name (SHOULD) — needs the Resource metadata ===\n if (!manifestResource) {\n checks.push(\n untestableCheck(\n METADATA_NAME_ID,\n METADATA_NAME_ID,\n 'SKILL.md resource name SHOULD match the frontmatter name.',\n `SKILL.md ${manifestUri} is not listed in resources/list, so its Resource name metadata is not observable`,\n [SEP_2640_REF],\n 'WARNING'\n )\n );\n } else if (fmName === undefined) {\n checks.push(\n untestableCheck(\n METADATA_NAME_ID,\n METADATA_NAME_ID,\n 'SKILL.md resource name SHOULD match the frontmatter name.',\n `SKILL.md frontmatter has no string \"name\" to compare against${readError ? ` (${readError})` : ''}`,\n [SEP_2640_REF],\n 'WARNING'\n )\n );\n } else {\n checks.push(\n skillsCheck(\n METADATA_NAME_ID,\n 'The SKILL.md resource name SHOULD be set from the frontmatter name.',\n manifestResource.name === fmName ? 'SUCCESS' : 'WARNING',\n manifestResource.name === fmName\n ? { details: { name: fmName } }\n : {\n errorMessage: `resource name ${JSON.stringify(manifestResource.name)} != frontmatter name ${JSON.stringify(fmName)}`\n }\n )\n );\n }\n\n // === skillmd-metadata-description (SHOULD) — needs Resource metadata ===\n if (!manifestResource) {\n checks.push(\n untestableCheck(\n METADATA_DESCRIPTION_ID,\n METADATA_DESCRIPTION_ID,\n 'SKILL.md resource description SHOULD match the frontmatter description.',\n `SKILL.md ${manifestUri} is not listed in resources/list, so its Resource description metadata is not observable`,\n [SEP_2640_REF],\n 'WARNING'\n )\n );\n } else if (fmDescription === undefined) {\n checks.push(\n untestableCheck(\n METADATA_DESCRIPTION_ID,\n METADATA_DESCRIPTION_ID,\n 'SKILL.md resource description SHOULD match the frontmatter description.',\n `SKILL.md frontmatter has no string \"description\" to compare against${readError ? ` (${readError})` : ''}`,\n [SEP_2640_REF],\n 'WARNING'\n )\n );\n } else {\n checks.push(\n skillsCheck(\n METADATA_DESCRIPTION_ID,\n 'The SKILL.md resource description SHOULD be set from the frontmatter description.',\n manifestResource.description === fmDescription\n ? 'SUCCESS'\n : 'WARNING',\n manifestResource.description === fmDescription\n ? { details: { description: fmDescription } }\n : {\n errorMessage: `resource description ${JSON.stringify(manifestResource.description)} != frontmatter description ${JSON.stringify(fmDescription)}`\n }\n )\n );\n }\n\n // === meta-prefix (SHOULD, conditional on _meta keys being present) ===\n // Union the _meta of the read content and the resources/list Resource.\n const metaKeys = new Set([\n ...Object.keys(content?.meta ?? {}),\n ...Object.keys(manifestResource?._meta ?? {})\n ]);\n if (metaKeys.size === 0) {\n checks.push(\n skillsCheck(\n META_PREFIX_ID,\n 'When _meta keys are used for skill resources, they SHOULD use the io.modelcontextprotocol.skills/ reverse-domain prefix.',\n 'SUCCESS',\n { details: { note: 'skill resource exposes no _meta keys' } }\n )\n );\n } else {\n // Only bare (un-namespaced) keys are flagged: a key already carrying a\n // reverse-domain namespace is the intended shape, whichever vendor.\n const bareKeys = [...metaKeys].filter((k) => !isNamespacedMetaKey(k));\n checks.push(\n skillsCheck(\n META_PREFIX_ID,\n 'When _meta keys are used for skill resources, they SHOULD use the io.modelcontextprotocol.skills/ reverse-domain prefix.',\n bareKeys.length === 0 ? 'SUCCESS' : 'WARNING',\n bareKeys.length === 0\n ? { details: { metaKeys: [...metaKeys] } }\n : {\n errorMessage: `un-namespaced skill _meta keys SHOULD use the ${SKILLS_META_PREFIX} prefix: ${bareKeys.join(', ')}`\n }\n )\n );\n }\n\n return checks;\n } finally {\n await conn.close();\n }\n }\n}\n",[],[142,474,499,754,746],"skills","e6ed87b6-bd78-4afb-b34d-4bd30c70ae5b","c0cd53fe-ae14-11f1-a425-1607ee4eb77e",185,["D",1789153958232],"/**\n * Shared helpers for the SEP-2640 (Skills extension) server-conformance\n * scenarios under this directory.\n *\n * The scenarios treat the server-under-test as an arbitrary SEP-2640 server:\n * capability is read from `server/discover` (never inferred from an error), and\n * every skill is discovered dynamically through `skills/list` — no\n * fixture-specific URI is hardcoded, so the checks pass against any conformant\n * server, not just one implementation's fixture.\n *\n * Extracted against the 2026-08-21 revision of the SEP (branch\n * `sep/skills-extension`), which replaced the `skill://index.json` well-known\n * resource with the `skills/list` and `skills/get` methods, deferred archive\n * distribution, and reshaped the skill entry to `{uri, frontmatter, resources}`.\n */\n\nimport type {\n CheckStatus,\n ConformanceCheck,\n SpecReference\n} from '../../../types.ts';\nimport type { Connection } from '../../../connection/index.ts';\nimport { JsonRpcError } from '../../../connection/index.ts';\nimport { parse as parseYaml } from 'npm:yaml@^2.8.2';\n\nexport const SKILLS_EXTENSION_ID = 'io.modelcontextprotocol/skills';\nexport const SKILL_URI_SCHEME = 'skill://';\nexport const SKILL_MANIFEST_FILENAME = 'SKILL.md';\nexport const SKILLS_META_PREFIX = 'io.modelcontextprotocol.skills/';\n\n/** Reserved prefix for MCP-defined keys inside frontmatter `metadata`. */\nexport const FRONTMATTER_RESERVED_PREFIX = 'io.modelcontextprotocol/';\n\nexport const SKILLS_LIST_METHOD = 'skills/list';\nexport const SKILLS_GET_METHOD = 'skills/get';\nexport const DIRECTORY_READ_METHOD = 'resources/directory/read';\n\n/** `sha256:{hex}` with exactly 64 lowercase hex characters (SEP-2640). */\nexport const SKILL_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;\n\n/** The `\"dynamic\"` sentinel a server sets in place of a `resources` array. */\nexport const RESOURCES_DYNAMIC = 'dynamic';\n\n/** Per-skill limits fixed by the SEP (§Limits). */\nexport const MAX_RESOURCES_PER_SKILL = 512;\nexport const MAX_TOTAL_SIZE_PER_SKILL = 16 * 1024 * 1024; // 16 MiB\n\nexport const JSONRPC_METHOD_NOT_FOUND = -32601;\nexport const JSONRPC_INVALID_PARAMS = -32602;\n\nexport const SEP_2640_REF: SpecReference = {\n id: 'SEP-2640',\n url: 'https://modelcontextprotocol.io/seps/2640-skills-extension#specification'\n};\n\n/** A `resources/list` / directory-read entry (only the fields we inspect). */\nexport interface SkillResource {\n uri: string;\n name?: string;\n description?: string;\n mimeType?: string;\n _meta?: Record;\n}\n\n/** One `{uri, digest, size}` triple of a skill entry's `resources` array. */\nexport interface SkillResourceEntry {\n uri?: unknown;\n digest?: unknown;\n size?: unknown;\n [key: string]: unknown;\n}\n\n/**\n * One skill entry, as returned by `skills/list` (in `skills[]`) and by\n * `skills/get` (as `skill`). The two are identical in shape and meaning.\n */\nexport interface SkillEntry {\n uri?: unknown;\n frontmatter?: unknown;\n /** An array of `{uri, digest, size}`, or the string `\"dynamic\"`. */\n resources?: unknown;\n [key: string]: unknown;\n}\n\nexport interface SkillsListResult {\n skills?: unknown;\n nextCursor?: string;\n ttlMs?: unknown;\n cacheScope?: unknown;\n [key: string]: unknown;\n}\n\nexport interface SkillsGetResult {\n skill?: unknown;\n nextCursor?: unknown;\n [key: string]: unknown;\n}\n\n/** First text content of a `resources/read`, with its mimeType and `_meta`. */\nexport interface ResourceText {\n text: string;\n mimeType?: string;\n meta?: Record;\n}\n\n/**\n * Build a check carrying the SEP-2640 reference. Per AGENTS.md the same `id`\n * flips `status` + `errorMessage` between SUCCESS and FAILURE rather than\n * branching into distinct slugs.\n */\nexport function skillsCheck(\n id: string,\n description: string,\n status: CheckStatus,\n extras: Partial = {}\n): ConformanceCheck {\n return {\n id,\n name: id,\n description,\n status,\n timestamp: new Date().toISOString(),\n specReferences: [SEP_2640_REF],\n ...extras\n };\n}\n\n/** A JSON object, as opposed to an array, `null`, or a primitive. */\nexport function isSettingsObject(\n value: unknown\n): value is Record {\n return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** How to name an observed non-object value in an error message. */\nexport function describeValue(value: unknown): string {\n if (value === null) return 'null';\n if (Array.isArray(value)) return 'an array';\n return `a ${typeof value}`;\n}\n\n/**\n * Whether the server declared the skills extension at all, and the raw value it\n * declared it with, before any shape coercion.\n *\n * `skillsCapability` folds a malformed declaration (`true`, a string, an array)\n * into `undefined`, which downstream reads as \"extension not declared\" and\n * SKIPs. That is a false SKIP: the server did declare the extension, it just\n * declared it with the wrong type, and the suite should say so. Callers that\n * need to tell \"absent\" from \"malformed\" apart use this instead.\n *\n * Reads the declared capability from `server/discover` (mirrors\n * `tasks/capability.ts`), never inferred from a `-32601`.\n */\nexport async function declaredSkillsCapability(\n conn: Connection\n): Promise<{ declared: boolean; value: unknown }> {\n const discovered = await conn.discover();\n const caps = (discovered.capabilities as Record) ?? {};\n const extensions = caps.extensions as Record | undefined;\n if (!extensions || !(SKILLS_EXTENSION_ID in extensions)) {\n return { declared: false, value: undefined };\n }\n return { declared: true, value: extensions[SKILLS_EXTENSION_ID] };\n}\n\n/**\n * The skills extension object declared under `capabilities.extensions`, or\n * `undefined` when the server did not declare it — or declared it with\n * something that is not a settings object, which the callers of this helper\n * treat the same way. An undeclared optional extension is a SKIP.\n */\nexport async function skillsCapability(\n conn: Connection\n): Promise | undefined> {\n const { value } = await declaredSkillsCapability(conn);\n return isSettingsObject(value) ? value : undefined;\n}\n\n/**\n * Whether the declared extension object nests its settings inline, as both\n * SEP-2133 and SEP-2640 require, rather than wrapping them in an envelope.\n *\n * SEP-2133 (status Final) defines `extensions` as \"a map of extension\n * identifiers to per-extension settings objects\", and SEP-2640's capability\n * block matches: `{\"io.modelcontextprotocol/skills\": {\"directoryRead\": true}}`.\n * Neither SEP defines an envelope, and neither has a slot for `id`,\n * `specVersion` or `stability`.\n *\n * An earlier revision of this helper accepted a `config` envelope alongside the\n * inline form, on the belief that the two SEPs disagreed. Re-reading SEP-2133\n * at Final status, they do not. The envelope is a non-conformant shape emitted\n * by at least one SDK, so it is reported rather than silently accepted.\n */\nexport function settingsAreInline(skills: Record): {\n inline: boolean;\n envelopeKeys: string[];\n} {\n const envelopeKeys = ['config', 'specVersion', 'stability', 'id'].filter(\n (k) => k in skills\n );\n return { inline: envelopeKeys.length === 0, envelopeKeys };\n}\n\n/**\n * Whether the server declares the base `resources` capability.\n *\n * The stable spec page (ext-skills#139) states this as a consequence of the\n * base Resources specification rather than a new obligation: a server that\n * serves skill files through `resources/read` already has to declare it.\n */\nexport async function resourcesCapabilityDeclared(\n conn: Connection\n): Promise {\n const discovered = await conn.discover();\n const caps = (discovered.capabilities as Record) ?? {};\n return isSettingsObject(caps.resources);\n}\n\n/**\n * Whether the skills extension declares `directoryRead: true`.\n *\n * Reads only the inline location the SEPs specify. A server that buries the\n * flag inside an envelope fails `sep-2640-capability-declaration-inline` and is\n * treated here as not having declared the optional method, which is the\n * conservative reading: a client that follows the spec would not see the flag\n * either, and \"clients MUST NOT call resources/directory/read against a server\n * that has not declared directoryRead: true\".\n */\nexport function directoryReadDeclared(\n skills: Record\n): boolean {\n return skills.directoryRead === true;\n}\n\n/** Everything from `resources/list`, paginating until `nextCursor` clears. */\nexport async function listAllResources(\n conn: Connection\n): Promise {\n const out: SkillResource[] = [];\n let cursor: string | undefined;\n do {\n const page = await conn.request<{\n resources?: SkillResource[];\n nextCursor?: string;\n }>('resources/list', cursor ? { cursor } : undefined);\n out.push(...(page.resources ?? []));\n cursor = page.nextCursor;\n } while (cursor);\n return out;\n}\n\n/** One page of `skills/list`, kept separate so pagination can be inspected. */\nexport interface SkillsListPage {\n result: SkillsListResult;\n entries: SkillEntry[];\n}\n\n/**\n * Call `skills/list` once, optionally with a cursor. Returns a `JsonRpcError`\n * rather than throwing so a scenario can distinguish \"method not implemented\"\n * (a FAILURE, since the method is mandatory for a declaring server) from a\n * transport fault.\n */\nexport async function skillsListPage(\n conn: Connection,\n cursor?: string\n): Promise {\n try {\n const result = await conn.request(\n SKILLS_LIST_METHOD,\n cursor ? { cursor } : {}\n );\n const entries = Array.isArray(result.skills)\n ? (result.skills as SkillEntry[])\n : [];\n return { result, entries };\n } catch (e) {\n if (e instanceof JsonRpcError) return { error: e };\n throw e;\n }\n}\n\n/**\n * Every entry from `skills/list`, following `nextCursor`. `pages` is retained\n * so the atomic-entry and pagination checks can reason about page boundaries.\n * Bounded to avoid looping forever against a server that returns a constant\n * cursor.\n */\nexport async function skillsListAll(\n conn: Connection,\n maxPages = 50\n): Promise<\n | { entries: SkillEntry[]; pages: SkillsListPage[]; truncated: boolean }\n | { error: JsonRpcError }\n> {\n const pages: SkillsListPage[] = [];\n const entries: SkillEntry[] = [];\n let cursor: string | undefined;\n const seenCursors = new Set();\n\n for (let i = 0; i < maxPages; i++) {\n const page = await skillsListPage(conn, cursor);\n if ('error' in page) return page;\n pages.push(page);\n entries.push(...page.entries);\n const next = page.result.nextCursor;\n if (typeof next !== 'string' || next.length === 0) {\n return { entries, pages, truncated: false };\n }\n if (seenCursors.has(next)) {\n // A repeating cursor is a server bug; stop rather than spin.\n return { entries, pages, truncated: true };\n }\n seenCursors.add(next);\n cursor = next;\n }\n return { entries, pages, truncated: true };\n}\n\n/** Call `skills/get` for one skill URI. */\nexport async function skillsGet(\n conn: Connection,\n uri: string\n): Promise<{ result: SkillsGetResult } | { error: JsonRpcError }> {\n try {\n const result = await conn.request(SKILLS_GET_METHOD, {\n uri\n });\n return { result };\n } catch (e) {\n if (e instanceof JsonRpcError) return { error: e };\n throw e;\n }\n}\n\n/** Read a resource's first text content plus its mimeType and `_meta`. */\nexport async function readResourceText(\n conn: Connection,\n uri: string\n): Promise {\n const res = await conn.request<{\n contents?: Array<{\n text?: string;\n mimeType?: string;\n _meta?: Record;\n }>;\n }>('resources/read', { uri });\n const entry = (res.contents ?? []).find((c) => typeof c.text === 'string');\n if (!entry || typeof entry.text !== 'string') return undefined;\n return { text: entry.text, mimeType: entry.mimeType, meta: entry._meta };\n}\n\n/**\n * The skill name recoverable from a `SKILL.md` resource URI: the final segment\n * of ``, i.e. the last path segment before the trailing\n * `SKILL.md`. Returns `undefined` when the URI does not end in `/SKILL.md`.\n *\n * Scheme-agnostic by design: the SEP is explicit that \"no scheme is\n * privileged\" and that the structural constraints \"apply regardless of\n * scheme\", so a server serving skills under `github://` is judged by the same\n * path rule as one using `skill://`.\n *\n * skill://org/team/deploy/SKILL.md -> \"deploy\"\n * github://acme/repo/lint/SKILL.md -> \"lint\"\n */\nexport function skillNameFromManifestUri(uri: string): string | undefined {\n const schemeEnd = uri.indexOf('://');\n if (schemeEnd < 0) return undefined;\n const parts = uri\n .slice(schemeEnd + 3)\n .split('/')\n .filter((p) => p.length > 0);\n if (parts.length < 2) return undefined;\n if (parts[parts.length - 1] !== SKILL_MANIFEST_FILENAME) return undefined;\n return parts[parts.length - 2];\n}\n\n/** The skill's root directory URI: its `SKILL.md` URI with the file removed. */\nexport function skillRootFromManifestUri(uri: string): string | undefined {\n if (!uri.endsWith(`/${SKILL_MANIFEST_FILENAME}`)) return undefined;\n return uri.slice(0, -`/${SKILL_MANIFEST_FILENAME}`.length);\n}\n\n/**\n * Extract and parse the YAML frontmatter block at the head of a `SKILL.md`.\n * Returns `undefined` when there is no leading `---` delimited block or it does\n * not parse to an object.\n */\nexport function parseFrontmatter(\n markdown: string\n): Record | undefined {\n // Tolerate a leading UTF-8 BOM before the opening `---` fence.\n const body = markdown.charCodeAt(0) === 0xfeff ? markdown.slice(1) : markdown;\n const match = body.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---[ \\t]*(?:\\r?\\n|$)/);\n if (!match) return undefined;\n try {\n const parsed = parseYaml(match[1]) as unknown;\n return parsed && typeof parsed === 'object'\n ? (parsed as Record)\n : undefined;\n } catch {\n return undefined;\n }\n}\n\n/** True when the entry's `resources` is the `\"dynamic\"` sentinel. */\nexport function isDynamicResources(entry: SkillEntry): boolean {\n return entry.resources === RESOURCES_DYNAMIC;\n}\n\n/**\n * The entry's `resources` array, or `undefined` when it is `\"dynamic\"`, absent,\n * or any other value. Callers distinguish those cases via `isDynamicResources`.\n */\nexport function resourcesArray(\n entry: SkillEntry\n): SkillResourceEntry[] | undefined {\n return Array.isArray(entry.resources)\n ? (entry.resources as SkillResourceEntry[])\n : undefined;\n}\n\n/** A short, stable label for an entry, for error messages. */\nexport function entryLabel(entry: SkillEntry, i: number): string {\n return typeof entry.uri === 'string' ? entry.uri : `skills[${i}]`;\n}\n\n/**\n * Every child of a directory, following `nextCursor` until it clears.\n *\n * SEP-2640 says directory-read pagination mirrors `resources/list`, so a\n * conformant server MAY split a directory across pages. Reading only the\n * first page makes \"no subdirectory here\" indistinguishable from \"the\n * subdirectory is on page two\".\n */\nexport async function directoryReadAll(\n conn: Connection,\n uri: string,\n maxPages = 50\n): Promise<{ resources: SkillResource[]; pages: number; truncated: boolean }> {\n const resources: SkillResource[] = [];\n const seen = new Set();\n let cursor: string | undefined;\n\n for (let i = 0; i < maxPages; i++) {\n const page = await conn.request<{\n resources?: SkillResource[];\n nextCursor?: string;\n }>('resources/directory/read', cursor ? { uri, cursor } : { uri });\n resources.push(...(page.resources ?? []));\n const next = page.nextCursor;\n if (typeof next !== 'string' || next.length === 0) {\n return { resources, pages: i + 1, truncated: false };\n }\n if (seen.has(next)) return { resources, pages: i + 1, truncated: true };\n seen.add(next);\n cursor = next;\n }\n return { resources, pages: maxPages, truncated: true };\n}\n",[],[142,474,499,754,702],"403f2d2e-4a59-418a-814f-fbfb67094577","enumeration.ts","b80808ae-ae14-11f1-9f35-1607ee4eb77e",180,["D",1789153943484],"/**\n * SEP-2640 Skills extension — the `skills/list` and `skills/get` surface.\n *\n * Replaces the former `skill://index.json` scenario. The 2026-08-21 revision of\n * the SEP removed that well-known resource entirely (it appears nowhere in the\n * current text) and replaced it with two methods that every server declaring the\n * extension MUST implement.\n *\n * One scenario, many checks (per AGENTS.md \"fewer scenarios, more checks\").\n * Each check's verbatim spec quote lives next to its check ID in\n * src/seps/sep-2640.yaml, keeping the YAML and this scenario in lock-step.\n *\n * All discovery is dynamic and brand-neutral: the scenario enumerates whatever\n * the server serves and validates the entries it finds, hardcoding no\n * fixture-specific skill name or URI. When the server does not declare the\n * skills extension the checks are SKIPPED (an optional, undeclared capability).\n * An empty listing is explicitly permitted, so entry-level checks SKIP rather\n * than fail against a server with an unenumerable catalog.\n */\n\nimport { isDeepStrictEqual } from 'node:util';\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport type { RunContext } from '../../../connection/index.ts';\nimport {\n SKILLS_EXTENSION_ID,\n SKILLS_LIST_METHOD,\n SKILLS_GET_METHOD,\n SKILL_URI_SCHEME,\n SKILL_MANIFEST_FILENAME,\n SKILL_DIGEST_PATTERN,\n RESOURCES_DYNAMIC,\n MAX_RESOURCES_PER_SKILL,\n MAX_TOTAL_SIZE_PER_SKILL,\n FRONTMATTER_RESERVED_PREFIX,\n JSONRPC_INVALID_PARAMS,\n type SkillEntry,\n type SkillResourceEntry,\n declaredSkillsCapability,\n describeValue,\n resourcesCapabilityDeclared,\n isSettingsObject,\n skillsCheck,\n skillsListAll,\n skillsGet,\n settingsAreInline,\n skillNameFromManifestUri,\n skillRootFromManifestUri,\n isDynamicResources,\n resourcesArray,\n entryLabel,\n readResourceText,\n parseFrontmatter\n} from './helpers.ts';\n\nconst CAPABILITY_IDS = [\n 'sep-2640-capability-declaration-inline',\n 'sep-2640-capability-requires-resources',\n 'sep-2640-capability-commits-to-methods',\n 'sep-2640-capability-empty-object'\n] as const;\n\nconst LIST_IDS = [\n 'sep-2640-skills-list-implemented',\n 'sep-2640-skills-list-pagination',\n 'sep-2640-skills-list-entry-atomic',\n 'sep-2640-skills-list-cache-attributes'\n] as const;\n\nconst ENTRY_IDS = [\n 'sep-2640-entry-uri-required',\n 'sep-2640-entry-frontmatter-required',\n 'sep-2640-entry-uri-matches-frontmatter-name',\n 'sep-2640-skill-uri-scheme',\n 'sep-2640-entry-resources-required',\n 'sep-2640-resources-complete',\n 'sep-2640-resources-uri-within-skill',\n 'sep-2640-resources-digest-format',\n 'sep-2640-resources-size-required',\n 'sep-2640-limit-resources-per-skill',\n 'sep-2640-limit-total-size',\n 'sep-2640-metadata-reserved-prefix',\n 'sep-2640-name-naming-rules',\n 'sep-2640-authority-reg-name',\n 'sep-2640-names-should-be-unique'\n] as const;\n\nconst GET_IDS = [\n 'sep-2640-skills-get-implemented',\n 'sep-2640-skills-get-entry-shape',\n 'sep-2640-skills-get-cache-attributes',\n 'sep-2640-skills-get-no-cursor',\n 'sep-2640-skills-get-unknown-uri-invalid-params'\n] as const;\n\n/** Emitted by the read-back pass, which fetches one listed SKILL.md. */\nconst READBACK_IDS = [\n 'sep-2640-skillmd-required',\n 'sep-2640-skillmd-frontmatter',\n 'sep-2640-entry-frontmatter-identical'\n] as const;\n\nconst ALL_CHECK_IDS = [\n ...CAPABILITY_IDS,\n ...LIST_IDS,\n ...ENTRY_IDS,\n ...GET_IDS,\n ...READBACK_IDS\n];\n\n/**\n * Agent Skills naming rules as the SEP defers to them: 1-64 characters,\n * lowercase alphanumeric and hyphens, with no leading, trailing or\n * consecutive hyphens. The leading/trailing rule falls out of the anchored\n * alphanumeric bookends; the consecutive one needs the `(?!.*--)` lookahead.\n */\nconst SKILL_NAME_PATTERN = /^(?!.*--)[a-z0-9]([a-z0-9-]{0,62}[a-z0-9])?$/;\n\n/** RFC 3986 reg-name: unreserved / pct-encoded / sub-delims, case-insensitive. */\nconst REG_NAME_PATTERN = /^(?:[A-Za-z0-9\\-._~!$&'()*+,;=]|%[0-9A-Fa-f]{2})*$/;\n\n/** A URI that no conformant server should serve, for the -32602 probe. */\nconst UNKNOWN_SKILL_URI =\n 'skill://mcp-conformance-nonexistent-skill-9f3a2b/SKILL.md';\n\nfunction joinErrs(errs: string[], limit = 5): string {\n const shown = errs.slice(0, limit).join('; ');\n return errs.length > limit\n ? `${shown} (+${errs.length - limit} more)`\n : shown;\n}\n\nexport class SkillsEnumerationScenario implements ClientScenario {\n name = 'sep-2640-skills-enumeration';\n readonly source = { extensionId: SKILLS_EXTENSION_ID } as const;\n description = `SEP-2640 Skills extension: \\`skills/list\\` enumeration and \\`skills/get\\` retrieval.\n\n**Methods**: \\`skills/list\\`, \\`skills/get\\` (both mandatory for a server declaring \\`io.modelcontextprotocol/skills\\`)\n\n**Requirements covered** (each check carries a verbatim spec excerpt in src/seps/sep-2640.yaml):\n\n- \\`sep-2640-capability-declaration-inline\\` — extension settings sit inline under the identifier, per SEP-2133 (no \\`config\\` envelope)\n- \\`sep-2640-capability-commits-to-methods\\` — declaring the extension commits the server to both methods\n- \\`sep-2640-skills-list-implemented\\` — \\`skills/list\\` is implemented and returns a \\`skills\\` array\n- \\`sep-2640-skills-list-pagination\\` — \\`nextCursor\\` is honoured as a cursor on the next request\n- \\`sep-2640-skills-list-entry-atomic\\` — no skill entry is split across pages\n- \\`sep-2640-entry-uri-required\\` / \\`sep-2640-entry-frontmatter-required\\` / \\`sep-2640-entry-resources-required\\` — the three required entry fields\n- \\`sep-2640-entry-uri-matches-frontmatter-name\\` — the final skill-path segment equals \\`frontmatter.name\\`\n- \\`sep-2640-resources-complete\\` — \\`resources\\` includes an entry matching the skill's own \\`uri\\`, each file once\n- \\`sep-2640-resources-uri-within-skill\\` / \\`sep-2640-resources-digest-format\\` / \\`sep-2640-resources-size-required\\` — the \\`{uri, digest, size}\\` triple\n- \\`sep-2640-limit-resources-per-skill\\` / \\`sep-2640-limit-total-size\\` — 512 entries, 16 MiB\n- \\`sep-2640-metadata-reserved-prefix\\` — frontmatter \\`metadata\\` keys under \\`io.modelcontextprotocol/\\` are reserved\n- \\`sep-2640-skills-get-*\\` — \\`skills/get\\` returns a list-shaped entry, carries no cursor, and answers \\`-32602\\` for an unknown URI\n\n**Discovery is dynamic**: an undeclared extension SKIPs everything; an empty or partial listing is permitted and SKIPs the entry-level checks.`;\n\n async run(ctx: RunContext): Promise {\n const conn = await ctx.connect();\n try {\n const declaration = await declaredSkillsCapability(conn);\n if (!declaration.declared) {\n const reason =\n 'Server did not declare the io.modelcontextprotocol/skills extension; enumeration checks not applicable.';\n return ALL_CHECK_IDS.map((id) =>\n skillsCheck(id, reason, 'SKIPPED', { errorMessage: reason })\n );\n }\n\n // Declared, but possibly with something that is not a settings object.\n // The remaining checks read no settings from a malformed declaration, so\n // they proceed against an empty one rather than aborting: `skills/list`\n // and `skills/get` are still owed by anything that declared at all.\n const declaredValue = declaration.value;\n const wellFormed = isSettingsObject(declaredValue);\n const skills: Record = wellFormed ? declaredValue : {};\n\n const checks: ConformanceCheck[] = [];\n\n // === capability-empty-object ===\n // \"An empty object indicates support for the extension with no optional\n // features.\" The observable half is the type: the declared value MUST be\n // an object, and an empty one is a valid declaration rather than a\n // malformed capability. A server declaring `true` fails here instead of\n // silently skipping the suite.\n checks.push(\n skillsCheck(\n 'sep-2640-capability-empty-object',\n 'An empty object indicates support for the extension with no optional features.',\n wellFormed ? 'SUCCESS' : 'FAILURE',\n wellFormed\n ? {\n details: {\n declaredKeys: Object.keys(skills),\n empty: Object.keys(skills).length === 0\n }\n }\n : {\n errorMessage: `capabilities.extensions[\"${SKILLS_EXTENSION_ID}\"] is ${describeValue(declaredValue)}, not a settings object. An empty object is the way to declare support with no optional features.`,\n details: { observed: declaredValue }\n }\n )\n );\n\n // === capability-declaration-inline ===\n // SEP-2133 (Final) maps an extension identifier straight to its settings\n // object. An envelope hides settings from any spec-following client.\n if (wellFormed) {\n const { inline, envelopeKeys } = settingsAreInline(skills);\n checks.push(\n skillsCheck(\n 'sep-2640-capability-declaration-inline',\n 'Extension settings are a map of extension identifiers to per-extension settings objects; the settings sit directly under the identifier.',\n inline ? 'SUCCESS' : 'FAILURE',\n inline\n ? { details: { settingKeys: Object.keys(skills) } }\n : {\n errorMessage: `capabilities.extensions[\"${SKILLS_EXTENSION_ID}\"] carries envelope key(s) ${envelopeKeys.join(', ')} instead of the settings object itself. SEP-2133 (Final) defines no envelope, and SEP-2640's capability block places directoryRead inline.`,\n details: { envelopeKeys, observed: skills }\n }\n )\n );\n } else {\n const reason =\n 'the declared value is not a settings object, so there are no settings to place inline or in an envelope; see sep-2640-capability-empty-object';\n checks.push(\n skillsCheck(\n 'sep-2640-capability-declaration-inline',\n 'Extension settings are a map of extension identifiers to per-extension settings objects; the settings sit directly under the identifier.',\n 'SKIPPED',\n { errorMessage: reason }\n )\n );\n }\n\n // === capability-requires-resources ===\n // Stated on the stable page as a consequence of the base Resources\n // spec rather than a new obligation: a server serving skill files\n // through resources/read already has to declare `resources`. Checkable\n // here because the declaration is on the wire either way.\n const hasResources = await resourcesCapabilityDeclared(conn);\n checks.push(\n skillsCheck(\n 'sep-2640-capability-requires-resources',\n 'A server declaring this extension MUST also declare the resources capability, because skill files are served through resources/read.',\n hasResources ? 'SUCCESS' : 'FAILURE',\n hasResources\n ? { details: { resources: true } }\n : {\n errorMessage:\n 'the server declares the skills extension but not the base `resources` capability, so a spec-following client has no basis to call resources/read for skill files.'\n }\n )\n );\n\n // === skills/list ===\n const listed = await skillsListAll(conn);\n if ('error' in listed) {\n const reason = `${SKILLS_LIST_METHOD} failed with code ${listed.error.code}: ${listed.error.message}. A server declaring the extension MUST implement it.`;\n checks.push(\n skillsCheck(\n 'sep-2640-capability-commits-to-methods',\n 'Declaring the extension commits the server to skills/list and skills/get.',\n 'FAILURE',\n { errorMessage: reason }\n ),\n skillsCheck(\n 'sep-2640-skills-list-implemented',\n 'A server declaring the extension MUST implement the skills/list method.',\n 'FAILURE',\n { errorMessage: reason }\n )\n );\n for (const id of [\n 'sep-2640-skills-list-pagination',\n 'sep-2640-skills-list-entry-atomic',\n ...ENTRY_IDS,\n ...GET_IDS,\n ...READBACK_IDS\n ]) {\n checks.push(\n skillsCheck(id, 'skills/list is unavailable.', 'SKIPPED', {\n errorMessage: reason\n })\n );\n }\n return checks;\n }\n\n const { entries, pages, truncated } = listed;\n\n checks.push(\n skillsCheck(\n 'sep-2640-skills-list-implemented',\n 'A server declaring the extension MUST implement the skills/list method, which returns the skills it serves. The result MAY be empty.',\n 'SUCCESS',\n {\n details: {\n pages: pages.length,\n entries: entries.length,\n emptyListingPermitted: entries.length === 0\n }\n }\n )\n );\n\n // === skills-list-pagination ===\n // Multi-page runs prove the cursor round-trips. A single page is a clean\n // pass: the contract is \"when nextCursor is present, pass it back\", and\n // skillsListAll did exactly that to reach the end.\n checks.push(\n skillsCheck(\n 'sep-2640-skills-list-pagination',\n 'Pagination mirrors the base protocol: the request accepts an optional cursor, and when the result includes nextCursor the client passes it back.',\n truncated ? 'FAILURE' : 'SUCCESS',\n truncated\n ? {\n errorMessage: `skills/list did not terminate: the server kept returning a nextCursor (or repeated one) across ${pages.length} pages.`\n }\n : { details: { pages: pages.length } }\n )\n );\n\n // === skills-list-entry-atomic ===\n // \"An entry is atomic — a skill's resources set is never split across\n // pages.\" Observable as a URI appearing in more than one page.\n const uriPages = new Map();\n pages.forEach((page, pageIdx) => {\n for (const e of page.entries) {\n if (typeof e.uri !== 'string') continue;\n const seen = uriPages.get(e.uri) ?? [];\n if (!seen.includes(pageIdx)) seen.push(pageIdx);\n uriPages.set(e.uri, seen);\n }\n });\n const split = [...uriPages.entries()]\n .filter(([, p]) => p.length > 1)\n .map(([uri, p]) => `${uri} appears on pages ${p.join(', ')}`);\n checks.push(\n skillsCheck(\n 'sep-2640-skills-list-entry-atomic',\n \"An entry is atomic — a skill's resources set is never split across pages.\",\n split.length === 0 ? 'SUCCESS' : 'FAILURE',\n split.length === 0\n ? { details: { pages: pages.length, distinctUris: uriPages.size } }\n : { errorMessage: joinErrs(split) }\n )\n );\n\n // === skills-list-cache-attributes ===\n // SEP-2549 attributes exist only from 2026-07-28. Below that they are\n // not merely optional, they are undefined by the negotiated schema, so\n // a server that omits them is correct and a WARNING is a false\n // positive. From 2026-07-28 they are required, so a missing one is a\n // FAILURE rather than something to shrug at. Reported by Sam Bloomberg\n // against the Go SDK, which was correct in both directions while this\n // check graded it wrong in both.\n const first = pages[0]?.result ?? {};\n const hasTtl = first.ttlMs !== undefined;\n const hasScope = first.cacheScope !== undefined;\n const cacheAttrsApply = ctx.specVersion >= '2026-07-28';\n\n if (!cacheAttrsApply) {\n checks.push(\n skillsCheck(\n 'sep-2640-skills-list-cache-attributes',\n \"In protocol versions 2026-07-28 and later, the skills/list result carries the base protocol's list-caching attributes ttlMs and cacheScope (SEP-2549).\",\n 'SKIPPED',\n {\n errorMessage: `not applicable on negotiated protocol ${ctx.specVersion}: ttlMs and cacheScope are defined from 2026-07-28`,\n details: {\n specVersion: ctx.specVersion,\n ttlMs: first.ttlMs,\n cacheScope: first.cacheScope\n }\n }\n )\n );\n } else {\n const missing = [!hasTtl && 'ttlMs', !hasScope && 'cacheScope']\n .filter(Boolean)\n .join(' and ');\n checks.push(\n skillsCheck(\n 'sep-2640-skills-list-cache-attributes',\n \"In protocol versions 2026-07-28 and later, the skills/list result carries the base protocol's list-caching attributes ttlMs and cacheScope (SEP-2549).\",\n hasTtl && hasScope ? 'SUCCESS' : 'FAILURE',\n hasTtl && hasScope\n ? {\n details: { ttlMs: first.ttlMs, cacheScope: first.cacheScope }\n }\n : {\n errorMessage: `skills/list result omits ${missing} on protocol ${ctx.specVersion}, where SEP-2549 requires both.`\n }\n )\n );\n }\n\n if (entries.length === 0) {\n const reason =\n 'skills/list returned no entries; entry-level checks not applicable. A server whose catalog is large, generated on demand, or otherwise unenumerable MAY return an empty listing.';\n for (const id of [...ENTRY_IDS, ...GET_IDS, ...READBACK_IDS]) {\n checks.push(\n skillsCheck(id, reason, 'SKIPPED', { errorMessage: reason })\n );\n }\n checks.push(\n skillsCheck(\n 'sep-2640-capability-commits-to-methods',\n 'Declaring the extension commits the server to skills/list and skills/get.',\n 'SUCCESS',\n { details: { note: 'skills/list answered; listing is empty.' } }\n )\n );\n return checks;\n }\n\n checks.push(...entryChecks(entries));\n checks.push(...(await getChecks(conn, entries, ctx.specVersion)));\n checks.push(...(await readbackChecks(conn, entries)));\n\n return checks;\n } finally {\n await conn.close();\n }\n }\n}\n\n/** Validate every `skills[]` entry against the §Discovery entry schema. */\nfunction entryChecks(entries: SkillEntry[]): ConformanceCheck[] {\n const checks: ConformanceCheck[] = [];\n\n // === entry-uri-required ===\n const uriErrs = entries\n .map((e, i) =>\n typeof e.uri === 'string' && e.uri.length > 0\n ? null\n : `skills[${i}].uri is missing or not a string`\n )\n .filter((x): x is string => x !== null);\n checks.push(\n skillsCheck(\n 'sep-2640-entry-uri-required',\n \"Every entry carries uri, the full resource URI of the skill's SKILL.md.\",\n uriErrs.length === 0 ? 'SUCCESS' : 'FAILURE',\n uriErrs.length === 0\n ? { details: { entryCount: entries.length } }\n : { errorMessage: joinErrs(uriErrs) }\n )\n );\n\n // === entry-frontmatter-required ===\n // Verbatim frontmatter, so name and description are always present.\n const fmErrs: string[] = [];\n entries.forEach((e, i) => {\n const fm = e.frontmatter;\n if (!fm || typeof fm !== 'object' || Array.isArray(fm)) {\n fmErrs.push(\n `${entryLabel(e, i)}: frontmatter is missing or not an object`\n );\n return;\n }\n const obj = fm as Record;\n if (typeof obj.name !== 'string' || obj.name.length === 0) {\n fmErrs.push(`${entryLabel(e, i)}: frontmatter.name is missing or empty`);\n }\n if (typeof obj.description !== 'string' || obj.description.length === 0) {\n fmErrs.push(\n `${entryLabel(e, i)}: frontmatter.description is missing or empty`\n );\n }\n });\n checks.push(\n skillsCheck(\n 'sep-2640-entry-frontmatter-required',\n \"frontmatter is the skill's SKILL.md YAML frontmatter rendered verbatim as a JSON object; because the Agent Skills specification requires name and description, those fields are always present.\",\n fmErrs.length === 0 ? 'SUCCESS' : 'FAILURE',\n fmErrs.length === 0\n ? { details: { entryCount: entries.length } }\n : { errorMessage: joinErrs(fmErrs) }\n )\n );\n\n // === entry-uri-matches-frontmatter-name ===\n const nameErrs: string[] = [];\n entries.forEach((e) => {\n if (typeof e.uri !== 'string') return;\n const fm = e.frontmatter as Record | undefined;\n const declared = fm && typeof fm.name === 'string' ? fm.name : undefined;\n if (declared === undefined) return;\n const fromUri = skillNameFromManifestUri(e.uri);\n if (fromUri === undefined) {\n nameErrs.push(\n `${e.uri}: does not end in /${SKILL_MANIFEST_FILENAME}, so the skill name is not recoverable from the URI`\n );\n } else if (fromUri !== declared) {\n nameErrs.push(\n `${e.uri}: final skill-path segment \"${fromUri}\" !== frontmatter.name \"${declared}\"`\n );\n }\n });\n checks.push(\n skillsCheck(\n 'sep-2640-entry-uri-matches-frontmatter-name',\n \"The final segment of the entry's uri MUST equal frontmatter.name.\",\n nameErrs.length === 0 ? 'SUCCESS' : 'FAILURE',\n nameErrs.length === 0\n ? { details: { entryCount: entries.length } }\n : { errorMessage: joinErrs(nameErrs) }\n )\n );\n\n // === skill-uri-scheme (SHOULD) ===\n // \"Servers SHOULD use the skill:// URI scheme\", but a server MAY serve\n // skills under another scheme native to its domain and no scheme is\n // privileged, so a deviation is a WARNING rather than a failure.\n const otherScheme = entries\n .filter(\n (e) => typeof e.uri === 'string' && !e.uri.startsWith(SKILL_URI_SCHEME)\n )\n .map((e) => String(e.uri));\n checks.push(\n skillsCheck(\n 'sep-2640-skill-uri-scheme',\n 'Servers SHOULD use the skill:// URI scheme for the resources of a skill.',\n otherScheme.length === 0 ? 'SUCCESS' : 'WARNING',\n otherScheme.length === 0\n ? { details: { entryCount: entries.length } }\n : {\n errorMessage: `Entries served under another scheme (explicitly permitted; no scheme is privileged): ${joinErrs(otherScheme)}`\n }\n )\n );\n\n // === entry-resources-required ===\n const resErrs: string[] = [];\n entries.forEach((e, i) => {\n if (isDynamicResources(e)) return;\n if (resourcesArray(e) !== undefined) return;\n resErrs.push(\n `${entryLabel(e, i)}: resources is ${JSON.stringify(e.resources)}, neither an array nor \"${RESOURCES_DYNAMIC}\"`\n );\n });\n checks.push(\n skillsCheck(\n 'sep-2640-entry-resources-required',\n 'resources is REQUIRED on every skill entry and takes one of two forms: an array of {uri, digest, size} triples, or the string \"dynamic\". An entry with no resources at all, or with any other value, is invalid.',\n resErrs.length === 0 ? 'SUCCESS' : 'FAILURE',\n resErrs.length === 0\n ? {\n details: {\n entryCount: entries.length,\n dynamicEntries: entries.filter(isDynamicResources).length\n }\n }\n : { errorMessage: joinErrs(resErrs) }\n )\n );\n\n // Entries carrying an array are the only ones the remaining checks apply to.\n const arrayEntries = entries\n .map((e, i) => ({ e, i, arr: resourcesArray(e) }))\n .filter(\n (x): x is { e: SkillEntry; i: number; arr: SkillResourceEntry[] } =>\n x.arr !== undefined\n );\n\n const dynamicOnlyReason =\n 'Every entry declares \"resources\": \"dynamic\", which publishes no file manifest; the resources-array checks are not applicable.';\n\n if (arrayEntries.length === 0) {\n for (const id of [\n 'sep-2640-resources-complete',\n 'sep-2640-resources-uri-within-skill',\n 'sep-2640-resources-digest-format',\n 'sep-2640-resources-size-required',\n 'sep-2640-limit-resources-per-skill',\n 'sep-2640-limit-total-size'\n ]) {\n checks.push(\n skillsCheck(id, dynamicOnlyReason, 'SKIPPED', {\n errorMessage: dynamicOnlyReason\n })\n );\n }\n } else {\n // === resources-complete ===\n // Observable half: an entry matching the skill's own uri, and no file\n // listed twice. Full completeness (every file of the skill) cannot be\n // confirmed from the wire without a second source of truth.\n const completeErrs: string[] = [];\n for (const { e, i, arr } of arrayEntries) {\n const own = typeof e.uri === 'string' ? e.uri : undefined;\n if (own && !arr.some((r) => r.uri === own)) {\n completeErrs.push(\n `${entryLabel(e, i)}: resources has no entry matching the skill's own uri (the SKILL.md digest and size)`\n );\n }\n const seen = new Set();\n const dupes = new Set();\n for (const r of arr) {\n if (typeof r.uri !== 'string') continue;\n if (seen.has(r.uri)) dupes.add(r.uri);\n seen.add(r.uri);\n }\n if (dupes.size > 0) {\n completeErrs.push(\n `${entryLabel(e, i)}: resources lists ${[...dupes].join(', ')} more than once`\n );\n }\n }\n checks.push(\n skillsCheck(\n 'sep-2640-resources-complete',\n 'When present, resources MUST be complete: it lists every file of the skill, each exactly once, including an entry matching the skill top-level uri — that entry carries the digest and size of SKILL.md itself.',\n completeErrs.length === 0 ? 'SUCCESS' : 'FAILURE',\n completeErrs.length === 0\n ? { details: { entriesChecked: arrayEntries.length } }\n : { errorMessage: joinErrs(completeErrs) }\n )\n );\n\n // === resources-uri-within-skill ===\n const containErrs: string[] = [];\n for (const { e, i, arr } of arrayEntries) {\n const own = typeof e.uri === 'string' ? e.uri : undefined;\n const root = own ? skillRootFromManifestUri(own) : undefined;\n if (!root) continue;\n for (const r of arr) {\n if (typeof r.uri !== 'string') {\n containErrs.push(`${entryLabel(e, i)}: a resources entry has no uri`);\n continue;\n }\n if (r.uri !== own && !r.uri.startsWith(`${root}/`)) {\n containErrs.push(\n `${entryLabel(e, i)}: ${r.uri} is outside the skill directory ${root}`\n );\n }\n }\n }\n checks.push(\n skillsCheck(\n 'sep-2640-resources-uri-within-skill',\n \"Each uri MUST be the skill's SKILL.md or a file within the skill's directory.\",\n containErrs.length === 0 ? 'SUCCESS' : 'FAILURE',\n containErrs.length === 0\n ? { details: { entriesChecked: arrayEntries.length } }\n : { errorMessage: joinErrs(containErrs) }\n )\n );\n\n // === resources-digest-format ===\n const digestErrs: string[] = [];\n for (const { e, i, arr } of arrayEntries) {\n for (const r of arr) {\n if (\n typeof r.digest !== 'string' ||\n !SKILL_DIGEST_PATTERN.test(r.digest)\n ) {\n digestErrs.push(\n `${entryLabel(e, i)}: ${String(r.uri)} digest=${JSON.stringify(r.digest)} is not sha256:{64 lowercase hex}`\n );\n }\n }\n }\n checks.push(\n skillsCheck(\n 'sep-2640-resources-digest-format',\n \"Digests are SHA-256 hashes of an artifact's raw bytes, formatted as sha256:{hex} where {hex} is 64 lowercase hexadecimal characters.\",\n digestErrs.length === 0 ? 'SUCCESS' : 'FAILURE',\n digestErrs.length === 0\n ? { details: { entriesChecked: arrayEntries.length } }\n : { errorMessage: joinErrs(digestErrs) }\n )\n );\n\n // === resources-size-required ===\n const sizeErrs: string[] = [];\n for (const { e, i, arr } of arrayEntries) {\n for (const r of arr) {\n if (\n typeof r.size !== 'number' ||\n !Number.isInteger(r.size) ||\n r.size < 0\n ) {\n sizeErrs.push(\n `${entryLabel(e, i)}: ${String(r.uri)} size=${JSON.stringify(r.size)} is not a non-negative integer`\n );\n }\n }\n }\n checks.push(\n skillsCheck(\n 'sep-2640-resources-size-required',\n \"Each entry MUST carry size: the length in bytes of the file's raw content — the same bytes the digest covers.\",\n sizeErrs.length === 0 ? 'SUCCESS' : 'FAILURE',\n sizeErrs.length === 0\n ? { details: { entriesChecked: arrayEntries.length } }\n : { errorMessage: joinErrs(sizeErrs) }\n )\n );\n\n // === limit-resources-per-skill (SHOULD NOT exceed) ===\n const overCount = arrayEntries\n .filter(({ arr }) => arr.length > MAX_RESOURCES_PER_SKILL)\n .map(({ e, i, arr }) => `${entryLabel(e, i)}: ${arr.length} entries`);\n checks.push(\n skillsCheck(\n 'sep-2640-limit-resources-per-skill',\n 'Servers SHOULD NOT serve a skill exceeding 512 resource entries, counted over the entries of the skill resources, SKILL.md included.',\n overCount.length === 0 ? 'SUCCESS' : 'WARNING',\n overCount.length === 0\n ? {\n details: {\n maxObserved: Math.max(\n ...arrayEntries.map(({ arr }) => arr.length)\n ),\n limit: MAX_RESOURCES_PER_SKILL\n }\n }\n : { errorMessage: joinErrs(overCount) }\n )\n );\n\n // === limit-total-size (SHOULD NOT exceed) ===\n const sums = arrayEntries.map(({ e, i, arr }) => ({\n label: entryLabel(e, i),\n total: arr.reduce(\n (acc, r) => acc + (typeof r.size === 'number' ? r.size : 0),\n 0\n )\n }));\n const overSize = sums\n .filter((s) => s.total > MAX_TOTAL_SIZE_PER_SKILL)\n .map((s) => `${s.label}: ${s.total} bytes`);\n checks.push(\n skillsCheck(\n 'sep-2640-limit-total-size',\n 'Servers SHOULD NOT serve a skill whose total file size exceeds 16 MiB (16,777,216 bytes), summed over the skill resources.',\n overSize.length === 0 ? 'SUCCESS' : 'WARNING',\n overSize.length === 0\n ? {\n details: {\n maxObservedBytes: Math.max(...sums.map((s) => s.total)),\n limit: MAX_TOTAL_SIZE_PER_SKILL\n }\n }\n : { errorMessage: joinErrs(overSize) }\n )\n );\n }\n\n // === metadata-reserved-prefix ===\n // This extension currently defines no keys under the reserved prefix, so a\n // server publishing one is squatting on a namespace reserved for MCP.\n const reservedErrs: string[] = [];\n entries.forEach((e, i) => {\n const fm = e.frontmatter as Record | undefined;\n const meta = fm?.metadata;\n if (!meta || typeof meta !== 'object' || Array.isArray(meta)) return;\n for (const key of Object.keys(meta as Record)) {\n if (key.startsWith(FRONTMATTER_RESERVED_PREFIX)) {\n reservedErrs.push(\n `${entryLabel(e, i)}: frontmatter.metadata[\"${key}\"]`\n );\n }\n }\n });\n checks.push(\n skillsCheck(\n 'sep-2640-metadata-reserved-prefix',\n 'Within the frontmatter metadata object, keys prefixed with io.modelcontextprotocol/ are reserved for metadata defined by MCP extensions. This extension currently defines no such keys.',\n reservedErrs.length === 0 ? 'SUCCESS' : 'WARNING',\n reservedErrs.length === 0\n ? { details: { entryCount: entries.length } }\n : {\n errorMessage: `Keys under the reserved prefix, which this extension does not currently define: ${joinErrs(reservedErrs)}`\n }\n )\n );\n\n // === name-naming-rules ===\n // The name is recoverable from the URI alone, so this is checkable without\n // fetching anything.\n const badNames: string[] = [];\n entries.forEach((e, i) => {\n if (typeof e.uri !== 'string') return;\n const name = skillNameFromManifestUri(e.uri);\n if (name !== undefined && !SKILL_NAME_PATTERN.test(name)) {\n badNames.push(`${entryLabel(e, i)}: name \"${name}\"`);\n }\n });\n checks.push(\n skillsCheck(\n 'sep-2640-name-naming-rules',\n \"The final segment, being the skill name, MUST satisfy the Agent Skills specification's naming rules (1-64 characters, lowercase alphanumeric and hyphens, no leading, trailing or consecutive hyphens).\",\n badNames.length === 0 ? 'SUCCESS' : 'FAILURE',\n badNames.length === 0\n ? { details: { entryCount: entries.length } }\n : { errorMessage: joinErrs(badNames) }\n )\n );\n\n // === authority-reg-name (SHOULD) ===\n const badAuthority: string[] = [];\n entries.forEach((e, i) => {\n if (typeof e.uri !== 'string') return;\n const schemeEnd = e.uri.indexOf('://');\n if (schemeEnd < 0) return;\n const segments = e.uri\n .slice(schemeEnd + 3)\n .split('/')\n .filter((x) => x.length > 0);\n const authority = segments[0];\n if (authority !== undefined && !REG_NAME_PATTERN.test(authority)) {\n badAuthority.push(`${entryLabel(e, i)}: authority \"${authority}\"`);\n }\n });\n checks.push(\n skillsCheck(\n 'sep-2640-authority-reg-name',\n 'The first segment occupies the authority component and SHOULD be a valid reg-name per RFC 3986.',\n badAuthority.length === 0 ? 'SUCCESS' : 'WARNING',\n badAuthority.length === 0\n ? { details: { entryCount: entries.length } }\n : { errorMessage: joinErrs(badAuthority) }\n )\n );\n\n // === names-should-be-unique (SHOULD) ===\n // A collision is explicitly permitted — two skills at different paths may\n // share a final segment — so this is a WARNING that tells a host operator the\n // listing will need disambiguating, not a failure.\n const byName = new Map();\n entries.forEach((e) => {\n if (typeof e.uri !== 'string') return;\n const n = skillNameFromManifestUri(e.uri);\n if (n === undefined) return;\n byName.set(n, [...(byName.get(n) ?? []), e.uri]);\n });\n const collisions = [...byName.entries()]\n .filter(([, uris]) => uris.length > 1)\n .map(([n, uris]) => `\"${n}\" served at ${uris.join(' and ')}`);\n checks.push(\n skillsCheck(\n 'sep-2640-names-should-be-unique',\n \"Within a server's listing, names SHOULD be unique, but they are not guaranteed to be.\",\n collisions.length === 0 ? 'SUCCESS' : 'WARNING',\n collisions.length === 0\n ? { details: { distinctNames: byName.size } }\n : {\n errorMessage: `Names collide within one listing, so hosts MUST disambiguate them: ${joinErrs(collisions)}`\n }\n )\n );\n\n return checks;\n}\n\n/**\n * Fetch one listed `SKILL.md` and check it against the entry that advertised\n * it. This is the server-side half of the host's frontmatter-comparison MUST:\n * if the entry's `frontmatter` does not match the file, no conforming host can\n * load the skill.\n */\nasync function readbackChecks(\n conn: Parameters[0],\n entries: SkillEntry[]\n): Promise {\n const checks: ConformanceCheck[] = [];\n const sample = entries.find(\n (e) =>\n typeof e.uri === 'string' && e.uri.endsWith(`/${SKILL_MANIFEST_FILENAME}`)\n );\n const uri = sample?.uri as string | undefined;\n\n if (!uri) {\n const reason = `No listed entry has a uri ending in /${SKILL_MANIFEST_FILENAME}, so no SKILL.md can be read back.`;\n for (const id of READBACK_IDS) {\n checks.push(skillsCheck(id, reason, 'SKIPPED', { errorMessage: reason }));\n }\n return checks;\n }\n\n let body: Awaited>;\n try {\n body = await readResourceText(conn, uri);\n } catch (e) {\n const reason = `resources/read on ${uri} failed: ${e instanceof Error ? e.message : String(e)}`;\n checks.push(\n skillsCheck(\n 'sep-2640-skillmd-required',\n 'Every skill MUST contain a SKILL.md file at its root.',\n 'FAILURE',\n { errorMessage: reason }\n )\n );\n for (const id of [\n 'sep-2640-skillmd-frontmatter',\n 'sep-2640-entry-frontmatter-identical'\n ]) {\n checks.push(\n skillsCheck(id, 'SKILL.md is unreadable.', 'SKIPPED', {\n errorMessage: reason\n })\n );\n }\n return checks;\n }\n\n if (!body) {\n const reason = `resources/read on ${uri} returned no text content, so the listed SKILL.md is not retrievable.`;\n checks.push(\n skillsCheck(\n 'sep-2640-skillmd-required',\n 'Every skill MUST contain a SKILL.md file at its root.',\n 'FAILURE',\n { errorMessage: reason }\n )\n );\n for (const id of [\n 'sep-2640-skillmd-frontmatter',\n 'sep-2640-entry-frontmatter-identical'\n ]) {\n checks.push(\n skillsCheck(id, 'No SKILL.md content to inspect.', 'SKIPPED', {\n errorMessage: reason\n })\n );\n }\n return checks;\n }\n\n checks.push(\n skillsCheck(\n 'sep-2640-skillmd-required',\n 'Every skill MUST contain a SKILL.md file at its root.',\n 'SUCCESS',\n { details: { uri, bytes: body.text.length } }\n )\n );\n\n // === skillmd-frontmatter ===\n const fm = parseFrontmatter(body.text);\n const fmErrs: string[] = [];\n if (!fm) {\n fmErrs.push('SKILL.md has no leading --- delimited YAML frontmatter block');\n } else {\n if (typeof fm.name !== 'string' || fm.name.length === 0) {\n fmErrs.push('frontmatter has no non-empty name');\n }\n if (typeof fm.description !== 'string' || fm.description.length === 0) {\n fmErrs.push('frontmatter has no non-empty description');\n }\n }\n checks.push(\n skillsCheck(\n 'sep-2640-skillmd-frontmatter',\n 'SKILL.md MUST begin with YAML frontmatter containing at minimum the name and description fields.',\n fmErrs.length === 0 ? 'SUCCESS' : 'FAILURE',\n fmErrs.length === 0\n ? { details: { uri } }\n : { errorMessage: `${uri}: ${fmErrs.join('; ')}` }\n )\n );\n\n // === entry-frontmatter-identical ===\n const declared = sample?.frontmatter as Record | undefined;\n if (\n !fm ||\n !declared ||\n typeof declared !== 'object' ||\n Array.isArray(declared)\n ) {\n const reason =\n 'Either the file has no parseable frontmatter or the entry carries no frontmatter object, so the two cannot be compared.';\n checks.push(\n skillsCheck(\n 'sep-2640-entry-frontmatter-identical',\n 'The frontmatter object MUST be identical in content to the frontmatter of the SKILL.md it describes.',\n 'SKIPPED',\n { errorMessage: reason }\n )\n );\n return checks;\n }\n\n const diffs: string[] = [];\n const keys = new Set([...Object.keys(fm), ...Object.keys(declared)]);\n // Content, not serialisation: an encoder that orders map keys differently\n // from the YAML source (Go's encoding/json sorts them) still describes the\n // same frontmatter.\n for (const k of keys) {\n if (isDeepStrictEqual(fm[k] ?? null, declared[k] ?? null)) continue;\n diffs.push(\n `${k}: file=${JSON.stringify(fm[k] ?? null)} entry=${JSON.stringify(declared[k] ?? null)}`\n );\n }\n checks.push(\n skillsCheck(\n 'sep-2640-entry-frontmatter-identical',\n 'The frontmatter object MUST be identical in content to the frontmatter of the SKILL.md it describes.',\n diffs.length === 0 ? 'SUCCESS' : 'FAILURE',\n diffs.length === 0\n ? { details: { uri, fields: [...keys] } }\n : {\n errorMessage: `${uri}: entry frontmatter differs from the file's: ${joinErrs(diffs)}`\n }\n )\n );\n\n return checks;\n}\n\n/** Exercise `skills/get` against a real entry and against an unknown URI. */\nasync function getChecks(\n conn: Parameters[0],\n entries: SkillEntry[],\n specVersion: string\n): Promise {\n const checks: ConformanceCheck[] = [];\n const sample = entries.find((e) => typeof e.uri === 'string');\n const sampleUri = sample?.uri as string | undefined;\n\n if (!sampleUri) {\n const reason =\n 'No listed entry carries a uri, so skills/get cannot be exercised against a known skill.';\n for (const id of GET_IDS) {\n checks.push(skillsCheck(id, reason, 'SKIPPED', { errorMessage: reason }));\n }\n return checks;\n }\n\n const got = await skillsGet(conn, sampleUri);\n if ('error' in got) {\n const reason = `${SKILLS_GET_METHOD} failed for a skill the server itself listed (${sampleUri}) with code ${got.error.code}: ${got.error.message}.`;\n checks.push(\n skillsCheck(\n 'sep-2640-capability-commits-to-methods',\n 'Declaring the extension commits the server to skills/list and skills/get.',\n 'FAILURE',\n { errorMessage: reason }\n ),\n skillsCheck(\n 'sep-2640-skills-get-implemented',\n 'A server declaring the extension MUST also implement the skills/get method, which returns the entry for a single skill named by its URI.',\n 'FAILURE',\n { errorMessage: reason }\n )\n );\n for (const id of [\n 'sep-2640-skills-get-entry-shape',\n 'sep-2640-skills-get-no-cursor',\n 'sep-2640-skills-get-unknown-uri-invalid-params'\n ]) {\n checks.push(\n skillsCheck(id, 'skills/get is unavailable.', 'SKIPPED', {\n errorMessage: reason\n })\n );\n }\n return checks;\n }\n\n checks.push(\n skillsCheck(\n 'sep-2640-capability-commits-to-methods',\n 'Declaring the extension itself commits the server to skills/list and skills/get.',\n 'SUCCESS',\n { details: { methods: [SKILLS_LIST_METHOD, SKILLS_GET_METHOD] } }\n ),\n skillsCheck(\n 'sep-2640-skills-get-implemented',\n 'A server declaring the extension MUST also implement the skills/get method, which returns the entry for a single skill named by its URI.',\n 'SUCCESS',\n { details: { probedUri: sampleUri } }\n )\n );\n\n // === skills-get-entry-shape ===\n const skill = got.result.skill as SkillEntry | undefined;\n const shapeErrs: string[] = [];\n if (!skill || typeof skill !== 'object' || Array.isArray(skill)) {\n shapeErrs.push('result.skill is missing or not an object');\n } else {\n if (skill.uri !== sampleUri) {\n shapeErrs.push(\n `result.skill.uri=${JSON.stringify(skill.uri)} does not echo the requested uri ${sampleUri}`\n );\n }\n if (\n !skill.frontmatter ||\n typeof skill.frontmatter !== 'object' ||\n Array.isArray(skill.frontmatter)\n ) {\n shapeErrs.push('result.skill.frontmatter is missing or not an object');\n }\n if (!isDynamicResources(skill) && resourcesArray(skill) === undefined) {\n shapeErrs.push(\n `result.skill.resources=${JSON.stringify(skill.resources)} is neither an array nor \"${RESOURCES_DYNAMIC}\"`\n );\n }\n }\n checks.push(\n skillsCheck(\n 'sep-2640-skills-get-entry-shape',\n 'The skill object is a skill entry, identical in shape and meaning to an entry of skills/list — the same uri, frontmatter, and resources fields, under the same rules.',\n shapeErrs.length === 0 ? 'SUCCESS' : 'FAILURE',\n shapeErrs.length === 0\n ? { details: { probedUri: sampleUri } }\n : { errorMessage: joinErrs(shapeErrs) }\n )\n );\n\n // === skills-get-no-cursor ===\n const hasCursor = got.result.nextCursor !== undefined;\n checks.push(\n skillsCheck(\n 'sep-2640-skills-get-no-cursor',\n 'The result carries no pagination cursor: a single entry is not a list.',\n hasCursor ? 'FAILURE' : 'SUCCESS',\n hasCursor\n ? {\n errorMessage: `skills/get returned nextCursor=${JSON.stringify(got.result.nextCursor)}; a single entry is not a list.`\n }\n : { details: { probedUri: sampleUri } }\n )\n );\n\n // === skills-get-cache-attributes ===\n // SEP-2640 left this open (\"whether the result should also carry the base\n // protocol's caching attributes ... is left open\"); the stable page closed\n // it in the affirmative on 2026-09-10 (ext-skills#139). Gated the same way\n // as the skills/list check: below 2026-07-28 CacheableResult is undefined\n // by the negotiated schema, so omission is correct rather than a defect.\n const getResult = got.result as Record;\n const getTtl = getResult.ttlMs !== undefined;\n const getScope = getResult.cacheScope !== undefined;\n const getCacheApplies = specVersion >= '2026-07-28';\n const getCacheText =\n 'GetSkillResult extends CacheableResult, so ttlMs and cacheScope are REQUIRED, as they are on resources/read.';\n\n if (!getCacheApplies) {\n checks.push(\n skillsCheck(\n 'sep-2640-skills-get-cache-attributes',\n getCacheText,\n 'SKIPPED',\n {\n errorMessage: `not applicable on negotiated protocol ${specVersion}: ttlMs and cacheScope are defined from 2026-07-28`,\n details: {\n specVersion,\n ttlMs: getResult.ttlMs,\n cacheScope: getResult.cacheScope\n }\n }\n )\n );\n } else {\n const missing = [!getTtl && 'ttlMs', !getScope && 'cacheScope']\n .filter(Boolean)\n .join(' and ');\n checks.push(\n skillsCheck(\n 'sep-2640-skills-get-cache-attributes',\n getCacheText,\n getTtl && getScope ? 'SUCCESS' : 'FAILURE',\n getTtl && getScope\n ? {\n details: {\n ttlMs: getResult.ttlMs,\n cacheScope: getResult.cacheScope\n }\n }\n : {\n errorMessage: `skills/get result omits ${missing} on protocol ${specVersion}, where the stable spec page requires both.`\n }\n )\n );\n }\n\n // === skills-get-unknown-uri-invalid-params ===\n const unknown = await skillsGet(conn, UNKNOWN_SKILL_URI);\n if ('error' in unknown) {\n const ok = unknown.error.code === JSONRPC_INVALID_PARAMS;\n checks.push(\n skillsCheck(\n 'sep-2640-skills-get-unknown-uri-invalid-params',\n 'If the URI does not identify a skill the server serves, the server MUST return error -32602 (Invalid params).',\n ok ? 'SUCCESS' : 'FAILURE',\n ok\n ? {\n details: {\n probedUri: UNKNOWN_SKILL_URI,\n code: unknown.error.code\n }\n }\n : {\n errorMessage: `skills/get on an unserved URI returned code ${unknown.error.code} (${unknown.error.message}); expected ${JSONRPC_INVALID_PARAMS}.`\n }\n )\n );\n } else {\n checks.push(\n skillsCheck(\n 'sep-2640-skills-get-unknown-uri-invalid-params',\n 'If the URI does not identify a skill the server serves, the server MUST return error -32602 (Invalid params).',\n 'FAILURE',\n {\n errorMessage: `skills/get returned a successful result for ${UNKNOWN_SKILL_URI}, which no conformant server should serve; expected error ${JSONRPC_INVALID_PARAMS}.`\n }\n )\n );\n }\n\n return checks;\n}\n",[],[142,474,499,754,763],"f3d5f36e-e909-425e-89e7-decae69a329b","directory.ts","b86d87a6-ae14-11f1-be53-1607ee4eb77e",181,["D",1789153944176],"/**\n * SEP-2640 Skills extension — the `resources/directory/read` surface (added in\n * spec commit 2e04c48d, 2026-06-09).\n *\n * One scenario, six checks (per AGENTS.md \"fewer scenarios, more checks\").\n * Each check's verbatim spec quote lives next to its check ID in\n * src/seps/sep-2640.yaml.\n *\n * Capability gating reads the declared capability from `server/discover`\n * (mirrors `tasks/capability.ts`): the checks run only when the server declares\n * `io.modelcontextprotocol/skills.directoryRead: true`. An undeclared optional\n * capability is a SKIP (not a failure); a declared-but-broken one fails.\n *\n * Discovery is dynamic and brand-neutral: the directory to exercise is derived\n * from `skills/list` or `resources/list`, hardcoding no fixture URI, so\n * the scenario passes against any conformant SEP-2640 server. When no directory\n * (or no subdirectory) can be discovered, that check reports the missing\n * prerequisite via untestableCheck (issue #248), never a silent green.\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../../types.ts';\nimport { Connection, JsonRpcError, type RunContext } from '../../../connection/index.ts';\nimport { untestableCheck } from '../../untestable.ts';\nimport {\n SKILLS_EXTENSION_ID,\n SKILL_MANIFEST_FILENAME,\n SEP_2640_REF,\n JSONRPC_METHOD_NOT_FOUND,\n JSONRPC_INVALID_PARAMS,\n type SkillResource,\n skillsCapability,\n directoryReadDeclared,\n skillsCheck,\n listAllResources,\n skillsListAll,\n directoryReadAll,\n skillNameFromManifestUri\n} from './helpers.ts';\n\nconst DIRECTORY_MIME = 'inode/directory';\n\nconst CAPABILITY_ID = 'sep-2640-capability-directory-read-flag';\nconst METHOD_ID = 'sep-2640-directory-read-method-registered';\nconst SHAPE_ID = 'sep-2640-directory-read-result-resources-shape';\nconst SUBDIR_ID = 'sep-2640-directory-read-subdir-mimetype';\nconst INVALID_PARAMS_ID = 'sep-2640-directory-read-invalid-params';\nconst PAGINATION_ID = 'sep-2640-directory-read-pagination';\n\nconst ALL_IDS = [\n CAPABILITY_ID,\n METHOD_ID,\n SHAPE_ID,\n SUBDIR_ID,\n INVALID_PARAMS_ID,\n PAGINATION_ID\n];\n\ninterface DirectoryReadResult {\n resources?: SkillResource[];\n nextCursor?: string;\n}\n\n/** A directory to exercise plus, when known, a non-directory resource under it. */\ninterface DirectoryTarget {\n dirUri: string;\n /** A known file (non-directory) resource, used for the -32602 negative path. */\n fileUri?: string;\n}\n\n/** The skill root directory URI for a SKILL.md URI (strip the trailing file). */\nfunction skillRootFromManifestUri(uri: string): string | undefined {\n if (skillNameFromManifestUri(uri) === undefined) return undefined;\n return uri.slice(0, uri.length - `/${SKILL_MANIFEST_FILENAME}`.length);\n}\n\n/**\n * Discover a directory resource to exercise, brand-neutrally: prefer a skill\n * root derived from a skill-md SKILL.md (index first, then resources/list),\n * then any `inode/directory` resource in resources/list.\n */\nasync function discoverDirectory(\n conn: Connection\n): Promise {\n // 1. A skills/list entry — its SKILL.md URI gives us both a directory (the\n // skill root) and a known file (the SKILL.md itself). An unenumerable\n // catalog returns nothing here, so discovery falls through.\n const listed = await skillsListAll(conn);\n if (!('error' in listed)) {\n const entry = listed.entries.find(\n (e) =>\n typeof e.uri === 'string' &&\n skillRootFromManifestUri(e.uri) !== undefined\n );\n const uri = entry?.uri as string | undefined;\n if (uri) {\n return { dirUri: skillRootFromManifestUri(uri)!, fileUri: uri };\n }\n }\n\n const resources = await listAllResources(conn);\n\n // 2. A SKILL.md in resources/list — derive the skill root the same way.\n const manifest = resources.find(\n (r) => skillRootFromManifestUri(r.uri) !== undefined\n );\n if (manifest) {\n return {\n dirUri: skillRootFromManifestUri(manifest.uri)!,\n fileUri: manifest.uri\n };\n }\n\n // 3. Any directory resource, using a non-directory sibling for the -32602\n // path when one is listed.\n const dir = resources.find((r) => r.mimeType === DIRECTORY_MIME);\n if (dir) {\n const file = resources.find((r) => r.mimeType !== DIRECTORY_MIME);\n return { dirUri: dir.uri, fileUri: file?.uri };\n }\n\n return undefined;\n}\n\nexport class SkillsDirectoryReadScenario implements ClientScenario {\n name = 'sep-2640-skills-directory';\n readonly source = { extensionId: SKILLS_EXTENSION_ID } as const;\n description = `SEP-2640 Skills extension: resources/directory/read surface (added in spec commit 2e04c48d, 2026-06-09).\n\n**Endpoint**: \\`resources/directory/read\\` (gated by \\`io.modelcontextprotocol/skills.directoryRead: true\\`)\n\n**Requirements covered** (each check carries a verbatim spec excerpt in src/seps/sep-2640.yaml):\n\n- \\`sep-2640-capability-directory-read-flag\\` — server declared directoryRead (read from server/discover)\n- \\`sep-2640-directory-read-method-registered\\` — a declaring server supports the method on a served directory (MUST)\n- \\`sep-2640-directory-read-result-resources-shape\\` — result has resources[] of direct children (MUST)\n- \\`sep-2640-directory-read-subdir-mimetype\\` — subdirectory children carry \\`inode/directory\\` (MUST)\n- \\`sep-2640-directory-read-invalid-params\\` — a non-directory URI returns \\`-32602\\` (MUST)\n- \\`sep-2640-directory-read-pagination\\` — \\`nextCursor\\` round-trips per resources/list (single-page is conformant)\n\n**Gating & discovery**: the checks SKIP when the skills extension or its \\`directoryRead\\` flag is undeclared. The directory to exercise is discovered dynamically from \\`skills/list\\` / \\`resources/list\\` — no fixture URI is hardcoded.`;\n\n async run(ctx: RunContext): Promise {\n const conn = await ctx.connect();\n try {\n // === Capability gating via server/discover (not error-inference) ===\n const skills = await skillsCapability(conn);\n if (!skills) {\n const reason =\n 'Server did not declare the io.modelcontextprotocol/skills extension; directoryRead checks not applicable.';\n return ALL_IDS.map((id) =>\n skillsCheck(id, reason, 'SKIPPED', { errorMessage: reason })\n );\n }\n if (!directoryReadDeclared(skills)) {\n const reason =\n 'Server declared the skills extension but not directoryRead: true; the resources/directory/read checks are optional and not applicable.';\n return ALL_IDS.map((id) =>\n skillsCheck(id, reason, 'SKIPPED', { errorMessage: reason })\n );\n }\n\n const checks: ConformanceCheck[] = [];\n\n // Check 1: capability declared (observed directly from server/discover).\n checks.push(\n skillsCheck(\n CAPABILITY_ID,\n 'Server declared io.modelcontextprotocol/skills.directoryRead: true under capabilities.extensions.',\n 'SUCCESS',\n { details: { directoryRead: true } }\n )\n );\n\n // === Discover a directory to exercise (brand-neutral) ===\n const target = await discoverDirectory(conn);\n if (!target) {\n const reason =\n 'no directory resource discoverable via skills/list or resources/list to exercise resources/directory/read';\n const rest: Array<[string, string]> = [\n [\n METHOD_ID,\n 'A declaring server MUST support the method on a served directory.'\n ],\n [\n SHAPE_ID,\n 'Result carries resources[] of the directory’s direct children.'\n ],\n [SUBDIR_ID, 'Subdirectory children carry mimeType inode/directory.'],\n [\n INVALID_PARAMS_ID,\n 'A non-directory URI yields -32602 Invalid params.'\n ],\n [\n PAGINATION_ID,\n 'nextCursor round-trips per the resources/list contract.'\n ]\n ];\n for (const [id, desc] of rest) {\n checks.push(\n untestableCheck(id, id, desc, reason, [SEP_2640_REF], 'FAILURE')\n );\n }\n return checks;\n }\n\n // === Happy path: list the discovered directory ===\n let happy: DirectoryReadResult | undefined;\n let happyErr: unknown;\n try {\n happy = await conn.request(\n 'resources/directory/read',\n { uri: target.dirUri }\n );\n // Every check below inspects the directory's children, so they need\n // the whole directory rather than whichever slice fits one page.\n const all = await directoryReadAll(conn, target.dirUri);\n happy = { ...happy, resources: all.resources };\n } catch (e) {\n happyErr = e;\n }\n\n // Check 2: method registered (declared -> MUST be supported).\n const methodNotFound =\n happyErr instanceof JsonRpcError &&\n happyErr.code === JSONRPC_METHOD_NOT_FOUND;\n checks.push(\n skillsCheck(\n METHOD_ID,\n 'A server that declares directoryRead MUST support resources/directory/read on a served skill directory.',\n happy !== undefined ? 'SUCCESS' : 'FAILURE',\n happy !== undefined\n ? { details: { uri: target.dirUri } }\n : {\n errorMessage: methodNotFound\n ? `resources/directory/read returned -32601 for ${target.dirUri} despite the server declaring directoryRead: true`\n : `resources/directory/read on ${target.dirUri} failed: ${\n happyErr instanceof Error\n ? happyErr.message\n : String(happyErr)\n }`\n }\n )\n );\n\n // Check 3: result shape — resources[] of Resource objects.\n const shapeErrs: string[] = [];\n if (!Array.isArray(happy?.resources)) {\n shapeErrs.push('result.resources is not an array');\n } else {\n happy.resources.forEach((r, i) => {\n if (typeof r.uri !== 'string') {\n shapeErrs.push(`resources[${i}].uri is not a string`);\n }\n });\n }\n checks.push(\n skillsCheck(\n SHAPE_ID,\n 'The result contains resources[] listing the directory’s direct children, each with at least a uri.',\n happy === undefined\n ? 'FAILURE'\n : shapeErrs.length === 0\n ? 'SUCCESS'\n : 'FAILURE',\n happy === undefined\n ? { errorMessage: 'directory read did not return a result' }\n : shapeErrs.length === 0\n ? { details: { childCount: happy.resources?.length ?? 0 } }\n : { errorMessage: shapeErrs.join('; ') }\n )\n );\n\n // Check 4: subdirectory mime marker. A directory whose fixture exposes no\n // child subdirectory cannot exercise this — report it untestable, not a\n // pass and not a failure of the server.\n const subdirChild = Array.isArray(happy?.resources)\n ? happy.resources.find((r) => r.mimeType === DIRECTORY_MIME)\n : undefined;\n if (subdirChild) {\n checks.push(\n skillsCheck(\n SUBDIR_ID,\n 'A subdirectory child is listed as a directory resource (mimeType inode/directory) so clients can descend.',\n 'SUCCESS',\n { details: { subdirectoryUri: subdirChild.uri } }\n )\n );\n } else {\n checks.push(\n untestableCheck(\n SUBDIR_ID,\n SUBDIR_ID,\n 'A subdirectory child is listed with mimeType inode/directory.',\n `no child with mimeType ${DIRECTORY_MIME} under ${target.dirUri}; the served directory exposes no subdirectory to exercise this check`,\n [SEP_2640_REF],\n 'FAILURE'\n )\n );\n }\n\n // Check 5: non-directory URI -> -32602. Needs a known non-directory\n // resource; prefer the discovered fileUri, else a non-directory child.\n const nonDirUri =\n target.fileUri ??\n (Array.isArray(happy?.resources)\n ? happy.resources.find(\n (r) => typeof r.uri === 'string' && r.mimeType !== DIRECTORY_MIME\n )?.uri\n : undefined);\n if (nonDirUri === undefined) {\n checks.push(\n untestableCheck(\n INVALID_PARAMS_ID,\n INVALID_PARAMS_ID,\n 'A non-directory URI yields -32602 Invalid params.',\n 'no non-directory resource discoverable to probe the -32602 path',\n [SEP_2640_REF],\n 'FAILURE'\n )\n );\n } else {\n let invalidOk = false;\n let invalidDetail = '';\n try {\n await conn.request('resources/directory/read', {\n uri: nonDirUri\n });\n invalidDetail = `expected -32602 for non-directory URI ${nonDirUri}, got a successful result`;\n } catch (e) {\n if (e instanceof JsonRpcError && e.code === JSONRPC_INVALID_PARAMS) {\n invalidOk = true;\n } else if (e instanceof JsonRpcError) {\n invalidDetail = `expected -32602 for ${nonDirUri}, got ${e.code}: ${e.message}`;\n } else {\n invalidDetail = `expected -32602, got non-JsonRpcError: ${\n e instanceof Error ? e.message : String(e)\n }`;\n }\n }\n checks.push(\n skillsCheck(\n INVALID_PARAMS_ID,\n 'resources/directory/read on a non-directory URI MUST return -32602 (Invalid params).',\n invalidOk ? 'SUCCESS' : 'FAILURE',\n invalidOk\n ? { details: { nonDirectoryUri: nonDirUri } }\n : { errorMessage: invalidDetail }\n )\n );\n }\n\n // Check 6: pagination contract (single-page is conformant).\n let paginationOk = false;\n let paginationDetail = '';\n const firstCursor = happy?.nextCursor;\n if (happy === undefined) {\n paginationDetail = 'no directory result to evaluate pagination';\n } else if (!firstCursor) {\n paginationOk = true;\n paginationDetail = 'single-page response (no nextCursor)';\n } else {\n try {\n const second = await conn.request(\n 'resources/directory/read',\n { uri: target.dirUri, cursor: firstCursor }\n );\n paginationOk = Array.isArray(second.resources);\n paginationDetail = paginationOk\n ? `nextCursor round-tripped: ${firstCursor}`\n : 'follow-up call returned non-array resources';\n } catch (e) {\n paginationDetail = `follow-up call with cursor failed: ${\n e instanceof Error ? e.message : String(e)\n }`;\n }\n }\n checks.push(\n skillsCheck(\n PAGINATION_ID,\n 'nextCursor round-trips per the resources/list contract (single-page responses are conformant).',\n paginationOk ? 'SUCCESS' : 'FAILURE',\n paginationOk\n ? { details: { paginationDetail } }\n : { errorMessage: paginationDetail }\n )\n );\n\n return checks;\n } finally {\n await conn.close();\n }\n }\n}\n",[],[142,474,499,754,771],"10ead568-d0f8-436e-b7d9-57cebdcb1d3b",["D",1789153942827],[254,255,256,257],[142,474,499,754],"50afa1bb-c0d3-4355-ad76-1a75f1bc84c7",17,["D",1789043615501],[253,258,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289],[142,474,499],"0967930d-8125-4162-bc32-702e059b3d6c","tools_call.ts","de86429a-ad13-11f1-82bb-1607ee4eb77e","10de8c75-8bc0-4b41-a330-aa6a631a25cf",198,["D",1789162695188],"import type { ScenarioContext, MockHandler } from '../../mock-server/index.ts';\nimport type { ConformanceCheck, RequestListener } from '../../types.ts';\nimport { HandlerScenario } from '../../types.ts';\nimport type { CallToolRequest } from '../../spec-types/2025-06-18.ts';\n\nconst SPEC_REF = {\n id: 'MCP-Tools',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n};\n\n/** Raw events, one per request the mock routed to the scenario. */\nconst TOOLS_LIST_EVENT_ID = 'tools-list-requested';\nconst TOOLS_CALL_EVENT_ID = 'tools-call-requested';\n\nexport class ToolsCallScenario extends HandlerScenario {\n name = 'tools_call';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = 'Tests calling tools with various parameter types';\n mcpPath = '/mcp';\n private mock: MockHandler | null = null;\n /**\n * The raw log: an INFO event per tools/list and tools/call the client\n * made. getChecks() judges from this, so the hosted server can persist it\n * per process and judge the merged log once when a client's requests are\n * spread across processes (see src/hosted/session.ts).\n */\n private checks: ConformanceCheck[] = [];\n\n handler(_getBaseUrl: () => string, ctx: ScenarioContext): RequestListener {\n this.checks = [];\n // The version-aware mock supplies the lifecycle scaffold; unbound so the\n // same body serves the CLI runner (via HandlerScenario.start) and the\n // hosted runner's path-prefix mount.\n this.mock = ctx.createHandler({\n 'tools/list': () => {\n this.checks.push({\n id: TOOLS_LIST_EVENT_ID,\n name: 'ToolsListRequested',\n description: 'Client requested tools/list',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_REF]\n });\n return {\n tools: [\n {\n name: 'add_numbers',\n description: 'Add two numbers together',\n inputSchema: {\n type: 'object',\n properties: {\n a: { type: 'number', description: 'First number' },\n b: { type: 'number', description: 'Second number' }\n },\n required: ['a', 'b']\n }\n }\n ]\n };\n },\n 'tools/call': (params) => {\n const p = params as CallToolRequest['params'];\n this.checks.push({\n id: TOOLS_CALL_EVENT_ID,\n name: 'ToolsCallRequested',\n description: `Client called tool '${p.name}'`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_REF],\n details: { name: p.name, arguments: p.arguments }\n });\n if (p.name !== 'add_numbers') {\n throw new Error(`Unknown tool: ${p.name}`);\n }\n const { a, b } = p.arguments as { a: number; b: number };\n return {\n content: [\n { type: 'text', text: `The sum of ${a} and ${b} is ${a + b}` }\n ]\n };\n }\n });\n return this.mock.listener;\n }\n\n readonly steps = [\n { op: 'tools/list' },\n { op: 'tools/call', name: 'add_numbers', arguments: { a: 5, b: 3 } }\n ] as const;\n\n getChecks(): ConformanceCheck[] {\n // Built fresh on every call so getChecks() is idempotent — the runner may\n // call it more than once and we must not accumulate duplicates. Judged\n // from the raw log, not the mock's `recorded`, which only this process's\n // mock instance holds.\n const call = this.checks.find((c) => c.id === TOOLS_CALL_EVENT_ID);\n const args = call?.details?.arguments as\n | { a?: unknown; b?: unknown }\n | undefined;\n const ok =\n call !== undefined &&\n typeof args?.a === 'number' &&\n typeof args?.b === 'number';\n return [\n {\n id: 'tool-add-numbers',\n name: 'ToolAddNumbers',\n description: 'Validates that the add_numbers tool works correctly',\n status: ok ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_REF],\n details: ok\n ? {\n a: args!.a,\n b: args!.b,\n result: (args!.a as number) + (args!.b as number)\n }\n : { message: 'Tool was not called by client' }\n }\n ];\n }\n}\n",[],[142,474,796,788],"client","addfbfd7-90e0-42ec-9685-063120656b4a","stateless-gauntlet.ts","de3715f8-ad13-11f1-8258-1607ee4eb77e",110,["D",1789046877416],"/**\n * Stateless conformance gauntlet — one MCP server, many validating tools.\n *\n * Unlike the per-aspect scenarios, this is a single stateless server a client\n * connects to once. Every tool validates some aspect of the request that\n * carried it; transport-level obligations (Accept header, content type,\n * MCP-Protocol-Version) are validated on every POST before dispatch. The\n * conformance contract is self-evident:\n *\n * list tools, call each one with valid arguments — if nothing errors,\n * the client passed everything this server can observe per-request.\n *\n * There is intentionally NO cross-request state: each request is judged on\n * its own content, so the server can run on serverless hosts (val.town)\n * where consecutive requests may land on different isolates, and no run-id\n * or results polling is needed. Checks are still recorded for the runner /\n * hosted results view, but a misbehaving client finds out immediately\n * because its own request fails with an explanation.\n */\n\nimport { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n CallToolResult,\n ListToolsRequestSchema\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { createHash } from 'node:crypto';\nimport type { ConformanceCheck } from '../../types.ts';\nimport { HandlerScenario, DRAFT_PROTOCOL_VERSION } from '../../types.ts';\n\nconst SPEC_HTTP = {\n id: 'MCP-Streamable-HTTP',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#streamable-http'\n};\nconst SPEC_TOOLS = {\n id: 'MCP-Tools',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n};\n\n/**\n * The draft wire string and its planned release date are treated as the same\n * version: clients built against the dated release string must pass against\n * a server that predates the rename (and vice versa).\n */\nconst DRAFT_VERSION_ALIASES = [DRAFT_PROTOCOL_VERSION, '2026-07-28'];\n\nconst CLASSIC_PROTOCOL_VERSIONS = ['2025-03-26', '2025-06-18', '2025-11-25'];\n\nconst KNOWN_PROTOCOL_VERSIONS = [\n ...CLASSIC_PROTOCOL_VERSIONS,\n ...DRAFT_VERSION_ALIASES\n];\n\nfunction isDraftVersion(v: unknown): boolean {\n return DRAFT_VERSION_ALIASES.includes(String(v));\n}\n\n/** Versions compare equal across the draft/release-date alias. */\nfunction sameVersion(a: unknown, b: unknown): boolean {\n return String(a) === String(b) || (isDraftVersion(a) && isDraftVersion(b));\n}\n\nconst META_NS = 'io.modelcontextprotocol/';\n\n/**\n * The bearer token minted by the consent interstitial. The token IS the\n * message: every subsequent request from the consented client carries\n * `Authorization: Bearer this-client-led-with-initialize`, so request logs,\n * proxies, and the readiness report can all state the fact directly.\n */\nconst CONSENT_TOKEN = 'this-client-led-with-initialize';\n\n/** What clients see in serverInfo — one val, one spec version. */\nconst SERVER_INFO = { name: 'mcp-checker-2026-07-28', version: '1.0.0' };\n\n/** Escape a string for interpolation into HTML text or a quoted attribute. */\nfunction escapeHtml(s: string): string {\n return s.replace(\n /[&<>\"']/g,\n (c) =>\n ({ '&': '&', '<': '<', '>': '>', '\"': '"', \"'\": ''' })[\n c\n ]!\n );\n}\n\n// ---------------------------------------------------------------------------\n// MRTR (SEP-2322) — multi-round-trip tool, draft mode only.\n//\n// Listed only for clients whose per-request `_meta` clientCapabilities\n// declare elicitation support: a client that can't answer elicitation\n// requests simply never sees the tool, so \"call every listed tool\" stays the\n// whole contract. The requestState is self-contained (no server memory), so\n// the retry can land on any isolate.\n// ---------------------------------------------------------------------------\n\nconst MRTR_TOOL = {\n name: 'mrtr_confirm',\n description:\n 'Multi-round-trip tool (SEP-2322): the first call returns an ' +\n 'input_required result with an elicitation request and a requestState. ' +\n 'Re-call this tool with inputResponses.confirm set to the elicitation ' +\n 'result and requestState echoed back unchanged.',\n inputSchema: { type: 'object', properties: {} }\n};\n\n/**\n * Listed in place of mrtr_confirm when the client does NOT declare the\n * elicitation capability — so the absence is discoverable instead of silent.\n * Calling it is not an error (not implementing elicitation is conformant);\n * the result explains what declaring the capability unlocks.\n */\nconst ELICITATION_MISSING_TOOL = {\n name: 'elicitation_missing',\n description:\n 'You are seeing this tool because your client did not declare the ' +\n \"'elicitation' capability in _meta \" +\n `${META_NS}clientCapabilities. Clients that declare it ` +\n '({\"elicitation\": {}}) see the full tool list, including the ' +\n 'multi-round-trip (MRTR, SEP-2322) tool mrtr_confirm. Calling this ' +\n 'tool is not an error — it returns this explanation.',\n inputSchema: { type: 'object', properties: {} }\n};\n\nfunction declaresElicitation(meta: Record): boolean {\n const caps = meta[`${META_NS}clientCapabilities`];\n return (\n typeof caps === 'object' &&\n caps !== null &&\n (caps as Record).elicitation !== undefined\n );\n}\n\nfunction encodeMrtrState(): string {\n return Buffer.from(\n JSON.stringify({ tool: MRTR_TOOL.name, nonce: 'gauntlet-mrtr-v1' })\n ).toString('base64url');\n}\n\nfunction decodeMrtrState(state: string): boolean {\n try {\n const parsed = JSON.parse(Buffer.from(state, 'base64url').toString());\n return (\n parsed.tool === MRTR_TOOL.name && parsed.nonce === 'gauntlet-mrtr-v1'\n );\n } catch {\n return false;\n }\n}\n\ninterface ToolOutcome {\n ok: boolean;\n /** What was validated (on success) or what the client got wrong. */\n detail: string;\n}\n\n/**\n * Tool registry. Transport conformance (headers, _meta, version) is enforced\n * on every request before any tool runs, so tools only need to cover what a\n * request body can get wrong: constructing arguments that honor the\n * inputSchema. One tool with a string, a number, and a same-document $ref\n * field covers every argument kind in a single call; failures itemize\n * per-field problems so nothing diagnostic is lost by the consolidation.\n */\nconst GAUNTLET_TOOLS: {\n name: string;\n description: string;\n inputSchema: Record;\n validate: (args: Record, req: Request) => ToolOutcome;\n}[] = [\n {\n name: 'validate_arguments',\n description:\n 'Echoes back its arguments. Validates that the client constructs ' +\n 'arguments honoring the inputSchema: a required string, a required ' +\n 'JSON number (not a stringified number), and a field defined via a ' +\n 'same-document $ref (#/$defs/payload) — local refs are safe to ' +\n 'resolve (SEP-2106). Failures list every non-conforming field.',\n inputSchema: {\n type: 'object',\n properties: {\n message: { type: 'string', description: 'Any string to echo' },\n count: { type: 'number', description: 'Any JSON number' },\n payload: { $ref: '#/$defs/payload' }\n },\n required: ['message', 'count', 'payload'],\n $defs: {\n payload: {\n type: 'object',\n properties: { kind: { type: 'string', enum: ['solid', 'liquid'] } },\n required: ['kind']\n }\n }\n },\n validate: (args) => {\n const problems: string[] = [];\n if (typeof args.message !== 'string') {\n problems.push(\n `'message' must be a string; got ${JSON.stringify(args.message)} (${typeof args.message})`\n );\n }\n if (typeof args.count !== 'number') {\n problems.push(\n `'count' must be a JSON number, not a stringified number; got ${JSON.stringify(args.count)} (${typeof args.count})`\n );\n }\n const payload = args.payload as { kind?: unknown } | undefined;\n if (\n !payload ||\n typeof payload !== 'object' ||\n (payload.kind !== 'solid' && payload.kind !== 'liquid')\n ) {\n problems.push(\n `'payload' must match #/$defs/payload ({kind: \"solid\"|\"liquid\"}); got ${JSON.stringify(args.payload)}`\n );\n }\n if (problems.length > 0) {\n return { ok: false, detail: problems.join('; ') };\n }\n return {\n ok: true,\n detail: `message=${args.message}, count=${String(args.count)}, payload.kind=${String(payload?.kind)}`\n };\n }\n }\n];\n\n/** Transport-level problems with the request, empty when conformant. */\nfunction headerProblems(req: Request): string[] {\n const problems: string[] = [];\n const accept = String(req.headers.accept ?? '');\n if (\n !accept.includes('application/json') ||\n !accept.includes('text/event-stream')\n ) {\n problems.push(\n `Accept header MUST list both application/json and text/event-stream; got '${accept || '(missing)'}'`\n );\n }\n const contentType = String(req.headers['content-type'] ?? '');\n if (!contentType.includes('application/json')) {\n problems.push(\n `Content-Type MUST be application/json; got '${contentType || '(missing)'}'`\n );\n }\n return problems;\n}\n\n/**\n * Draft-2026 (SEP-2575/SEP-2243) per-request obligations. There is no\n * initialization in the stateless draft protocol, so everything a classic\n * handshake established must be carried by every request: the version header,\n * the io.modelcontextprotocol/* `_meta` fields, and the Mcp-Method/Mcp-Name\n * routing headers.\n */\nfunction draftProblems(\n req: Request,\n body: { method?: string; params?: Record }\n): string[] {\n const problems: string[] = [];\n const headerVersion = req.headers['mcp-protocol-version'];\n const meta = (body.params?._meta ?? {}) as Record;\n const metaVersion = meta[`${META_NS}protocolVersion`];\n\n if (!headerVersion) {\n problems.push(\n 'MCP-Protocol-Version header MUST be sent on every request (SEP-2575; there is no initialize handshake to negotiate it)'\n );\n } else if (!KNOWN_PROTOCOL_VERSIONS.includes(String(headerVersion))) {\n problems.push(\n `MCP-Protocol-Version '${String(headerVersion)}' is not a known protocol version (${KNOWN_PROTOCOL_VERSIONS.join(', ')})`\n );\n }\n for (const field of ['protocolVersion', 'clientInfo', 'clientCapabilities']) {\n if (meta[`${META_NS}${field}`] === undefined) {\n problems.push(\n `_meta MUST carry ${META_NS}${field} on every request (SEP-2575)`\n );\n }\n }\n if (\n headerVersion !== undefined &&\n metaVersion !== undefined &&\n !sameVersion(headerVersion, metaVersion)\n ) {\n problems.push(\n `MCP-Protocol-Version header ('${String(headerVersion)}') MUST match _meta ${META_NS}protocolVersion ('${String(metaVersion)}')`\n );\n }\n const mcpMethod = req.headers['mcp-method'];\n if (!mcpMethod) {\n problems.push(\n 'Mcp-Method header MUST mirror the JSON-RPC method on every POST (SEP-2243)'\n );\n } else if (body.method && String(mcpMethod) !== body.method) {\n problems.push(\n `Mcp-Method header ('${String(mcpMethod)}') MUST equal the body method ('${body.method}') (SEP-2243)`\n );\n }\n if (body.method === 'tools/call') {\n const mcpName = req.headers['mcp-name'];\n const toolName = (body.params as { name?: string } | undefined)?.name;\n if (!mcpName) {\n problems.push(\n 'Mcp-Name header MUST mirror params.name on tools/call (SEP-2243)'\n );\n } else if (toolName && String(mcpName) !== toolName) {\n problems.push(\n `Mcp-Name header ('${String(mcpName)}') MUST equal params.name ('${toolName}') (SEP-2243)`\n );\n }\n }\n return problems;\n}\n\nfunction check(\n checks: ConformanceCheck[],\n id: string,\n name: string,\n ok: boolean,\n description: string,\n details?: Record,\n failStatus: 'FAILURE' | 'WARNING' = 'FAILURE'\n): void {\n checks.push({\n id,\n name,\n description,\n status: ok ? 'SUCCESS' : failStatus,\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_HTTP],\n details\n });\n}\n\ninterface ToolCallResult {\n content: { type: 'text'; text: string }[];\n isError?: boolean;\n [key: string]: unknown;\n}\n\n/**\n * Execute a gauntlet tool call. In lenient mode failures stay isError tool\n * results (recorded as WARNING checks) instead of escalating to HTTP 400 —\n * an old client keeps its flow and reads the feedback from the result.\n */\nfunction runTool(\n checks: ConformanceCheck[],\n name: string,\n args: Record,\n req: Request,\n lenient = false\n): ToolCallResult {\n const tool = GAUNTLET_TOOLS.find((t) => t.name === name);\n if (!tool) {\n return {\n content: [\n {\n type: 'text',\n text:\n `CONFORMANCE FAIL: unknown tool '${name}'. ` +\n `Available: ${GAUNTLET_TOOLS.map((t) => t.name).join(', ')}`\n }\n ],\n isError: true\n };\n }\n const outcome = tool.validate(args, req);\n check(\n checks,\n `gauntlet-${tool.name}`,\n `Gauntlet: ${tool.name}`,\n outcome.ok,\n outcome.ok\n ? `Client called ${tool.name} conformantly`\n : `Client call to ${tool.name} was not conformant`,\n { detail: outcome.detail },\n lenient ? 'WARNING' : 'FAILURE'\n );\n if (!outcome.ok) {\n return {\n content: [\n {\n type: 'text',\n text: `CONFORMANCE FAIL [${tool.name}]: ${outcome.detail}`\n }\n ],\n isError: true\n };\n }\n return {\n content: [\n { type: 'text', text: `CONFORMANCE OK [${tool.name}]: ${outcome.detail}` }\n ]\n };\n}\n\n// ---------------------------------------------------------------------------\n// Lenient mode (\"/lenient\" sub-path) — serve old clients, report the gaps.\n//\n// Classic flows complete normally (initialize handshake via the SDK) so an\n// old client can actually run; the draft gap report is delivered where the\n// client will see it: the initialize result's `instructions`, and the\n// draft_readiness tool whose result itemizes what the request that carried\n// it was missing relative to the stateless draft.\n// ---------------------------------------------------------------------------\n\nconst DRAFT_READINESS_TOOL = {\n name: 'draft_readiness',\n description:\n 'Reports how draft-ready (stateless 2026-07-28, SEP-2575) your client ' +\n 'is, judged from the request that carries this call: protocol version ' +\n 'declaration, _meta fields, and Mcp-* routing headers. Never errors — ' +\n 'the result is the report.',\n inputSchema: { type: 'object', properties: {} }\n};\n\n/**\n * Behavioral changes the draft brings that a per-request gap list cannot\n * detect — appended to every readiness report so old clients learn about\n * them even though their requests can't \"miss\" them yet.\n */\nconst MRTR_NOTE =\n 'Also note: the stateless draft replaces server-initiated requests with ' +\n 'multi-round-trip tool results (MRTR, SEP-2322). If your client supports ' +\n 'elicitation, it must declare it in _meta ' +\n `${META_NS}clientCapabilities ({\"elicitation\": {}}) and handle ` +\n \"resultType:'input_required' tool results — answer the inputRequests and \" +\n 'retry the call with requestState echoed back unchanged. Declaring the ' +\n 'capability makes this gauntlet list the mrtr_confirm tool so you can ' +\n 'exercise that flow.';\n\n/** Itemized draft gaps of one request, framed as an advisory report. */\nfunction readinessReport(\n req: Request,\n body: { method?: string; params?: Record }\n): string {\n const headerVersion = req.headers['mcp-protocol-version'];\n const meta = (body.params?._meta ?? {}) as Record;\n const gaps = draftProblems(req, body);\n // The consent token spells it out: this client led with initialize.\n if (req.headers.authorization === `Bearer ${CONSENT_TOKEN}`) {\n gaps.unshift(\n 'Do not lead with initialize — the stateless draft has no handshake. ' +\n 'This client presented the consent token (literally ' +\n `'${CONSENT_TOKEN}') minted at the initialize gate, so it opened ` +\n 'this session with initialize. Draft clients start with ' +\n 'server/discover or any request directly.'\n );\n } else if (body.method === 'initialize') {\n gaps.unshift(\n 'Do not lead with initialize — the stateless draft has no handshake. ' +\n 'This request IS an initialize. Draft clients start with ' +\n 'server/discover or any request directly.'\n );\n }\n if (gaps.length === 0) {\n return (\n 'DRAFT-READY: this request carries everything the stateless draft ' +\n 'protocol requires. Run the strict gauntlet at the parent URL ' +\n '(without /lenient) to confirm end to end.' +\n (declaresElicitation(meta) ? '' : `\\n\\n${MRTR_NOTE}`)\n );\n }\n const intro =\n body.method === 'initialize'\n ? 'Your client spoke the classic handshake protocol' +\n ' — the stateless draft (2026-07-28) has no initialize step.'\n : `Your client declared protocol version '${String(headerVersion ?? '(none)')}'.`;\n return (\n `DRAFT GAPS (${gaps.length}): ${intro} To be draft-ready it must also fix:\\n` +\n gaps.map((g, i) => `${i + 1}. ${g}`).join('\\n') +\n `\\n\\n${MRTR_NOTE}`\n );\n}\n\n/** Classic SDK server for lenient mode, carrying the gap report. */\nfunction createLenientClassicServer(\n checks: ConformanceCheck[],\n req: Request,\n body: { method?: string; params?: Record }\n): Server {\n const server = new Server(SERVER_INFO, {\n capabilities: { tools: {} },\n instructions:\n 'Lenient conformance gauntlet. Call every listed tool with valid ' +\n 'arguments; call draft_readiness for an itemized report of what ' +\n 'this client must change for the stateless draft protocol.\\n\\n' +\n readinessReport(req, body)\n });\n\n server.setRequestHandler(ListToolsRequestSchema, async () => ({\n // Classic requests carry no per-request capabilities, so MRTR can't be\n // capability-gated here the way it is in draft mode — list the\n // placeholder unconditionally so the old client discovers the gap.\n tools: [\n ...GAUNTLET_TOOLS.map(({ name, description, inputSchema }) => ({\n name,\n description,\n inputSchema\n })),\n DRAFT_READINESS_TOOL,\n ELICITATION_MISSING_TOOL\n ]\n }));\n\n server.setRequestHandler(\n CallToolRequestSchema,\n async (request): Promise => {\n if (request.params.name === DRAFT_READINESS_TOOL.name) {\n return {\n content: [{ type: 'text' as const, text: readinessReport(req, body) }]\n };\n }\n if (request.params.name === ELICITATION_MISSING_TOOL.name) {\n return {\n content: [\n {\n type: 'text' as const,\n text: `CONFORMANCE NOTE [elicitation_missing]: ${MRTR_NOTE}`\n }\n ]\n };\n }\n return runTool(\n checks,\n request.params.name,\n (request.params.arguments ?? {}) as Record,\n req,\n true\n );\n }\n );\n\n return server;\n}\n\nexport class StatelessGauntletScenario extends HandlerScenario {\n name = 'checker-2026-07-28';\n description =\n 'Single stateless MCP server with validating tools, draft protocol ' +\n '(SEP-2575) ONLY. List tools, call each once with valid arguments; any ' +\n 'error response tells you what the client got wrong. No run-id and no ' +\n 'results polling — every request is judged on its own content. Clients ' +\n 'that fall back to a classic version (initialize, or a 2025-* version ' +\n 'header) fail with an itemized list of what a draft request carries ' +\n 'that theirs did not.';\n readonly source = { introducedIn: '2025-06-18' } as const;\n mcpPath = '';\n\n private checks: ConformanceCheck[] = [];\n\n handler(getBaseUrl: () => string): express.Application {\n const app = express();\n app.use(express.json());\n app.use(express.urlencoded({ extended: false }));\n\n // -----------------------------------------------------------------------\n // Consent gate for `initialize` (and only initialize — nothing else is\n // auth-gated). An old client leading with initialize gets a 401; its\n // OAuth flow lands a human on an HTML page explaining that initialize\n // does not exist in the stateless draft. Continuing mints a consent\n // token, and a consented classic client is served leniently — so \"I\n // understand, test anyway\" is exactly what the token encodes. This\n // mini-AS is a consent-delivery vehicle, NOT an auth conformance test\n // (the auth/* scenarios cover that).\n // -----------------------------------------------------------------------\n const issuer = () => `${getBaseUrl()}/oauth`;\n // PRM URL per RFC 9728, derived from wherever this app is mounted:\n // root mount (dedicated checker val) → origin-rooted well-known;\n // /x/ mount (hosted runner) → path-suffixed well-known.\n const prmUrl = () => {\n const base = new URL(getBaseUrl());\n return `${base.origin}/.well-known/oauth-protected-resource${base.pathname === '/' ? '' : base.pathname}`;\n };\n\n app.get('/.well-known/oauth-protected-resource', (_req, res) => {\n res.json({\n resource: getBaseUrl(),\n authorization_servers: [issuer()],\n bearer_methods_supported: ['header']\n });\n });\n\n const asMetadata = (_req: Request, res: Response) => {\n res.json({\n issuer: issuer(),\n authorization_endpoint: `${issuer()}/authorize`,\n token_endpoint: `${issuer()}/token`,\n registration_endpoint: `${issuer()}/register`,\n response_types_supported: ['code'],\n grant_types_supported: ['authorization_code'],\n code_challenge_methods_supported: ['S256'],\n token_endpoint_auth_methods_supported: ['none']\n });\n };\n app.get('/.well-known/oauth-authorization-server/oauth', asMetadata);\n // OIDC-style discovery fallback for clients that only try this form.\n app.get('/.well-known/openid-configuration/oauth', asMetadata);\n\n app.post('/oauth/register', (req, res) => {\n res.status(201).json({\n ...req.body,\n client_id: 'gauntlet-consent-client',\n token_endpoint_auth_method: 'none'\n });\n });\n\n app.get('/oauth/authorize', (req, res) => {\n const query = new URLSearchParams(\n req.query as Record\n ).toString();\n const continueUrl = `${issuer()}/authorize/continue?${query}`;\n res.status(200).type('html').send(`\nHold on — initialize?\n\n\n
Hold on — this client led with initialize
\n
The client you are testing started its session with an\ninitialize request. That is invalid in the new\nstateless protocol (2026-07-28 / SEP-2575) — there is no handshake;\nevery request carries the protocol version, client info, and capabilities\nitself.
\n
You can continue with the test if you want: the gauntlet will serve this\nclient's classic flow and report what it is missing (see the\ndraft_readiness tool and the initialize result's instructions).\nBut know that leading with initialize will not work against\nstateless draft servers.
\n
I understand — continue with the test
\n`);\n });\n\n app.get('/oauth/authorize/continue', (req, res) => {\n const q = req.query as Record;\n if (!q.redirect_uri) {\n res.status(400).json({\n error: 'invalid_request',\n error_description: 'redirect_uri required'\n });\n return;\n }\n const redirect = new URL(q.redirect_uri);\n const code = Buffer.from(\n JSON.stringify({\n consent: 'gauntlet-initialize',\n challenge: q.code_challenge ?? null\n })\n ).toString('base64url');\n redirect.searchParams.set('code', code);\n if (q.state !== undefined) redirect.searchParams.set('state', q.state);\n res.redirect(redirect.toString());\n });\n\n app.post('/oauth/token', (req, res) => {\n const grant = req.body as Record;\n let decoded: { consent?: string; challenge?: string | null };\n try {\n decoded = JSON.parse(\n Buffer.from(String(grant.code ?? ''), 'base64url').toString()\n );\n } catch {\n decoded = {};\n }\n if (\n grant.grant_type !== 'authorization_code' ||\n decoded.consent !== 'gauntlet-initialize'\n ) {\n res.status(400).json({ error: 'invalid_grant' });\n return;\n }\n if (decoded.challenge) {\n const expected = createHash('sha256')\n .update(String(grant.code_verifier ?? ''))\n .digest('base64url');\n if (expected !== decoded.challenge) {\n res.status(400).json({\n error: 'invalid_grant',\n error_description: 'PKCE verification failed'\n });\n return;\n }\n }\n res.json({\n access_token: CONSENT_TOKEN,\n token_type: 'Bearer',\n expires_in: 3600\n });\n });\n\n app.post('/', async (req: Request, res: Response) => {\n const body =\n req.body && !Array.isArray(req.body)\n ? (req.body as {\n method?: string;\n id?: unknown;\n params?: Record;\n })\n : {};\n const headerVersion = req.headers['mcp-protocol-version'];\n\n // This gauntlet tests the stateless draft protocol ONLY. A client\n // that falls back to a classic version (an `initialize` request or a\n // 2025-* version header) fails — but with a full inventory of what a\n // draft request must carry that this one didn't, so the failure is\n // also the upgrade guide. A request carrying draft `_meta` fields is\n // judged as draft no matter what its header claims (the disagreement\n // is reported, not routed around).\n const meta = (body.params?._meta ?? {}) as Record;\n const hasDraftMeta = Object.keys(meta).some((k) => k.startsWith(META_NS));\n const isClassicFallback =\n !hasDraftMeta &&\n ((body.method === 'initialize' && !isDraftVersion(headerVersion)) ||\n (headerVersion !== undefined &&\n CLASSIC_PROTOCOL_VERSIONS.includes(String(headerVersion))));\n\n // A consent token (minted by the initialize interstitial) means a\n // human read \"this client shouldn't do initialize\" and chose to\n // continue — serve the classic flow leniently from here on.\n const consented = req.headers.authorization === `Bearer ${CONSENT_TOKEN}`;\n if (isClassicFallback && consented) {\n const gaps = [...headerProblems(req), ...draftProblems(req, body)];\n check(\n this.checks,\n 'gauntlet-draft-readiness',\n 'Gauntlet: draft readiness (consented classic)',\n gaps.length === 0,\n 'Consented classic flow served leniently; draft gaps are advisory',\n { method: body.method, ...(gaps.length ? { gaps } : {}) },\n 'WARNING'\n );\n const server = createLenientClassicServer(this.checks, req, body);\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n await transport.handleRequest(req, res, req.body);\n res.on('close', () => {\n void transport.close();\n void server.close();\n });\n return;\n }\n\n // initialize — and ONLY initialize — is gated on auth: the OAuth flow\n // lands a human on an HTML page explaining that the draft has no\n // initialize, with a \"continue anyway\" button. Clients without OAuth\n // get the same explanation in the 401 body. Recorded as WARNING so\n // the /x wrapper lets the 401 challenge through.\n if (isClassicFallback && body.method === 'initialize') {\n const explanation =\n 'This gauntlet tests the stateless draft protocol (2026-07-28): there is NO initialize handshake. Leading with initialize is invalid in the new spec. If your client supports OAuth, completing the authorization flow shows the full explanation and lets you continue testing the classic flow anyway; or point the client at this URL + /lenient for ungated advisory mode.';\n check(\n this.checks,\n 'gauntlet-transport-headers',\n 'Gauntlet: transport headers',\n false,\n 'Client led with initialize; challenged with the consent gate',\n { method: body.method, mode: 'initialize-consent-gate' },\n 'WARNING'\n );\n res\n .status(401)\n .set('WWW-Authenticate', `Bearer resource_metadata=\"${prmUrl()}\"`)\n .json({\n error: 'consent_required',\n explanation,\n problems: draftProblems(req, body)\n });\n return;\n }\n\n const problems = headerProblems(req);\n if (isClassicFallback) {\n problems.unshift(\n `Request declared classic protocol version '${String(headerVersion)}'. This gauntlet tests the stateless draft protocol only — declare 2026-07-28 (or DRAFT-2026-v1) in both the MCP-Protocol-Version header and _meta.`\n );\n }\n // Draft obligations are evaluated for EVERY request — for a classic\n // fallback this doubles as the itemized list of what was missing.\n problems.push(...draftProblems(req, body));\n\n check(\n this.checks,\n 'gauntlet-transport-headers',\n 'Gauntlet: transport headers',\n problems.length === 0,\n problems.length === 0\n ? 'Request carried conformant draft transport headers'\n : isClassicFallback\n ? 'Client fell back to a classic protocol version'\n : 'Request transport headers were not conformant',\n {\n method: body.method,\n mode: isClassicFallback ? 'classic-fallback-rejected' : 'draft',\n ...(problems.length ? { problems } : {})\n }\n );\n if (problems.length > 0) {\n res.status(400).json({\n error: 'conformance failure',\n mode: isClassicFallback ? 'classic-fallback-rejected' : 'draft',\n problems,\n hint: isClassicFallback\n ? 'Each listed problem is one thing a stateless draft request carries that this request did not. For advisory-only feedback that still serves classic flows, point the client at this URL + /lenient.'\n : 'Fix the listed transport problems and retry.'\n });\n return;\n }\n\n this.handleDraft(req, res, body);\n });\n\n // Lenient mode: old clients complete their flows (initialize included);\n // draft gaps are reported, not enforced. Tool failures stay isError\n // results, and gap checks are WARNINGs so the /x wrapper passes them.\n app.post('/lenient', async (req: Request, res: Response) => {\n const body =\n req.body && !Array.isArray(req.body)\n ? (req.body as {\n method?: string;\n id?: unknown;\n params?: Record;\n })\n : {};\n const headerVersion = req.headers['mcp-protocol-version'];\n const meta = (body.params?._meta ?? {}) as Record;\n const hasDraftMeta = Object.keys(meta).some((k) => k.startsWith(META_NS));\n\n const gaps = [...headerProblems(req), ...draftProblems(req, body)];\n check(\n this.checks,\n 'gauntlet-draft-readiness',\n 'Gauntlet: draft readiness (lenient)',\n gaps.length === 0,\n gaps.length === 0\n ? 'Request carries everything the stateless draft requires'\n : 'Request is missing draft obligations (advisory)',\n { method: body.method, ...(gaps.length ? { gaps } : {}) },\n 'WARNING'\n );\n\n if (!hasDraftMeta && !isDraftVersion(headerVersion)) {\n // Classic client: serve the real handshake so the flow completes;\n // the gap report rides in instructions and draft_readiness.\n const server = createLenientClassicServer(this.checks, req, body);\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n await transport.handleRequest(req, res, req.body);\n res.on('close', () => {\n void transport.close();\n void server.close();\n });\n return;\n }\n\n this.handleDraft(req, res, body, true);\n });\n\n // Browsers get an explainer; programmatic GETs get the JSON hint.\n app.get('/', (req, res) => {\n if (!String(req.headers.accept ?? '').includes('text/html')) {\n res.status(405).json({\n error: 'stateless server: POST JSON-RPC to this URL',\n docs: 'open this URL in a browser for a full explanation'\n });\n return;\n }\n const base = getBaseUrl();\n res.type('html').send(`\nMCP Checker — 2026-07-28\n\n\n
MCP Checker — 2026-07-28
\n
Conformance checker for the stateless draft MCP protocol\n(2026-07-28 / DRAFT-2026-v1) — and only that version. Other spec versions have their own checkers.
\n\n
How it works
\n
This URL is the MCP endpoint. There is no run to mint and no results to\npoll: every request is judged on its own content. If your\nclient gets something wrong, the request itself fails with an explanation of\nwhat and why. If you can list the tools and call each one successfully, your\nclient is conformant for everything this server can observe.
\n
POST ${escapeHtml(base)} strict — stateless draft only\nPOST ${escapeHtml(base)}/lenient advisory — classic clients complete, gaps reported
\n\n
What is checked
\n
\n
Every POST: Accept / Content-Type, MCP-Protocol-Version header,\n_meta declarations (io.modelcontextprotocol/protocolVersion, clientInfo,\nclientCapabilities — SEP-2575), and Mcp-Method/Mcp-Name routing headers (SEP-2243).
\n
validate_arguments: argument construction against the inputSchema —\nstring, JSON number (not stringified), and a same-document $ref (SEP-2106).
\n
mrtr_confirm: the multi-round-trip flow (SEP-2322) — answer the\nelicitation request and retry with requestState echoed unchanged. Listed only when\nyour _meta clientCapabilities declare {\"elicitation\": {}}; otherwise an\nelicitation_missing placeholder explains the gap.
\n
draft_readiness (lenient/consented): itemized report of what the request\nthat carried it is missing relative to the draft.
\n
\n\n
Old clients
\n
Leading with initialize is invalid in the stateless draft, so the strict\nendpoint gates it behind an OAuth consent screen: your client's auth flow lands a human on a\npage explaining the situation, with a continue button. Continuing mints the bearer token\n${CONSENT_TOKEN} — the token is the message — and the classic flow is then served\nwith advisory feedback. No other request requires auth. Prefer zero friction? Use\n${escapeHtml(base)}/lenient.
\n\n
Try it
\n
curl -X POST ${escapeHtml(base)} \\\\\n -H 'content-type: application/json' \\\\\n -H 'accept: application/json, text/event-stream' \\\\\n -H 'mcp-protocol-version: 2026-07-28' \\\\\n -H 'mcp-method: tools/list' \\\\\n -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{\"_meta\":{\n \"io.modelcontextprotocol/protocolVersion\":\"2026-07-28\",\n \"io.modelcontextprotocol/clientInfo\":{\"name\":\"my-client\",\"version\":\"1.0\"},\n \"io.modelcontextprotocol/clientCapabilities\":{}}}}'
\n`);\n });\n\n return app;\n }\n\n /**\n * Draft-2026 dispatch: no lifecycle, plain JSON responses, every request\n * self-contained. Transport/draft obligations were already enforced.\n */\n private handleDraft(\n req: Request,\n res: Response,\n body: { method?: string; id?: unknown; params?: Record },\n lenient = false\n ): void {\n const reply = (result: object) => {\n // 2026-07-28 makes resultType REQUIRED on every Result; default it here so\n // every path is covered, and let callers override (e.g. 'input_required').\n res.json({\n jsonrpc: '2.0',\n id: body.id ?? null,\n result: { resultType: 'complete', ...result }\n });\n };\n\n switch (body.method) {\n case 'server/discover':\n reply({\n ttlMs: 0,\n cacheScope: 'public',\n supportedVersions: DRAFT_VERSION_ALIASES,\n capabilities: { tools: {} },\n serverInfo: SERVER_INFO,\n instructions:\n 'Call every tool once with valid arguments. Each tool validates ' +\n 'the request that carried it; any error explains what your ' +\n 'client got wrong.'\n });\n return;\n\n case 'tools/list': {\n const meta = (body.params?._meta ?? {}) as Record;\n const tools = GAUNTLET_TOOLS.map(\n ({ name, description, inputSchema }) => ({\n name,\n description,\n inputSchema\n })\n );\n // MRTR is only part of the contract for clients that can answer\n // elicitation requests — gate the listing on the declared capability\n // each request carries. Clients without it get a placeholder that\n // makes the gap (and how to close it) discoverable.\n tools.push(\n declaresElicitation(meta) ? MRTR_TOOL : ELICITATION_MISSING_TOOL\n );\n if (lenient) tools.push(DRAFT_READINESS_TOOL);\n reply({ ttlMs: 0, cacheScope: 'public', tools });\n return;\n }\n\n case 'tools/call': {\n const params = (body.params ?? {}) as {\n name?: string;\n arguments?: Record;\n inputResponses?: Record;\n requestState?: string;\n _meta?: Record;\n };\n\n if (params.name === DRAFT_READINESS_TOOL.name && lenient) {\n reply({\n content: [{ type: 'text', text: readinessReport(req, body) }]\n });\n return;\n }\n\n if (params.name === MRTR_TOOL.name) {\n reply(this.runMrtr(params, lenient));\n return;\n }\n\n if (params.name === ELICITATION_MISSING_TOOL.name) {\n const declared = declaresElicitation(\n (params._meta ?? {}) as Record\n );\n this.checks.push({\n id: 'gauntlet-elicitation-missing',\n name: 'Gauntlet: elicitation capability not declared',\n description:\n 'Client called the elicitation_missing placeholder tool',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_TOOLS],\n details: { declared }\n });\n reply({\n content: [\n {\n type: 'text',\n text: declared\n ? 'CONFORMANCE NOTE [elicitation_missing]: this request DOES declare the elicitation capability — list tools again and you will see mrtr_confirm instead of this placeholder.'\n : 'CONFORMANCE NOTE [elicitation_missing]: your client has not declared the elicitation capability, so the MRTR (SEP-2322) tool mrtr_confirm is hidden. This is conformant — elicitation is optional — but to exercise the full gauntlet, implement elicitation and declare it in _meta ' +\n `${META_NS}clientCapabilities as {\"elicitation\": {}}; the full tool list will then appear.`\n }\n ]\n });\n return;\n }\n\n // MRTR plumbing must not leak onto unrelated calls (SEP-2322).\n if (\n params.inputResponses !== undefined ||\n params.requestState !== undefined\n ) {\n const detail =\n 'inputResponses/requestState MUST only be sent when retrying the ' +\n 'tool that returned input_required; they leaked onto ' +\n `'${params.name ?? '(none)'}'`;\n check(\n this.checks,\n 'gauntlet-mrtr-leak',\n 'Gauntlet: MRTR state leak',\n false,\n 'MRTR retry fields leaked onto an unrelated tool call',\n { detail }\n );\n reply({\n content: [\n {\n type: 'text',\n text: `CONFORMANCE FAIL [${params.name}]: ${detail}`\n }\n ],\n isError: true\n });\n return;\n }\n\n reply(\n runTool(this.checks, params.name ?? '', params.arguments ?? {}, req)\n );\n return;\n }\n\n case 'initialize':\n case 'ping':\n case 'logging/setLevel':\n // Removed from the stateless draft protocol entirely.\n res.status(404).json({\n jsonrpc: '2.0',\n id: body.id ?? null,\n error: {\n code: -32601,\n message: `Method not found: '${body.method}' does not exist in the stateless draft protocol (use server/discover, not initialize)`\n }\n });\n return;\n\n default:\n res.status(404).json({\n jsonrpc: '2.0',\n id: body.id ?? null,\n error: {\n code: -32601,\n message: `Method not found: '${body.method ?? '(none)'}'. Supported: server/discover, tools/list, tools/call`\n }\n });\n }\n }\n\n /**\n * Two-phase MRTR tool. First call → input_required with a self-contained\n * requestState. Retry → validate the echoed state and the elicitation\n * response shape, then complete.\n */\n private runMrtr(\n params: {\n inputResponses?: Record;\n requestState?: string;\n },\n lenient = false\n ): object {\n if (params.inputResponses === undefined) {\n // Round 1: ask for confirmation via elicitation.\n return {\n resultType: 'input_required',\n inputRequests: {\n confirm: {\n method: 'elicitation/create',\n params: {\n message: 'Confirm the MRTR round-trip by answering this.',\n requestedSchema: {\n type: 'object',\n properties: { confirmed: { type: 'boolean' } },\n required: ['confirmed']\n }\n }\n }\n },\n requestState: encodeMrtrState()\n };\n }\n\n // Round 2: judge the retry on its own content.\n const problems: string[] = [];\n if (params.requestState === undefined) {\n problems.push(\n 'requestState MUST be echoed back unchanged on the retry (SEP-2322)'\n );\n } else if (!decodeMrtrState(params.requestState)) {\n problems.push(\n `requestState was altered — it MUST be echoed back byte-exact; got '${params.requestState.slice(0, 60)}'`\n );\n }\n const confirm = params.inputResponses.confirm as\n | { action?: unknown; content?: { confirmed?: unknown } }\n | undefined;\n if (!confirm || typeof confirm !== 'object') {\n problems.push(\n \"inputResponses MUST be keyed by the inputRequests key ('confirm')\"\n );\n } else {\n if (\n confirm.action !== 'accept' &&\n confirm.action !== 'decline' &&\n confirm.action !== 'cancel'\n ) {\n problems.push(\n `elicitation response action MUST be accept/decline/cancel; got ${JSON.stringify(confirm.action)}`\n );\n }\n if (\n confirm.action === 'accept' &&\n typeof confirm.content?.confirmed !== 'boolean'\n ) {\n problems.push(\n `accepted elicitation content MUST match requestedSchema ({confirmed: boolean}); got ${JSON.stringify(confirm.content)}`\n );\n }\n }\n\n const ok = problems.length === 0;\n const detail = ok\n ? `requestState echoed intact; elicitation response valid (action=${String((params.inputResponses.confirm as { action?: unknown })?.action)})`\n : problems.join('; ');\n check(\n this.checks,\n 'gauntlet-mrtr_confirm',\n 'Gauntlet: mrtr_confirm',\n ok,\n ok\n ? 'Client completed the MRTR round-trip conformantly'\n : 'Client MRTR retry was not conformant',\n { detail },\n lenient ? 'WARNING' : 'FAILURE'\n );\n if (!ok) {\n return {\n content: [\n { type: 'text', text: `CONFORMANCE FAIL [mrtr_confirm]: ${detail}` }\n ],\n isError: true\n };\n }\n return {\n content: [\n { type: 'text', text: `CONFORMANCE OK [mrtr_confirm]: ${detail}` }\n ]\n };\n }\n\n getChecks(): ConformanceCheck[] {\n return this.checks;\n }\n}\n",[],[142,474,796,798],"b15ed4db-86ad-4fdb-bd6f-66694f1f89ed","sse-retry.ts","dd596744-ad13-11f1-9d57-1607ee4eb77e",108,["D",1789046875960],"import type { ScenarioContext } from '../../mock-server/index.ts';\n/**\n * SSE Retry conformance test scenarios for MCP clients (SEP-1699)\n *\n * Tests that clients properly respect the SSE retry field by:\n * - Waiting the specified milliseconds before reconnecting\n * - Sending Last-Event-ID header on reconnection\n * - Treating graceful stream closure as reconnectable\n */\n\nimport http from 'node:http';\nimport {\n Scenario,\n ScenarioUrls,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION,\n RequestListener\n} from '../../types.ts';\n\nexport class SSERetryScenario implements Scenario {\n name = 'sse-retry';\n readonly source = {\n introducedIn: '2025-11-25',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description =\n 'Tests that client respects SSE retry field timing and reconnects properly (SEP-1699)';\n\n private server: http.Server | null = null;\n private checks: ConformanceCheck[] = [];\n private port: number = 0;\n\n // Timing tracking\n private toolStreamCloseTime: number | null = null;\n private getReconnectionTime: number | null = null;\n private getConnectionCount: number = 0;\n private lastEventIds: (string | undefined)[] = [];\n private retryValue: number = 500; // 500ms\n private eventIdCounter: number = 0;\n private sessionId: string = `session-${Date.now()}`;\n\n // Pending tool call to respond to after reconnection\n private pendingToolCallId: number | string | null = null;\n private getResponseStream: http.ServerResponse | null = null;\n\n // Tolerance for timing validation (early side only; lateness is not gated)\n private readonly EARLY_TOLERANCE = 50; // Allow 50ms early for scheduler variance\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n this.toolStreamCloseTime = null;\n this.getReconnectionTime = null;\n this.getConnectionCount = 0;\n this.lastEventIds = [];\n this.eventIdCounter = 0;\n this.sessionId = `session-${Date.now()}`;\n this.pendingToolCallId = null;\n this.getResponseStream = null;\n return (req, res) => this.handleRequest(req, res);\n }\n\n async start(_ctx?: ScenarioContext): Promise {\n const listener = this.handler(() => `http://localhost:${this.port}`);\n return new Promise((resolve, reject) => {\n this.server = http.createServer(listener);\n this.server.on('error', reject);\n this.server.listen(0, () => {\n const address = this.server!.address();\n if (address && typeof address === 'object') {\n this.port = address.port;\n resolve({\n serverUrl: `http://localhost:${this.port}`\n });\n } else {\n reject(new Error('Failed to get server address'));\n }\n });\n });\n }\n\n async stop(): Promise {\n return new Promise((resolve, reject) => {\n if (this.server) {\n this.server.close((err) => {\n if (err) {\n reject(err);\n } else {\n this.server = null;\n resolve();\n }\n });\n } else {\n resolve();\n }\n });\n }\n\n getChecks(): ConformanceCheck[] {\n // Generate checks based on observed behavior\n this.generateChecks();\n return this.checks;\n }\n\n private handleRequest(\n req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n if (req.method === 'GET') {\n // Track GET reconnection timing and Last-Event-ID\n this.getConnectionCount++;\n this.getReconnectionTime = performance.now();\n\n const lastEventId = req.headers['last-event-id'] as string | undefined;\n const description = lastEventId\n ? `Received GET request for ${req.url} (Last-Event-ID: ${lastEventId})`\n : `Received GET request for ${req.url}`;\n this.checks.push({\n id: 'incoming-request',\n name: 'IncomingRequest',\n description,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n method: 'GET',\n url: req.url,\n headers: req.headers,\n connectionCount: this.getConnectionCount\n }\n });\n\n if (lastEventId) {\n this.lastEventIds.push(lastEventId);\n }\n\n // Handle GET SSE stream request (reconnection)\n this.handleGetSSEStream(req, res);\n } else if (req.method === 'POST') {\n // Handle POST JSON-RPC requests\n this.handlePostRequest(req, res);\n } else {\n res.writeHead(405);\n res.end('Method Not Allowed');\n }\n }\n\n private handleGetSSEStream(\n _req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n // Set SSE headers\n res.writeHead(200, {\n 'Content-Type': 'text/event-stream',\n 'Cache-Control': 'no-cache',\n Connection: 'keep-alive',\n 'mcp-session-id': this.sessionId\n });\n\n // Generate event ID\n this.eventIdCounter++;\n const eventId = `event-${this.eventIdCounter}`;\n\n // Send priming event with ID and retry field\n const primingContent = `id: ${eventId}\\nretry: ${this.retryValue}\\ndata: \\n\\n`;\n res.write(primingContent);\n\n this.checks.push({\n id: 'outgoing-sse-event',\n name: 'OutgoingSseEvent',\n description: `Sent SSE priming event on GET stream (id: ${eventId}, retry: ${this.retryValue}ms)`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId,\n retryMs: this.retryValue,\n eventType: 'priming',\n raw: primingContent\n }\n });\n\n // Store the GET stream to send pending tool response\n this.getResponseStream = res;\n\n // If we have a pending tool call, send the response now\n if (this.pendingToolCallId !== null) {\n const toolResponse = {\n jsonrpc: '2.0',\n id: this.pendingToolCallId,\n result: {\n content: [\n {\n type: 'text',\n text: 'Reconnection test completed successfully'\n }\n ]\n }\n };\n\n const responseEventId = `event-${++this.eventIdCounter}`;\n const responseContent = `event: message\\nid: ${responseEventId}\\ndata: ${JSON.stringify(toolResponse)}\\n\\n`;\n res.write(responseContent);\n\n this.checks.push({\n id: 'outgoing-sse-event',\n name: 'OutgoingSseEvent',\n description: `Sent tool response on GET stream after reconnection (id: ${responseEventId})`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId: responseEventId,\n eventType: 'message',\n jsonrpcId: this.pendingToolCallId,\n body: toolResponse,\n raw: responseContent\n }\n });\n\n this.pendingToolCallId = null;\n }\n }\n\n private handlePostRequest(\n req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n let body = '';\n\n req.on('data', (chunk) => {\n body += chunk.toString();\n });\n\n req.on('end', () => {\n try {\n const request = JSON.parse(body);\n\n this.checks.push({\n id: 'incoming-request',\n name: 'IncomingRequest',\n description: `Received POST request for ${req.url} (method: ${request.method})`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n method: 'POST',\n url: req.url,\n jsonrpcMethod: request.method,\n jsonrpcId: request.id\n }\n });\n\n if (request.method === 'initialize') {\n this.handleInitialize(req, res, request);\n } else if (request.method === 'tools/list') {\n this.handleToolsList(res, request);\n } else if (request.method === 'tools/call') {\n this.handleToolsCall(res, request);\n } else if (request.id === undefined) {\n // Notifications (no id) - return 202 Accepted\n res.writeHead(202);\n res.end();\n } else {\n // For other requests, send a simple JSON response\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {}\n })\n );\n }\n } catch (error) {\n res.writeHead(400, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n error: {\n code: -32700,\n message: `Parse error: ${error}`\n }\n })\n );\n }\n });\n }\n\n private handleInitialize(\n _req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n const response = {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n // The retry MUST under test was introduced in 2025-11-25 (SEP-1699)\n protocolVersion: '2025-11-25',\n serverInfo: {\n name: 'sse-retry-test-server',\n version: '1.0.0'\n },\n capabilities: {\n tools: {}\n }\n }\n };\n\n res.end(JSON.stringify(response));\n\n this.checks.push({\n id: 'outgoing-response',\n name: 'OutgoingResponse',\n description: `Sent initialize response`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n jsonrpcId: request.id,\n body: response\n }\n });\n }\n\n private handleToolsList(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n const response = {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n tools: [\n {\n name: 'test_reconnection',\n description:\n 'A tool that triggers SSE stream closure to test client reconnection behavior',\n inputSchema: {\n type: 'object',\n properties: {},\n required: []\n }\n }\n ]\n }\n };\n\n res.end(JSON.stringify(response));\n\n this.checks.push({\n id: 'outgoing-response',\n name: 'OutgoingResponse',\n description: `Sent tools/list response`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n jsonrpcId: request.id,\n body: response\n }\n });\n }\n\n private handleToolsCall(res: http.ServerResponse, request: any): void {\n // Store the request ID so we can respond after reconnection\n this.pendingToolCallId = request.id;\n\n // Start SSE stream\n res.writeHead(200, {\n 'Content-Type': 'text/event-stream',\n 'Cache-Control': 'no-cache',\n Connection: 'keep-alive',\n 'mcp-session-id': this.sessionId\n });\n\n // Send priming event with retry field\n this.eventIdCounter++;\n const primingEventId = `event-${this.eventIdCounter}`;\n const primingContent = `id: ${primingEventId}\\nretry: ${this.retryValue}\\ndata: \\n\\n`;\n res.write(primingContent);\n\n this.checks.push({\n id: 'outgoing-sse-event',\n name: 'OutgoingSseEvent',\n description: `Sent SSE priming event for tools/call (id: ${primingEventId}, retry: ${this.retryValue}ms)`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId: primingEventId,\n retryMs: this.retryValue,\n eventType: 'priming',\n raw: primingContent\n }\n });\n\n // Close the stream after a short delay to trigger reconnection\n setTimeout(() => {\n this.toolStreamCloseTime = performance.now();\n this.checks.push({\n id: 'outgoing-stream-close',\n name: 'OutgoingStreamClose',\n description:\n 'Closed tools/call SSE stream to trigger client reconnection',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n retryMs: this.retryValue,\n pendingToolCallId: this.pendingToolCallId\n }\n });\n res.end();\n }, 50);\n }\n\n private generateChecks(): void {\n // Check 1: Client should have reconnected via GET after tool call stream close\n if (this.getConnectionCount < 1) {\n this.checks.push({\n id: 'client-sse-graceful-reconnect',\n name: 'ClientGracefulReconnect',\n description:\n 'Client reconnects via GET after SSE stream is closed gracefully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Client did not attempt GET reconnection after stream closure. Client should treat graceful stream close as reconnectable.`,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n getConnectionCount: this.getConnectionCount,\n toolStreamCloseTime: this.toolStreamCloseTime,\n retryValue: this.retryValue\n }\n });\n return;\n }\n\n // Client did reconnect - SUCCESS for graceful reconnection\n this.checks.push({\n id: 'client-sse-graceful-reconnect',\n name: 'ClientGracefulReconnect',\n description:\n 'Client reconnects via GET after SSE stream is closed gracefully',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n getConnectionCount: this.getConnectionCount\n }\n });\n\n // Check 2: Client MUST respect retry field timing\n if (\n this.toolStreamCloseTime !== null &&\n this.getReconnectionTime !== null\n ) {\n const actualDelay = this.getReconnectionTime - this.toolStreamCloseTime;\n const minExpected = this.retryValue - this.EARLY_TOLERANCE;\n\n // The retry MUST is a lower bound (\"waiting the given number of\n // milliseconds before attempting to reconnect\"), so only an early\n // reconnect fails; lateness is environment latency and is not gated.\n const tooEarly = actualDelay < minExpected;\n\n this.checks.push({\n id: 'client-sse-retry-timing',\n name: 'ClientRespectsRetryField',\n description:\n 'Client MUST respect the retry field, waiting the given number of milliseconds before attempting to reconnect',\n status: tooEarly ? 'FAILURE' : 'SUCCESS',\n timestamp: new Date().toISOString(),\n errorMessage: tooEarly\n ? `Client reconnected too early (${actualDelay.toFixed(0)}ms instead of ${this.retryValue}ms). Client MUST respect the retry field and wait the specified time.`\n : undefined,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n expectedRetryMs: this.retryValue,\n actualDelayMs: Math.round(actualDelay),\n minAcceptableMs: minExpected,\n earlyToleranceMs: this.EARLY_TOLERANCE,\n getConnectionCount: this.getConnectionCount\n }\n });\n } else {\n this.checks.push({\n id: 'client-sse-retry-timing',\n name: 'ClientRespectsRetryField',\n description: 'Client MUST respect the retry field timing',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Could not measure timing - tool stream close time or GET reconnection time not recorded',\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n toolStreamCloseTime: this.toolStreamCloseTime,\n getReconnectionTime: this.getReconnectionTime\n }\n });\n }\n\n // Check 3: Client SHOULD send Last-Event-ID header on reconnection\n const hasLastEventId =\n this.lastEventIds.length > 0 && this.lastEventIds[0] !== undefined;\n\n this.checks.push({\n id: 'client-sse-last-event-id',\n name: 'ClientSendsLastEventId',\n description:\n 'Client SHOULD send Last-Event-ID header on reconnection for resumability',\n status: hasLastEventId ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n hasLastEventId,\n lastEventIds: this.lastEventIds,\n getConnectionCount: this.getConnectionCount\n },\n errorMessage: !hasLastEventId\n ? 'Client did not send Last-Event-ID header on reconnection. This is a SHOULD requirement for resumability.'\n : undefined\n });\n }\n}\n",[],[142,474,796,806],"6dcb033f-c4c4-4a07-9a4b-abff8744facc","request-metadata.ts","dd02e8ec-ad13-11f1-bed6-1607ee4eb77e",224,["D",1789332101310],"import { withRequiredDraftResultFields } from '../../mock-server/index.ts';\nimport http from 'node:http';\nimport {\n HandlerScenario,\n RequestListener,\n ConformanceCheck,\n CheckStatus,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\n\n/**\n * Severity ranking used to latch per-id check results: a single\n * non-conformant request is a violation even if later requests are\n * conformant, so a later better status must never overwrite a worse one.\n */\nconst STATUS_SEVERITY: Record = {\n FAILURE: 3,\n WARNING: 2,\n SUCCESS: 1,\n INFO: 1,\n SKIPPED: 0\n};\n\n/**\n * Every check ID this scenario can emit. Declared-but-unemitted checks are\n * backfilled as FAILURE by getChecks(), so the emitted ID set is the same for\n * every client. The positive-path test asserts this list is exact.\n */\nexport const DECLARED_CHECK_IDS = [\n 'sep-2575-http-client-sends-version-header',\n 'sep-2575-client-populates-meta',\n 'sep-2575-client-sends-client-info',\n 'sep-2575-http-version-header-matches-meta',\n 'sep-2575-client-declares-roots-capability',\n 'sep-2575-client-declares-sampling-capability',\n 'sep-2575-client-declares-elicitation-capability',\n 'sep-2575-client-retry-supported-version'\n] as const;\n\n/**\n * Recorded the moment the simulated version rejection is issued, and only\n * then — so its presence in the log is the record that the rejection\n * happened. Deriving that from the log rather than from an instance flag is\n * what lets a run split across processes (the hosted server seeds a cold\n * process with the persisted log) reject the client's first request once,\n * not once per process.\n */\nconst RETRY_CHECK_ID = 'sep-2575-client-retry-supported-version';\n\nexport class RequestMetadataScenario extends HandlerScenario {\n name = 'request-metadata';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Per-request _meta and MCP-Protocol-Version header obligations (SEP-2575)';\n\n private checks: ConformanceCheck[] = [];\n private requestsObserved = 0;\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n this.requestsObserved = 0;\n return (req, res) => this.handleRequest(req, res);\n }\n\n /** Whether this run has already issued its one simulated rejection. */\n private hasSimulatedRejection(): boolean {\n return this.checks.some((c) => c.id === RETRY_CHECK_ID);\n }\n\n getChecks(): ConformanceCheck[] {\n this.collapseDuplicateIds();\n // Declared but never emitted -> FAILURE. A check that is legitimately not\n // applicable must be emitted as SKIPPED explicitly to avoid this.\n for (const id of DECLARED_CHECK_IDS) {\n if (!this.checks.some((c) => c.id === id)) {\n this.checks.push({\n id,\n name: 'NotObserved',\n description: `Declared check ${id} was never emitted`,\n status: 'FAILURE',\n errorMessage:\n this.requestsObserved === 0\n ? 'Check was not observed: the client never sent a request to the scenario server (no handler registered for this scenario?)'\n : 'Check was not observed: no request exercised it',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/index#meta'\n }\n ],\n details: { observed: false, requestsObserved: this.requestsObserved }\n });\n }\n }\n return this.checks;\n }\n\n /**\n * A log merged from several processes (see src/hosted/session.ts) can carry\n * one id more than once, one per process that observed it. Collapse each\n * id the way addOrUpdateCheck() would have as the requests arrived: the\n * worst status wins. The retry check is the exception — it is rewritten by\n * every retry the client makes, so its latest observation supersedes.\n */\n private collapseDuplicateIds(): void {\n if (new Set(this.checks.map((c) => c.id)).size === this.checks.length)\n return;\n const byId = new Map();\n for (const check of this.checks) {\n const kept = byId.get(check.id);\n if (\n !kept ||\n check.id === RETRY_CHECK_ID ||\n STATUS_SEVERITY[check.status] >= STATUS_SEVERITY[kept.status]\n ) {\n byId.set(check.id, check);\n }\n }\n this.checks = Array.from(byId.values());\n }\n\n private addOrUpdateCheck(check: ConformanceCheck): void {\n const index = this.checks.findIndex((c) => c.id === check.id);\n if (index === -1) {\n this.checks.push(check);\n return;\n }\n // Keep the worst status observed for this id (FAILURE > WARNING > SUCCESS\n // > SKIPPED): an equal-or-worse result replaces the stored check (so its\n // details stay fresh), but a better result must not erase a violation\n // recorded from an earlier request.\n const existing = this.checks[index];\n if (STATUS_SEVERITY[check.status] >= STATUS_SEVERITY[existing.status]) {\n this.checks[index] = check;\n }\n }\n\n private handleRequest(\n req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n // This scenario only evaluates the metadata attached to POST requests.\n // Clients may probe a Streamable HTTP endpoint with an empty-body GET\n // before sending MCP requests, so reject unsupported methods before\n // attempting to parse a JSON-RPC body.\n if (req.method !== 'POST') {\n res.writeHead(405, { Allow: 'POST' });\n res.end('Method Not Allowed');\n return;\n }\n\n let body = '';\n req.on('data', (chunk) => {\n body += chunk.toString();\n });\n req.on('end', () => {\n let request;\n try {\n request = JSON.parse(body);\n } catch (error) {\n res.writeHead(400, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: null,\n error: {\n code: -32700,\n message: `Parse error: ${String(error)}`\n }\n })\n );\n return;\n }\n\n // initialize is the dated revisions' handshake, not a 2026-07-28\n // request: it carries no per-request _meta to judge, and it is not the\n // client's first choice of version for the simulated rejection below.\n // Answered as a modern-only server should, naming its version\n // (2026-07-28 basic/versioning), and otherwise left out of the run.\n if (request?.method === 'initialize') {\n res.writeHead(400, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id ?? null,\n error: {\n code: -32022,\n message: 'Unsupported protocol version',\n data: {\n supported: [DRAFT_PROTOCOL_VERSION],\n requested: String(\n request.params?.protocolVersion ??\n req.headers['mcp-protocol-version'] ??\n ''\n )\n }\n }\n })\n );\n return;\n }\n\n this.requestsObserved++;\n\n // Extract version and headers\n const meta = request.params?._meta;\n const metaVersion = meta?.['io.modelcontextprotocol/protocolVersion'];\n const headerVersion = req.headers['mcp-protocol-version'];\n\n // 1. \"Every POST request to the MCP endpoint MUST include an\n // MCP-Protocol-Version header.\" — unconditional, so this fires for\n // server/discover too.\n this.addOrUpdateCheck({\n id: 'sep-2575-http-client-sends-version-header',\n name: 'ClientSendsVersionHeader',\n description: 'Client sends MCP-Protocol-Version header on every POST',\n status: headerVersion !== undefined ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#protocol-version-header'\n }\n ],\n details: { method: request.method, headerVersion }\n });\n\n // 2. \"Every client request MUST include the following\n // io.modelcontextprotocol/* fields in _meta: protocolVersion,\n // clientCapabilities.\" clientInfo is a SHOULD since spec PR #3002 and\n // is tracked by its own check below, so requirement levels never blend\n // in one check id.\n const hasClientInfo = meta?.['io.modelcontextprotocol/clientInfo'];\n const hasCapabilities =\n meta?.['io.modelcontextprotocol/clientCapabilities'];\n const metaIsValid = metaVersion && hasCapabilities;\n\n this.addOrUpdateCheck({\n id: 'sep-2575-client-populates-meta',\n name: 'ClientPopulatesMeta',\n description:\n 'Client populates _meta on every request with the required fields (protocolVersion, clientCapabilities)',\n status: metaIsValid ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/index#meta'\n }\n ],\n details: { method: request.method, meta }\n });\n\n // 2b. clientInfo SHOULD (spec PR #3002): absence is a WARNING, never a\n // FAILURE — a dedicated id so adoption is trackable on its own.\n this.addOrUpdateCheck({\n id: 'sep-2575-client-sends-client-info',\n name: 'ClientSendsClientInfo',\n description:\n \"Client SHOULD include io.modelcontextprotocol/clientInfo in every request's _meta (spec PR #3002)\",\n status: hasClientInfo ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/index#meta'\n }\n ],\n details: { method: request.method, meta }\n });\n\n // 3. \"The header value MUST match the io.modelcontextprotocol/protocolVersion\n // field carried in the request body's _meta.\" Only comparable when both\n // are present; absence is already covered by the two checks above, so\n // emit SKIPPED rather than falling through to the declared-check failure.\n const bothVersionsPresent =\n headerVersion !== undefined && metaVersion !== undefined;\n this.addOrUpdateCheck({\n id: 'sep-2575-http-version-header-matches-meta',\n name: 'ClientVersionHeaderMatchesMeta',\n description:\n 'MCP-Protocol-Version header matches _meta.protocolVersion',\n status: !bothVersionsPresent\n ? 'SKIPPED'\n : headerVersion === metaVersion\n ? 'SUCCESS'\n : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#protocol-version-header'\n }\n ],\n details: { headerVersion, metaVersion }\n });\n\n // 4. Optional client capabilities conditional verification\n const capabilities = meta?.['io.modelcontextprotocol/clientCapabilities'];\n const checkOptionalCapability = (\n capabilityName: string,\n checkId: string,\n checkName: string\n ) => {\n let status: 'SUCCESS' | 'FAILURE' | 'SKIPPED' = 'SKIPPED';\n if (capabilities && capabilityName in capabilities) {\n const val = capabilities[capabilityName];\n const isValidObject =\n typeof val === 'object' && val !== null && !Array.isArray(val);\n status = isValidObject ? 'SUCCESS' : 'FAILURE';\n }\n this.addOrUpdateCheck({\n id: checkId,\n name: checkName,\n description: `Client declares valid ${capabilityName} capability if present`,\n status,\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/index#capabilities'\n }\n ],\n details: { capabilityValue: capabilities?.[capabilityName] }\n });\n };\n\n checkOptionalCapability(\n 'roots',\n 'sep-2575-client-declares-roots-capability',\n 'ClientDeclaresRootsCapability'\n );\n checkOptionalCapability(\n 'sampling',\n 'sep-2575-client-declares-sampling-capability',\n 'ClientDeclaresSamplingCapability'\n );\n checkOptionalCapability(\n 'elicitation',\n 'sep-2575-client-declares-elicitation-capability',\n 'ClientDeclaresElicitationCapability'\n );\n\n // 5. Simulated Version Negotiation Retry Check — issued once per run;\n // the retry check recorded here is the record that it was (see\n // RETRY_CHECK_ID).\n if (!this.hasSimulatedRejection()) {\n this.addOrUpdateCheck({\n id: RETRY_CHECK_ID,\n name: 'ClientRetrySupportedVersion',\n description:\n 'Client retries with a supported version when first choice is rejected',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#protocol-version-header'\n }\n ],\n details: { headerVersion }\n });\n\n res.writeHead(400, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id ?? null,\n error: {\n // UnsupportedProtocolVersionError per the draft schema.\n code: -32022,\n message: 'Unsupported protocol version',\n data: {\n supported: [DRAFT_PROTOCOL_VERSION],\n requested: String(headerVersion ?? metaVersion ?? '')\n }\n }\n })\n );\n return;\n }\n\n const retryCheck = this.checks.find((c) => c.id === RETRY_CHECK_ID);\n if (retryCheck) {\n if (\n headerVersion === DRAFT_PROTOCOL_VERSION &&\n metaVersion === DRAFT_PROTOCOL_VERSION\n ) {\n retryCheck.status = 'SUCCESS';\n } else {\n retryCheck.status = 'WARNING';\n }\n // Re-stamped so that, in a log merged across processes, this\n // observation is the latest one for the id.\n retryCheck.timestamp = new Date().toISOString();\n retryCheck.details = {\n ...retryCheck.details,\n retryHeaderVersion: headerVersion,\n retryMetaVersion: metaVersion\n };\n }\n\n // server/discover is optional for clients (spec: \"Clients MAY call it\"),\n // so no check is emitted; we still respond so a client that does call it\n // proceeds normally and exercises the per-request _meta/header checks above.\n if (request.method === 'server/discover') {\n res.writeHead(200, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: withRequiredDraftResultFields(request.method, {\n supportedVersions: [DRAFT_PROTOCOL_VERSION],\n capabilities: {},\n serverInfo: { name: 'test', version: '1.0' }\n })\n })\n );\n return;\n }\n\n // Return generic response to unblock client\n let result: object = {};\n if (request.method === 'tools/list') {\n result = { tools: [] };\n } else if (request.method === 'tools/call') {\n result = { content: [] };\n }\n res.writeHead(200, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: withRequiredDraftResultFields(request.method, result)\n })\n );\n });\n }\n}\n",[],[142,474,796,814],"2b19b20b-9aa7-4f81-9fef-5d9b263fbf80","mrtr-client.ts","dca475e6-ad13-11f1-bafc-1607ee4eb77e",223,["D",1789332101084],"/**\n * SEP-2322: MRTR Client Conformance Tests\n *\n * Tests that clients correctly handle the MRTR (Multi-Round Tool Resolution) flow:\n * - Echo requestState back unchanged when retrying\n * - Don't include requestState when server didn't send one\n * - Use a different JSON-RPC id on retry\n *\n * The server exposes two tools. The client calls each tool, gets InputRequiredResult,\n * fulfills the elicitation, and retries. The server verifies correct client behavior.\n *\n * The first call and its retry may reach different processes of a\n * multi-process host that share no memory. The only state the retry needs,\n * the original request id and the exact requestState, travels inside the\n * requestState the server sends, with a digest so any process can rebuild\n * the expected string and compare it byte for byte.\n */\n\nimport type { ConformanceCheck, RequestListener } from '../../types.ts';\nimport { HandlerScenario, DRAFT_PROTOCOL_VERSION } from '../../types.ts';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { createHash, randomUUID } from 'node:crypto';\n\nconst MRTR_SPEC_REFERENCES = [\n {\n id: 'SEP-2322-MRTR',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/utilities/mrtr'\n }\n];\n\nconst TOOLS = [\n {\n name: 'test_mrtr_echo_state',\n description:\n 'Test tool: triggers MRTR flow with requestState. Client must echo state back unchanged.',\n inputSchema: {\n type: 'object' as const,\n properties: {},\n required: [] as string[]\n }\n },\n {\n name: 'test_mrtr_no_state',\n description:\n 'Test tool: triggers MRTR flow WITHOUT requestState. Client must NOT include requestState in retry.',\n inputSchema: {\n type: 'object' as const,\n properties: {},\n required: [] as string[]\n }\n },\n {\n name: 'test_mrtr_unrelated',\n description:\n 'Test tool: simple tool called between MRTR rounds. Must NOT carry inputResponses or requestState from another tool.',\n inputSchema: {\n type: 'object' as const,\n properties: {},\n required: [] as string[]\n }\n },\n {\n name: 'test_mrtr_no_result_type',\n description:\n 'Test tool: returns a result without resultType. Client must treat it as complete (default).',\n inputSchema: {\n type: 'object' as const,\n properties: {},\n required: [] as string[]\n }\n }\n];\n\nconst EXPECTED_CHECK_IDS = [\n 'sep-2322-client-request-state-echoed',\n 'sep-2322-client-jsonrpc-id-different',\n 'sep-2322-client-no-state-omitted',\n 'sep-2322-client-parallel-isolation',\n 'sep-2322-default-result-type-complete'\n];\n\n/**\n * INFO record of the first echo_state call, a fallback for its retry. Not\n * prefixed with the SEP: it is the server's bookkeeping, not a requirement.\n */\nconst ECHO_INITIAL_CHECK_ID = 'mrtr-echo-state-initial';\n\ninterface JsonRpcRequest {\n jsonrpc: '2.0';\n id: string | number;\n method: string;\n params?: Record;\n}\n\n/**\n * The requestState sent on the first echo_state call: the call's id and a\n * nonce, plus a digest over both, in a fixed key order. Rebuilding it from\n * the fields a client echoed reproduces the exact string only if the client\n * left it untouched: re-serialized JSON changes the bytes, and an edited id\n * or nonce changes the digest.\n */\nfunction echoState(originalId: string | number, nonce: string): string {\n const digest = createHash('sha256')\n .update(JSON.stringify({ nonce, originalId }))\n .digest('base64url')\n .slice(0, 22);\n return JSON.stringify({ nonce, originalId, digest });\n}\n\n/** The state this server would have sent for the fields in `state`, if any. */\nfunction rebuildEchoState(\n state: string\n): { originalId: string | number; expected: string } | undefined {\n try {\n const parsed = JSON.parse(state) as Record;\n const { nonce, originalId } = parsed;\n if (typeof nonce !== 'string') return undefined;\n if (typeof originalId !== 'string' && typeof originalId !== 'number')\n return undefined;\n return { originalId, expected: echoState(originalId, nonce) };\n } catch {\n return undefined;\n }\n}\n\nfunction createMRTRServer(checks: ConformanceCheck[]): express.Application {\n const app = express();\n app.use(express.json());\n\n app.post('/mcp', (req: Request, res: Response) => {\n const body = req.body as JsonRpcRequest;\n const { id, method, params } = body;\n\n switch (method) {\n case 'server/discover': {\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n resultType: 'complete',\n ttlMs: 0,\n cacheScope: 'private',\n supportedVersions: [DRAFT_PROTOCOL_VERSION],\n capabilities: { tools: {} },\n serverInfo: { name: 'mrtr-mock-server', version: '1.0.0' }\n }\n });\n return;\n }\n\n case 'initialize': {\n // The dated revisions' handshake. This server supports only\n // 2026-07-28, so it names that version in the error, as a\n // modern-only server should (2026-07-28 basic/versioning).\n res.status(400).json({\n jsonrpc: '2.0',\n id,\n error: {\n code: -32022,\n message: 'Unsupported protocol version',\n data: {\n supported: [DRAFT_PROTOCOL_VERSION],\n requested: String(\n (params as Record)?.protocolVersion ?? ''\n )\n }\n }\n });\n return;\n }\n\n case 'notifications/initialized': {\n res.status(204).end();\n return;\n }\n\n case 'tools/list': {\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n resultType: 'complete',\n ttlMs: 0,\n cacheScope: 'private',\n tools: TOOLS\n }\n });\n return;\n }\n\n case 'tools/call': {\n const toolName = (params as Record)?.name as string;\n const inputResponses = (params as Record)\n ?.inputResponses as Record | undefined;\n const requestState = (params as Record)\n ?.requestState as string | undefined;\n\n if (toolName === 'test_mrtr_echo_state') {\n handleEchoState(id, inputResponses, requestState, checks, res);\n return;\n }\n\n if (toolName === 'test_mrtr_no_state') {\n handleNoState(id, inputResponses, requestState, checks, res);\n return;\n }\n\n if (toolName === 'test_mrtr_unrelated') {\n handleUnrelated(inputResponses, requestState, checks, res, id);\n return;\n }\n\n if (toolName === 'test_mrtr_no_result_type') {\n handleNoResultType(id, inputResponses, checks, res);\n return;\n }\n\n res.json({\n jsonrpc: '2.0',\n id,\n error: { code: -32601, message: `Unknown tool: ${toolName}` }\n });\n return;\n }\n\n case 'elicitation/create': {\n // Client is fulfilling our ElicitRequest — accept it\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n resultType: 'complete',\n action: 'accept',\n content: { confirmed: true }\n }\n });\n return;\n }\n\n default: {\n res.json({\n jsonrpc: '2.0',\n id,\n error: { code: -32601, message: `Method not found: ${method}` }\n });\n return;\n }\n }\n });\n\n function handleEchoState(\n id: string | number,\n inputResponses: Record | undefined,\n requestState: string | undefined,\n checks: ConformanceCheck[],\n res: Response\n ) {\n if (!inputResponses) {\n // Initial call: return InputRequiredResult with a requestState that\n // carries this call's id, and note both in the log as a fallback.\n const state = echoState(id, randomUUID());\n checks.push({\n id: ECHO_INITIAL_CHECK_ID,\n name: 'MRTREchoStateInitialCall',\n description:\n 'The server answered the first test_mrtr_echo_state call with a requestState',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: MRTR_SPEC_REFERENCES,\n details: { originalId: id, requestStateSent: state }\n });\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n resultType: 'input_required',\n inputRequests: {\n confirm: {\n method: 'elicitation/create',\n params: {\n message: 'Please confirm to continue',\n requestedSchema: {\n type: 'object',\n properties: {\n confirmed: { type: 'boolean', description: 'Confirm?' }\n }\n }\n }\n }\n },\n requestState: state\n }\n });\n return;\n }\n\n // Retry: what was sent comes from the echoed state itself when it is\n // exactly what this server would have sent, or failing that from the log\n // of the first call (possibly another process's). A state that does not\n // rebuild byte for byte is never believed, so an edited originalId cannot\n // steer the id check.\n const rebuilt = requestState ? rebuildEchoState(requestState) : undefined;\n const intact =\n rebuilt && rebuilt.expected === requestState ? rebuilt : undefined;\n const initial = [...checks]\n .reverse()\n .find((c) => c.id === ECHO_INITIAL_CHECK_ID)?.details as\n | { originalId?: string | number; requestStateSent?: string }\n | undefined;\n const originalId = intact?.originalId ?? initial?.originalId;\n const sentState = intact?.expected ?? initial?.requestStateSent;\n\n // Check 1: requestState must be present and byte-for-byte identical to\n // what the server sent. The spec requires the client to echo back the\n // *exact value* without inspecting, parsing, or modifying it — so a\n // semantically-equal but re-serialized string is still a failure.\n const stateErrors: string[] = [];\n if (!requestState) {\n stateErrors.push('Client did not include requestState in retry');\n } else if (requestState !== sentState) {\n stateErrors.push(\n 'requestState was not echoed back exactly — clients MUST NOT inspect, parse, or modify it'\n );\n }\n\n checks.push({\n id: 'sep-2322-client-request-state-echoed',\n name: 'MRTRClientRequestStateEchoed',\n description:\n 'Client MUST echo back the exact value of requestState when retrying',\n status: stateErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: stateErrors.length > 0 ? stateErrors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: {\n requestStateSent: sentState,\n requestStateReceived: requestState,\n originalId\n }\n });\n\n // Check 2: JSON-RPC id must differ from original. When the original id\n // cannot be recovered (no intact state and no record of the first call)\n // there is nothing to compare, and check 1 has already failed the retry.\n const idErrors: string[] = [];\n if (originalId !== undefined && id === originalId) {\n idErrors.push(\n `JSON-RPC id is the same on retry (${id}) — MUST be different`\n );\n }\n\n checks.push({\n id: 'sep-2322-client-jsonrpc-id-different',\n name: 'MRTRClientJsonRpcIdDifferent',\n description:\n 'The JSON-RPC id MUST be different between the initial request and the retry',\n status: idErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: idErrors.length > 0 ? idErrors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: {\n originalId,\n retryId: id\n }\n });\n\n // Return complete result\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n resultType: 'complete',\n content: [{ type: 'text', text: 'echo-state-ok' }]\n }\n });\n }\n\n function handleNoState(\n id: string | number,\n inputResponses: Record | undefined,\n requestState: string | undefined,\n checks: ConformanceCheck[],\n res: Response\n ) {\n if (!inputResponses) {\n // Initial call — return InputRequiredResult WITHOUT requestState\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n resultType: 'input_required',\n inputRequests: {\n confirm: {\n method: 'elicitation/create',\n params: {\n message: 'Please confirm to continue (no state test)',\n requestedSchema: {\n type: 'object',\n properties: {\n confirmed: { type: 'boolean', description: 'Confirm?' }\n }\n }\n }\n }\n }\n // No requestState field!\n }\n });\n return;\n }\n\n // Retry — verify client did NOT include requestState\n const errors: string[] = [];\n if (requestState !== undefined) {\n errors.push(\n `Client included requestState (\"${requestState}\") but server did not send one — MUST NOT include it`\n );\n }\n\n checks.push({\n id: 'sep-2322-client-no-state-omitted',\n name: 'MRTRClientNoStateOmitted',\n description:\n 'If InputRequiredResult does not contain requestState, client MUST NOT include one in the retry',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: {\n requestStateReceived: requestState\n }\n });\n\n // Return complete result\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n resultType: 'complete',\n content: [{ type: 'text', text: 'no-state-ok' }]\n }\n });\n }\n\n function handleUnrelated(\n inputResponses: Record | undefined,\n requestState: string | undefined,\n checks: ConformanceCheck[],\n res: Response,\n id: string | number\n ) {\n // This tool should NEVER receive inputResponses or requestState —\n // those belong to a different tool's MRTR flow\n const errors: string[] = [];\n if (inputResponses !== undefined) {\n errors.push(\n `Unrelated tool call included inputResponses from another tool's MRTR flow`\n );\n }\n if (requestState !== undefined) {\n errors.push(\n `Unrelated tool call included requestState from another tool's MRTR flow`\n );\n }\n\n checks.push({\n id: 'sep-2322-client-parallel-isolation',\n name: 'MRTRClientParallelIsolation',\n description:\n 'inputRequests and requestState MUST NOT be used for any other request the client may be sending',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: {\n inputResponsesReceived: inputResponses,\n requestStateReceived: requestState\n }\n });\n\n // Return a normal complete result\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n resultType: 'complete',\n content: [{ type: 'text', text: 'unrelated-ok' }]\n }\n });\n }\n\n function handleNoResultType(\n id: string | number,\n inputResponses: Record | undefined,\n checks: ConformanceCheck[],\n res: Response\n ) {\n const checkId = 'sep-2322-default-result-type-complete';\n\n // If the client retries this tool, it did NOT treat the result as\n // complete. The SUCCESS noted for the first answer may sit in another\n // process's log, so it is not removed here: getChecks() lets the\n // FAILURE win.\n if (inputResponses) {\n checks.push({\n id: checkId,\n name: 'DefaultResultTypeComplete',\n description:\n 'Client MUST assume resultType \"complete\" when not specified',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Client retried with inputResponses even though the result had no resultType (should default to complete)',\n specReferences: MRTR_SPEC_REFERENCES\n });\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n resultType: 'complete',\n content: [{ type: 'text', text: 'unexpected-retry' }]\n }\n });\n return;\n }\n\n // Return a result WITHOUT resultType — client should treat as complete\n checks.push({\n id: checkId,\n name: 'DefaultResultTypeComplete',\n description:\n 'Client MUST assume resultType \"complete\" when not specified',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: MRTR_SPEC_REFERENCES\n });\n\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n // Deliberately NO resultType field\n content: [{ type: 'text', text: 'no-result-type-test-ok' }]\n }\n });\n }\n\n return app;\n}\n\nexport class MRTRClientScenario extends HandlerScenario {\n name = 'sep-2322-client-request-state';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests client MRTR behavior: requestState echo, no-state omission, and JSON-RPC id uniqueness (SEP-2322)';\n mcpPath = '/mcp';\n private checks: ConformanceCheck[] = [];\n\n /** What a client driven by hand (or by a generic steps interpreter) should do. */\n readonly steps = [\n { op: 'tools/list' },\n { op: 'tools/call', name: 'test_mrtr_echo_state' },\n { op: 'tools/call', name: 'test_mrtr_unrelated' },\n { op: 'tools/call', name: 'test_mrtr_no_state' },\n { op: 'tools/call', name: 'test_mrtr_no_result_type' }\n ] as const;\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n return createMRTRServer(this.checks);\n }\n\n /**\n * One row per check id, built fresh so the raw log stays as observed: a\n * FAILURE wins over any SUCCESS for the same id (a merged log from several\n * processes can hold both), otherwise the latest row. Expected checks that\n * never ran are reported as FAILURE.\n */\n getChecks(): ConformanceCheck[] {\n const byId = new Map();\n for (const check of this.checks) {\n const previous = byId.get(check.id);\n if (!previous || previous.status !== 'FAILURE') byId.set(check.id, check);\n }\n const result = [...byId.values()];\n for (const slug of EXPECTED_CHECK_IDS) {\n if (byId.has(slug)) continue;\n result.push({\n id: slug,\n name: slug,\n description: `MRTR client check: ${slug}`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n details: {\n message: 'Tool was not called by client or MRTR flow not completed'\n },\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n return result;\n }\n}\n",[],[142,474,796,822],"2ba50d99-bd5e-4237-a788-b66ff3930c8a","json-schema-ref-deref.ts","d5280f76-ad13-11f1-a016-1607ee4eb77e",220,["D",1789332092736],"import { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n ErrorCode,\n ListToolsRequestSchema,\n McpError,\n LATEST_PROTOCOL_VERSION as SDK_LATEST_PROTOCOL_VERSION\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport type { ConformanceCheck, RequestListener } from '../../types.ts';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { HandlerScenario, DRAFT_PROTOCOL_VERSION } from '../../types.ts';\n\n/**\n * Scenario: JSON Schema network $ref dereferencing (SEP-2106)\n *\n * SEP-2106 permits the full JSON Schema 2020-12 vocabulary in tool schemas,\n * including `$ref`. A `$ref` that resolves to a network URI is an SSRF /\n * fetch-DoS vector: a malicious tool definition could point at internal\n * infrastructure and have the *client* fetch it during schema processing.\n *\n * Per SEP-2106, implementations MUST NOT automatically dereference `$ref`\n * values that resolve to a network URI (anything that is not a same-document\n * JSON Pointer such as `#/$defs/Foo` or an internal `$anchor`).\n *\n * This scenario advertises a tool whose inputSchema contains both a\n * same-document `$ref` and a `$ref` to a canary URL hosted by the scenario\n * itself. If the client fetches the canary URL at any point before the\n * scenario stops, the check fails.\n */\n\nconst TOOL_NAME = 'lookup_user';\nconst CANARY_PATH = '/canary/profile-schema.json';\nconst TOOLS_LISTED_EVENT = '_state/tools-listed';\nconst CANARY_EVENT = '_state/canary-fetched';\nconst CHECK_ID = 'sep-2106-no-network-ref-deref';\n\nconst SPEC_REFERENCES = [\n {\n id: 'SEP-2106',\n url: 'https://modelcontextprotocol.io/seps/2106-json-schema-2020-12#security-implications'\n }\n];\n\nfunction createMcpServer(canaryUrl: string, onToolsListed: () => void): Server {\n const server = new Server(\n { name: 'json-schema-ref-deref-server', version: '1.0.0' },\n { capabilities: { tools: {} } }\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => {\n onToolsListed();\n return {\n resultType: 'complete',\n ttlMs: 0,\n cacheScope: 'private',\n tools: [\n {\n name: TOOL_NAME,\n description: 'Look up a user profile by id',\n inputSchema: {\n $schema: 'https://json-schema.org/draft/2020-12/schema',\n type: 'object',\n $defs: {\n userId: { type: 'string', pattern: '^[a-z0-9-]+$' }\n },\n properties: {\n // Same-document $ref: safe, expected to be resolvable locally.\n id: { $ref: '#/$defs/userId' },\n // Network $ref: the canary. Implementations MUST NOT fetch this\n // automatically while processing the schema.\n profile: { $ref: canaryUrl }\n },\n required: ['id']\n }\n }\n ]\n };\n });\n\n // A client that lists the tool may well call it (a person driving a chat\n // app will). Answer from nothing, never fetching the canary: the check is\n // only about whether the client fetches it.\n server.setRequestHandler(CallToolRequestSchema, async (request) => {\n if (request.params.name !== TOOL_NAME) {\n throw new McpError(\n ErrorCode.InvalidParams,\n `Unknown tool: ${request.params.name}`\n );\n }\n const id = request.params.arguments?.id;\n return {\n resultType: 'complete',\n content: [\n {\n type: 'text',\n text: `No profile on file for user ${typeof id === 'string' ? id : '(no id given)'}.`\n }\n ]\n };\n });\n\n return server;\n}\n\nexport class JsonSchemaRefDerefScenario extends HandlerScenario {\n name = 'json-schema-ref-no-deref';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Tests that a client does not automatically dereference a network-URI \\`$ref\\` in a tool's inputSchema (SEP-2106).\n\nThe scenario advertises a tool whose inputSchema contains a \\`$ref\\` pointing at a canary URL. The client should list tools (and may otherwise process the schema), but must not fetch the canary URL. Same-document refs (\\`#/$defs/...\\`) remain safe to resolve.`;\n mcpPath = '/mcp';\n /** List only — the point is what the client does NOT fetch afterwards. */\n readonly steps = [{ op: 'tools/list' }] as const;\n\n /**\n * Raw event log. What the scenario observed is kept as INFO events here\n * (rather than in private fields) so a host that spreads one run over\n * several processes can merge the logs and judge once — see rawChecks().\n */\n checks: ConformanceCheck[] = [];\n\n private record(id: string, details?: Record): void {\n this.checks.push({\n id,\n name: id,\n description: id,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details\n });\n }\n\n rawChecks(): ConformanceCheck[] {\n return this.checks;\n }\n\n handler(getBaseUrl: () => string): RequestListener {\n this.checks = [];\n\n const app = express();\n app.use(express.json());\n\n // Canary endpoint: any request here means the client dereferenced the\n // network $ref. Return a valid schema so a dereferencing client gets a\n // realistic response rather than an error it might silently swallow.\n app.all(CANARY_PATH, (req: Request, res: Response) => {\n this.record(CANARY_EVENT, {\n method: req.method,\n userAgent: req.headers['user-agent']\n });\n res.json({\n $schema: 'https://json-schema.org/draft/2020-12/schema',\n type: 'object',\n properties: { displayName: { type: 'string' } }\n });\n });\n\n app.post('/mcp', async (req: Request, res: Response) => {\n // The bundled SDK server below predates the 2026-07-28 lifecycle and\n // does not implement server/discover; answer it directly so a client\n // that negotiates first can proceed to tools/list.\n if (\n (req.body as Record | undefined)?.method ===\n 'server/discover'\n ) {\n return res.json({\n jsonrpc: '2.0',\n id: (req.body as Record).id ?? null,\n result: {\n resultType: 'complete',\n ttlMs: 0,\n cacheScope: 'private',\n supportedVersions: [DRAFT_PROTOCOL_VERSION],\n capabilities: { tools: {} },\n serverInfo: {\n name: 'json-schema-ref-deref-server',\n version: '1.0.0'\n }\n }\n });\n }\n // Second half of the same workaround: the pinned SDK transport\n // whitelists MCP-Protocol-Version headers and would reject the draft\n // version that the server/discover response above advertises with an\n // HTTP 400. Rewrite it to the newest version the SDK understands so a\n // client that honors the negotiated version can reach tools/list.\n if (req.headers['mcp-protocol-version'] === DRAFT_PROTOCOL_VERSION) {\n req.headers['mcp-protocol-version'] = SDK_LATEST_PROTOCOL_VERSION;\n // The SDK's Node adapter rebuilds its web-standard Request from\n // rawHeaders, not the parsed headers object, so patch those too.\n for (let i = 0; i < req.rawHeaders.length; i += 2) {\n if (req.rawHeaders[i].toLowerCase() === 'mcp-protocol-version') {\n req.rawHeaders[i + 1] = SDK_LATEST_PROTOCOL_VERSION;\n }\n }\n }\n try {\n // Stateless: fresh server and transport per request\n const canaryUrl = `${getBaseUrl()}${CANARY_PATH}`;\n const server = createMcpServer(canaryUrl, () => {\n this.record(TOOLS_LISTED_EVENT);\n });\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n await transport.handleRequest(req, res, req.body);\n } catch (error) {\n if (!res.headersSent) {\n res.status(500).json({\n jsonrpc: '2.0',\n error: {\n code: -32603,\n message: `Internal error: ${error instanceof Error ? error.message : String(error)}`\n },\n id: null\n });\n }\n }\n });\n\n return app;\n }\n\n getChecks(): ConformanceCheck[] {\n // Built fresh on every call so getChecks() is idempotent — the runner may\n // call it more than once and we must not accumulate duplicates.\n const timestamp = new Date().toISOString();\n const canaryRequests = this.checks\n .filter((c) => c.id === CANARY_EVENT)\n .map((c) => c.details ?? {});\n const toolsListed = this.checks.some((c) => c.id === TOOLS_LISTED_EVENT);\n const fetched = canaryRequests.length > 0;\n\n if (!toolsListed) {\n return [\n {\n id: CHECK_ID,\n name: 'NoNetworkRefDereference',\n description:\n 'Client never requested tools/list, so $ref handling could not be evaluated',\n status: 'FAILURE',\n timestamp,\n errorMessage:\n 'Client did not call tools/list against a server advertising a tool with a network $ref',\n specReferences: SPEC_REFERENCES,\n details: { toolsListed: false }\n }\n ];\n }\n\n return [\n {\n id: CHECK_ID,\n name: 'NoNetworkRefDereference',\n description: fetched\n ? 'Client automatically dereferenced a network-URI $ref in a tool inputSchema. Implementations MUST NOT automatically dereference $ref values that resolve to a network URI (SEP-2106).'\n : 'Client did not dereference the network-URI $ref in the tool inputSchema',\n status: fetched ? 'FAILURE' : 'SUCCESS',\n timestamp,\n errorMessage: fetched\n ? `Canary URL ${CANARY_PATH} was fetched ${canaryRequests.length} time(s)`\n : undefined,\n specReferences: SPEC_REFERENCES,\n details: {\n toolsListed: true,\n canaryRequestCount: canaryRequests.length,\n canaryRequests\n }\n }\n ];\n }\n}\n",[],[142,474,796,830],"875f7149-d436-4668-9290-8cc750a546eb","json-schema-2020-12-preservation.ts","5f9e7346-ad1b-11f1-90b8-1607ee4eb77e",72,["D",1789046850491],"/**\n * Client-side JSON Schema 2020-12 keyword preservation (SEP-1613, SEP-2106)\n *\n * Validates that a client receiving a tool definition via `tools/list`\n * preserves the full JSON Schema 2020-12 vocabulary in its internal\n * representation, rather than silently stripping `$schema`, `$defs`,\n * `additionalProperties`, `$anchor`, composition (`allOf`/`anyOf`), or\n * conditional (`if`/`then`/`else`) keywords during parsing.\n *\n * This is the client-side counterpart of the server-side\n * `json-schema-2020-12` scenario.\n * This scenario exercises:\n *\n * 1. The mock server advertises a focal tool (`json_schema_2020_12_tool`)\n * whose inputSchema contains the full SEP-1613/SEP-2106 vocabulary, plus\n * a permissive echo tool (`json_schema_echo`).\n * 2. The client under test calls `tools/list`, observes the focal tool's\n * inputSchema, then round-trips it back via `tools/call json_schema_echo`\n * with `{ schema: }`.\n * 3. The scenario diffs the echoed schema against the original fixture and\n * flags any missing or altered keywords.\n *\n * SEP-2106 vocabulary checks are soft-gated via `sep2106KeywordCheckStatus`:\n * stripping is FAILURE only when the run targets the draft version\n * (`2026-07-28`); on earlier dated versions the check reports SKIPPED.\n */\n\nimport type { ScenarioContext, MockServer } from '../../mock-server/index.ts';\nimport type {\n CallToolRequest,\n ListToolsResult\n} from '../../spec-types/2025-11-25.ts';\nimport {\n DRAFT_PROTOCOL_VERSION,\n LATEST_SPEC_VERSION,\n type ConformanceCheck,\n type Scenario,\n type ScenarioUrls,\n type SpecVersion\n} from '../../types.ts';\nimport {\n EXPECTED_SCHEMA_DIALECT,\n EXPECTED_TOOL_NAME,\n JSON_SCHEMA_2020_12_FIXTURE,\n sep2106KeywordCheckStatus\n} from '../server/json-schema-2020-12.ts';\n\nconst ECHO_TOOL_NAME = 'json_schema_echo';\n\nconst SEP_1613_REF = {\n id: 'SEP-1613',\n url: 'https://github.com/modelcontextprotocol/specification/pull/655'\n};\nconst SEP_2106_REF = {\n id: 'SEP-2106',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2106'\n};\n\nexport class JsonSchema2020_12PreservationScenario implements Scenario {\n name = 'json-schema-2020-12-preservation';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description = `Validates client-side preservation of JSON Schema 2020-12 keywords (SEP-1613, SEP-2106).\n\n**Client Implementation Requirements:**\n\n1. Call \\`tools/list\\`. The mock server advertises two tools: \\`${EXPECTED_TOOL_NAME}\\` (focal, carries the rich inputSchema) and \\`${ECHO_TOOL_NAME}\\` (permissive echo).\n2. Round-trip the focal tool's \\`inputSchema\\` back via \\`tools/call\\` on \\`${ECHO_TOOL_NAME}\\`, passing it verbatim as the \\`schema\\` argument:\n\n\\`\\`\\`json\n{\n \"name\": \"${ECHO_TOOL_NAME}\",\n \"arguments\": {\n \"schema\": \"\"\n }\n}\n\\`\\`\\`\n\nThe scenario compares the echoed schema against the original fixture and flags any keyword that was stripped or altered during the client's internal parsing.\n\n**Verification**: \\`$schema\\`, \\`$defs\\`, and \\`additionalProperties\\` must be preserved (SEP-1613). The SEP-2106 vocabulary (\\`$anchor\\` inside \\`$defs\\`, composition \\`allOf\\`/\\`anyOf\\`, conditional \\`if\\`/\\`then\\`/\\`else\\`) must also survive; for dated protocol versions these checks are SKIPPED rather than FAILURE since SEP-2106 applies from the draft version.`;\n\n private srv: MockServer | null = null;\n private specVersion: SpecVersion | null = null;\n private observedSchema: Record | null = null;\n private toolsListed = false;\n\n async start(ctx: ScenarioContext): Promise {\n this.specVersion = ctx.specVersion;\n this.observedSchema = null;\n this.toolsListed = false;\n\n this.srv = await ctx.createServer({\n 'tools/list': (): ListToolsResult => {\n this.toolsListed = true;\n return {\n tools: [\n {\n name: EXPECTED_TOOL_NAME,\n description: 'Tool with JSON Schema 2020-12 features',\n inputSchema: JSON_SCHEMA_2020_12_FIXTURE\n },\n {\n name: ECHO_TOOL_NAME,\n description:\n 'Echoes back an arbitrary JSON Schema object so the harness can observe what the client preserved.',\n inputSchema: {\n type: 'object',\n properties: {\n schema: {\n type: 'object',\n description: `The inputSchema the client observed for ${EXPECTED_TOOL_NAME}, passed back verbatim.`\n }\n },\n required: ['schema']\n }\n }\n ]\n };\n },\n 'tools/call': (params) => {\n const p = params as unknown as CallToolRequest['params'];\n if (p.name === ECHO_TOOL_NAME) {\n const args = p.arguments as { schema?: unknown } | undefined;\n if (args && typeof args.schema === 'object' && args.schema !== null) {\n this.observedSchema = args.schema as Record;\n }\n return { content: [{ type: 'text', text: 'echoed' }] };\n }\n if (p.name === EXPECTED_TOOL_NAME) {\n return { content: [{ type: 'text', text: 'ok' }] };\n }\n throw new Error(`Unknown tool: ${p.name}`);\n }\n });\n return { serverUrl: this.srv.url };\n }\n\n async stop(): Promise {\n await this.srv?.close();\n this.srv = null;\n }\n\n getChecks(): ConformanceCheck[] {\n // Built fresh on every call so getChecks() is idempotent — the runner may\n // call it more than once and we must not accumulate duplicates.\n const timestamp = new Date().toISOString();\n const targetVersion = this.specVersion ?? LATEST_SPEC_VERSION;\n const echo = this.observedSchema;\n\n const checks: ConformanceCheck[] = [];\n\n checks.push({\n id: 'json-schema-2020-12-client-tool-found',\n name: 'JsonSchema2020_12ClientToolFound',\n description: `Client called tools/list and the mock server advertised '${EXPECTED_TOOL_NAME}'`,\n status: this.toolsListed ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SEP_1613_REF],\n errorMessage: this.toolsListed\n ? undefined\n : 'Client never called tools/list; the scenario cannot observe schema preservation',\n details: { toolsListCalled: this.toolsListed }\n });\n\n checks.push({\n id: 'json-schema-2020-12-client-echo-completed',\n name: 'JsonSchema2020_12ClientEchoCompleted',\n description: `Client called tools/call '${ECHO_TOOL_NAME}' with a 'schema' object argument`,\n status: echo !== null ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SEP_1613_REF],\n errorMessage:\n echo !== null\n ? undefined\n : 'Client did not echo back the inputSchema; downstream preservation checks are SKIPPED',\n details: { echoCompleted: echo !== null }\n });\n\n // If the client never echoed, the downstream preservation checks cannot\n // be evaluated. Emit SKIPPED for each so the SEP traceability manifest\n // still records all known check IDs from this scenario.\n if (echo === null) {\n const skipReason =\n 'Skipped because the client did not complete the schema echo';\n checks.push(\n {\n id: 'json-schema-2020-12-client-$schema-preserved',\n name: 'JsonSchema2020_12Client$SchemaPreserved',\n description:\n 'Client preserved the $schema field of the focal tool inputSchema',\n status: 'SKIPPED',\n timestamp,\n specReferences: [SEP_1613_REF],\n errorMessage: skipReason\n },\n {\n id: 'json-schema-2020-12-client-$defs-preserved',\n name: 'JsonSchema2020_12Client$DefsPreserved',\n description:\n 'Client preserved the $defs field of the focal tool inputSchema',\n status: 'SKIPPED',\n timestamp,\n specReferences: [SEP_1613_REF],\n errorMessage: skipReason\n },\n {\n id: 'json-schema-2020-12-client-additionalProperties-preserved',\n name: 'JsonSchema2020_12ClientAdditionalPropertiesPreserved',\n description:\n 'Client preserved the additionalProperties field of the focal tool inputSchema',\n status: 'SKIPPED',\n timestamp,\n specReferences: [SEP_1613_REF],\n errorMessage: skipReason\n },\n {\n id: 'sep-2106-client-composition-keywords-preserved',\n name: 'JsonSchema2020_12ClientCompositionKeywordsPreserved',\n description:\n 'Client preserved composition keywords (allOf/anyOf) on the focal tool inputSchema',\n status: 'SKIPPED',\n timestamp,\n specReferences: [SEP_2106_REF],\n errorMessage: skipReason\n },\n {\n id: 'sep-2106-client-conditional-keywords-preserved',\n name: 'JsonSchema2020_12ClientConditionalKeywordsPreserved',\n description:\n 'Client preserved conditional keywords (if/then/else) on the focal tool inputSchema',\n status: 'SKIPPED',\n timestamp,\n specReferences: [SEP_2106_REF],\n errorMessage: skipReason\n },\n {\n id: 'sep-2106-client-anchor-keyword-preserved',\n name: 'JsonSchema2020_12ClientAnchorKeywordPreserved',\n description:\n 'Client preserved the $anchor keyword inside $defs.address',\n status: 'SKIPPED',\n timestamp,\n specReferences: [SEP_2106_REF],\n errorMessage: skipReason\n }\n );\n return checks;\n }\n\n // SEP-1613: $schema preserved\n const hasSchema = '$schema' in echo;\n const schemaCorrect = echo['$schema'] === EXPECTED_SCHEMA_DIALECT;\n checks.push({\n id: 'json-schema-2020-12-client-$schema-preserved',\n name: 'JsonSchema2020_12Client$SchemaPreserved',\n description: `Client preserved $schema = '${EXPECTED_SCHEMA_DIALECT}'`,\n status: hasSchema && schemaCorrect ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SEP_1613_REF],\n errorMessage: !hasSchema\n ? '$schema missing from echoed inputSchema — client likely stripped it during parsing'\n : !schemaCorrect\n ? `$schema has unexpected value: ${JSON.stringify(echo['$schema'])}`\n : undefined,\n details: { hasSchema, schemaValue: echo['$schema'] }\n });\n\n // SEP-1613: $defs preserved\n const defs = echo['$defs'] as Record | undefined;\n const hasDefs = '$defs' in echo;\n const defsHasAddress = hasDefs && defs !== undefined && 'address' in defs;\n checks.push({\n id: 'json-schema-2020-12-client-$defs-preserved',\n name: 'JsonSchema2020_12Client$DefsPreserved',\n description:\n 'Client preserved $defs with the expected nested definitions',\n status: hasDefs && defsHasAddress ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SEP_1613_REF],\n errorMessage: !hasDefs\n ? '$defs missing from echoed inputSchema — client likely stripped it during parsing'\n : !defsHasAddress\n ? '$defs exists but missing expected \"address\" definition'\n : undefined,\n details: {\n hasDefs,\n defsKeys: defs !== undefined ? Object.keys(defs) : []\n }\n });\n\n // SEP-1613: additionalProperties preserved\n const hasAdditionalProps = 'additionalProperties' in echo;\n const additionalPropsCorrect = echo['additionalProperties'] === false;\n checks.push({\n id: 'json-schema-2020-12-client-additionalProperties-preserved',\n name: 'JsonSchema2020_12ClientAdditionalPropertiesPreserved',\n description:\n 'Client preserved additionalProperties = false on the focal inputSchema',\n status:\n hasAdditionalProps && additionalPropsCorrect ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SEP_1613_REF],\n errorMessage: !hasAdditionalProps\n ? 'additionalProperties missing from echoed inputSchema — client likely stripped it during parsing'\n : !additionalPropsCorrect\n ? `additionalProperties has unexpected value: ${JSON.stringify(echo['additionalProperties'])}`\n : undefined,\n details: { hasAdditionalProps, value: echo['additionalProperties'] }\n });\n\n // SEP-2106 vocabulary — soft-gated via sep2106KeywordCheckStatus.\n const skippedSuffix = ` (run targets protocol version ${targetVersion}; SEP-2106 applies from ${DRAFT_PROTOCOL_VERSION})`;\n\n // SEP-2106: composition (allOf/anyOf) preserved\n const allOf = echo['allOf'];\n const hasAllOf = Array.isArray(allOf) && allOf.length > 0;\n const hasNestedAnyOf =\n Array.isArray(allOf) &&\n allOf.some(\n (sub) =>\n typeof sub === 'object' &&\n sub !== null &&\n Array.isArray((sub as Record)['anyOf'])\n );\n const compositionPreserved = hasAllOf && hasNestedAnyOf;\n const compositionStatus = sep2106KeywordCheckStatus(\n compositionPreserved,\n targetVersion\n );\n checks.push({\n id: 'sep-2106-client-composition-keywords-preserved',\n name: 'JsonSchema2020_12ClientCompositionKeywordsPreserved',\n description:\n 'Client preserved composition keywords (allOf/anyOf) on the focal inputSchema',\n status: compositionStatus,\n timestamp,\n specReferences: [SEP_2106_REF],\n errorMessage: compositionPreserved\n ? undefined\n : (!hasAllOf\n ? 'allOf missing from echoed inputSchema — composition keyword was likely stripped'\n : 'nested anyOf missing from echoed allOf — composition keyword was likely stripped') +\n (compositionStatus === 'SKIPPED' ? skippedSuffix : ''),\n details: {\n hasAllOf,\n hasNestedAnyOf,\n targetProtocolVersion: targetVersion\n }\n });\n\n // SEP-2106: conditional (if/then/else) preserved\n const hasIf = 'if' in echo;\n const hasThen = 'then' in echo;\n const hasElse = 'else' in echo;\n const conditionalPreserved = hasIf && hasThen && hasElse;\n const conditionalStatus = sep2106KeywordCheckStatus(\n conditionalPreserved,\n targetVersion\n );\n checks.push({\n id: 'sep-2106-client-conditional-keywords-preserved',\n name: 'JsonSchema2020_12ClientConditionalKeywordsPreserved',\n description:\n 'Client preserved conditional keywords (if/then/else) on the focal inputSchema',\n status: conditionalStatus,\n timestamp,\n specReferences: [SEP_2106_REF],\n errorMessage: conditionalPreserved\n ? undefined\n : `Conditional keywords missing (if=${hasIf}, then=${hasThen}, else=${hasElse}) — likely stripped` +\n (conditionalStatus === 'SKIPPED' ? skippedSuffix : ''),\n details: {\n hasIf,\n hasThen,\n hasElse,\n targetProtocolVersion: targetVersion\n }\n });\n\n // SEP-2106: $anchor inside $defs.address preserved\n const address = defs?.['address'] as Record | undefined;\n const hasAnchor = !!address && '$anchor' in address;\n const anchorStatus = sep2106KeywordCheckStatus(hasAnchor, targetVersion);\n checks.push({\n id: 'sep-2106-client-anchor-keyword-preserved',\n name: 'JsonSchema2020_12ClientAnchorKeywordPreserved',\n description: 'Client preserved $anchor inside $defs.address',\n status: anchorStatus,\n timestamp,\n specReferences: [SEP_2106_REF],\n errorMessage: hasAnchor\n ? undefined\n : '$anchor missing from echoed $defs.address — reference keyword was likely stripped' +\n (anchorStatus === 'SKIPPED' ? skippedSuffix : ''),\n details: {\n hasAnchor,\n anchorValue: address?.['$anchor']\n }\n });\n\n return checks;\n }\n}\n",[],[142,474,796,838],"f45d0e19-831c-45eb-8b39-0f8293020420","initialize.ts","ded3ce70-ad13-11f1-bf23-1607ee4eb77e",203,["D",1789192936965],"import http from 'node:http';\nimport {\n HandlerScenario,\n RequestListener,\n ConformanceCheck,\n LATEST_SPEC_VERSION,\n NEGOTIABLE_PROTOCOL_VERSIONS,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport { clientChecks } from '../../checks/index.ts';\n\nexport class InitializeScenario extends HandlerScenario {\n name = 'initialize';\n readonly source = {\n introducedIn: '2025-06-18',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description = 'Tests MCP client initialization handshake';\n\n private checks: ConformanceCheck[] = [];\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n return (req, res) => this.handleRequest(req, res);\n }\n\n /** Plumbing only: connect (implicit) and make one ordinary request. */\n readonly steps = [{ op: 'tools/list' }] as const;\n\n getChecks(): ConformanceCheck[] {\n return this.checks;\n }\n\n private handleRequest(\n req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n let body = '';\n\n req.on('data', (chunk) => {\n body += chunk.toString();\n });\n\n req.on('end', () => {\n try {\n const request = JSON.parse(body);\n\n if (request.method === 'initialize') {\n this.handleInitialize(request, res);\n } else if (request.method === 'tools/list') {\n this.handleToolsList(request, res);\n } else if (request.method === 'notifications/initialized') {\n // Per MCP spec 2025-11-25 section 2.1 (Sending Messages to the Server),\n // point 4: \"If the input is a JSON-RPC response or notification ...\n // the server MUST return HTTP status code 202 Accepted with no body.\"\n res.writeHead(202);\n res.end();\n } else if (request.method === 'ping' || request.id === undefined) {\n // Empty result for ping; notifications and responses get none.\n res.writeHead(200, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {}\n })\n );\n } else {\n // A method this dated server does not have — notably the\n // 2026-07-28 `server/discover` probe of a dual-era client, which\n // must be turned away so the client falls back to `initialize`\n // rather than read an empty result as a discovery.\n res.writeHead(404, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n error: {\n code: -32601,\n message: `Method not found: ${request.method}`\n }\n })\n );\n }\n } catch (error) {\n res.writeHead(400, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n error: {\n code: -32700,\n message: `Parse error ${error}`\n }\n })\n );\n }\n });\n }\n\n private handleInitialize(request: any, res: http.ServerResponse): void {\n const initializeRequest = request.params;\n\n const check =\n clientChecks.createClientInitializationCheck(initializeRequest);\n this.checks.push(check);\n\n const serverInfo = {\n name: 'test-server',\n version: '1.0.0'\n };\n\n this.checks.push(clientChecks.createServerInfoCheck(serverInfo));\n\n // Echo back client's version if valid, otherwise use latest\n const clientVersion = initializeRequest?.protocolVersion;\n const responseVersion = NEGOTIABLE_PROTOCOL_VERSIONS.includes(clientVersion)\n ? clientVersion\n : LATEST_SPEC_VERSION;\n\n const response = {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n protocolVersion: responseVersion,\n serverInfo,\n capabilities: {}\n }\n };\n\n res.writeHead(200, { 'Content-Type': 'application/json' });\n res.end(JSON.stringify(response));\n }\n\n private handleToolsList(request: any, res: http.ServerResponse): void {\n const response = {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n tools: []\n }\n };\n\n res.writeHead(200, { 'Content-Type': 'application/json' });\n res.end(JSON.stringify(response));\n }\n}\n",[],[142,474,796,846],"da460767-d092-4980-931d-d7d85271348e","d60e02ce-ad13-11f1-8e58-1607ee4eb77e",222,["D",1789332093366],"/**\n * HTTP Standard Headers conformance test scenario for MCP clients (SEP-2243)\n *\n * Tests that clients include the required standard MCP request headers on\n * Streamable HTTP POST requests:\n * - `Mcp-Method`: mirrors the `method` field from the JSON-RPC request body\n * - `Mcp-Name`: mirrors `params.name` or `params.uri` for tools/call,\n * resources/read, and prompts/get requests\n *\n * This is a Scenario (acts as a test server that inspects incoming requests\n * from the client under test).\n */\n\nimport http from 'node:http';\nimport { ConformanceCheck } from '../../types.ts';\nimport { BaseHttpScenario } from './http-base.ts';\n\nconst SPEC_REFERENCE = {\n id: 'SEP-2243-Standard-Headers',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#standard-mcp-request-headers'\n};\n\nexport class HttpStandardHeadersScenario extends BaseHttpScenario {\n name = 'http-standard-headers';\n description =\n 'Tests that client includes Mcp-Method and Mcp-Name headers on HTTP POST requests (SEP-2243)';\n\n /**\n * Which methods have a recorded check is read off `this.checks` itself\n * (one row per check name), never off instance state: the hosted server\n * judges a merged log in a fresh instance, and a method only an instance\n * field remembered would read as never sent — SUCCESS and SKIPPED for\n * the same method.\n */\n private recorded(name: string): boolean {\n return this.checks.some((c) => c.name === name);\n }\n\n private static methodCheckName(method: string): string {\n return `ClientMcpMethodHeader_${method.replace(/\\//g, '_')}`;\n }\n\n private static nameCheckName(method: string): string {\n return `ClientMcpNameHeader_${method.replace(/\\//g, '_')}`;\n }\n\n getChecks(): ConformanceCheck[] {\n // Build a fresh array each call so getChecks() is idempotent — the runner\n // may call it more than once and we must not accumulate duplicates. One\n // row per check name, the first recorded (a merged log can hold the same\n // method from several processes); `this.checks` is left as the raw log.\n const seen = new Set();\n const result = this.checks.filter((c) => {\n if (seen.has(c.name)) return false;\n seen.add(c.name);\n return true;\n });\n\n // SEP-2243 requires Mcp-Method on \"all requests and notifications\". A\n // client that never sent prompts/list isn't violating SEP-2243 — it just\n // didn't exercise that path. Emit SKIPPED (not FAILURE) so a prompts-less\n // client doesn't show red, but the gap is still visible in the report.\n // The initialize handshake is not part of 2026-07-28 (changelog: \"remove\n // the initialize/notifications/initialized handshake\"), so it is neither\n // expected nor judged here; see LEGACY_HANDSHAKE.\n const expectedMethods = [\n 'tools/list',\n 'tools/call',\n 'resources/list',\n 'resources/read',\n 'prompts/list',\n 'prompts/get'\n ];\n\n for (const method of expectedMethods) {\n if (!seen.has(HttpStandardHeadersScenario.methodCheckName(method))) {\n result.push({\n id: 'sep-2243-client-includes-standard-headers',\n name: HttpStandardHeadersScenario.methodCheckName(method),\n description: `Client sends correct Mcp-Method header on ${method} request`,\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n errorMessage: `Client did not send a ${method} request; Mcp-Method header was not exercised for this method.`,\n specReferences: [SPEC_REFERENCE]\n });\n }\n }\n\n const expectedNameMethods = ['tools/call', 'resources/read', 'prompts/get'];\n for (const method of expectedNameMethods) {\n if (!seen.has(HttpStandardHeadersScenario.nameCheckName(method))) {\n result.push({\n id: 'sep-2243-client-includes-standard-headers',\n name: HttpStandardHeadersScenario.nameCheckName(method),\n description: `Client sends correct Mcp-Name header on ${method} request`,\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n errorMessage: `Client did not send a ${method} request; Mcp-Name header was not exercised for this method.`,\n specReferences: [SPEC_REFERENCE]\n });\n }\n }\n\n return result;\n }\n\n protected handlePost(\n req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n // Check Mcp-Method header for every request\n this.checkMcpMethodHeader(req, request);\n\n // Route to handlers (initialize never gets here: the base class answers\n // it with the versions this 2026-07-28-only server supports)\n if (request.method === 'tools/list') {\n this.handleToolsList(res, request);\n } else if (request.method === 'tools/call') {\n this.checkMcpNameHeader(req, request, 'params.name');\n this.handleToolsCall(res, request);\n } else if (request.method === 'resources/list') {\n this.handleResourcesList(res, request);\n } else if (request.method === 'resources/read') {\n this.checkMcpNameHeader(req, request, 'params.uri');\n this.handleResourcesRead(res, request);\n } else if (request.method === 'prompts/list') {\n this.handlePromptsList(res, request);\n } else if (request.method === 'prompts/get') {\n this.checkMcpNameHeader(req, request, 'params.name');\n this.handlePromptsGet(res, request);\n } else if (request.id === undefined) {\n // Notifications - return 202 (Mcp-Method already checked above)\n this.sendNotificationAck(res);\n } else {\n this.sendGenericResult(res, request);\n }\n }\n\n /**\n * The legacy handshake. It is not part of 2026-07-28, and a dual-era client\n * may open with it to learn the server's era (basic/versioning, \"Backward\n * Compatibility with Initialization-Based Versions\"), so the 2026-07-28\n * Mcp-Method header is not expected on it.\n */\n private static readonly LEGACY_HANDSHAKE = new Set([\n 'initialize',\n 'notifications/initialized'\n ]);\n\n private checkMcpMethodHeader(req: http.IncomingMessage, request: any): void {\n const method = request.method;\n if (!method) return;\n if (HttpStandardHeadersScenario.LEGACY_HANDSHAKE.has(method)) return;\n\n // Already recorded a check for this method\n const name = HttpStandardHeadersScenario.methodCheckName(method);\n if (this.recorded(name)) return;\n\n // Header names are lowercased by Node.js http parser\n const mcpMethodHeader = req.headers['mcp-method'] as string | undefined;\n\n const errors: string[] = [];\n if (!mcpMethodHeader) {\n errors.push(\n `Missing Mcp-Method header on ${method} request. Clients MUST include the Mcp-Method header on all POST requests.`\n );\n } else if (mcpMethodHeader !== method) {\n // Header values are case-sensitive\n errors.push(\n `Mcp-Method header value '${mcpMethodHeader}' does not match body method '${method}'. Header values are case-sensitive.`\n );\n }\n\n this.checks.push({\n id: 'sep-2243-client-includes-standard-headers',\n name,\n description: `Client sends correct Mcp-Method header on ${method} request`,\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [SPEC_REFERENCE],\n details: {\n expectedMethod: method,\n actualHeader: mcpMethodHeader\n }\n });\n }\n\n private checkMcpNameHeader(\n req: http.IncomingMessage,\n request: any,\n sourceField: string\n ): void {\n const method = request.method;\n\n // Same de-dup guard as checkMcpMethodHeader: the harness advertises two\n // tools and two resources, so a client that calls both would otherwise\n // produce duplicate check rows for the same id.\n const name = HttpStandardHeadersScenario.nameCheckName(method);\n if (this.recorded(name)) return;\n\n const expectedValue =\n sourceField === 'params.uri' ? request.params?.uri : request.params?.name;\n\n const mcpNameHeader = req.headers['mcp-name'] as string | undefined;\n\n const errors: string[] = [];\n if (!mcpNameHeader) {\n errors.push(\n `Missing Mcp-Name header on ${method} request. Clients MUST include the Mcp-Name header for ${method} requests.`\n );\n } else if (mcpNameHeader !== expectedValue) {\n errors.push(\n `Mcp-Name header value '${mcpNameHeader}' does not match body ${sourceField} '${expectedValue}'.`\n );\n }\n\n this.checks.push({\n id: 'sep-2243-client-includes-standard-headers',\n name,\n description: `Client sends correct Mcp-Name header on ${method} request`,\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [SPEC_REFERENCE],\n details: {\n method,\n sourceField,\n expectedValue,\n actualHeader: mcpNameHeader\n }\n });\n }\n\n protected discoverCapabilities(): object {\n return { tools: {}, resources: {}, prompts: {} };\n }\n\n private handleToolsList(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n resultType: 'complete',\n ttlMs: 0,\n cacheScope: 'private',\n tools: [\n {\n name: 'test_headers',\n description:\n 'A simple tool used to test that HTTP headers are sent correctly',\n inputSchema: {\n type: 'object',\n properties: {},\n required: []\n }\n },\n {\n name: 'my-hyphenated-tool',\n description:\n 'Tool with hyphen in name to test special chars in Mcp-Name header',\n inputSchema: {\n type: 'object',\n properties: {},\n required: []\n }\n }\n ]\n }\n })\n );\n }\n\n private handleToolsCall(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n resultType: 'complete',\n content: [\n {\n type: 'text',\n text: 'Headers test completed'\n }\n ]\n }\n })\n );\n }\n\n private handleResourcesList(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n resultType: 'complete',\n ttlMs: 0,\n cacheScope: 'private',\n resources: [\n {\n uri: 'file:///path/to/file%20name.txt',\n name: 'File with spaces',\n description: 'Resource URI with percent-encoded spaces'\n },\n {\n uri: 'https://example.com/resource?id=123',\n name: 'Resource with query string',\n description: 'Resource URI with query string'\n }\n ]\n }\n })\n );\n }\n\n private handleResourcesRead(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n resultType: 'complete',\n ttlMs: 0,\n cacheScope: 'private',\n contents: []\n }\n })\n );\n }\n\n private handlePromptsList(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n resultType: 'complete',\n ttlMs: 0,\n cacheScope: 'private',\n prompts: [\n {\n name: 'test_prompt',\n description: 'A simple prompt for header testing'\n }\n ]\n }\n })\n );\n }\n\n private handlePromptsGet(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n resultType: 'complete',\n messages: []\n }\n })\n );\n }\n}\n",[],[142,474,796,597],"5b373486-1e92-4a0c-8a7a-c9ad20dfb1f0","http-custom-headers.ts","d5a72d4c-ad13-11f1-a612-1607ee4eb77e",221,["D",1789332092998],"import type { ScenarioContext } from '../../mock-server/index.ts';\nimport type { Step } from '../../steps/index.ts';\n/**\n * HTTP Custom Headers conformance test scenario for MCP clients (SEP-2243)\n *\n * Tests that clients correctly handle the `x-mcp-header` extension property:\n * 1. Mirror annotated tool parameter values into `Mcp-Param-{Name}` headers\n * 2. Apply correct value encoding (plain ASCII, Base64 for non-ASCII)\n * 3. Reject tool definitions with invalid `x-mcp-header` annotations\n *\n * This is a Scenario (acts as a test server that inspects incoming requests\n * from the client under test).\n */\n\nimport http from 'node:http';\nimport { ScenarioUrls, ConformanceCheck } from '../../types.ts';\nimport { BaseHttpScenario } from './http-base.ts';\n\nconst SPEC_REFERENCE_CUSTOM = {\n id: 'SEP-2243-Custom-Headers',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#custom-headers-from-tool-parameters'\n};\n\nconst SPEC_REFERENCE_ENCODING = {\n id: 'SEP-2243-Value-Encoding',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#value-encoding'\n};\n\nconst SPEC_REFERENCE_TOOL_DEF = {\n id: 'SEP-2243-x-mcp-header',\n url: 'https://modelcontextprotocol.io/specification/draft/server/tools#x-mcp-header'\n};\n\n/**\n * Every requirement-level check ID HttpCustomHeadersScenario can emit\n * (SEP-2243). Declared-but-unemitted checks are backfilled as FAILURE by\n * getChecks() — same pattern as request-metadata.ts — so the emitted ID set\n * is stable for traceability even when the client never exercises the\n * feature.\n */\nexport const CUSTOM_HEADERS_DECLARED_CHECK_IDS = [\n 'sep-2243-client-supports-custom-headers',\n 'sep-2243-client-mirrors-designated-params',\n 'sep-2243-client-encode-values',\n 'sep-2243-client-base64-unsafe',\n 'sep-2243-client-omit-null'\n] as const;\n\n/**\n * Every requirement-level check ID HttpInvalidToolHeadersScenario can emit\n * (SEP-2243).\n */\nexport const INVALID_TOOL_DECLARED_CHECK_IDS = [\n 'sep-2243-client-reject-invalid-tool',\n 'sep-2243-x-mcp-header-not-empty',\n 'sep-2243-x-mcp-header-charset',\n 'sep-2243-x-mcp-header-unique',\n 'sep-2243-x-mcp-header-primitive-only'\n] as const;\n\n/**\n * Invalid tool definitions served by HttpInvalidToolHeadersScenario, keyed by\n * tool name, mapped to the SEP-2243 x-mcp-header constraint each one\n * violates. The check for \"client did not call this tool\" is emitted under\n * the constraint's requirement ID so each constraint traces to a check.\n */\nconst INVALID_TOOL_CONSTRAINT_IDS: Record = {\n invalid_empty_header: 'sep-2243-x-mcp-header-not-empty',\n invalid_object_header: 'sep-2243-x-mcp-header-primitive-only',\n invalid_array_header: 'sep-2243-x-mcp-header-primitive-only',\n invalid_null_header: 'sep-2243-x-mcp-header-primitive-only',\n invalid_number_header: 'sep-2243-x-mcp-header-primitive-only',\n invalid_duplicate_same_case: 'sep-2243-x-mcp-header-unique',\n invalid_duplicate_diff_case: 'sep-2243-x-mcp-header-unique',\n invalid_space_in_name: 'sep-2243-x-mcp-header-charset',\n invalid_colon_in_name: 'sep-2243-x-mcp-header-charset',\n invalid_non_ascii_name: 'sep-2243-x-mcp-header-charset',\n invalid_control_char_name: 'sep-2243-x-mcp-header-charset'\n};\n\n/**\n * Decodes a header value that may be Base64-encoded.\n * Base64-encoded values use the format: =?base64?{Base64EncodedValue}?=\n */\nfunction decodeHeaderValue(value: string): string {\n const base64Match = value.match(/^=\\?base64\\?(.*)\\?=$/);\n if (base64Match) {\n return Buffer.from(base64Match[1], 'base64').toString('utf-8');\n }\n return value;\n}\n\n/**\n * Check if a value needs Base64 encoding per the spec:\n * - Non-ASCII characters\n * - Control characters\n * - Leading/trailing whitespace\n */\nfunction needsBase64Encoding(value: string): boolean {\n // Check for non-ASCII or control characters\n for (let i = 0; i < value.length; i++) {\n const code = value.charCodeAt(i);\n if (code < 0x20 || code > 0x7e) {\n // Allow space (0x20) and tab (0x09) only inside values, not at edges\n if (code === 0x09) return true; // tab always needs encoding\n if (code < 0x20) return true; // other control chars\n if (code > 0x7e) return true; // non-ASCII\n }\n }\n // Check for leading/trailing whitespace\n if (value !== value.trim()) return true;\n return false;\n}\n\n/**\n * Checks if a raw header value is properly encoded for a body value that\n * needs Base64 encoding. Returns null if valid, error string if invalid.\n */\nfunction validateEncodedHeader(\n rawHeader: string,\n bodyValue: string,\n valueType?: string\n): string | null {\n if (needsBase64Encoding(bodyValue)) {\n // Value requires Base64 encoding\n const base64Match = rawHeader.match(/^=\\?base64\\?(.*)\\?=$/);\n\n if (!base64Match) {\n return `Value '${bodyValue}' requires Base64 encoding but header was sent as plain: '${rawHeader}'`;\n }\n const decoded = Buffer.from(base64Match[1], 'base64').toString('utf-8');\n if (valueType === 'number' || valueType === 'integer') {\n return compareNumericValues(decoded, bodyValue);\n }\n if (decoded !== bodyValue) {\n return `Base64-decoded header value '${decoded}' does not match body value '${bodyValue}'`;\n }\n return null;\n }\n // Plain ASCII - compare directly (after decoding if Base64 was used)\n const decoded = decodeHeaderValue(rawHeader);\n if (valueType === 'number' || valueType === 'integer') {\n return compareNumericValues(decoded, bodyValue);\n }\n if (decoded !== bodyValue) {\n return `Header value '${decoded}' (raw: '${rawHeader}') does not match body value '${bodyValue}'`;\n }\n return null;\n}\n\n/**\n * Compare two string representations of numbers numerically.\n * For integers, requires exact match. For decimals, allows\n * a tolerance of 1e-9 to account for cross-SDK floating point\n * representation differences.\n */\nfunction compareNumericValues(\n headerValue: string,\n bodyValue: string\n): string | null {\n const headerNum = Number(headerValue);\n const bodyNum = Number(bodyValue);\n if (isNaN(headerNum) || isNaN(bodyNum)) {\n return `Non-numeric value in number comparison: header='${headerValue}', body='${bodyValue}'`;\n }\n if (Number.isInteger(bodyNum)) {\n // Integer: require exact numeric match (e.g. 42 === 42.0)\n if (headerNum !== bodyNum) {\n return `Numeric header value ${headerNum} does not match body value ${bodyNum}`;\n }\n } else {\n // Decimal: allow tolerance of 1e-9\n if (Math.abs(headerNum - bodyNum) > 1e-9) {\n return `Numeric header value ${headerNum} does not match body value ${bodyNum} (difference ${Math.abs(headerNum - bodyNum)} exceeds tolerance 1e-9)`;\n }\n }\n return null;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// HttpCustomHeadersScenario - tests that clients mirror x-mcp-header params\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * The tool calls whose argument values exercise the encoding edge cases.\n * Handed to the client twice from this one list, so the two cannot drift: as\n * `toolCalls` in its context (what a client with a handler for this scenario\n * reads) and as `tools/call` steps (what a generic or hand-driven client\n * follows).\n */\nconst TOOL_CALLS = [\n {\n name: 'test_custom_headers',\n arguments: {\n region: 'us-west1',\n priority: 42,\n verbose: false,\n debug: true,\n empty_val: '',\n method_val: 'test-method',\n float_val: 3.14159,\n non_ascii_val: 'Hello, 世界',\n whitespace_val: ' padded ',\n leading_space_val: ' us-west1',\n trailing_space_val: 'us-west1 ',\n internal_space_val: 'us west 1',\n control_char_val: 'line1\\nline2',\n crlf_val: 'line1\\r\\nline2',\n tab_val: '\\tindented',\n query: 'SELECT * FROM users'\n }\n },\n {\n name: 'test_custom_headers_null',\n arguments: {\n region: 'us-east1',\n priority: 1,\n verbose: null,\n query: 'SELECT 1'\n }\n }\n];\n\nexport class HttpCustomHeadersScenario extends BaseHttpScenario {\n name = 'http-custom-headers';\n description =\n 'Tests that client mirrors x-mcp-header tool parameters into Mcp-Param headers with correct encoding (SEP-2243)';\n\n /** List first: the x-mcp-header annotations are in the tool schemas. */\n readonly steps: readonly Step[] = [\n { op: 'tools/list' },\n ...TOOL_CALLS.map((call) => ({ op: 'tools/call' as const, ...call }))\n ];\n\n private toolCallReceived: boolean = false;\n private nullToolCallReceived: boolean = false;\n\n /** Read by start() for the CLI runner and by the hosted server per cell. */\n protected scenarioContext(): Record {\n return { toolCalls: TOOL_CALLS };\n }\n\n async start(ctx: ScenarioContext): Promise {\n const urls = await super.start(ctx);\n urls.context = this.scenarioContext();\n return urls;\n }\n\n getChecks(): ConformanceCheck[] {\n // Declared-but-unemitted -> FAILURE (request-metadata.ts pattern). Keeps\n // the emitted ID set stable for traceability even when the client never\n // calls the annotated tools. The `some()` guard makes this idempotent.\n for (const id of CUSTOM_HEADERS_DECLARED_CHECK_IDS) {\n if (this.checks.some((c) => c.id === id)) continue;\n const missingNullCall =\n id === 'sep-2243-client-omit-null' && !this.nullToolCallReceived;\n this.checks.push({\n id,\n name: 'NotObserved',\n description: `Declared check ${id} was never emitted`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: missingNullCall\n ? 'Client did not send a tools/call request for test_custom_headers_null to test null/omitted parameter handling.'\n : this.toolCallReceived\n ? 'Check was not observed: no tool call exercised it.'\n : 'Client did not send a tools/call request for test_custom_headers.',\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n return this.checks;\n }\n\n protected handlePost(\n req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n if (request.method === 'tools/list') {\n this.handleToolsList(res, request);\n } else if (request.method === 'tools/call') {\n this.handleToolsCall(req, res, request);\n } else if (request.id === undefined) {\n this.sendNotificationAck(res);\n } else {\n this.sendGenericResult(res, request);\n }\n }\n\n private handleToolsList(res: http.ServerResponse, request: any): void {\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n resultType: 'complete',\n ttlMs: 300000,\n cacheScope: 'private',\n tools: [\n {\n name: 'test_custom_headers',\n description:\n 'A tool with x-mcp-header annotations to test custom header mirroring and encoding',\n inputSchema: {\n type: 'object',\n properties: {\n region: {\n type: 'string',\n description: 'Plain ASCII string value',\n 'x-mcp-header': 'Region'\n },\n priority: {\n type: 'integer',\n description: 'Integer numeric value',\n 'x-mcp-header': 'Priority'\n },\n verbose: {\n type: 'boolean',\n description: 'Boolean value',\n 'x-mcp-header': 'Verbose'\n },\n debug: {\n type: 'boolean',\n description: 'Boolean true value',\n 'x-mcp-header': 'Debug'\n },\n empty_val: {\n type: 'string',\n description: 'Empty string value',\n 'x-mcp-header': 'EmptyVal'\n },\n method_val: {\n type: 'string',\n description:\n 'Value for header named \"Method\" — tests that x-mcp-header \"Method\" produces Mcp-Param-Method (not Mcp-Method)',\n 'x-mcp-header': 'Method'\n },\n float_val: {\n type: 'number',\n description:\n 'Floating point value — no x-mcp-header annotation, should not be mirrored'\n },\n non_ascii_val: {\n type: 'string',\n description:\n 'Non-ASCII string value — requires Base64 encoding',\n 'x-mcp-header': 'NonAscii'\n },\n whitespace_val: {\n type: 'string',\n description:\n 'String with leading/trailing whitespace — requires Base64 encoding',\n 'x-mcp-header': 'Whitespace'\n },\n leading_space_val: {\n type: 'string',\n description:\n 'String with leading space only — requires Base64 encoding',\n 'x-mcp-header': 'LeadingSpace'\n },\n trailing_space_val: {\n type: 'string',\n description:\n 'String with trailing space only — requires Base64 encoding',\n 'x-mcp-header': 'TrailingSpace'\n },\n internal_space_val: {\n type: 'string',\n description:\n 'String with internal spaces only — plain ASCII, no Base64',\n 'x-mcp-header': 'InternalSpace'\n },\n control_char_val: {\n type: 'string',\n description:\n 'String with control characters — requires Base64 encoding',\n 'x-mcp-header': 'ControlChar'\n },\n crlf_val: {\n type: 'string',\n description:\n 'String with carriage return and line feed — requires Base64 encoding',\n 'x-mcp-header': 'CrLf'\n },\n tab_val: {\n type: 'string',\n description:\n 'String with leading tab — requires Base64 encoding',\n 'x-mcp-header': 'Tab'\n },\n query: {\n type: 'string',\n description:\n 'No x-mcp-header annotation - should not be mirrored'\n }\n },\n required: ['region', 'priority', 'query']\n }\n },\n {\n name: 'test_custom_headers_null',\n description:\n 'A tool for testing null/omitted x-mcp-header parameter handling',\n inputSchema: {\n type: 'object',\n properties: {\n region: {\n type: 'string',\n description: 'Plain ASCII string value',\n 'x-mcp-header': 'Region'\n },\n priority: {\n type: 'integer',\n description: 'Integer numeric value',\n 'x-mcp-header': 'Priority'\n },\n verbose: {\n type: 'boolean',\n description: 'Boolean value — will be null to test omission',\n 'x-mcp-header': 'Verbose'\n },\n query: {\n type: 'string',\n description: 'No x-mcp-header annotation'\n }\n },\n required: ['region', 'priority', 'query']\n }\n }\n ]\n }\n });\n }\n\n private handleToolsCall(\n req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n const toolName = request.params?.name;\n const args = request.params?.arguments || {};\n\n if (toolName === 'test_custom_headers') {\n this.toolCallReceived = true;\n\n // SEP-2243 \"MCP clients MUST support this feature\": observable as the\n // client calling the annotated tool with at least one mirrored\n // Mcp-Param-* header. The per-parameter checks below then validate each\n // mirrored value individually.\n const hasAnyParamHeader = Object.keys(req.headers).some((h) =>\n h.startsWith('mcp-param-')\n );\n this.checks.push({\n id: 'sep-2243-client-supports-custom-headers',\n name: 'ClientSupportsCustomHeaders',\n description:\n 'Client supports custom headers: calls the x-mcp-header annotated tool and mirrors at least one parameter',\n status: hasAnyParamHeader ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: hasAnyParamHeader\n ? undefined\n : 'Client called test_custom_headers but sent no Mcp-Param-* headers.',\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n\n // Check Mcp-Param-Region header (plain ASCII string)\n this.checkParamHeader(req, 'Region', args.region, 'string');\n\n // Check Mcp-Param-Priority header (integer)\n this.checkParamHeader(req, 'Priority', args.priority, 'integer');\n\n // Check Mcp-Param-Verbose header (boolean value)\n // checkParamHeader already FAILs on missing header, so this also covers\n // \"optional parameter present → client MUST include header\" without a\n // separate check id.\n if (args.verbose !== undefined && args.verbose !== null) {\n this.checkParamHeader(req, 'Verbose', args.verbose, 'boolean');\n }\n\n // Check Mcp-Param-Debug header (boolean true value)\n if (args.debug !== undefined && args.debug !== null) {\n this.checkParamHeader(req, 'Debug', args.debug, 'boolean');\n }\n\n // Check Mcp-Param-EmptyVal header (empty string → empty header value)\n if (args.empty_val !== undefined && args.empty_val !== null) {\n this.checkParamHeader(req, 'EmptyVal', args.empty_val, 'string');\n }\n\n // Check Mcp-Param-Method header (x-mcp-header \"Method\" → Mcp-Param-Method, NOT Mcp-Method)\n if (args.method_val !== undefined && args.method_val !== null) {\n this.checkParamHeader(req, 'Method', args.method_val, 'string');\n }\n\n // float_val is intentionally unannotated: SEP-2243 forbids x-mcp-header on\n // `number`-typed properties, so it is served without one. Assert no header\n // was sent — same \"designated params only\" rule as the `query` check below.\n const floatHeader = req.headers['mcp-param-floatval'] as\n | string\n | undefined;\n this.checks.push({\n id: 'sep-2243-client-mirrors-designated-params',\n name: 'ClientCustomHeaderNoMirrorNumber',\n description:\n 'Client MUST NOT add Mcp-Param headers for parameters without x-mcp-header (number-typed float_val is served unannotated per SEP-2243)',\n status: floatHeader === undefined ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n floatHeader !== undefined\n ? `Found unexpected Mcp-Param-FloatVal header '${floatHeader}' for an unannotated number parameter`\n : undefined,\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n\n // Check Mcp-Param-NonAscii header (requires Base64 encoding)\n if (args.non_ascii_val !== undefined && args.non_ascii_val !== null) {\n this.checkParamHeader(req, 'NonAscii', args.non_ascii_val, 'string');\n }\n\n // Check Mcp-Param-Whitespace header (leading/trailing whitespace → Base64)\n if (args.whitespace_val !== undefined && args.whitespace_val !== null) {\n this.checkParamHeader(req, 'Whitespace', args.whitespace_val, 'string');\n }\n\n // Check Mcp-Param-LeadingSpace header (leading space only → Base64)\n if (\n args.leading_space_val !== undefined &&\n args.leading_space_val !== null\n ) {\n this.checkParamHeader(\n req,\n 'LeadingSpace',\n args.leading_space_val,\n 'string'\n );\n }\n\n // Check Mcp-Param-TrailingSpace header (trailing space only → Base64)\n if (\n args.trailing_space_val !== undefined &&\n args.trailing_space_val !== null\n ) {\n this.checkParamHeader(\n req,\n 'TrailingSpace',\n args.trailing_space_val,\n 'string'\n );\n }\n\n // Check Mcp-Param-InternalSpace header (internal spaces only → plain ASCII, no Base64)\n if (\n args.internal_space_val !== undefined &&\n args.internal_space_val !== null\n ) {\n this.checkParamHeader(\n req,\n 'InternalSpace',\n args.internal_space_val,\n 'string'\n );\n }\n\n // Check Mcp-Param-ControlChar header (control characters → Base64)\n if (\n args.control_char_val !== undefined &&\n args.control_char_val !== null\n ) {\n this.checkParamHeader(\n req,\n 'ControlChar',\n args.control_char_val,\n 'string'\n );\n }\n\n // Check Mcp-Param-CrLf header (carriage return + line feed → Base64)\n if (args.crlf_val !== undefined && args.crlf_val !== null) {\n this.checkParamHeader(req, 'CrLf', args.crlf_val, 'string');\n }\n\n // Check Mcp-Param-Tab header (leading tab → Base64)\n if (args.tab_val !== undefined && args.tab_val !== null) {\n this.checkParamHeader(req, 'Tab', args.tab_val, 'string');\n }\n\n // Check that 'query' (no x-mcp-header) is NOT mirrored — the negative\n // half of \"mirror the *designated* parameter values\".\n const queryHeader = req.headers['mcp-param-query'] as string | undefined;\n this.checks.push({\n id: 'sep-2243-client-mirrors-designated-params',\n name: 'ClientCustomHeaderNoMirrorUnannotated',\n description:\n 'Client MUST NOT add Mcp-Param headers for parameters without x-mcp-header',\n status: queryHeader === undefined ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n queryHeader !== undefined\n ? `Found unexpected Mcp-Param-Query header '${queryHeader}' for unannotated parameter`\n : undefined,\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n } else if (toolName === 'test_custom_headers_null') {\n this.nullToolCallReceived = true;\n\n // When value is null or not provided, client MUST omit the header\n const verboseHeader = req.headers['mcp-param-verbose'] as\n | string\n | undefined;\n this.checks.push({\n id: 'sep-2243-client-omit-null',\n name: 'ClientCustomHeaderOmitNull',\n description:\n 'Client MUST omit Mcp-Param header when parameter value is null or not provided',\n status: verboseHeader === undefined ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n verboseHeader !== undefined\n ? `Mcp-Param-Verbose should be omitted when null/undefined, but got '${verboseHeader}'`\n : undefined,\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n resultType: 'complete',\n content: [{ type: 'text', text: 'Custom headers test completed' }]\n }\n });\n }\n\n private checkParamHeader(\n req: http.IncomingMessage,\n headerName: string,\n bodyValue: any,\n valueType: string\n ): void {\n const headerKey = `mcp-param-${headerName.toLowerCase()}`;\n const rawHeaderValue = req.headers[headerKey] as string | undefined;\n\n if (bodyValue === undefined || bodyValue === null) return;\n\n const errors: string[] = [];\n\n if (rawHeaderValue === undefined) {\n errors.push(\n `Missing Mcp-Param-${headerName} header. Client MUST include headers for x-mcp-header parameters.`\n );\n } else {\n // Convert body value to expected string representation\n let expectedString: string;\n switch (valueType) {\n case 'number':\n expectedString = String(bodyValue);\n break;\n case 'boolean':\n expectedString = bodyValue ? 'true' : 'false';\n break;\n default:\n expectedString = String(bodyValue);\n }\n\n // For numbers, compare numerically to allow for cross-SDK\n // floating point representation differences (e.g., \"42\" vs \"42.0\").\n // See SEP-2243 discussion on number precision.\n const validationError = validateEncodedHeader(\n rawHeaderValue,\n expectedString,\n valueType\n );\n if (validationError) {\n errors.push(validationError);\n }\n }\n\n // One check ID per SEP-2243 requirement, picked by what this parameter\n // actually exercises: Base64 wrapping for unsafe values, primitive\n // (number/boolean) string encoding, or plain mirroring. The per-parameter\n // detail lives in `name`/`details`.\n const needsBase64 =\n typeof bodyValue === 'string' && needsBase64Encoding(String(bodyValue));\n const checkId = needsBase64\n ? 'sep-2243-client-base64-unsafe'\n : valueType === 'number' ||\n valueType === 'integer' ||\n valueType === 'boolean'\n ? 'sep-2243-client-encode-values'\n : 'sep-2243-client-mirrors-designated-params';\n\n this.checks.push({\n id: checkId,\n name: `ClientCustomHeader_${headerName}`,\n description: `Client sends correct Mcp-Param-${headerName} header (${valueType} value)`,\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [SPEC_REFERENCE_ENCODING],\n details: {\n headerName: `Mcp-Param-${headerName}`,\n rawHeaderValue,\n bodyValue,\n valueType,\n needsBase64\n }\n });\n }\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// HttpInvalidToolHeadersScenario - tests that clients reject invalid tools\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Raw event: the client sent tools/list (SUCCESS) — or never did (FAILURE). */\nconst TOOLS_LIST_GATE_ID = 'sep-2243-invalid-tool-tools-list-gate';\n/** Raw event, one per tools/call: which tool, with the headers it carried. */\nconst TOOL_CALL_EVENT_ID = 'sep-2243-invalid-tool-call';\n\nexport class HttpInvalidToolHeadersScenario extends BaseHttpScenario {\n name = 'http-invalid-tool-headers';\n description =\n 'Tests that client rejects tools with invalid x-mcp-header annotations (SEP-2243)';\n allowClientError = true;\n /**\n * List, then call the one valid tool: proof the client kept it. The\n * invalid tools are never named here — calling one is the failure.\n */\n readonly steps = [\n { op: 'tools/list' },\n { op: 'tools/call', name: 'valid_tool', arguments: { region: 'us-west1' } }\n ] as const;\n\n /**\n * Verdicts are derived from the raw events in `this.checks` (tools/list\n * sent, each tools/call with its header observations), never from\n * instance state: the hosted server judges a merged log in a fresh\n * instance, and anything only an instance field knew would be lost — a\n * tool the client did call would read as never called.\n */\n getChecks(): ConformanceCheck[] {\n const calledTools = new Set(\n this.checks\n .filter((c) => c.id === TOOL_CALL_EVENT_ID)\n .map((c) => c.details?.tool)\n .filter((t): t is string => typeof t === 'string')\n );\n const verdicts: ConformanceCheck[] = [];\n if (!this.checks.some((c) => c.id === TOOLS_LIST_GATE_ID)) {\n verdicts.push({\n id: TOOLS_LIST_GATE_ID,\n name: 'ClientInvalidToolHeadersToolsList',\n description: 'Client requests tools/list',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'Client did not send a tools/list request.',\n specReferences: [SPEC_REFERENCE_TOOL_DEF]\n });\n }\n\n // Check that valid_tool WAS called — proves client kept valid tools\n const validToolCalled = calledTools.has('valid_tool');\n verdicts.push({\n id: 'sep-2243-client-reject-invalid-tool',\n name: 'ClientKeepsValidTool',\n description: 'Client MUST keep valid tools while excluding invalid ones',\n status: validToolCalled ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: validToolCalled\n ? undefined\n : \"Client did not call 'valid_tool'. A single malformed tool definition must not prevent other valid tools from being used.\",\n specReferences: [SPEC_REFERENCE_TOOL_DEF]\n });\n\n // Check that the client did NOT call any of the invalid tools. Each\n // invalid tool violates one specific x-mcp-header constraint, so the\n // check is emitted under that constraint's requirement ID — the client\n // rejecting the tool is how the constraint is enforced on the wire.\n for (const [toolName, constraintId] of Object.entries(\n INVALID_TOOL_CONSTRAINT_IDS\n )) {\n const called = calledTools.has(toolName);\n verdicts.push({\n id: constraintId,\n name: `ClientRejectsInvalidTool_${toolName}`,\n description: `Client MUST NOT call tool '${toolName}' with invalid x-mcp-header`,\n status: called ? 'FAILURE' : 'SUCCESS',\n timestamp: new Date().toISOString(),\n errorMessage: called\n ? `Client called '${toolName}' which has an invalid x-mcp-header. Clients MUST reject (exclude) such tools.`\n : undefined,\n specReferences: [SPEC_REFERENCE_TOOL_DEF]\n });\n }\n\n // Events first, verdicts after; `this.checks` itself is left as the raw\n // log so this is idempotent and the hosted server can re-judge it.\n return [...this.checks, ...verdicts];\n }\n\n protected handlePost(\n req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n if (request.method === 'tools/list') {\n this.handleToolsList(res, request);\n } else if (request.method === 'tools/call') {\n this.handleToolsCall(req, res, request);\n } else if (request.id === undefined) {\n this.sendNotificationAck(res);\n } else {\n this.sendGenericResult(res, request);\n }\n }\n\n private handleToolsList(res: http.ServerResponse, request: any): void {\n if (!this.checks.some((c) => c.id === TOOLS_LIST_GATE_ID)) {\n this.checks.push({\n id: TOOLS_LIST_GATE_ID,\n name: 'ClientInvalidToolHeadersToolsList',\n description: 'Client requests tools/list',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_REFERENCE_TOOL_DEF]\n });\n }\n\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n resultType: 'complete',\n ttlMs: 0,\n cacheScope: 'private',\n tools: [\n // ── Valid tool (should be kept by client) ──\n {\n name: 'valid_tool',\n description: 'A valid tool with correct x-mcp-header',\n inputSchema: {\n type: 'object',\n properties: {\n region: {\n type: 'string',\n 'x-mcp-header': 'Region'\n }\n },\n required: ['region']\n }\n },\n\n // ── Invalid: empty x-mcp-header value ──\n {\n name: 'invalid_empty_header',\n description:\n 'x-mcp-header MUST NOT be empty (MUST be rejected by client)',\n inputSchema: {\n type: 'object',\n properties: {\n value: { type: 'string', 'x-mcp-header': '' }\n },\n required: ['value']\n }\n },\n\n // ── Invalid: x-mcp-header on object type ──\n {\n name: 'invalid_object_header',\n description:\n 'x-mcp-header MUST only be on primitive types (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n data: { type: 'object', 'x-mcp-header': 'Data' }\n },\n required: ['data']\n }\n },\n\n // ── Invalid: x-mcp-header on array type ──\n {\n name: 'invalid_array_header',\n description:\n 'x-mcp-header MUST only be on primitive types (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n items: {\n type: 'array',\n items: { type: 'string' },\n 'x-mcp-header': 'Items'\n }\n },\n required: ['items']\n }\n },\n\n // ── Invalid: x-mcp-header on null type ──\n {\n name: 'invalid_null_header',\n description:\n 'x-mcp-header MUST only be on primitive types (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n nil: { type: 'null', 'x-mcp-header': 'Nil' }\n },\n required: ['nil']\n }\n },\n\n // ── Invalid: x-mcp-header on number type ──\n // `number` is a JSON Schema primitive but SEP-2243 excludes it from\n // the permitted set: \"Parameters with type `number` are not\n // permitted.\" Only integer, string and boolean may be annotated.\n {\n name: 'invalid_number_header',\n description:\n 'x-mcp-header MUST NOT be on number type (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n score: { type: 'number', 'x-mcp-header': 'Score' }\n },\n required: ['score']\n }\n },\n\n // ── Invalid: duplicate same-case x-mcp-header values ──\n {\n name: 'invalid_duplicate_same_case',\n description:\n 'Duplicate x-mcp-header \"Region\" on two properties (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n field1: { type: 'string', 'x-mcp-header': 'Region' },\n field2: { type: 'string', 'x-mcp-header': 'Region' }\n },\n required: ['field1', 'field2']\n }\n },\n\n // ── Invalid: duplicate case-insensitive x-mcp-header values ──\n {\n name: 'invalid_duplicate_diff_case',\n description:\n 'Duplicate case-insensitive x-mcp-header \"MyField\"/\"myfield\" (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n field1: { type: 'string', 'x-mcp-header': 'MyField' },\n field2: { type: 'string', 'x-mcp-header': 'myfield' }\n },\n required: ['field1', 'field2']\n }\n },\n\n // ── Invalid: space in x-mcp-header name ──\n {\n name: 'invalid_space_in_name',\n description:\n 'x-mcp-header MUST NOT contain space (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n value: { type: 'string', 'x-mcp-header': 'My Region' }\n },\n required: ['value']\n }\n },\n\n // ── Invalid: colon in x-mcp-header name ──\n {\n name: 'invalid_colon_in_name',\n description:\n 'x-mcp-header MUST NOT contain colon (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n value: {\n type: 'string',\n 'x-mcp-header': 'Region:Primary'\n }\n },\n required: ['value']\n }\n },\n\n // ── Invalid: non-ASCII in x-mcp-header name ──\n {\n name: 'invalid_non_ascii_name',\n description:\n 'x-mcp-header MUST contain only ASCII chars (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n value: { type: 'string', 'x-mcp-header': 'Région' }\n },\n required: ['value']\n }\n },\n\n // ── Invalid: control character in x-mcp-header name ──\n {\n name: 'invalid_control_char_name',\n description:\n 'x-mcp-header MUST NOT contain control chars (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n value: { type: 'string', 'x-mcp-header': 'Region\\t1' }\n },\n required: ['value']\n }\n }\n ]\n }\n });\n }\n\n private handleToolsCall(\n req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n const toolName = request.params?.name;\n if (typeof toolName === 'string') {\n const mcpParamHeaders = Object.fromEntries(\n Object.entries(req.headers).filter(([k]) =>\n k.toLowerCase().startsWith('mcp-param-')\n )\n );\n this.checks.push({\n id: TOOL_CALL_EVENT_ID,\n name: 'ClientCalledTool',\n description: `Client called tool '${toolName}'`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_REFERENCE_TOOL_DEF],\n details: {\n tool: toolName,\n arguments: request.params?.arguments,\n mcpParamHeaders\n }\n });\n }\n\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n resultType: 'complete',\n content: [{ type: 'text', text: 'Tool call received' }]\n }\n });\n }\n}\n",[],[142,474,796,861],"9988f585-8886-4903-9e17-84b154bba705","http-base.ts","df69518e-ad13-11f1-a016-1607ee4eb77e",226,["D",1789332105390],"import { withRequiredDraftResultFields } from '../../mock-server/index.ts';\n/**\n * Shared HTTP test-server scaffold for client-under-test SEP-2243 scenarios.\n *\n * A scenario that needs to act as a Streamable-HTTP MCP server, inspect\n * incoming client requests, and emit ConformanceChecks should extend this\n * class and implement handlePost() + getChecks(). start()/stop() and the\n * GET/DELETE/body-parse boilerplate are handled here.\n */\n\nimport http from 'node:http';\nimport {\n HandlerScenario,\n RequestListener,\n ConformanceCheck,\n ScenarioSource,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\n\n/**\n * Schema-valid empty results for the standard list-shaped methods, keyed by\n * method. A Map, not an object literal, so a method name that collides with\n * Object.prototype (\"constructor\", \"toString\", ...) misses instead of\n * returning a function. Merged into the generic fallback so a list method a\n * scenario does not route still carries its required list member — a bare\n * `{}` fails schema validation and strict clients drop the connection before\n * the scenario's real checks run (#474). `tasks/list` exists only at\n * 2025-11-25 (the draft schema has no ListTasksResult); the empty member is\n * harmless on the draft wire. Non-list results (tools/call, resources/read,\n * prompts/get, ...) have no meaningful empty default and keep the bare\n * stamped fallback, so a route a scenario forgot surfaces instead of being\n * masked.\n */\nconst EMPTY_LIST_RESULTS: ReadonlyMap = new Map([\n ['tools/list', { tools: [] }],\n ['resources/list', { resources: [] }],\n ['resources/templates/list', { resourceTemplates: [] }],\n ['prompts/list', { prompts: [] }],\n ['roots/list', { roots: [] }],\n ['tasks/list', { tasks: [] }]\n]);\n\nexport abstract class BaseHttpScenario extends HandlerScenario {\n abstract name: string;\n abstract description: string;\n readonly source: ScenarioSource = { introducedIn: DRAFT_PROTOCOL_VERSION };\n\n protected checks: ConformanceCheck[] = [];\n protected sessionId: string = `session-${Date.now()}`;\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n this.sessionId = `session-${Date.now()}`;\n return (req, res) => this.handleRequest(req, res);\n }\n\n abstract getChecks(): ConformanceCheck[];\n\n protected handleRequest(\n req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n if (req.method === 'GET') {\n res.writeHead(200, {\n 'Content-Type': 'text/event-stream',\n 'Cache-Control': 'no-cache',\n Connection: 'keep-alive',\n 'mcp-session-id': this.sessionId\n });\n res.write('data: \\n\\n');\n return;\n }\n if (req.method === 'DELETE') {\n res.writeHead(200);\n res.end();\n return;\n }\n if (req.method !== 'POST') {\n res.writeHead(405);\n res.end('Method Not Allowed');\n return;\n }\n\n // Decode the stream as UTF-8 so multi-byte characters that straddle a\n // chunk boundary aren't corrupted by per-chunk Buffer.toString().\n req.setEncoding('utf8');\n let body = '';\n req.on('data', (chunk) => {\n body += chunk;\n });\n req.on('end', () => {\n try {\n const request = JSON.parse(body);\n if (request.method === 'server/discover') {\n this.sendDiscover(res, request);\n return;\n }\n if (request.method === 'initialize' && this.isModernOnly()) {\n this.rejectLegacyInitialize(res, request);\n return;\n }\n this.handlePost(req, res, request);\n } catch (error) {\n res.writeHead(400, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n error: { code: -32700, message: `Parse error: ${error}` }\n })\n );\n }\n });\n }\n\n protected abstract handlePost(\n req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void;\n\n protected sendJson(res: http.ServerResponse, body: object): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n res.end(JSON.stringify(body));\n }\n\n /**\n * Capabilities advertised to a 2026-07-28 client via `server/discover`.\n * Subclasses override to match the methods they actually serve.\n */\n protected discoverCapabilities(): object {\n return { tools: {} };\n }\n\n protected sendDiscover(res: http.ServerResponse, request: any): void {\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: withRequiredDraftResultFields('server/discover', {\n supportedVersions: [DRAFT_PROTOCOL_VERSION],\n capabilities: this.discoverCapabilities(),\n serverInfo: { name: this.name + '-server', version: '1.0.0' }\n })\n });\n }\n\n /**\n * Whether this scenario exists only at 2026-07-28 (the scaffold's default\n * source). Extension scenarios built on it, such as the skills ones, run at\n * the dated revisions too and answer initialize themselves.\n */\n protected isModernOnly(): boolean {\n const source = this.source as { introducedIn?: string };\n return source.introducedIn === DRAFT_PROTOCOL_VERSION;\n }\n\n /**\n * For a 2026-07-28-only scenario, initialize is the dated revisions'\n * handshake, not one of its own requests. A server that supports only modern\n * versions SHOULD name them in any error it returns to an initialize\n * (2026-07-28 basic/versioning, \"Backward Compatibility with\n * Initialization-Based Versions\"), so a dual-era client that opens this way\n * learns to retry with 2026-07-28. Replying with a 2026-07-28 initialize\n * result instead would be a version the client did not ask for.\n */\n protected rejectLegacyInitialize(\n res: http.ServerResponse,\n request: any\n ): void {\n res.writeHead(400, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id ?? null,\n error: {\n code: -32022,\n message: 'Unsupported protocol version',\n data: {\n supported: [DRAFT_PROTOCOL_VERSION],\n requested: String(request.params?.protocolVersion ?? '')\n }\n }\n })\n );\n }\n\n protected sendNotificationAck(res: http.ServerResponse): void {\n res.writeHead(202);\n res.end();\n }\n\n protected sendGenericResult(res: http.ServerResponse, request: any): void {\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n // Method-aware so cacheable methods that fall through to the generic\n // reply still carry the ttlMs/cacheScope the draft revision requires,\n // and unrouted standard list methods carry their required list member.\n result: withRequiredDraftResultFields(\n request.method,\n EMPTY_LIST_RESULTS.get(request.method) ?? {}\n )\n });\n }\n}\n",[],[142,474,796,869],"dd587433-1fdb-45f7-a952-728317a4cab0","dd9c695e-ad13-11f1-986c-1607ee4eb77e",109,["D",1789046876522],"/**\n * SEP-1034: Elicitation defaults test\n * Validates that clients properly apply default values for omitted fields\n * in elicitation responses before sending them to the server\n */\n\nimport { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n ElicitResultSchema\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport type { ConformanceCheck, RequestListener } from '../../types.ts';\nimport { HandlerScenario } from '../../types.ts';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { DRAFT_PROTOCOL_VERSION } from '../../types.ts';\nimport { createRequestLogger } from '../request-logger.ts';\nimport { randomUUID } from 'node:crypto';\n\nfunction isInitializeRequest(body: unknown): boolean {\n if (\n typeof body === 'object' &&\n body !== null &&\n 'method' in body &&\n (body as { method: string }).method === 'initialize'\n ) {\n return true;\n }\n return false;\n}\n\nfunction createServer(checks: ConformanceCheck[]): {\n app: express.Application;\n cleanup: () => void;\n} {\n // Session management\n const transports: { [sessionId: string]: StreamableHTTPServerTransport } = {};\n const servers: { [sessionId: string]: Server } = {};\n\n const createMcpServer = () => {\n const server = new Server(\n {\n name: 'elicitation-defaults-test-server',\n version: '1.0.0'\n },\n {\n capabilities: {\n tools: {}\n }\n }\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => {\n return {\n tools: [\n {\n name: 'test_client_elicitation_defaults',\n description:\n 'Tests that client applies defaults for omitted elicitation fields',\n inputSchema: {\n type: 'object',\n properties: {},\n required: []\n }\n }\n ]\n };\n });\n\n server.setRequestHandler(CallToolRequestSchema, async (request) => {\n if (request.params.name === 'test_client_elicitation_defaults') {\n try {\n // Request elicitation with all optional fields having defaults\n // Using raw server.request() to verify client applies defaults before sending response\n const elicitResult = await server.request(\n {\n method: 'elicitation/create',\n params: {\n message:\n 'Test client default value handling - please accept with defaults',\n requestedSchema: {\n type: 'object',\n properties: {\n name: {\n type: 'string',\n description: 'User name',\n default: 'John Doe'\n },\n age: {\n type: 'integer',\n description: 'User age',\n default: 30\n },\n score: {\n type: 'number',\n description: 'User score',\n default: 95.5\n },\n status: {\n type: 'string',\n description: 'User status',\n enum: ['active', 'inactive', 'pending'],\n default: 'active'\n },\n verified: {\n type: 'boolean',\n description: 'Verification status',\n default: true\n }\n },\n required: [] // All fields optional, so defaults should apply\n }\n }\n },\n ElicitResultSchema\n );\n\n // Check if elicitation was accepted\n if (elicitResult.action !== 'accept') {\n checks.push({\n id: 'client-elicitation-sep1034-general',\n name: 'ClientElicitationSEP1034General',\n description: 'Client accepts elicitation request',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Expected action 'accept', got '${elicitResult.action}'`,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ]\n });\n return {\n content: [{ type: 'text', text: 'Elicitation was not accepted' }]\n };\n }\n\n const content = elicitResult.content || {};\n\n // Validate string default was applied\n const stringErrors: string[] = [];\n if (!('name' in content)) {\n stringErrors.push(\n 'Field \"name\" missing - should have default \"John Doe\"'\n );\n } else if (typeof content.name !== 'string') {\n stringErrors.push(\n `Expected string for \"name\", got ${typeof content.name}`\n );\n }\n\n checks.push({\n id: 'client-elicitation-sep1034-string-default',\n name: 'ClientElicitationSEP1034StringDefault',\n description: 'Client applies string default value for elicitation',\n status: stringErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n stringErrors.length > 0 ? stringErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'name',\n expectedDefault: 'John Doe',\n receivedValue: content.name\n }\n });\n\n // Validate integer default was applied\n const integerErrors: string[] = [];\n if (!('age' in content)) {\n integerErrors.push('Field \"age\" missing - should have default 30');\n } else if (typeof content.age !== 'number') {\n integerErrors.push(\n `Expected number for \"age\", got ${typeof content.age}`\n );\n }\n\n checks.push({\n id: 'client-elicitation-sep1034-integer-default',\n name: 'ClientElicitationSEP1034IntegerDefault',\n description: 'Client applies integer default value for elicitation',\n status: integerErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n integerErrors.length > 0 ? integerErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'age',\n expectedDefault: 30,\n receivedValue: content.age\n }\n });\n\n // Validate number default was applied\n const numberErrors: string[] = [];\n if (!('score' in content)) {\n numberErrors.push(\n 'Field \"score\" missing - should have default 95.5'\n );\n } else if (typeof content.score !== 'number') {\n numberErrors.push(\n `Expected number for \"score\", got ${typeof content.score}`\n );\n }\n\n checks.push({\n id: 'client-elicitation-sep1034-number-default',\n name: 'ClientElicitationSEP1034NumberDefault',\n description: 'Client applies number default value for elicitation',\n status: numberErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n numberErrors.length > 0 ? numberErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'score',\n expectedDefault: 95.5,\n receivedValue: content.score\n }\n });\n\n // Validate enum default was applied\n const enumErrors: string[] = [];\n if (!('status' in content)) {\n enumErrors.push(\n 'Field \"status\" missing - should have default \"active\"'\n );\n } else if (typeof content.status !== 'string') {\n enumErrors.push(\n `Expected string for \"status\", got ${typeof content.status}`\n );\n } else if (\n !['active', 'inactive', 'pending'].includes(content.status)\n ) {\n enumErrors.push(\n `Value \"${content.status}\" is not a valid enum member`\n );\n }\n\n checks.push({\n id: 'client-elicitation-sep1034-enum-default',\n name: 'ClientElicitationSEP1034EnumDefault',\n description: 'Client applies enum default value for elicitation',\n status: enumErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n enumErrors.length > 0 ? enumErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'status',\n expectedDefault: 'active',\n receivedValue: content.status\n }\n });\n\n // Validate boolean default was applied\n const booleanErrors: string[] = [];\n if (!('verified' in content)) {\n booleanErrors.push(\n 'Field \"verified\" missing - should have default true'\n );\n } else if (typeof content.verified !== 'boolean') {\n booleanErrors.push(\n `Expected boolean for \"verified\", got ${typeof content.verified}`\n );\n }\n\n checks.push({\n id: 'client-elicitation-sep1034-boolean-default',\n name: 'ClientElicitationSEP1034BooleanDefault',\n description: 'Client applies boolean default value for elicitation',\n status: booleanErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n booleanErrors.length > 0 ? booleanErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'verified',\n expectedDefault: true,\n receivedValue: content.verified\n }\n });\n\n return {\n content: [\n {\n type: 'text',\n text: `Elicitation completed: ${JSON.stringify(content)}`\n }\n ]\n };\n } catch (error: any) {\n checks.push({\n id: 'client-elicitation-sep1034-general',\n name: 'ClientElicitationSEP1034General',\n description: 'Client handles elicitation with defaults',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Elicitation failed: ${error.message}`,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ]\n });\n\n return {\n content: [\n {\n type: 'text',\n text: `Elicitation error: ${error.message}`\n }\n ]\n };\n }\n }\n\n throw new Error(`Unknown tool: ${request.params.name}`);\n });\n\n return server;\n };\n\n const app = express();\n app.use(express.json());\n\n app.use(\n createRequestLogger(checks, {\n incomingId: 'incoming-request',\n outgoingId: 'outgoing-response',\n mcpRoute: '/mcp'\n })\n );\n\n // Handle POST requests - stateful mode\n app.post('/mcp', async (req: Request, res: Response) => {\n const sessionId = req.headers['mcp-session-id'] as string | undefined;\n\n try {\n let transport: StreamableHTTPServerTransport;\n\n if (sessionId && transports[sessionId]) {\n // Reuse existing transport for established sessions\n transport = transports[sessionId];\n } else if (!sessionId && isInitializeRequest(req.body)) {\n // Create new transport for initialization requests\n const mcpServer = createMcpServer();\n\n transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: () => randomUUID(),\n onsessioninitialized: (newSessionId) => {\n transports[newSessionId] = transport;\n servers[newSessionId] = mcpServer;\n }\n });\n\n transport.onclose = () => {\n const sid = transport.sessionId;\n if (sid && transports[sid]) {\n delete transports[sid];\n if (servers[sid]) {\n servers[sid].close();\n delete servers[sid];\n }\n }\n };\n\n await mcpServer.connect(transport);\n await transport.handleRequest(req, res, req.body);\n return;\n } else {\n res.status(400).json({\n jsonrpc: '2.0',\n error: {\n code: -32000,\n message: 'Invalid or missing session ID'\n },\n id: null\n });\n return;\n }\n\n await transport.handleRequest(req, res, req.body);\n } catch {\n if (!res.headersSent) {\n res.status(500).json({\n jsonrpc: '2.0',\n error: {\n code: -32603,\n message: 'Internal server error'\n },\n id: null\n });\n }\n }\n });\n\n // Handle GET requests - SSE streams for sessions\n app.get('/mcp', async (req: Request, res: Response) => {\n const sessionId = req.headers['mcp-session-id'] as string | undefined;\n\n if (!sessionId || !transports[sessionId]) {\n res.status(400).send('Invalid or missing session ID');\n return;\n }\n\n try {\n const transport = transports[sessionId];\n await transport.handleRequest(req, res);\n } catch {\n if (!res.headersSent) {\n res.status(500).send('Error establishing SSE stream');\n }\n }\n });\n\n // Handle DELETE requests - session termination\n app.delete('/mcp', async (req: Request, res: Response) => {\n const sessionId = req.headers['mcp-session-id'] as string | undefined;\n\n if (!sessionId || !transports[sessionId]) {\n res.status(400).send('Invalid or missing session ID');\n return;\n }\n\n try {\n const transport = transports[sessionId];\n await transport.handleRequest(req, res);\n } catch {\n if (!res.headersSent) {\n res.status(500).send('Error handling termination');\n }\n }\n });\n\n const cleanup = () => {\n // Clean up all sessions\n for (const sessionId of Object.keys(transports)) {\n if (servers[sessionId]) {\n servers[sessionId].close();\n }\n }\n };\n\n return { app, cleanup };\n}\n\nexport class ElicitationClientDefaultsScenario extends HandlerScenario {\n name = 'elicitation-sep1034-client-defaults';\n readonly source = {\n introducedIn: '2025-11-25',\n removedIn: DRAFT_PROTOCOL_VERSION\n } as const;\n description =\n 'Tests client applies default values for omitted elicitation fields (SEP-1034)';\n mcpPath = '/mcp';\n private checks: ConformanceCheck[] = [];\n private cleanup: (() => void) | null = null;\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n const { app, cleanup } = createServer(this.checks);\n this.cleanup = cleanup;\n return app;\n }\n\n async stop() {\n this.cleanup?.();\n this.cleanup = null;\n await super.stop();\n }\n\n /**\n * The tool call triggers elicitation/create; the interpreter's standing\n * default (accept with schema defaults) is exactly the behaviour under test.\n */\n readonly steps = [\n { op: 'tools/list' },\n {\n op: 'tools/call',\n name: 'test_client_elicitation_defaults',\n arguments: {}\n }\n ] as const;\n\n getChecks(): ConformanceCheck[] {\n const expectedSlugs = [\n 'client-elicitation-sep1034-string-default',\n 'client-elicitation-sep1034-integer-default',\n 'client-elicitation-sep1034-number-default',\n 'client-elicitation-sep1034-enum-default',\n 'client-elicitation-sep1034-boolean-default'\n ];\n\n // Add failures for any checks that weren't triggered (tool not called)\n for (const slug of expectedSlugs) {\n if (!this.checks.find((c) => c.id === slug)) {\n this.checks.push({\n id: slug,\n name: slug.replace(/-/g, ''),\n description: `Server applies ${slug.split('-')[4]} default for elicitation`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n details: { message: 'Tool was not called by client' },\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ]\n });\n }\n }\n return this.checks;\n }\n}\n",[],[142,474,796,613],"ae5adfaf-4175-4bcb-b0fa-e6b9db5bf7fc","auth-checker.ts","ddeaad80-ad13-11f1-8de9-1607ee4eb77e",36,["D",1789043626411],"/**\n * Auth checker — a stateless re-auth chain.\n *\n * One MCP server, three auth rungs. Each rung is reached by forcing the\n * client back through authorization under a DIFFERENT configuration, using\n * only the spec's own signals:\n *\n * rung 1 \"basic\" 401 challenge → PRM #1 → AS #1: PKCE S256 + DCR +\n * RFC 8707 resource indicator.\n * rung 2 \"scoped\" calling advance_to_scoped with a basic token → 401\n * whose WWW-Authenticate points at PRM #2 (different AS,\n * SEP-835: scope must be taken from scopes_supported).\n * rung 3 \"step-up\" calling advance_to_stepup with only conformance:read →\n * 403 insufficient_scope, scope=\"… conformance:write\"\n * (RFC 6750 step-up at the same AS).\n *\n * The access token IS the progress report: `ac.`, so\n * possession of a token with cfg=scoped and conformance:write proves the\n * client handled discovery, a challenge-driven AS switch, SEP-835 scope\n * selection, and 403 step-up — with zero server-side state. The final\n * auth_complete tool spells that out.\n *\n * Like the consent gate in checker-2026-07-28, the embedded ASs are\n * deliverers of specific challenge shapes, not auth conformance tests in\n * themselves — but unlike the consent gate they auto-redirect, so the whole\n * chain is automatable.\n */\n\nimport { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n CallToolResult,\n ListToolsRequestSchema\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { createHash } from 'node:crypto';\nimport type { ConformanceCheck } from '../../types.ts';\nimport { HandlerScenario } from '../../types.ts';\n\nconst SERVER_INFO = { name: 'mcp-checker-auth', version: '1.0.0' };\n\nconst SCOPE_READ = 'conformance:read';\nconst SCOPE_WRITE = 'conformance:write';\n\ntype Cfg = 'basic' | 'scoped' | 'isstrap';\n\ninterface TokenClaims {\n cfg: Cfg;\n scope: string;\n /** Set on tokens minted through the iss-mismatch trap — see rung 4. */\n trap?: string;\n}\n\nfunction mintToken(claims: TokenClaims): string {\n return `ac.${Buffer.from(JSON.stringify(claims)).toString('base64url')}`;\n}\n\nfunction parseToken(\n authorization: string | undefined\n): TokenClaims | undefined {\n const m = /^Bearer ac\\.([A-Za-z0-9_-]+)$/.exec(authorization ?? '');\n if (!m) return undefined;\n try {\n const claims = JSON.parse(Buffer.from(m[1], 'base64url').toString());\n if (!['basic', 'scoped', 'isstrap'].includes(claims.cfg)) return undefined;\n return {\n cfg: claims.cfg,\n scope: String(claims.scope ?? ''),\n ...(claims.trap ? { trap: String(claims.trap) } : {})\n };\n } catch {\n return undefined;\n }\n}\n\nconst hasScope = (t: TokenClaims, scope: string) =>\n t.scope.split(' ').includes(scope);\n\n/** What each successfully-reached rung proves about the client. */\nconst RUNG_PROOF: Record = {\n auth_status: 'you completed at least one full authorization flow',\n advance_to_scoped:\n 'your client handled a mid-session 401 whose WWW-Authenticate pointed ' +\n 'at a DIFFERENT resource_metadata, re-discovered, re-registered at the ' +\n 'second AS, and requested the scope advertised in scopes_supported ' +\n '(SEP-835)',\n advance_to_stepup:\n 'your client handled a 403 insufficient_scope challenge by ' +\n 're-authorizing with the broader scope from the challenge (RFC 6750 ' +\n 'step-up) while staying at the same AS',\n auth_complete:\n 'ALL AUTH RUNGS PASSED: initial discovery + PKCE S256 + DCR + RFC 8707 ' +\n 'resource indicator (rung 1), challenge-driven AS switch + SEP-835 ' +\n 'scope selection (rung 2), 403 insufficient_scope step-up (rung 3)'\n};\n\nconst TOOLS = [\n {\n name: 'auth_status',\n description:\n 'Reports which auth rung your current access token proves. Call this ' +\n 'first and after each advance.'\n },\n {\n name: 'advance_to_scoped',\n description:\n 'Rung 2 gate. With a rung-1 (basic) token this returns HTTP 401 whose ' +\n 'WWW-Authenticate names a different resource_metadata — re-authorize ' +\n 'through it (note its scopes_supported) and retry.'\n },\n {\n name: 'advance_to_stepup',\n description:\n `Rung 3 gate. Requires ${SCOPE_WRITE}; with only ${SCOPE_READ} this ` +\n 'returns HTTP 403 insufficient_scope naming the scope to add — ' +\n 're-authorize with it and retry.'\n },\n {\n name: 'auth_complete',\n description:\n 'The finish line. Succeeds only with a token proving every rung; the ' +\n 'result is the full report.'\n },\n {\n name: 'check_iss_validation',\n description:\n 'OPTIONAL TRAP (RFC 9207 / SEP-2468). Calling this returns a 401 ' +\n 'pointing at an AS that advertises ' +\n 'authorization_response_iss_parameter_supported: true but sends a ' +\n 'WRONG iss in the authorization response. This tool can NEVER return ' +\n 'success: a conformant client refuses to exchange the code (your own ' +\n 'client errors about the iss mismatch — that error IS the pass). A ' +\n 'client that exchanges the code anyway receives a poisoned token, and ' +\n 'every request made with it fails with an explanation. Run this last; ' +\n 'it ends the session either way.'\n }\n].map((t) => ({ ...t, inputSchema: { type: 'object', properties: {} } }));\n\nexport class AuthCheckerScenario extends HandlerScenario {\n name = 'checker-auth';\n description =\n 'Stateless auth re-auth chain: each tool rung forces re-authorization ' +\n 'under a different configuration (401 with a different ' +\n 'resource_metadata, then 403 insufficient_scope step-up). The access ' +\n 'token encodes progress; auth_complete succeeds only after every rung.';\n readonly source = { introducedIn: '2025-06-18' } as const;\n mcpPath = '';\n\n private checks: ConformanceCheck[] = [];\n\n handler(getBaseUrl: () => string): express.Application {\n const app = express();\n app.use(express.json());\n app.use(express.urlencoded({ extended: false }));\n\n const base = () => new URL(getBaseUrl());\n const basePath = () => (base().pathname === '/' ? '' : base().pathname);\n const prmUrl = (cfg: Cfg) =>\n `${base().origin}/.well-known/oauth-protected-resource${basePath()}${cfg === 'basic' ? '' : `/cfg/${cfg}`}`;\n const issuer = (cfg: Cfg) => `${getBaseUrl()}/as/${cfg}`;\n /** The deliberately-wrong iss value the trap AS puts in its redirects. */\n const wrongIss = () => `${getBaseUrl()}/as/mixup-attacker`;\n\n const record = (\n id: string,\n ok: boolean,\n description: string,\n details?: Record\n ) => {\n this.checks.push({\n id,\n name: id,\n description,\n status: ok ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Auth',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization'\n }\n ],\n details\n });\n };\n\n // ---------------- protected resource metadata (three variants) --------\n const prmDoc = (cfg: Cfg) => ({\n resource: getBaseUrl(),\n authorization_servers: [issuer(cfg)],\n bearer_methods_supported: ['header'],\n // SEP-835: rung 2's PRM advertises the scope the client must request.\n // Deliberately ONLY the read scope — the write scope must be learned\n // from the rung-3 403 challenge, otherwise an SDK that requests all of\n // scopes_supported up front would never exercise the step-up path.\n ...(cfg === 'scoped' ? { scopes_supported: [SCOPE_READ] } : {})\n });\n app.get('/.well-known/oauth-protected-resource', (_req, res) => {\n res.json(prmDoc('basic'));\n });\n app.get('/.well-known/oauth-protected-resource/cfg/scoped', (_req, res) => {\n res.json(prmDoc('scoped'));\n });\n app.get(\n '/.well-known/oauth-protected-resource/cfg/isstrap',\n (_req, res) => {\n res.json(prmDoc('isstrap'));\n }\n );\n\n // ---------------- the two ASs (path-based issuers, stateless) ---------\n const asMetadata = (cfg: Cfg) => (_req: Request, res: Response) => {\n res.json({\n issuer: issuer(cfg),\n authorization_endpoint: `${issuer(cfg)}/authorize`,\n token_endpoint: `${issuer(cfg)}/token`,\n registration_endpoint: `${issuer(cfg)}/register`,\n response_types_supported: ['code'],\n grant_types_supported: ['authorization_code'],\n code_challenge_methods_supported: ['S256'],\n token_endpoint_auth_methods_supported: ['none'],\n ...(cfg === 'scoped'\n ? { scopes_supported: [SCOPE_READ, SCOPE_WRITE] }\n : {}),\n // RFC 9207: the trap AS PROMISES iss in authorization responses —\n // which obliges the client to validate it. The redirect then carries\n // a wrong one.\n ...(cfg === 'isstrap'\n ? { authorization_response_iss_parameter_supported: true }\n : {})\n });\n };\n for (const cfg of ['basic', 'scoped', 'isstrap'] as const) {\n app.get(\n `/.well-known/oauth-authorization-server/as/${cfg}`,\n asMetadata(cfg)\n );\n app.get(`/.well-known/openid-configuration/as/${cfg}`, asMetadata(cfg));\n\n app.post(`/as/${cfg}/register`, (req, res) => {\n res.status(201).json({\n ...req.body,\n client_id: `checker-auth-${cfg}-client`,\n token_endpoint_auth_method: 'none'\n });\n });\n\n app.get(`/as/${cfg}/authorize`, (req, res) => {\n const q = req.query as Record;\n const fail = (error: string, description: string) => {\n if (!q.redirect_uri) {\n res.status(400).json({ error, error_description: description });\n return;\n }\n const r = new URL(q.redirect_uri);\n r.searchParams.set('error', error);\n r.searchParams.set('error_description', description);\n if (q.state !== undefined) r.searchParams.set('state', q.state);\n res.redirect(r.toString());\n };\n if (\n q.code_challenge === undefined ||\n q.code_challenge_method !== 'S256'\n ) {\n fail('invalid_request', 'PKCE with S256 is required');\n return;\n }\n if (cfg === 'basic' && q.resource === undefined) {\n fail(\n 'invalid_target',\n 'RFC 8707: include the resource parameter naming the MCP server'\n );\n return;\n }\n const requested = (q.scope ?? '').split(' ').filter(Boolean);\n if (cfg === 'scoped' && !requested.includes(SCOPE_READ)) {\n fail(\n 'invalid_scope',\n `SEP-835: request the scopes advertised in the PRM scopes_supported (at least ${SCOPE_READ}); got '${q.scope ?? ''}'`\n );\n return;\n }\n record(\n `auth-checker-authorize-${cfg}`,\n true,\n `Conformant authorization request at the '${cfg}' AS`,\n { scope: q.scope }\n );\n if (!q.redirect_uri) {\n res.status(400).json({\n error: 'invalid_request',\n error_description: 'redirect_uri required'\n });\n return;\n }\n const r = new URL(q.redirect_uri);\n r.searchParams.set(\n 'code',\n Buffer.from(\n JSON.stringify({\n cfg,\n challenge: q.code_challenge,\n scope: requested.join(' ')\n })\n ).toString('base64url')\n );\n if (q.state !== undefined) r.searchParams.set('state', q.state);\n // The trap: metadata promised iss, the response lies about it. A\n // conformant client compares this against the issuer it authorized\n // at and refuses to exchange the code (RFC 9207 §2.4).\n if (cfg === 'isstrap') r.searchParams.set('iss', wrongIss());\n res.redirect(r.toString());\n });\n\n app.post(`/as/${cfg}/token`, (req, res) => {\n const grant = req.body as Record;\n let code: { cfg?: string; challenge?: string; scope?: string };\n try {\n code = JSON.parse(\n Buffer.from(String(grant.code ?? ''), 'base64url').toString()\n );\n } catch {\n code = {};\n }\n if (grant.grant_type !== 'authorization_code' || code.cfg !== cfg) {\n res.status(400).json({ error: 'invalid_grant' });\n return;\n }\n const expected = createHash('sha256')\n .update(String(grant.code_verifier ?? ''))\n .digest('base64url');\n if (expected !== code.challenge) {\n res.status(400).json({\n error: 'invalid_grant',\n error_description: 'PKCE verification failed'\n });\n return;\n }\n const scope = code.scope ?? '';\n // Exchanging a trap code means the client ignored the iss mismatch —\n // the token records the offense and incriminates every later request.\n res.json({\n access_token: mintToken({\n cfg,\n scope,\n ...(cfg === 'isstrap'\n ? { trap: 'exchanged-code-despite-iss-mismatch' }\n : {})\n }),\n token_type: 'Bearer',\n expires_in: 3600,\n ...(scope ? { scope } : {})\n });\n });\n }\n\n // ---------------- landing -------------------------------------------\n app.get('/', (req, res) => {\n if (!String(req.headers.accept ?? '').includes('text/html')) {\n res.status(405).json({\n error: 'POST JSON-RPC to this URL (auth required)',\n docs: 'open this URL in a browser for a full explanation'\n });\n return;\n }\n res.type('html').send(`\nMCP Checker — Auth Chain\n\n\n
MCP Checker — Auth Chain
\n
Checks a client's OAuth behavior by forcing it back through\nauthorization under different configurations, using only the spec's own signals.\nStateless: the access token itself encodes your progress.
\n
\n
Rung 1 — basic: any unauthenticated request → 401. Complete\ndiscovery, DCR, PKCE (S256), and send the RFC 8707 resource parameter.
\n
Rung 2 — AS switch + scopes: call advance_to_scoped →\n401 whose WWW-Authenticate names a different resource_metadata.\nRe-authorize there, requesting the scope from scopes_supported (SEP-835).
\n
Rung 3 — step-up: call advance_to_stepup →\n403 insufficient_scope naming ${SCOPE_WRITE}. Re-authorize with it.
\n
Finish: auth_complete succeeds only with the final token\nand prints the full report.
\n
Optional trap — iss validation (RFC 9207): check_iss_validation\nchallenges you toward an AS whose metadata promises iss in authorization\nresponses, then sends a wrong one. A conformant client refuses to exchange the\ncode — your client's own iss-mismatch error is the pass. A client that exchanges anyway\ngets a poisoned token and every request with it fails with the explanation. Run it last;\nit ends the session either way.
\n
\n
Your token is readable: ac.<base64url JSON> — decode it any time to\nsee what your client has proven.
\n`);\n });\n\n // ---------------- the MCP endpoint, gated per rung -------------------\n // HTTP header values must be Latin-1; keep the rich text in the body.\n const headerSafe = (s: string) => s.replace(/[^\\x20-\\x7e]/g, '-');\n const challenge401 = (res: Response, cfg: Cfg, description: string) => {\n res\n .status(401)\n .set(\n 'WWW-Authenticate',\n `Bearer error=\"invalid_token\", error_description=\"${headerSafe(description)}\", resource_metadata=\"${prmUrl(cfg)}\"`\n )\n .json({ error: 'invalid_token', error_description: description });\n };\n\n app.post('/', async (req: Request, res: Response) => {\n const token = parseToken(req.headers.authorization);\n const body =\n req.body && !Array.isArray(req.body)\n ? (req.body as { method?: string; params?: { name?: string } })\n : {};\n\n if (!token) {\n challenge401(\n res,\n 'basic',\n 'Rung 1: authorize via the resource_metadata in this challenge'\n );\n return;\n }\n\n // NOTE: a poisoned token (minted by exchanging a wrong-iss code) is\n // NOT rejected at the HTTP layer. Doing so delivered the verdict on the\n // SDK's reconnect/initialize POST — a layer the agent never sees, so\n // the failure surfaced as an opaque \"reconnect failed: HTTP 400\". We\n // accept the token (the session stays alive) and instead fail the\n // check_iss_validation TOOL CALL in-band below, matching every other\n // rung's verdict style. Safe: the harness controls both ASs.\n\n // Gate the advance tools at the HTTP layer so the failures are real\n // OAuth challenges, not tool errors — that is the whole trick.\n const toolName =\n body.method === 'tools/call' ? body.params?.name : undefined;\n\n // The iss trap. A non-poisoned token gets challenged toward the trap AS\n // (a conformant client refuses mid-OAuth and never comes back — that\n // out-of-band refusal is the PASS). A poisoned token means the client\n // exchanged the wrong-iss code: fall through to the SDK dispatch, which\n // returns the FAIL verdict as an in-band tool result.\n if (toolName === 'check_iss_validation' && !token.trap) {\n record(\n 'auth-checker-iss-trap-armed',\n true,\n 'iss trap challenge issued'\n );\n challenge401(\n res,\n 'isstrap',\n 'iss validation check: re-authorize via the resource_metadata in this challenge. If your client validates iss (RFC 9207) it will refuse to complete - that refusal is the PASS'\n );\n return;\n }\n if (toolName === 'advance_to_scoped' && token.cfg !== 'scoped') {\n record(\n 'auth-checker-rung2-challenged',\n true,\n 'Rung 2 challenge issued'\n );\n challenge401(\n res,\n 'scoped',\n 'Rung 2: this rung requires the second AS configuration — re-authorize via the resource_metadata in this challenge and note its scopes_supported'\n );\n return;\n }\n if (\n (toolName === 'advance_to_stepup' || toolName === 'auth_complete') &&\n !(token.cfg === 'scoped' && hasScope(token, SCOPE_WRITE))\n ) {\n if (token.cfg !== 'scoped') {\n challenge401(res, 'scoped', 'Complete rung 2 before rung 3');\n return;\n }\n record('auth-checker-rung3-challenged', true, 'Rung 3 step-up issued');\n res\n .status(403)\n .set(\n 'WWW-Authenticate',\n `Bearer error=\"insufficient_scope\", scope=\"${SCOPE_READ} ${SCOPE_WRITE}\", resource_metadata=\"${prmUrl('scoped')}\"`\n )\n .json({\n error: 'insufficient_scope',\n error_description: `Rung 3: re-authorize with '${SCOPE_WRITE}' (RFC 6750 step-up)`\n });\n return;\n }\n\n // Gate passed — serve via the SDK (per-request, stateless).\n const server = new Server(SERVER_INFO, {\n capabilities: { tools: {} },\n instructions:\n 'Auth-chain checker. Call auth_status, then advance_to_scoped, ' +\n 'then advance_to_stepup, then auth_complete. Each advance forces ' +\n 'a re-authorization under a different configuration; an HTTP ' +\n '401/403 along the way is the next challenge, not a failure.'\n });\n server.setRequestHandler(ListToolsRequestSchema, async () => ({\n tools: TOOLS\n }));\n server.setRequestHandler(\n CallToolRequestSchema,\n async (request): Promise => {\n // iss trap, fail path: reached only with a poisoned token, i.e.\n // the client exchanged a code whose response carried a wrong iss.\n // Deliver the verdict in-band so it surfaces as a tool result, not\n // a swallowed transport error — and keep the session alive.\n if (request.params.name === 'check_iss_validation') {\n record(\n 'auth-checker-iss-trap-caught',\n false,\n 'Client exchanged an authorization code despite an iss mismatch',\n { iss: wrongIss(), expected: issuer('isstrap') }\n );\n return {\n content: [\n {\n type: 'text',\n text:\n 'FAIL [check_iss_validation]: client exchanged an ' +\n `authorization code whose response carried iss='${wrongIss()}', ` +\n `expected '${issuer('isstrap')}' (RFC 9207 / SEP-2468). The ` +\n 'trap AS advertised ' +\n 'authorization_response_iss_parameter_supported: true, so a ' +\n 'conformant client MUST compare iss against the issuer it ' +\n 'authorized at and abort BEFORE the token exchange. ' +\n 'Reaching this tool result means your client did not — ' +\n 'leaving it open to authorization-server mix-up attacks.'\n }\n ],\n isError: true\n };\n }\n const proof = RUNG_PROOF[request.params.name];\n if (!proof) {\n return {\n content: [\n {\n type: 'text',\n text: `unknown tool '${request.params.name}'`\n }\n ],\n isError: true\n };\n }\n record(`auth-checker-${request.params.name}`, true, proof, {\n cfg: token.cfg,\n scope: token.scope\n });\n const status =\n request.params.name === 'auth_status'\n ? `Token: cfg=${token.cfg}, scope='${token.scope}' — ${\n token.cfg === 'basic'\n ? 'rung 1 done; call advance_to_scoped next.'\n : hasScope(token, SCOPE_WRITE)\n ? 'all rungs done; call auth_complete.'\n : 'rung 2 done; call advance_to_stepup next.'\n }`\n : proof;\n return {\n content: [\n {\n type: 'text',\n text: `CONFORMANCE OK [${request.params.name}]: ${status}`\n }\n ]\n };\n }\n );\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n await transport.handleRequest(req, res, req.body);\n res.on('close', () => {\n void transport.close();\n void server.close();\n });\n });\n\n return app;\n }\n\n getChecks(): ConformanceCheck[] {\n return this.checks;\n }\n}\n",[],[142,474,796,884],"b4490072-4a9c-4d31-ac4d-76606820a590","verification.ts","bb33f484-ae14-11f1-9e0b-1607ee4eb77e","84310e66-34ea-4875-8e92-2548fb71a140",182,["D",1789153948831],"/**\n * SEP-2640 client scenarios for the read-time verification MUSTs.\n *\n * Each variant serves a listing that is internally honest, then tampers with\n * exactly one thing on the wire and watches whether the client notices. The\n * tamper always targets the skill's `SKILL.md`, and the client's contract is\n * \"load the skill, then read its supporting file\". A client that verifies\n * fails at the first step and never reaches the second, so **rejection is\n * detected by the absence of the supporting-file read**, the same way\n * `auth/resource-mismatch` detects rejection by the absence of an\n * authorization request.\n *\n * Absence only means something once the client has actually loaded the skill.\n * A client that lists and exits produces the same empty read log as one that\n * verified and stopped, so every variant requires the manifest read as a\n * prerequisite and reports untestable without it (#248). Before that gate a\n * client implementing `skills/list` and nothing else passed every variant\n * here.\n *\n * A fourth variant, `unlisted`, was retired 2026-09-10. Nothing was tampered\n * in it, so the only thing under test was whether the driver asked for a URI\n * it should not have, which grades the driver rather than the client. The\n * requirement is recorded as excluded in src/seps/sep-2640.yaml.\n */\n\nimport { createHash } from 'node:crypto';\nimport http from 'node:http';\nimport { ConformanceCheck } from '../../../types.ts';\nimport { untestableCheck } from '../../untestable.ts';\nimport { BaseHttpScenario } from '../http-base.ts';\nimport {\n initializeResult,\n readResult,\n skillsListResult\n} from './mock-results.ts';\n\nconst SKILLS_EXTENSION_ID = 'io.modelcontextprotocol/skills';\n\nconst SPEC_REFERENCE = {\n id: 'SEP-2640-Verification-On-Read',\n url: 'https://modelcontextprotocol.io/seps/2640-skills-extension#integrity-and-verification'\n};\n\nconst SKILL_URI = 'skill://pdf-processing/SKILL.md';\nconst SUPPORTING_URI = 'skill://pdf-processing/references/FORMS.md';\n\nconst SKILL_MD = `---\nname: pdf-processing\ndescription: Extract, fill, and assemble PDF documents\n---\n\nSkill body.\n`;\n\nconst SUPPORTING = 'Supporting content.\\n';\n\nconst sha256 = (s: string) =>\n 'sha256:' + createHash('sha256').update(s, 'utf8').digest('hex');\n\nexport type VerificationMode = 'digest' | 'size' | 'frontmatter';\n\nconst MODES: Record<\n VerificationMode,\n { scenario: string; checkId: string; description: string }\n> = {\n digest: {\n scenario: 'sep-2640-client-verify-digest',\n checkId: 'sep-2640-host-verify-digest',\n description:\n \"When a host retrieves a file listed in a skill's resources, it MUST verify the content against that entry's digest, and MUST NOT use unverified content.\"\n },\n size: {\n scenario: 'sep-2640-client-verify-size',\n checkId: 'sep-2640-host-size-mismatch-failure',\n description:\n \"A read whose byte length differs from the entry's size is a verification failure equivalent to a digest mismatch, whether or not the host goes on to compute the digest.\"\n },\n frontmatter: {\n scenario: 'sep-2640-client-verify-frontmatter',\n checkId: 'sep-2640-host-frontmatter-comparison',\n description:\n \"After fetching a SKILL.md for which the host holds an entry, hosts MUST parse its YAML frontmatter and compare it field-by-field against the entry's frontmatter, and MUST NOT load the skill on any discrepancy.\"\n }\n};\n\nexport class SkillsVerificationScenario extends BaseHttpScenario {\n name: string;\n description: string;\n readonly source = { extensionId: SKILLS_EXTENSION_ID } as const;\n\n // A verifying client aborts on the tampered SKILL.md, so it exits with an\n // error rather than completing its script. That is the pass, not a failure.\n allowClientError = true;\n\n private readonly mode: VerificationMode;\n private reads: string[] = [];\n private listCalled = false;\n\n constructor(mode: VerificationMode) {\n super();\n this.mode = mode;\n this.name = MODES[mode].scenario;\n this.description = MODES[mode].description;\n }\n\n /** One class, three registry entries: a per-run copy must keep its mode. */\n fresh(): SkillsVerificationScenario {\n return new SkillsVerificationScenario(this.mode);\n }\n\n /** The entry as advertised. Always internally consistent with SKILL_MD. */\n private entry() {\n const resources = [\n {\n uri: SKILL_URI,\n digest: sha256(SKILL_MD),\n size: Buffer.byteLength(SKILL_MD)\n },\n {\n uri: SUPPORTING_URI,\n digest: sha256(SUPPORTING),\n size: Buffer.byteLength(SUPPORTING)\n }\n ];\n return {\n uri: SKILL_URI,\n frontmatter: {\n name: 'pdf-processing',\n description: 'Extract, fill, and assemble PDF documents'\n },\n resources\n };\n }\n\n /** What the server actually serves for SKILL.md, per mode. */\n private skillBody(): string {\n switch (this.mode) {\n case 'digest':\n // Same length, different bytes: only the digest catches this.\n return SKILL_MD.replace('Skill body.', 'Evil body!!');\n case 'size':\n return SKILL_MD + 'extra bytes the entry did not account for\\n';\n case 'frontmatter':\n // Digest and size are recomputed for this body below, so the only\n // discrepancy left is the frontmatter disagreeing with the entry.\n return SKILL_MD.replace(\n 'description: Extract, fill, and assemble PDF documents',\n 'description: Exfiltrate credentials'\n );\n default:\n return SKILL_MD;\n }\n }\n\n /**\n * Advertised on both lifecycles. `server/discover` is intercepted by the\n * base class before `handlePost` runs, so declaring these only in the\n * `initialize` reply left a 2026-07-28 discover-first client seeing a\n * tools-only server, with nothing to gate a `skills/list` call on.\n */\n protected discoverCapabilities(): object {\n return {\n resources: { listChanged: false },\n extensions: { [SKILLS_EXTENSION_ID]: {} }\n };\n }\n\n protected handlePost(\n _req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n switch (request.method) {\n case 'initialize':\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: initializeResult(\n this.name,\n request,\n this.discoverCapabilities()\n )\n });\n return;\n\n case 'skills/list': {\n this.listCalled = true;\n const entry = this.entry();\n if (this.mode === 'frontmatter') {\n // Make digest and size honest for the tampered body, so the\n // frontmatter comparison is the only thing that can fail.\n const body = this.skillBody();\n entry.resources[0].digest = sha256(body);\n entry.resources[0].size = Buffer.byteLength(body);\n }\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: skillsListResult([entry])\n });\n return;\n }\n\n case 'resources/read': {\n const uri = request.params?.uri;\n if (typeof uri === 'string') this.reads.push(uri);\n const text = uri === SUPPORTING_URI ? SUPPORTING : this.skillBody();\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: readResult(uri, text)\n });\n return;\n }\n\n default:\n if (request.id === undefined) {\n this.sendNotificationAck(res);\n return;\n }\n this.sendGenericResult(res, request);\n }\n }\n\n getChecks(): ConformanceCheck[] {\n const { checkId, description } = MODES[this.mode];\n const base = {\n id: checkId,\n name: `SkillsClientVerify_${this.mode}`,\n description,\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_REFERENCE]\n };\n\n // An undeclared extension is genuinely not applicable, so this one stays\n // a SKIP: the client was never offered a skill to hold an entry for.\n if (!this.listCalled) {\n return [\n {\n ...base,\n status: 'SKIPPED',\n errorMessage:\n 'the client never called skills/list, so it never held an entry to verify against'\n }\n ];\n }\n\n // The prerequisite, and the reason this scenario is worth anything.\n //\n // Rejection is detected by the absence of the supporting-file read, and a\n // client that never loaded the skill produces exactly the same empty read\n // log as one that loaded it and correctly stopped. Reporting SUCCESS for\n // both means a client implementing `skills/list` and nothing else passes\n // every variant here, which is what happened until 2026-09-10.\n //\n // A missing prerequisite is a FAILURE rather than a SKIP, per #248:\n // SKIPPED is excluded from pass/fail counts and exit codes, so it would\n // read as green and hide the gap from anyone burning down a list.\n if (!this.reads.includes(SKILL_URI)) {\n return [\n untestableCheck(\n checkId,\n base.name,\n description,\n `the client never read ${SKILL_URI}, so it never loaded the tampered skill and had nothing to reject. Absence of the supporting-file read proves nothing here.`,\n [SPEC_REFERENCE]\n )\n ];\n }\n\n // Proven by the client stopping before the supporting file, which it\n // would only reach by having accepted the tampered SKILL.md.\n const violated = this.reads.includes(SUPPORTING_URI);\n const evidence = `client continued to ${SUPPORTING_URI} after being served a SKILL.md that fails ${this.mode} verification, so it did not reject the content`;\n\n return [\n {\n ...base,\n status: violated ? 'FAILURE' : 'SUCCESS',\n errorMessage: violated ? evidence : undefined,\n details: { mode: this.mode, reads: this.reads }\n }\n ];\n }\n}\n",[],[142,474,796,754,892],"22198ef8-ee4f-490e-b743-c256fdac53d8","no-prefetch.ts","bb83c31a-ae14-11f1-9265-1607ee4eb77e",183,["D",1789153949321],"/**\n * SEP-2640 client scenario: hosts MUST NOT retrieve a skill's files ahead of\n * need.\n *\n * This is a `Scenario` rather than a `ClientScenario`: the harness stands up\n * the server and the client is the system under test. The rule reduces to\n * \"did a request arrive\", which makes it one of the most wire-observable\n * obligations in the SEP despite the first traceability pass filing it as an\n * unobservable host obligation.\n *\n * Contract for the client under test, keyed on MCP_CONFORMANCE_SCENARIO:\n * connect, call `skills/list`, then exit. Do not load a skill. A client that\n * prefetches will read `SKILL.md` or a supporting file during that window and\n * fail the check.\n */\n\nimport http from 'node:http';\nimport { ConformanceCheck } from '../../../types.ts';\nimport { BaseHttpScenario } from '../http-base.ts';\nimport {\n initializeResult,\n readResult,\n skillsListResult\n} from './mock-results.ts';\n\nconst SPEC_REFERENCE = {\n id: 'SEP-2640-Lazy-Retrieval',\n url: 'https://modelcontextprotocol.io/seps/2640-skills-extension#integrity-and-verification'\n};\n\nconst SKILLS_EXTENSION_ID = 'io.modelcontextprotocol/skills';\n\n/** One skill with a supporting file, so a prefetch has something to grab. */\nconst SKILL_URI = 'skill://pdf-processing/SKILL.md';\nconst SUPPORTING_URI = 'skill://pdf-processing/references/FORMS.md';\n\nconst SKILL_MD = `---\nname: pdf-processing\ndescription: Extract, fill, and assemble PDF documents\n---\n\nBody the client has no business fetching yet.\n`;\n\nconst SUPPORTING =\n 'Supporting content the client has no business fetching yet.\\n';\n\n/** sha256 of the two bodies, computed at module load so the entry is honest. */\nimport { createHash } from 'node:crypto';\nconst digestOf = (s: string) =>\n 'sha256:' + createHash('sha256').update(s, 'utf8').digest('hex');\n\nexport class SkillsNoPrefetchScenario extends BaseHttpScenario {\n name = 'sep-2640-client-no-prefetch';\n description =\n 'A client MUST NOT retrieve a skill file before the skill is loaded';\n readonly source = { extensionId: SKILLS_EXTENSION_ID } as const;\n\n /** Every resources/read URI the client asked for, in order. */\n private readsRequested: string[] = [];\n private listCalled = false;\n\n /**\n * Advertised on both lifecycles. `server/discover` is intercepted by the\n * base class before `handlePost` runs, so declaring these only in the\n * `initialize` reply left a 2026-07-28 discover-first client seeing a\n * tools-only server, with nothing to gate a `skills/list` call on.\n */\n protected discoverCapabilities(): object {\n return {\n resources: { listChanged: false },\n extensions: { [SKILLS_EXTENSION_ID]: {} }\n };\n }\n\n protected handlePost(\n _req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n switch (request.method) {\n case 'initialize':\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: initializeResult(\n this.name,\n request,\n this.discoverCapabilities()\n )\n });\n return;\n\n case 'skills/list':\n this.listCalled = true;\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: skillsListResult([\n {\n uri: SKILL_URI,\n frontmatter: {\n name: 'pdf-processing',\n description: 'Extract, fill, and assemble PDF documents'\n },\n resources: [\n {\n uri: SKILL_URI,\n digest: digestOf(SKILL_MD),\n size: Buffer.byteLength(SKILL_MD)\n },\n {\n uri: SUPPORTING_URI,\n digest: digestOf(SUPPORTING),\n size: Buffer.byteLength(SUPPORTING)\n }\n ]\n }\n ])\n });\n return;\n\n // Served, but reaching it during this scenario is the failure.\n case 'resources/read': {\n const uri = request.params?.uri;\n if (typeof uri === 'string') this.readsRequested.push(uri);\n const body = uri === SUPPORTING_URI ? SUPPORTING : SKILL_MD;\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: readResult(uri, body)\n });\n return;\n }\n\n default:\n if (request.id === undefined) {\n this.sendNotificationAck(res);\n return;\n }\n this.sendGenericResult(res, request);\n }\n }\n\n getChecks(): ConformanceCheck[] {\n const DESC =\n \"Hosts MUST NOT retrieve a skill's files ahead of need, not on connection, not on listing, and not at approval.\";\n\n // Without a listing there is no window in which prefetching is even\n // possible, so the run proves nothing rather than passing.\n if (!this.listCalled) {\n return [\n {\n id: 'sep-2640-host-no-prefetch',\n name: 'SkillsClientNoPrefetch',\n description: DESC,\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'the client never called skills/list, so no retrieval window was opened',\n specReferences: [SPEC_REFERENCE]\n }\n ];\n }\n\n const prefetched = this.readsRequested.filter(\n (u) => u === SKILL_URI || u === SUPPORTING_URI\n );\n\n return [\n {\n id: 'sep-2640-host-no-prefetch',\n name: 'SkillsClientNoPrefetch',\n description: DESC,\n status: prefetched.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n prefetched.length === 0\n ? undefined\n : `client read ${prefetched.length} skill file(s) without loading a skill: ${prefetched.join(', ')}`,\n specReferences: [SPEC_REFERENCE],\n details: {\n skillsListCalled: true,\n fileReads: prefetched.length\n }\n }\n ];\n }\n}\n",[],[142,474,796,754,901],"cf2c04b0-b872-47df-90f1-cc0dac9da88e","mock-results.ts","c16bb706-ae14-11f1-96c6-1607ee4eb77e",186,["D",1789153959274],"/**\n * Results for the hand-rolled SEP-2640 client-scenario mocks, shaped like a\n * conformant server's so a strict client is graded on its skills behaviour\n * rather than turned away by the harness.\n */\n\nimport {\n DRAFT_PROTOCOL_VERSION,\n NEGOTIABLE_PROTOCOL_VERSIONS\n} from '../../../types.ts';\nimport { withRequiredDraftResultFields } from '../../../mock-server/index.ts';\n\n/**\n * `ListSkillsResult` is cacheable like `resources/list`, but `skills/list` is\n * an extension method and not in the shared cacheable set, so the caching\n * members are stamped here.\n */\nexport function skillsListResult(skills: object[]): object {\n return { resultType: 'complete', ttlMs: 0, cacheScope: 'private', skills };\n}\n\nexport function readResult(uri: unknown, text: string): unknown {\n return withRequiredDraftResultFields('resources/read', {\n contents: [{ uri, mimeType: 'text/markdown', text }]\n });\n}\n\n/**\n * The `initialize` result at the version the client asked for, when the suite\n * can speak it. The extension has no 2026-07-28 dependency, and the runner\n * hands these scenarios' clients 2025-11-25 unless `--spec-version` says\n * otherwise, so a fixed 2026-07-28 reply would turn a correct stateful client\n * away before it ever lists.\n */\nexport function initializeResult(\n name: string,\n request: { params?: { protocolVersion?: unknown } },\n capabilities: object\n): object {\n const requested = request.params?.protocolVersion;\n const protocolVersion =\n typeof requested === 'string' &&\n NEGOTIABLE_PROTOCOL_VERSIONS.includes(requested)\n ? requested\n : DRAFT_PROTOCOL_VERSION;\n return {\n resultType: 'complete',\n protocolVersion,\n serverInfo: { name: `${name}-server`, version: '1.0.0' },\n capabilities\n };\n}\n",[],[142,474,796,754,909],"49c7dfae-440d-4f31-8fb0-37d96bfc2b27",["D",1789153948831],[236,237,238],[142,474,796,754],"a34e1e00-b017-48d3-b299-538f30a83f9c","wif-jwt-bearer.ts","761fb7c4-ad1b-11f1-b855-1607ee4eb77e","9f323523-6c17-4682-a46c-6c3ac09d1fec",131,["D",1789046888256],"import * as jose from 'npm:jose@^6.1.2';\nimport type { Scenario, ConformanceCheck, ScenarioUrls } from '../../../types.ts';\nimport type { ScenarioContext } from '../../../mock-server/index.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport {\n JWT_BEARER_GRANT_TYPE,\n WIF_TRIGGER_UNAUTHORIZED_SCOPE,\n WIF_REJECTED_SCOPE,\n generateWorkloadKeypair,\n createWorkloadJwt\n} from './helpers/createWorkloadJwt.ts';\n\nconst WIF_ISSUER = 'https://idp.conformance-test.local';\nconst WIF_SUBJECT = 'conformance-workload';\nconst WIF_CLIENT_ID = 'conformance-wif-workload';\n\nexport class WifJwtBearerScenario implements Scenario {\n name = 'auth/wif-jwt-bearer';\n readonly source = {\n extensionId: 'io.modelcontextprotocol/auth/wif'\n } as const;\n description =\n 'Tests the RFC 7523 JWT-bearer grant for workload identity federation (SEP-1933). ' +\n 'The client must: use grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer, ' +\n 'include the workload JWT as the assertion parameter, and surface errors ' +\n '(invalid_grant, invalid_scope, unauthorized_client) without retrying or switching grant types.';\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private tokenRequestReceived = false;\n private failedOnce = false;\n\n async start(ctx: ScenarioContext): Promise {\n this.checks = [];\n this.tokenRequestReceived = false;\n this.failedOnce = false;\n\n const { publicKey, privateKey } = await generateWorkloadKeypair();\n\n const tokenVerifier = new MockTokenVerifier(this.checks);\n\n const authApp = createAuthServer(ctx, this.checks, this.authServer.getUrl, {\n grantTypesSupported: [JWT_BEARER_GRANT_TYPE],\n tokenEndpointAuthMethodsSupported: ['none'],\n tokenVerifier,\n disableDynamicRegistration: true,\n onTokenRequest: async ({ grantType, body, timestamp, authBaseUrl }) => {\n // wif-no-retry and wif-grant-fallback fire on any second request after\n // any first failure, not only after unauthorized_client specifically.\n if (this.tokenRequestReceived && this.failedOnce) {\n if (grantType !== JWT_BEARER_GRANT_TYPE) {\n this.checks.push({\n id: 'wif-grant-fallback',\n name: 'WifGrantFallback',\n description: `Client fell back to ${grantType} grant after a JWT-bearer token request was rejected; clients should not switch grant types after a JWT-bearer failure`,\n status: 'WARNING',\n timestamp,\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_1933_WIF\n ]\n });\n return {\n error: 'unsupported_grant_type',\n errorDescription: 'Only JWT-bearer grant is supported'\n };\n }\n this.checks.push({\n id: 'wif-no-retry',\n name: 'WifNoRetry',\n description:\n 'Client retried JWT-bearer token request after a failure instead of giving up',\n status: 'WARNING',\n timestamp,\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_1933_WIF\n ]\n });\n return {\n error: 'invalid_request',\n errorDescription: 'Retry not allowed for JWT-bearer grant'\n };\n }\n this.tokenRequestReceived = true;\n if (grantType !== JWT_BEARER_GRANT_TYPE) {\n this.checks.push({\n id: 'wif-grant-type',\n name: 'WifGrantType',\n description: `Expected grant_type=${JWT_BEARER_GRANT_TYPE}, got ${grantType}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_1933_WIF\n ]\n });\n this.failedOnce = true;\n return {\n error: 'unsupported_grant_type',\n errorDescription: `Only ${JWT_BEARER_GRANT_TYPE} grant is supported`\n };\n }\n\n const assertion = body.assertion;\n if (!assertion) {\n this.checks.push({\n id: 'wif-assertion-missing',\n name: 'WifAssertionMissing',\n description:\n 'Missing assertion parameter in JWT-bearer token request',\n status: 'FAILURE',\n timestamp,\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_1933_WIF\n ]\n });\n this.failedOnce = true;\n return {\n error: 'invalid_request',\n errorDescription: 'Missing assertion parameter'\n };\n }\n\n try {\n const withoutSlash = authBaseUrl.replace(/\\/+$/, '');\n const withSlash = `${withoutSlash}/`;\n // iss is not validated: the keypair is generated per start() call and\n // the public key closure binds the assertion to this run. This scenario\n // tests client behaviour, not AS issuer policy.\n // clockTolerance of 5s is sufficient because JWTs are signed and consumed\n // within the same test run; skew from a real IdP is not a factor here.\n // Both slash forms are accepted because the SDK constructs the audience\n // from the AS metadata URL, which may or may not carry a trailing slash\n // depending on how the metadata endpoint was discovered.\n await jose.jwtVerify(assertion, publicKey, {\n audience: [withoutSlash, withSlash],\n clockTolerance: 5\n });\n\n this.checks.push({\n id: 'wif-assertion-verified',\n name: 'WifAssertionVerified',\n description:\n 'Workload JWT assertion verified — signature, audience, and expiry are valid (iss not validated; keypair is run-scoped)',\n status: 'SUCCESS',\n timestamp,\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_1933_WIF\n ]\n });\n\n const scopeList = body.scope ? body.scope.split(' ') : [];\n if (scopeList.includes(WIF_TRIGGER_UNAUTHORIZED_SCOPE)) {\n this.failedOnce = true;\n return {\n error: 'unauthorized_client',\n errorDescription: 'Client not authorized for JWT-bearer grant'\n };\n }\n if (scopeList.includes(WIF_REJECTED_SCOPE)) {\n this.failedOnce = true;\n return {\n error: 'invalid_scope',\n errorDescription:\n 'Requested scope is not permitted for this grant'\n };\n }\n return {\n token: `test-token-${Date.now()}`,\n scopes: scopeList\n };\n } catch (e) {\n const msg = e instanceof Error ? e.message : String(e);\n\n if (e instanceof jose.errors.JWTExpired) {\n this.checks.push({\n id: 'wif-assertion-expired',\n name: 'WifAssertionExpired',\n description: `JWT-bearer assertion is expired: ${msg}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_1933_WIF\n ]\n });\n this.failedOnce = true;\n return {\n error: 'invalid_grant',\n errorDescription: 'JWT assertion is expired'\n };\n }\n\n // JWTExpired extends JWTClaimValidationFailed; check aud specifically so\n // other claim failures (iss, nbf, etc.) fall through to malformed.\n if (\n e instanceof jose.errors.JWTClaimValidationFailed &&\n e.claim === 'aud'\n ) {\n this.checks.push({\n id: 'wif-assertion-audience',\n name: 'WifAssertionAudience',\n description: `JWT-bearer assertion audience claim is invalid: ${msg}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_1933_WIF\n ]\n });\n this.failedOnce = true;\n return {\n error: 'invalid_grant',\n errorDescription: 'JWT assertion audience is invalid'\n };\n }\n\n this.checks.push({\n id: 'wif-assertion-malformed',\n name: 'WifAssertionMalformed',\n description: `JWT-bearer assertion is malformed or has an invalid signature: ${msg}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_1933_WIF\n ]\n });\n this.failedOnce = true;\n return {\n error: 'invalid_grant',\n errorDescription: `JWT assertion verification failed: ${msg}`\n };\n }\n }\n });\n\n await this.authServer.start(authApp);\n\n const authServerUrl = this.authServer.getUrl();\n\n const [validJwt, wrongAudienceJwt, expiredJwt] = await Promise.all([\n createWorkloadJwt({\n issuer: WIF_ISSUER,\n subject: WIF_SUBJECT,\n audience: authServerUrl,\n privateKey\n }),\n createWorkloadJwt({\n issuer: WIF_ISSUER,\n subject: WIF_SUBJECT,\n audience: 'https://wrong.example',\n privateKey\n }),\n createWorkloadJwt({\n issuer: WIF_ISSUER,\n subject: WIF_SUBJECT,\n audience: authServerUrl,\n privateKey,\n // Absolute epoch seconds in the past; jose treats a number as an absolute\n // epoch timestamp, producing a token that is already expired.\n expiresIn: '-60s'\n })\n ]);\n\n const app = createServer(\n ctx,\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n { tokenVerifier }\n );\n\n await this.server.start(app);\n\n return {\n serverUrl: `${this.server.getUrl()}/mcp`,\n context: {\n client_id: WIF_CLIENT_ID,\n valid_jwt: validJwt,\n wrong_audience_jwt: wrongAudienceJwt,\n expired_jwt: expiredJwt\n }\n };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n if (!this.tokenRequestReceived) {\n this.checks.push({\n id: 'wif-assertion-verified',\n name: 'WifAssertionVerified',\n description: 'Client did not make a JWT-bearer token request',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_1933_WIF\n ]\n });\n }\n return this.checks;\n }\n}\n",[],[142,474,796,929,921],"auth","449860b0-c51e-405e-aa7d-8958ae87ed38","token-endpoint-auth.ts","e310e75c-ad13-11f1-9294-1607ee4eb77e",233,["D",1789332110058],"import {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n ConformanceCheck\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\nimport {\n addResourceParameterChecks,\n observeResourceParameters\n} from './helpers/resourceParameterChecks.ts';\n\ntype AuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';\n\nfunction detectAuthMethod(\n authorizationHeader?: string,\n bodyClientSecret?: string\n): AuthMethod {\n if (authorizationHeader?.startsWith('Basic ')) {\n return 'client_secret_basic';\n }\n if (bodyClientSecret) {\n return 'client_secret_post';\n }\n return 'none';\n}\n\nfunction validateBasicAuthFormat(authorizationHeader: string): {\n valid: boolean;\n error?: string;\n} {\n const encoded = authorizationHeader.substring('Basic '.length);\n try {\n const decoded = Buffer.from(encoded, 'base64').toString('utf-8');\n if (!decoded.includes(':')) {\n return { valid: false, error: 'missing colon separator' };\n }\n return { valid: true };\n } catch {\n return { valid: false, error: 'base64 decoding failed' };\n }\n}\n\nconst AUTH_METHOD_NAMES: Record = {\n client_secret_basic: 'HTTP Basic authentication (client_secret_basic)',\n client_secret_post: 'client_secret_post',\n none: 'no authentication (public client)'\n};\n\nclass TokenEndpointAuthScenario extends AuthHandlerScenario {\n name: string;\n readonly source = { introducedIn: '2025-06-18' } as const;\n description: string;\n private expectedAuthMethod: AuthMethod;\n private checks: ConformanceCheck[] = [];\n\n // Track resource parameters for RFC 8707 validation\n private authorizationResource?: string;\n private tokenResource?: string;\n private prmResource?: string;\n\n constructor(expectedAuthMethod: AuthMethod) {\n super();\n this.expectedAuthMethod = expectedAuthMethod;\n this.name = `auth/token-endpoint-auth-${expectedAuthMethod === 'client_secret_basic' ? 'basic' : expectedAuthMethod === 'client_secret_post' ? 'post' : 'none'}`;\n this.description = `Tests that client uses ${AUTH_METHOD_NAMES[expectedAuthMethod]} when server only supports ${expectedAuthMethod}`;\n }\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n this.authorizationResource = undefined;\n this.tokenResource = undefined;\n this.prmResource = undefined;\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n tokenEndpointAuthMethodsSupported: [this.expectedAuthMethod],\n onAuthorizationRequest: ({ resource }) => {\n this.authorizationResource = resource;\n },\n onTokenRequest: ({ authorizationHeader, body, timestamp }) => {\n // Track resource from token request for RFC 8707 validation\n this.tokenResource = body.resource;\n const bodyClientSecret = body.client_secret;\n const actualMethod = detectAuthMethod(\n authorizationHeader,\n bodyClientSecret\n );\n const isCorrect = actualMethod === this.expectedAuthMethod;\n\n // For basic auth, also validate the format\n let formatError: string | undefined;\n if (actualMethod === 'client_secret_basic' && authorizationHeader) {\n const validation = validateBasicAuthFormat(authorizationHeader);\n if (!validation.valid) {\n formatError = validation.error;\n }\n }\n\n const status = isCorrect && !formatError ? 'SUCCESS' : 'FAILURE';\n let description: string;\n\n if (formatError) {\n description = `Client sent Basic auth header but ${formatError}`;\n } else if (isCorrect) {\n description = `Client correctly used ${AUTH_METHOD_NAMES[this.expectedAuthMethod]} for token endpoint`;\n } else {\n description = `Client used ${actualMethod} but server only supports ${this.expectedAuthMethod}`;\n }\n\n this.checks.push({\n id: 'token-endpoint-auth-method',\n name: 'Token endpoint authentication method',\n description,\n status,\n timestamp,\n specReferences: [SpecReferences.OAUTH_2_1_TOKEN],\n details: {\n expectedAuthMethod: this.expectedAuthMethod,\n actualAuthMethod: actualMethod,\n hasAuthorizationHeader: !!authorizationHeader,\n hasBodyClientSecret: !!bodyClientSecret,\n ...(formatError && { formatError })\n }\n });\n\n return {\n token: `test-token-${Date.now()}`,\n scopes: []\n };\n },\n onRegistrationRequest: () => ({\n clientId: `test-client-${Date.now()}`,\n clientSecret:\n this.expectedAuthMethod === 'none'\n ? undefined\n : `test-secret-${Date.now()}`,\n tokenEndpointAuthMethod: this.expectedAuthMethod\n })\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [],\n tokenVerifier,\n onPrmRequest: ({ resource }) => {\n this.prmResource = resource;\n }\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const timestamp = new Date().toISOString();\n\n if (!checks.some((c) => c.id === 'token-endpoint-auth-method')) {\n checks.push({\n id: 'token-endpoint-auth-method',\n name: 'Token endpoint authentication method',\n description: 'Client did not make a token request',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.OAUTH_2_1_TOKEN]\n });\n }\n\n // RFC 8707 Resource Parameter Validation Checks. The private fields are\n // empty when a fresh instance re-judges a persisted log (hosted server),\n // so fall back to what the request logger recorded.\n const observed = observeResourceParameters(this.checks);\n addResourceParameterChecks(\n checks,\n {\n authorizationResource:\n this.authorizationResource ?? observed.authorizationResource,\n tokenResource: this.tokenResource ?? observed.tokenResource,\n prmResource: this.prmResource ?? observed.prmResource\n },\n timestamp\n );\n\n return checks;\n }\n}\n\nexport class ClientSecretBasicAuthScenario extends TokenEndpointAuthScenario {\n constructor() {\n super('client_secret_basic');\n }\n}\n\nexport class ClientSecretPostAuthScenario extends TokenEndpointAuthScenario {\n constructor() {\n super('client_secret_post');\n }\n}\n\nexport class PublicClientAuthScenario extends TokenEndpointAuthScenario {\n constructor() {\n super('none');\n }\n}\n",[],[142,474,796,929,931],"f5f28ce0-19a1-4cca-9b2b-e5bd6880c584","spec-references.ts","dfb71f90-ad13-11f1-9679-1607ee4eb77e",123,["D",1789046884297],"import { SpecReference } from '../../../types.ts';\n\nexport const SpecReferences: { [key: string]: SpecReference } = {\n RFC_PRM_DISCOVERY: {\n id: 'RFC-9728',\n url: 'https://www.rfc-editor.org/rfc/rfc9728.html#section-3.1'\n },\n RFC_AUTH_SERVER_METADATA_REQUEST: {\n id: 'RFC-8414-metadata-request',\n url: 'https://www.rfc-editor.org/rfc/rfc8414.html#section-3.1'\n },\n LEGACY_2025_03_26_AUTH_DISCOVERY: {\n id: 'MCP-2025-03-26-Authorization-metadata-discovery',\n url: 'https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization#server-metadata-discovery'\n },\n LEGACY_2025_03_26_AUTH_URL_FALLBACK: {\n id: 'MCP-2025-03-26-Authorization-metadata-url-fallback',\n url: 'https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization#fallbacks-for-servers-without-metadata-discovery'\n },\n MCP_PRM_DISCOVERY: {\n id: 'MCP-2025-06-18-PRM-discovery',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#protected-resource-metadata-discovery-requirements'\n },\n MCP_AUTH_DISCOVERY: {\n id: 'MCP-Authorization-metadata-discovery',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#authorization-server-metadata-discovery'\n },\n MCP_DCR: {\n id: 'MCP-Dynamic-client-registration',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/client#dynamic-client-registration'\n },\n OAUTH_2_1_AUTHORIZATION_ENDPOINT: {\n id: 'OAUTH-2.1-authorization-endpoint',\n url: 'https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-13.html#name-authorization-endpoint'\n },\n OAUTH_2_1_TOKEN: {\n id: 'OAUTH-2.1-token-request',\n url: 'https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-13.html#name-token-request'\n },\n MCP_ACCESS_TOKEN_USAGE: {\n id: 'MCP-Access-token-usage',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#access-token-usage'\n },\n MCP_SCOPE_SELECTION_STRATEGY: {\n id: 'MCP-Scope-selection-strategy',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#scope-selection-strategy'\n },\n MCP_SCOPE_CHALLENGE_HANDLING: {\n id: 'MCP-Scope-challenge-handling',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#scope-challenge-handling'\n },\n MCP_AUTH_ERROR_HANDLING: {\n id: 'MCP-Auth-error-handling',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#error-handling'\n },\n MCP_CLIENT_ID_METADATA_DOCUMENTS: {\n id: 'MCP-Client-ID-Metadata-Documents',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#client-id-metadata-documents'\n },\n IETF_CIMD: {\n id: 'IETF-OAuth-Client-ID-Metadata-Document',\n url: 'https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00'\n },\n RFC_JWT_CLIENT_AUTH: {\n id: 'RFC-7523-JWT-Client-Auth',\n url: 'https://datatracker.ietf.org/doc/html/rfc7523#section-2.2'\n },\n OAUTH_2_1_CLIENT_CREDENTIALS: {\n id: 'OAUTH-2.1-client-credentials-grant',\n url: 'https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-13.html#section-4.2'\n },\n SEP_1046_CLIENT_CREDENTIALS: {\n id: 'SEP-1046-Client-Credentials',\n url: 'https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/oauth-client-credentials.mdx'\n },\n RFC_8707_RESOURCE_INDICATORS: {\n id: 'RFC-8707-Resource-Indicators',\n url: 'https://www.rfc-editor.org/rfc/rfc8707.html'\n },\n MCP_RESOURCE_PARAMETER: {\n id: 'MCP-Resource-Parameter-Implementation',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/authorization#resource-parameter-implementation'\n },\n MCP_CANONICAL_SERVER_URI: {\n id: 'MCP-Canonical-Server-URI',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/authorization#canonical-server-uri'\n },\n RFC_9728_RESOURCE_IDENTITY: {\n id: 'RFC-9728-resource-identity',\n url: 'https://www.rfc-editor.org/rfc/rfc9728.html#section-3.3'\n },\n MCP_PREREGISTRATION: {\n id: 'MCP-Preregistration',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#preregistration'\n },\n MCP_PKCE: {\n id: 'MCP-PKCE-requirement',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#authorization-code-protection'\n },\n // TODO: Update to MCP spec URL once SEP-2468 (modelcontextprotocol/modelcontextprotocol#2468) is merged\n RFC_9207_ISS_PARAMETER: {\n id: 'RFC-9207-iss-parameter',\n url: 'https://www.rfc-editor.org/rfc/rfc9207.html#section-2'\n },\n RFC_8693_TOKEN_EXCHANGE: {\n id: 'RFC-8693-Token-Exchange',\n url: 'https://datatracker.ietf.org/doc/html/rfc8693'\n },\n RFC_7523_JWT_BEARER: {\n id: 'RFC-7523-JWT-Bearer-Grant',\n url: 'https://datatracker.ietf.org/doc/html/rfc7523'\n },\n SEP_990_ENTERPRISE_OAUTH: {\n id: 'SEP-990-Enterprise-Managed-OAuth',\n url: 'https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/enterprise-managed-authorization.mdx'\n },\n SEP_2207_REFRESH_TOKEN_GUIDANCE: {\n id: 'SEP-2207-Refresh-Token-Guidance',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2207'\n },\n SEP_1933_WIF: {\n id: 'SEP-1933-Workload-Identity-Federation',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1933'\n },\n // DPoP (SEP-1932 / RFC 9449) — client concerns.\n SEP_1932_DPOP: {\n id: 'SEP-1932-DPoP',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1932'\n },\n DPOP_EXTENSION: {\n id: 'MCP-DPoP-Extension',\n url: 'https://github.com/modelcontextprotocol/ext-auth/blob/pieterkas-dpop-extension/specification/draft/dpop-extension.mdx'\n },\n RFC_9449_PROOF_SYNTAX: {\n id: 'RFC-9449-dpop-proof-jwt-syntax',\n url: 'https://www.rfc-editor.org/rfc/rfc9449.html#section-4.2'\n },\n RFC_9449_CHECKING_PROOFS: {\n id: 'RFC-9449-checking-dpop-proofs',\n url: 'https://www.rfc-editor.org/rfc/rfc9449.html#section-4.3'\n },\n RFC_9449_AUTH_SCHEME: {\n id: 'RFC-9449-dpop-authentication-scheme',\n url: 'https://www.rfc-editor.org/rfc/rfc9449.html#section-7.1'\n },\n RFC_9449_TOKEN_REQUEST: {\n id: 'RFC-9449-dpop-access-token-request',\n url: 'https://www.rfc-editor.org/rfc/rfc9449.html#section-5'\n },\n RFC_9449_AS_NONCE: {\n id: 'RFC-9449-authorization-server-provided-nonce',\n url: 'https://www.rfc-editor.org/rfc/rfc9449.html#section-8'\n },\n RFC_9449_RS_NONCE: {\n id: 'RFC-9449-resource-server-provided-nonce',\n url: 'https://www.rfc-editor.org/rfc/rfc9449.html#section-9'\n }\n};\n",[],[142,474,796,929,939],"a7665961-2f15-4c22-b265-16b6b9da8ad0","scope-handling.ts","e359bcf2-ad13-11f1-986c-1607ee4eb77e",237,["D",1789333468384],"import {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION,\n SpecVersion,\n isSpecVersion,\n specVersionAtLeast\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\nimport type { Request, Response, NextFunction } from 'npm:express@^5.1.0';\n\n/**\n * The authorization requests in a scenario's log, in the order they arrived.\n * Scenarios that judge the Nth authorization request read them here, at\n * judgement time, rather than counting requests as they arrive: on a\n * serverless host consecutive requests can reach processes whose replayed\n * logs each lack the other's, but the log being judged holds them all.\n */\nfunction authorizationRequests(checks: ConformanceCheck[]): ConformanceCheck[] {\n return checks.filter((c) => c.id === 'authorization-request');\n}\n\n/**\n * The authorization request that answers the insufficient_scope challenge:\n * the first one logged after the first 403 from the MCP endpoint. A client\n * may start an authorization and abandon it before then (the C# SDK does\n * when its server/discover probe times out mid-flow and it falls back to\n * initialize), so the second authorization request is not reliably the\n * escalation. With no 403 in the log, it is the second request, as before.\n */\nfunction escalationRequest(\n checks: ConformanceCheck[]\n): ConformanceCheck | undefined {\n const challenge = checks.findIndex(\n (c) =>\n c.id === 'outgoing-response' &&\n c.details?.path === '/mcp' &&\n c.details?.statusCode === 403\n );\n if (challenge < 0) return authorizationRequests(checks)[1];\n return authorizationRequests(checks.slice(challenge + 1))[0];\n}\n\n/** The `scope` parameter of a logged authorization request, if any. */\nfunction requestedScope(authorization: ConformanceCheck): string | undefined {\n const query = authorization.details?.query as\n | Record\n | undefined;\n return typeof query?.scope === 'string' ? query.scope : undefined;\n}\n\n/** The revision createAuthServer recorded on a logged authorization request. */\nfunction specVersionIn(checks: ConformanceCheck[]): SpecVersion | undefined {\n for (const c of authorizationRequests(checks)) {\n const v = c.details?.specVersion;\n if (isSpecVersion(v)) return v;\n }\n return undefined;\n}\n\n/**\n * Scenario 1: Client uses scope from WWW-Authenticate header\n *\n * Tests that clients SHOULD follow the scope parameter from the initial\n * WWW-Authenticate header in the 401 response, per the scope selection strategy.\n */\nexport class ScopeFromWwwAuthenticateScenario extends AuthHandlerScenario {\n name = 'auth/scope-from-www-authenticate';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests that client uses scope parameter from WWW-Authenticate header when provided';\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const expectedScope = 'mcp:basic';\n const tokenVerifier = new MockTokenVerifier(this.checks, [expectedScope]);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n onAuthorizationRequest: (data) => {\n // Check if client used the scope from WWW-Authenticate header\n const requestedScopes = data.scope ? data.scope.split(' ') : [];\n const usedCorrectScope = requestedScopes.includes(expectedScope);\n this.checks.push({\n id: 'scope-from-www-authenticate',\n name: 'Client scope selection from WWW-Authenticate header',\n description: usedCorrectScope\n ? 'Client correctly used the scope parameter from the WWW-Authenticate header'\n : 'Client SHOULD use the scope parameter from the WWW-Authenticate header when provided',\n status: usedCorrectScope ? 'SUCCESS' : 'WARNING',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY],\n details: {\n expectedScope,\n requestedScope: data.scope || 'none'\n }\n });\n }\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [expectedScope],\n includeScopeInWwwAuth: true,\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n // Emit failure check if expected scope check didn't run\n const hasScopeCheck = checks.some(\n (c) => c.id === 'scope-from-www-authenticate'\n );\n if (!hasScopeCheck) {\n checks.push({\n id: 'scope-from-www-authenticate',\n name: 'Client scope selection from WWW-Authenticate header',\n description:\n 'Client did not complete authorization flow - scope check could not be performed',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY]\n });\n }\n return checks;\n }\n}\n\n/**\n * Scenario 2: Client falls back to scopes_supported when scope not in WWW-Authenticate\n *\n * Tests that clients SHOULD use all scopes from scopes_supported in the PRM\n * when the scope parameter is not available in the WWW-Authenticate header.\n */\nexport class ScopeFromScopesSupportedScenario extends AuthHandlerScenario {\n name = 'auth/scope-from-scopes-supported';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests that client uses all scopes from scopes_supported when scope not in WWW-Authenticate header';\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const scopesSupported = ['mcp:basic', 'mcp:read', 'mcp:write'];\n const tokenVerifier = new MockTokenVerifier(this.checks, scopesSupported);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n onAuthorizationRequest: (data) => {\n // Check if client requested all scopes from scopes_supported\n const requestedScopes = data.scope ? data.scope.split(' ') : [];\n const hasAllScopes = scopesSupported.every((scope) =>\n requestedScopes.includes(scope)\n );\n this.checks.push({\n id: 'scope-from-scopes-supported',\n name: 'Client scope selection from scopes_supported',\n description: hasAllScopes\n ? 'Client correctly used all scopes from scopes_supported in PRM when scope not in WWW-Authenticate'\n : 'Client SHOULD use all scopes from scopes_supported when scope not available in WWW-Authenticate header',\n status: hasAllScopes ? 'SUCCESS' : 'WARNING',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY],\n details: {\n scopesSupported: scopesSupported.join(' '),\n requestedScope: data.scope || 'none',\n ...(hasAllScopes\n ? {}\n : {\n missingScopes: scopesSupported\n .filter((s) => !requestedScopes.includes(s))\n .join(' ')\n })\n }\n });\n }\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: scopesSupported,\n scopesSupported: scopesSupported,\n includeScopeInWwwAuth: false,\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n // Emit failure check if expected scope check didn't run\n const hasScopeCheck = checks.some(\n (c) => c.id === 'scope-from-scopes-supported'\n );\n if (!hasScopeCheck) {\n checks.push({\n id: 'scope-from-scopes-supported',\n name: 'Client scope selection from scopes_supported',\n description:\n 'Client did not complete authorization flow - scope check could not be performed',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY]\n });\n }\n return checks;\n }\n}\n\n/**\n * Scenario 3: Client omits scope when scopes_supported is undefined\n *\n * Tests that clients SHOULD omit the scope parameter when scopes_supported\n * is not available in the PRM and scope is not in WWW-Authenticate header.\n */\nexport class ScopeOmittedWhenUndefinedScenario extends AuthHandlerScenario {\n name = 'auth/scope-omitted-when-undefined';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests that client omits scope parameter when scopes_supported is undefined';\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n onAuthorizationRequest: (data) => {\n // Check if client omitted scope parameter\n const scopeOmitted = !data.scope || data.scope.trim() === '';\n this.checks.push({\n id: 'scope-omitted-when-undefined',\n name: 'Client scope omission when scopes_supported undefined',\n description: scopeOmitted\n ? 'Client correctly omitted scope parameter when scopes_supported is undefined'\n : 'Client SHOULD omit scope parameter when scopes_supported is undefined and scope not in WWW-Authenticate',\n status: scopeOmitted ? 'SUCCESS' : 'WARNING',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY],\n details: {\n scopeParameter: scopeOmitted ? 'omitted' : data.scope\n }\n });\n }\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [],\n scopesSupported: undefined,\n includeScopeInWwwAuth: false,\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n // Emit failure check if expected scope check didn't run\n const hasScopeCheck = checks.some(\n (c) => c.id === 'scope-omitted-when-undefined'\n );\n if (!hasScopeCheck) {\n checks.push({\n id: 'scope-omitted-when-undefined',\n name: 'Client scope omission when scopes_supported undefined',\n description:\n 'Client did not complete authorization flow - scope check could not be performed',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY]\n });\n }\n return checks;\n }\n}\n\n/**\n * Scenario 4: Client performs step-up authentication\n *\n * Tests that clients handle step-up authentication where:\n * - initialize/notifications do not require auth\n * - listTools requires mcp:basic scope (401 if missing)\n * - tools/call requires mcp:basic + mcp:write scopes (403 if insufficient)\n * Client must handle both 401 and 403 responses with different scope requirements\n */\nexport class ScopeStepUpAuthScenario extends AuthHandlerScenario {\n name = 'auth/scope-step-up';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests that client handles step-up authentication with different scope requirements per operation';\n private checks: ConformanceCheck[] = [];\n // SEP-2350's set-wise union requirement was introduced in 2026-07-28 (the\n // current draft); it was not a requirement at 2025-11-25, where\n // non-accumulating re-auth is conformant. Gate the union check accordingly.\n // An instance that only judges a log gets it from judgeAt(), or failing\n // that from the log; see getChecks().\n private specVersion: SpecVersion | undefined;\n\n judgeAt(specVersion: SpecVersion): void {\n this.specVersion = specVersion;\n }\n\n private static readonly initialScope = 'mcp:basic';\n // tools/call gates on mcp:write only (not the union) so the scenario can\n // complete even for clients that don't accumulate; the SEP-2350 check then\n // observes whether the previously-granted mcp:basic was retained.\n private static readonly stepUpScope = 'mcp:write';\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n this.specVersion = ctx.specVersion;\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const { initialScope, stepUpScope } = ScopeStepUpAuthScenario;\n const escalatedScopes = [initialScope, stepUpScope];\n const tokenVerifier = new MockTokenVerifier(this.checks, escalatedScopes);\n\n // The authorization requests are judged in getChecks(), in order.\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier\n });\n\n // Inline step-up auth middleware\n const resourceMetadataUrl = () =>\n `${ctx.getRsBaseUrl()}/.well-known/oauth-protected-resource/mcp`;\n\n const stepUpMiddleware = async (\n req: Request,\n res: Response,\n next: NextFunction\n ) => {\n // Parse body to check method\n let body = req.body;\n if (typeof body === 'string') {\n body = JSON.parse(body);\n }\n const method = body?.method;\n\n // Allow initialize and notifications without auth\n if (method === 'initialize' || method?.startsWith('notifications/')) {\n return next();\n }\n\n const authHeader = req.headers.authorization;\n if (!authHeader || !authHeader.startsWith('Bearer ')) {\n // No auth - return 401 with initial scope\n return res\n .status(401)\n .set(\n 'WWW-Authenticate',\n `Bearer scope=\"${initialScope}\", resource_metadata=\"${resourceMetadataUrl()}\"`\n )\n .json({\n error: 'invalid_token',\n error_description: 'Missing Authorization header'\n });\n }\n\n const token = authHeader.substring('Bearer '.length);\n const authInfo = await tokenVerifier.verifyAccessToken(token);\n const tokenScopes = authInfo.scopes || [];\n\n // Determine required scopes based on method\n const isToolCall = method === 'tools/call';\n const requiredScopes = isToolCall ? [stepUpScope] : [initialScope];\n\n const hasRequiredScopes = requiredScopes.every((s) =>\n tokenScopes.includes(s)\n );\n\n if (!hasRequiredScopes) {\n // Has token but insufficient scopes - return 403. Challenge with only\n // the step-up scope so SEP-2350 union accumulation is observable: a\n // client that just echoes the challenge would drop mcp:basic.\n return res\n .status(403)\n .set(\n 'WWW-Authenticate',\n `Bearer scope=\"${stepUpScope}\", resource_metadata=\"${resourceMetadataUrl()}\", error=\"insufficient_scope\"`\n )\n .json({\n error: 'insufficient_scope',\n error_description: 'Token has insufficient scope'\n });\n }\n\n next();\n };\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: escalatedScopes,\n // Deliberately disjoint from initialScope/stepUpScope so the SEP-2350\n // union check can't be satisfied by a client that unions\n // scopes_supported ∪ challenge instead of prior-grant ∪ challenge.\n // The spec allows this: clients MUST NOT assume any set relationship\n // between challenged scopes and scopes_supported.\n scopesSupported: ['mcp:profile'],\n includeScopeInWwwAuth: true,\n authMiddleware: stepUpMiddleware,\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const { initialScope, stepUpScope } = ScopeStepUpAuthScenario;\n const specVersion = this.specVersion ?? specVersionIn(this.checks);\n const unionRequired =\n specVersion !== undefined &&\n specVersionAtLeast(specVersion, DRAFT_PROTOCOL_VERSION);\n const [initial] = authorizationRequests(this.checks);\n const escalation = escalationRequest(this.checks);\n\n if (initial) {\n // First auth request - should request mcp:basic from WWW-Authenticate\n const scope = requestedScope(initial);\n const usedCorrectScope = (scope?.split(' ') ?? []).includes(initialScope);\n checks.push({\n id: 'scope-step-up-initial',\n name: 'Client initial scope selection for step-up auth',\n description: usedCorrectScope\n ? 'Client correctly used scope from WWW-Authenticate header for initial auth'\n : 'Client SHOULD use the scope parameter from the WWW-Authenticate header',\n status: usedCorrectScope ? 'SUCCESS' : 'WARNING',\n timestamp: initial.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY],\n details: {\n expectedScope: initialScope,\n requestedScope: scope || 'none'\n }\n });\n }\n\n if (escalation) {\n // Second auth request after a 403 challenge that listed only the\n // *missing* scope (mcp:write). Two distinct assertions:\n // - escalation: client included the challenged scope at all\n // - SEP-2350 union: client *also* kept the previously-granted scope\n // that was NOT in the challenge (i.e., computed prior ∪ challenge)\n const scope = requestedScope(escalation);\n const requestedScopes = scope?.split(' ') ?? [];\n const includesChallenged = requestedScopes.includes(stepUpScope);\n checks.push({\n id: 'scope-step-up-escalation',\n name: 'Client scope escalation for step-up auth',\n description: includesChallenged\n ? 'Client correctly requested the challenged scope for step-up authentication'\n : 'Client SHOULD request additional scopes when receiving 403 with new scope requirements',\n status: includesChallenged ? 'SUCCESS' : 'WARNING',\n timestamp: escalation.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY],\n details: {\n challengedScope: stepUpScope,\n requestedScope: scope || 'none'\n }\n });\n\n if (unionRequired) {\n const retainedPrior = requestedScopes.includes(initialScope);\n checks.push({\n id: 'sep-2350-scope-union-on-reauth',\n name: 'Client accumulates previously-granted scopes on re-authorization',\n description: retainedPrior\n ? 'Client included previously-granted scopes alongside the newly challenged scope when re-authorizing'\n : 'Client SHOULD compute the union of previously requested scopes and newly challenged scopes when initiating re-authorization (SEP-2350); previously-granted scope was dropped',\n status: retainedPrior ? 'SUCCESS' : 'WARNING',\n timestamp: escalation.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING],\n details: {\n previouslyGranted: initialScope,\n challengedScope: stepUpScope,\n requestedScope: scope || 'none'\n }\n });\n }\n }\n\n // Emit failure checks if expected auth requests didn't happen\n if (!initial) {\n checks.push({\n id: 'scope-step-up-initial',\n name: 'Client initial scope selection for step-up auth',\n description: 'Client did not make an initial authorization request',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY]\n });\n }\n\n if (!escalation) {\n checks.push({\n id: 'scope-step-up-escalation',\n name: 'Client scope escalation for step-up auth',\n description:\n 'Client did not make a second authorization request for scope escalation',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY]\n });\n if (unionRequired) {\n checks.push({\n id: 'sep-2350-scope-union-on-reauth',\n name: 'Client accumulates previously-granted scopes on re-authorization',\n description:\n 'Client did not make a second authorization request - scope union check could not be performed',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING]\n });\n }\n }\n\n return checks;\n }\n}\n\n/**\n * Scenario 5: Client implements retry limits for scope escalation\n *\n * Tests that clients SHOULD implement retry limits to avoid infinite\n * authorization loops when receiving repeated 403 insufficient_scope errors.\n * The server always returns 403 with the same scope requirement, and clients\n * should stop retrying after a reasonable number of attempts (3 or fewer).\n */\nexport class ScopeRetryLimitScenario extends AuthHandlerScenario {\n name = 'auth/scope-retry-limit';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests that client implements retry limits to prevent infinite authorization loops on repeated 403 responses';\n allowClientError = true;\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const requiredScope = 'mcp:admin';\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n // Each authorization request is an attempt, counted in getChecks().\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier\n });\n\n const resourceMetadataUrl = () =>\n `${ctx.getRsBaseUrl()}/.well-known/oauth-protected-resource/mcp`;\n\n const maxAttempts = 3;\n // Token-bearing MCP requests answered so far. Every one of them is\n // answered 403 or 410 by the middleware below, and the request logger\n // records each answer, so the count is read from the log (replayed into\n // each process on a serverless host) rather than kept in memory.\n const answeredWithToken = () =>\n this.checks.filter(\n (c) =>\n c.id === 'outgoing-response' &&\n c.details?.path === '/mcp' &&\n (c.details?.statusCode === 403 || c.details?.statusCode === 410)\n ).length;\n\n const alwaysDeny403Middleware = async (\n req: Request,\n res: Response,\n next: NextFunction\n ) => {\n let body = req.body;\n if (typeof body === 'string') {\n body = JSON.parse(body);\n }\n const method = body?.method;\n\n if (method === 'initialize' || method?.startsWith('notifications/')) {\n return next();\n }\n\n const authHeader = req.headers.authorization;\n if (!authHeader || !authHeader.startsWith('Bearer ')) {\n return res\n .status(401)\n .set(\n 'WWW-Authenticate',\n `Bearer scope=\"${requiredScope}\", resource_metadata=\"${resourceMetadataUrl()}\"`\n )\n .json({\n error: 'invalid_token',\n error_description: 'Missing Authorization header'\n });\n }\n\n const mcpRequestWithTokenCount = answeredWithToken() + 1;\n\n if (mcpRequestWithTokenCount > maxAttempts) {\n return res.status(410).json({\n error: 'test_complete',\n error_description:\n 'Test is over - client exceeded maximum retry attempts'\n });\n }\n\n return res\n .status(403)\n .set(\n 'WWW-Authenticate',\n `Bearer error=\"insufficient_scope\", scope=\"${requiredScope}\", resource_metadata=\"${resourceMetadataUrl()}\", error_description=\"Scope upgrade will never succeed\"`\n )\n .json({\n error: 'insufficient_scope',\n error_description: 'Scope upgrade will never succeed'\n });\n };\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [requiredScope],\n scopesSupported: [requiredScope],\n includeScopeInWwwAuth: true,\n authMiddleware: alwaysDeny403Middleware,\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const attempts = authorizationRequests(this.checks);\n attempts.forEach((authorization, i) => {\n const attemptNumber = i + 1;\n checks.push({\n id: 'scope-retry-auth-attempt',\n name: `Authorization attempt ${attemptNumber}`,\n description: `Client made authorization request attempt ${attemptNumber}`,\n status: 'INFO',\n timestamp: authorization.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING],\n details: {\n attemptNumber,\n requestedScope: requestedScope(authorization) || 'none'\n }\n });\n });\n const authAttempts = attempts.length;\n\n if (authAttempts === 0) {\n checks.push({\n id: 'scope-retry-limit',\n name: 'Client retry limit for scope escalation',\n description: 'Client did not make any authorization requests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING]\n });\n } else if (authAttempts <= 3) {\n checks.push({\n id: 'scope-retry-limit',\n name: 'Client retry limit for scope escalation',\n description: `Client correctly limited retry attempts to ${authAttempts} (3 or fewer)`,\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING],\n details: {\n authorizationAttempts: authAttempts,\n maxAllowed: 3\n }\n });\n } else {\n checks.push({\n id: 'scope-retry-limit',\n name: 'Client retry limit for scope escalation',\n description: `Client made ${authAttempts} authorization attempts (more than 3). Clients SHOULD implement retry limits to avoid infinite loops.`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING],\n details: {\n authorizationAttempts: authAttempts,\n maxAllowed: 3\n }\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,796,929,947],"272f31e8-2b85-4c19-a9aa-240f1b54e9cc","resource-mismatch.ts","e2557274-ad13-11f1-8f50-1607ee4eb77e",232,["D",1789332109494],"import {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\nimport { untestableCheck } from '../../untestable.ts';\n\n/**\n * Scenario: Resource Mismatch Detection\n *\n * Tests that clients correctly detect and reject when the Protected Resource\n * Metadata returns a `resource` field that doesn't match the server URL\n * the client is trying to access.\n *\n * Per RFC 8707 and MCP spec, clients MUST validate that the resource from\n * PRM matches the expected server before proceeding with authorization.\n *\n * Setup:\n * - Server returns PRM with resource: \"https://evil.example.com/mcp\" (different origin)\n * - Client is trying to access the actual server at localhost:/mcp\n *\n * Expected behavior:\n * - Client should NOT proceed with authorization\n * - Client should abort due to resource mismatch\n * - Test passes if client does NOT complete the auth flow (no authorization request)\n */\nexport class ResourceMismatchScenario extends AuthHandlerScenario {\n name = 'auth/resource-mismatch';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client rejects when PRM resource does not match server URL';\n allowClientError = true;\n\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n // An authorization request means the client proceeded despite the\n // mismatch; getChecks() reads it from the log.\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n tokenEndpointAuthMethodsSupported: ['none'],\n onRegistrationRequest: () => ({\n clientId: `test-client-${Date.now()}`,\n clientSecret: undefined,\n tokenEndpointAuthMethod: 'none'\n })\n });\n\n // Create server that returns a mismatched resource in PRM\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [],\n tokenVerifier,\n // Return a different origin in PRM - this should be rejected by the client\n prmResourceOverride: 'https://evil.example.com/mcp'\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const timestamp = new Date().toISOString();\n const specRefs = [\n SpecReferences.RFC_8707_RESOURCE_INDICATORS,\n SpecReferences.MCP_RESOURCE_PARAMETER\n ];\n\n // Reason-bound verdict (#467). \"Did not proceed with authorization\" is not\n // by itself evidence of validation: a client that never fetched the PRM\n // document never read the mismatched `resource`, so it cannot have\n // compared it. Absent that fetch the requirement was never exercised,\n // which is the untestable case (#248) rather than a pass or a violation.\n if (!checks.some((c) => c.id === 'resource-mismatch-rejected')) {\n const prmRequested = this.checks.some(\n (c) => c.id === 'prm-pathbased-requested'\n );\n const authorizationRequestMade = this.checks.some(\n (c) => c.id === 'authorization-request'\n );\n const correctlyRejected = prmRequested && !authorizationRequestMade;\n const observations = {\n prmResource: 'https://evil.example.com/mcp',\n expectedBehavior: 'Client should NOT proceed with authorization',\n prmRequested,\n authorizationRequestMade\n };\n\n if (!prmRequested) {\n const check = untestableCheck(\n 'resource-mismatch-rejected',\n 'Client rejects mismatched resource',\n 'Client MUST validate that PRM resource matches the server URL before proceeding with authorization',\n 'client never requested the Protected Resource Metadata document, so it never read the resource value it was required to validate',\n specRefs\n );\n check.details = {\n ...check.details,\n ...observations,\n propertyReached: false,\n stopReason: 'prm-not-requested'\n };\n checks.push(check);\n } else {\n checks.push({\n id: 'resource-mismatch-rejected',\n name: 'Client rejects mismatched resource',\n description: correctlyRejected\n ? 'Client correctly rejected authorization when PRM resource does not match server URL'\n : 'Client MUST validate that PRM resource matches the server URL before proceeding with authorization',\n status: correctlyRejected ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n ...observations,\n propertyReached: true,\n stopReason: correctlyRejected\n ? 'declined-after-reading-prm'\n : 'proceeded-to-authorization'\n }\n });\n }\n }\n\n return checks;\n }\n}\n",[],[142,474,796,929,955],"81214458-fcec-4f9a-a5ce-b0c4c8e07517","pre-registration.ts","e2148534-ad13-11f1-b438-1607ee4eb77e",133,["D",1789046888956],"import {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n ConformanceCheck\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\n\nconst PRE_REGISTERED_CLIENT_ID = 'pre-registered-client';\nconst PRE_REGISTERED_CLIENT_SECRET = 'pre-registered-secret';\n\n/**\n * Scenario: Pre-registration (static client credentials)\n *\n * Tests OAuth flow where the server does NOT support Dynamic Client Registration.\n * Clients must use pre-registered credentials passed via context. The context\n * also carries the mock AS's `issuer` identifier: clients targeting the\n * 2026-07-28 spec MUST associate pre-registered credentials with the\n * authorization server that issued them, keyed by that issuer\n * (Authorization Server Binding):\n * https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration#authorization-server-binding\n *\n * This tests the pre-registration approach described in the MCP spec:\n * https://modelcontextprotocol.io/specification/draft/basic/authorization#preregistration\n */\nexport class PreRegistrationScenario extends AuthHandlerScenario {\n name = 'auth/pre-registration';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests OAuth flow with pre-registered client credentials. Server does not support DCR.';\n\n private checks: ConformanceCheck[] = [];\n private getAsUrl: (() => string) | null = null;\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n this.getAsUrl = getAsUrl;\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n disableDynamicRegistration: true,\n tokenEndpointAuthMethodsSupported: ['client_secret_basic'],\n onTokenRequest: ({ authorizationHeader, timestamp }) => {\n // Verify client used pre-registered credentials via Basic auth\n if (!authorizationHeader?.startsWith('Basic ')) {\n this.checks.push({\n id: 'pre-registration-auth',\n name: 'Pre-registration authentication',\n description:\n 'Client did not use Basic authentication with pre-registered credentials',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PREREGISTRATION]\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Missing or invalid Authorization header',\n statusCode: 401\n };\n }\n\n const base64Credentials = authorizationHeader.slice(6);\n const credentials = Buffer.from(base64Credentials, 'base64').toString(\n 'utf-8'\n );\n const [clientId, clientSecret] = credentials.split(':');\n\n if (\n clientId !== PRE_REGISTERED_CLIENT_ID ||\n clientSecret !== PRE_REGISTERED_CLIENT_SECRET\n ) {\n this.checks.push({\n id: 'pre-registration-auth',\n name: 'Pre-registration authentication',\n description: `Client used incorrect pre-registered credentials. Expected client_id '${PRE_REGISTERED_CLIENT_ID}', got '${clientId}'`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PREREGISTRATION],\n details: {\n expectedClientId: PRE_REGISTERED_CLIENT_ID,\n actualClientId: clientId\n }\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Invalid pre-registered credentials',\n statusCode: 401\n };\n }\n\n // Success - client used correct pre-registered credentials\n this.checks.push({\n id: 'pre-registration-auth',\n name: 'Pre-registration authentication',\n description:\n 'Client correctly used pre-registered credentials when server does not support DCR',\n status: 'SUCCESS',\n timestamp,\n specReferences: [SpecReferences.MCP_PREREGISTRATION],\n details: { clientId }\n });\n\n return {\n token: `test-token-prereg-${Date.now()}`,\n scopes: []\n };\n }\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [],\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n protected scenarioContext() {\n return {\n client_id: PRE_REGISTERED_CLIENT_ID,\n client_secret: PRE_REGISTERED_CLIENT_SECRET,\n // The `issuer` the mock AS publishes in its metadata — the scenario\n // sets neither `metadataIssuer` nor `routePrefix`, so createAuthServer\n // resolves the published issuer to exactly the AS base URL.\n issuer: this.getAsUrl?.()\n };\n }\n\n getChecks(): ConformanceCheck[] {\n // Ensure we have the pre-registration check\n const hasPreRegCheck = this.checks.some(\n (c) => c.id === 'pre-registration-auth'\n );\n if (!hasPreRegCheck) {\n this.checks.push({\n id: 'pre-registration-auth',\n name: 'Pre-registration authentication',\n description: 'Client did not make a token request',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_PREREGISTRATION]\n });\n }\n\n return this.checks;\n }\n}\n",[],[142,474,796,929,963],"bf1a63e2-e6ce-454a-9e22-152d2d2fdacf","offline-access.ts","e174e3e4-ad13-11f1-ad25-1607ee4eb77e",231,["D",1789332107646],"import type { ScenarioContext } from '../../../mock-server/index.ts';\nimport {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION,\n ScenarioUrls\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\n\n/** Whether a grant_types observation (DCR body or CIMD document) is logged. */\nfunction grantTypesCheckedIn(checks: ConformanceCheck[]): boolean {\n return checks.some((c) => c.id === 'sep-2207-client-metadata-grant-types');\n}\n\n/**\n * Scenario: Offline Access Scope (SEP-2207)\n *\n * Tests client behavior when the Authorization Server metadata lists\n * `offline_access` in `scopes_supported`:\n *\n * 1. Client SHOULD include `refresh_token` in `grant_types` client metadata\n * (checked via DCR body or CIMD document, whichever the client uses)\n * 2. Client MAY include `offline_access` in authorization request scope\n *\n * Setup:\n * - AS metadata: scopes_supported includes 'offline_access'\n * - PRM: scopes_supported does NOT include 'offline_access' (per SEP-2207 server guidance)\n * - Both CIMD and DCR paths available\n */\nexport class OfflineAccessScopeScenario extends AuthHandlerScenario {\n name = 'auth/offline-access-scope';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that a client that wants a refresh token handles offline_access scope and refresh_token grant type when AS supports them (SEP-2207)';\n\n private checks: ConformanceCheck[] = [];\n /**\n * Whether to fetch a CIMD client's metadata document. Only when run\n * locally through start(): the hosted server calls authHandlers() itself\n * and must not fetch URLs a client hands it, so there a CIMD client's\n * grant_types stay uninspected (INFO).\n */\n private fetchesCimd = false;\n\n async start(ctx: ScenarioContext): Promise {\n this.fetchesCimd = true;\n return super.start(ctx);\n }\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const tokenVerifier = new MockTokenVerifier(this.checks, ['mcp:basic']);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n scopesSupported: ['mcp:basic', 'offline_access'],\n clientIdMetadataDocumentSupported: true,\n onRegistrationRequest: (req) => {\n // DCR path: inspect grant_types in registration body\n const grantTypes: string[] = req.body.grant_types || [];\n const hasRefreshToken = grantTypes.includes('refresh_token');\n this.checks.push({\n id: 'sep-2207-client-metadata-grant-types',\n name: 'Client metadata includes refresh_token grant type (DCR)',\n description: hasRefreshToken\n ? 'Client correctly included refresh_token in grant_types during dynamic client registration'\n : 'Client SHOULD include refresh_token in grant_types client metadata (SEP-2207)',\n status: hasRefreshToken ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n registrationMethod: 'DCR',\n grantTypes: grantTypes.length > 0 ? grantTypes.join(' ') : 'none'\n }\n });\n\n const clientId = `test-client-${Date.now()}`;\n return {\n clientId,\n clientSecret: undefined,\n tokenEndpointAuthMethod: 'none'\n };\n },\n onAuthorizationRequest: async (data) => {\n // Check if client included offline_access in scope\n const requestedScopes = data.scope ? data.scope.split(' ') : [];\n const hasOfflineAccess = requestedScopes.includes('offline_access');\n this.checks.push({\n id: 'sep-2207-offline-access-requested',\n name: 'Client requests offline_access scope',\n description: hasOfflineAccess\n ? 'Client included offline_access in authorization request scope when AS lists it in scopes_supported'\n : 'Client MAY include offline_access in scope when AS metadata lists it in scopes_supported (SEP-2207). Client chose not to request it.',\n status: hasOfflineAccess ? 'SUCCESS' : 'INFO',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n asScopesSupported: 'mcp:basic offline_access',\n requestedScope: data.scope || 'none'\n }\n });\n\n // A URL-based client_id (CIMD): inspect its metadata document now,\n // before answering, so the observation is in the log that the\n // results are judged from.\n if (\n this.fetchesCimd &&\n data.clientId?.startsWith('http') &&\n !grantTypesCheckedIn(this.checks)\n ) {\n await this.inspectCimd(data.clientId);\n }\n }\n });\n\n // PRM does NOT include offline_access (per SEP-2207 server guidance:\n // servers SHOULD NOT include offline_access in PRM scopes_supported)\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: ['mcp:basic'],\n scopesSupported: ['mcp:basic'],\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n /** Fetch a CIMD client's metadata document and log its grant_types. */\n private async inspectCimd(cimdUrl: string): Promise {\n const controller = new AbortController();\n const timeout = setTimeout(() => controller.abort(), 3000);\n try {\n const response = await fetch(cimdUrl, { signal: controller.signal });\n if (response.ok) {\n const metadata = await response.json();\n const grantTypes: string[] = metadata.grant_types || [];\n const hasRefreshToken = grantTypes.includes('refresh_token');\n this.checks.push({\n id: 'sep-2207-client-metadata-grant-types',\n name: 'Client metadata includes refresh_token grant type (CIMD)',\n description: hasRefreshToken\n ? 'Client metadata document includes refresh_token in grant_types'\n : 'Client SHOULD include refresh_token in grant_types client metadata (SEP-2207)',\n status: hasRefreshToken ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n registrationMethod: 'CIMD',\n cimdUrl,\n grantTypes: grantTypes.length > 0 ? grantTypes.join(' ') : 'none'\n }\n });\n }\n } catch {\n // CIMD URL didn't resolve - emit info check\n this.checks.push({\n id: 'sep-2207-client-metadata-grant-types',\n name: 'Client metadata includes refresh_token grant type (CIMD)',\n description:\n 'Client used CIMD but metadata URL could not be fetched to verify grant_types',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n registrationMethod: 'CIMD',\n cimdUrl,\n fetchFailed: true\n }\n });\n } finally {\n clearTimeout(timeout);\n }\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const timestamp = new Date().toISOString();\n\n // If grant_types was never checked (no DCR, no CIMD, possibly pre-registered)\n if (!grantTypesCheckedIn(this.checks)) {\n checks.push({\n id: 'sep-2207-client-metadata-grant-types',\n name: 'Client metadata includes refresh_token grant type',\n description:\n 'Client did not use DCR or fetchable CIMD — grant_types could not be inspected',\n status: 'INFO',\n timestamp,\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n registrationMethod: 'unknown'\n }\n });\n }\n\n // If offline_access check never ran, the authorization flow didn't complete\n if (\n !this.checks.some((c) => c.id === 'sep-2207-offline-access-requested')\n ) {\n checks.push({\n id: 'sep-2207-offline-access-requested',\n name: 'Client requests offline_access scope',\n description:\n 'Client did not complete authorization flow — offline_access scope check could not be performed',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE]\n });\n }\n\n return checks;\n }\n}\n\n/**\n * Scenario: Offline Access Not Supported (SEP-2207)\n *\n * Tests that clients do NOT include `offline_access` in the authorization\n * request scope when the AS metadata does NOT list it in `scopes_supported`.\n *\n * Per SEP-2207, clients MAY add offline_access only \"when the Authorization\n * Server's metadata lists it in scopes_supported\". If the AS doesn't support\n * it, requesting it is an error (requesting an unsupported scope).\n *\n * Setup:\n * - AS metadata: scopes_supported does NOT include 'offline_access'\n * - PRM: standard scopes\n */\nexport class OfflineAccessNotSupportedScenario extends AuthHandlerScenario {\n name = 'auth/offline-access-not-supported';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client does not request offline_access when AS does not list it in scopes_supported (SEP-2207)';\n\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const tokenVerifier = new MockTokenVerifier(this.checks, [\n 'mcp:basic',\n 'mcp:read'\n ]);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n scopesSupported: ['mcp:basic', 'mcp:read'],\n onAuthorizationRequest: (data) => {\n const requestedScopes = data.scope ? data.scope.split(' ') : [];\n const hasOfflineAccess = requestedScopes.includes('offline_access');\n this.checks.push({\n id: 'sep-2207-offline-access-not-requested',\n name: 'Client does not request unsupported offline_access',\n description: hasOfflineAccess\n ? 'Client MUST NOT request offline_access when it is not listed in AS scopes_supported (SEP-2207)'\n : 'Client correctly did not request offline_access when AS does not list it in scopes_supported',\n status: hasOfflineAccess ? 'FAILURE' : 'SUCCESS',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n asScopesSupported: 'mcp:basic mcp:read',\n requestedScope: data.scope || 'none'\n }\n });\n }\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: ['mcp:basic', 'mcp:read'],\n scopesSupported: ['mcp:basic', 'mcp:read'],\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n if (\n !this.checks.some((c) => c.id === 'sep-2207-offline-access-not-requested')\n ) {\n checks.push({\n id: 'sep-2207-offline-access-not-requested',\n name: 'Client does not request unsupported offline_access',\n description:\n 'Client did not complete authorization flow — offline_access scope check could not be performed',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE]\n });\n }\n\n return checks;\n }\n}\n",[],[142,474,796,929,971],"0fe56b9f-f746-4f32-94fe-467cb5468b72","march-spec-backcompat.ts","e3b162b8-ad13-11f1-87ac-1607ee4eb77e",138,["D",1789046890769],"import type { ScenarioContext } from '../../../mock-server/index.ts';\nimport type { Scenario, ConformanceCheck } from '../../../types.ts';\nimport { ScenarioUrls } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { SpecReferences } from './spec-references.ts';\n\nexport class Auth20250326OAuthMetadataBackcompatScenario implements Scenario {\n name = 'auth/2025-03-26-oauth-metadata-backcompat';\n readonly source = {\n introducedIn: '2025-03-26',\n removedIn: '2025-06-18'\n } as const;\n description =\n 'Tests 2025-03-26 spec OAuth flow: no PRM (Protected Resource Metadata), OAuth metadata at root location';\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(ctx: ScenarioContext): Promise {\n this.checks = [];\n // Legacy server, so we create the auth server endpoints on the\n // same URL as the main server (rather than separating AS / RS).\n const authApp = createAuthServer(ctx, this.checks, this.server.getUrl, {\n // Disable logging since the main server will already have logging enabled\n loggingEnabled: false,\n // Keep auth endpoints off the 2025-03-26 fallback paths so a client that\n // fetches metadata but ignores the advertised endpoints still 404s.\n routePrefix: '/oauth',\n // Metadata is served at the root well-known path, so per RFC 8414 §3.3\n // the `issuer` must be the bare origin — not `/oauth`.\n metadataIssuer: () => this.server.getUrl()\n });\n const app = createServer(\n ctx,\n this.checks,\n this.server.getUrl,\n this.server.getUrl,\n // Explicitly set to null to indicate no PRM available\n { prmPath: null }\n );\n app.use(authApp);\n\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const expectedSlugs = [\n 'authorization-server-metadata',\n 'client-registration',\n 'authorization-request',\n 'token-request'\n ];\n\n for (const slug of expectedSlugs) {\n if (!this.checks.find((c) => c.id === slug)) {\n this.checks.push({\n id: slug,\n name: `Expected Check Missing: ${slug}`,\n description: `Expected Check Missing: ${slug}`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.LEGACY_2025_03_26_AUTH_DISCOVERY]\n });\n }\n }\n\n return this.checks;\n }\n}\n\nexport class Auth20250326OEndpointFallbackScenario implements Scenario {\n name = 'auth/2025-03-26-oauth-endpoint-fallback';\n readonly source = {\n introducedIn: '2025-03-26',\n removedIn: '2025-06-18'\n } as const;\n description =\n 'Tests OAuth flow with no metadata endpoints, relying on fallback to standard OAuth endpoints at server root (2025-03-26 spec behavior)';\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(ctx: ScenarioContext): Promise {\n this.checks = [];\n\n const app = createServer(\n ctx,\n this.checks,\n this.server.getUrl,\n this.server.getUrl,\n { prmPath: null }\n );\n\n // needed for /token endpoint\n app.use(express.urlencoded({ extended: true }));\n\n app.get('/authorize', (req: Request, res: Response) => {\n this.checks.push({\n id: 'authorization-request',\n name: 'AuthorizationRequest',\n description: 'Client made authorization request to fallback endpoint',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.LEGACY_2025_03_26_AUTH_URL_FALLBACK],\n details: {\n response_type: req.query.response_type,\n client_id: req.query.client_id,\n redirect_uri: req.query.redirect_uri,\n state: req.query.state,\n code_challenge: req.query.code_challenge ? 'present' : 'missing',\n code_challenge_method: req.query.code_challenge_method\n }\n });\n\n const redirectUri = req.query.redirect_uri as string;\n const state = req.query.state as string;\n const redirectUrl = new URL(redirectUri);\n redirectUrl.searchParams.set('code', 'test-auth-code');\n if (state) {\n redirectUrl.searchParams.set('state', state);\n }\n\n res.redirect(redirectUrl.toString());\n });\n\n app.post('/token', (req: Request, res: Response) => {\n this.checks.push({\n id: 'token-request',\n name: 'TokenRequest',\n description: 'Client requested access token from fallback endpoint',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.LEGACY_2025_03_26_AUTH_URL_FALLBACK],\n details: {\n endpoint: '/token',\n grantType: req.body.grant_type\n }\n });\n\n res.json({\n access_token: 'test-token',\n token_type: 'Bearer',\n expires_in: 3600\n });\n });\n\n app.post('/register', (req: Request, res: Response) => {\n this.checks.push({\n id: 'client-registration',\n name: 'ClientRegistration',\n description:\n 'Client registered with authorization server at fallback endpoint',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.LEGACY_2025_03_26_AUTH_URL_FALLBACK],\n details: {\n endpoint: '/register',\n clientName: req.body.client_name\n }\n });\n\n res.status(201).json({\n client_id: 'test-client-id',\n client_secret: 'test-client-secret',\n client_name: req.body.client_name || 'test-client',\n redirect_uris: req.body.redirect_uris || []\n });\n });\n\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const expectedSlugs = [\n 'client-registration',\n 'authorization-request',\n 'token-request'\n ];\n\n for (const slug of expectedSlugs) {\n if (!this.checks.find((c) => c.id === slug)) {\n this.checks.push({\n id: slug,\n name: `Expected Check Missing: ${slug}`,\n description: `Expected Check Missing: ${slug}`,\n status: 'FAILURE',\n timestamp: new Date().toISOString()\n });\n }\n }\n\n return this.checks;\n }\n}\n",[],[142,474,796,929,979],"e3f8ce82-eb3c-46f5-8c49-603a08bbff1e","issuer-parameter.ts","e0bc758e-ad13-11f1-b4fb-1607ee4eb77e",229,["D",1789332107020],"import {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\nimport { untestableCheck } from '../../untestable.ts';\n\nconst specRefs = [SpecReferences.RFC_9207_ISS_PARAMETER];\nconst metadataSpecRefs = [\n SpecReferences.RFC_AUTH_SERVER_METADATA_REQUEST,\n SpecReferences.MCP_AUTH_DISCOVERY\n];\n\n/**\n * What the flow reached, read from the log: the mock servers record every\n * metadata fetch, registration, authorization and token request. Verdicts\n * read these rather than flags set as requests arrive, so a fresh instance\n * judging a merged log (the hosted server, across processes) reaches the\n * same verdict as the instance that served the flow.\n */\nfunction logged(checks: ConformanceCheck[], id: string): boolean {\n return checks.some((c) => c.id === id);\n}\n\n/** The issuer the AS metadata document declared, as createAuthServer logged it. */\nfunction declaredIssuer(checks: ConformanceCheck[]): string | undefined {\n const issuer = checks.find((c) => c.id === 'authorization-server-metadata')\n ?.details?.issuer;\n return typeof issuer === 'string' ? issuer : undefined;\n}\n\n/** The authorization server the PRM document sent the client to. */\nfunction advertisedAuthorizationServer(\n checks: ConformanceCheck[]\n): string | undefined {\n const servers = checks.find((c) => c.id === 'prm-pathbased-requested')\n ?.details?.authorizationServers;\n return Array.isArray(servers) && typeof servers[0] === 'string'\n ? servers[0]\n : undefined;\n}\n\n/** The token every scenario here issues; none of them requests scopes. */\nconst issueToken = () => ({ token: `test-token-${Date.now()}`, scopes: [] });\n\n/**\n * Reason-bound verdict for the RFC 9207 `iss` rejection checks (issue #467).\n *\n * `authReached && !tokenRequestMade` is a verdict, not a reason. SEP-2468\n * conditions every one of these requirements on the issuer the client recorded\n * \"from the selected authorization server validated metadata document\", so a\n * client that never retrieved that document cannot have performed the\n * comparison under test — yet it satisfies the verdict, because not reaching\n * the token endpoint is exactly what a client that fell over earlier also\n * does. Absent the retrieval the requirement was never exercised, which is the\n * untestable case (#248) rather than a pass or a violation.\n *\n * `auth/metadata-issuer-mismatch` in this same file already gates on the\n * metadata fetch; the other checks did not. Keeping the policy in one function\n * is deliberate: the duplication is what let five of six sites drift apart.\n *\n * Residual gap, deliberately not papered over: a client that receives the\n * redirect and then aborts before the token request for an unrelated reason is\n * still indistinguishable from one that rejected on `iss`. Closing that needs\n * a signal from inside the client, which a black-box harness does not have.\n * What this closes is the \"never reached the requirement at all\" class.\n */\nfunction issRejectionCheck(opts: {\n id: string;\n name: string;\n passDescription: string;\n failDescription: string;\n metadataRequested: boolean;\n authReached: boolean;\n tokenRequestMade: boolean;\n observations: Record;\n timestamp: string;\n}): ConformanceCheck {\n const {\n id,\n name,\n passDescription,\n failDescription,\n metadataRequested,\n authReached,\n tokenRequestMade,\n observations,\n timestamp\n } = opts;\n\n const reached = metadataRequested && authReached;\n const observed = {\n ...observations,\n metadataRequested,\n authReached,\n tokenRequestMade\n };\n\n if (!reached) {\n const reason = !metadataRequested\n ? 'client never retrieved the authorization server metadata document, so it never recorded the issuer this comparison is made against'\n : 'client never reached the authorization endpoint, so it never received an authorization response to validate';\n const check = untestableCheck(id, name, failDescription, reason, specRefs);\n check.details = {\n ...check.details,\n ...observed,\n propertyReached: false,\n stopReason: !metadataRequested\n ? 'as-metadata-not-requested'\n : 'authorization-endpoint-not-reached'\n };\n return check;\n }\n\n const correctlyRejected = !tokenRequestMade;\n return {\n id,\n name,\n description: correctlyRejected ? passDescription : failDescription,\n status: correctlyRejected ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n ...observed,\n propertyReached: true,\n stopReason: correctlyRejected\n ? 'declined-before-token-request'\n : 'transmitted-code-to-token-endpoint'\n }\n };\n}\n\n/** Where the iss rejection verdicts read the flow from: the log. */\nfunction issFlow(checks: ConformanceCheck[]) {\n return {\n metadataRequested: logged(checks, 'authorization-server-metadata'),\n authReached: logged(checks, 'authorization-request'),\n tokenRequestMade: logged(checks, 'token-request')\n };\n}\n\n/**\n * Scenario: ISS Parameter Supported (positive)\n *\n * Server advertises authorization_response_iss_parameter_supported: true and\n * includes the correct iss value in the authorization redirect. A conformant\n * client should validate iss and proceed normally.\n */\nexport class IssParameterSupportedScenario extends AuthHandlerScenario {\n name = 'auth/iss-supported';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client accepts authorization response when server advertises and sends correct iss parameter';\n\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n issParameterSupported: true,\n issInRedirect: 'correct',\n onTokenRequest: issueToken\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n requiredScopes: [],\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const timestamp = new Date().toISOString();\n const tokenRequestMade = logged(this.checks, 'token-request');\n\n checks.push({\n id: 'sep-2468-client-compare-iss-supported',\n name: 'Client accepts matching iss when advertised',\n description: tokenRequestMade\n ? 'Client compared advertised iss against recorded issuer and proceeded to token exchange'\n : 'Client did not proceed to token exchange after receiving a correct iss from a server that advertised support',\n status: tokenRequestMade ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: { tokenRequestMade }\n });\n\n return checks;\n }\n}\n\n/**\n * Scenario: ISS Parameter Not Advertised (positive)\n *\n * Server does not advertise authorization_response_iss_parameter_supported and\n * does not include iss in the redirect. A conformant client should proceed normally.\n */\nexport class IssParameterNotAdvertisedScenario extends AuthHandlerScenario {\n name = 'auth/iss-not-advertised';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client accepts authorization response when server does not advertise or send iss parameter';\n\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n issParameterSupported: null,\n issInRedirect: 'omit',\n onTokenRequest: issueToken\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n requiredScopes: [],\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const timestamp = new Date().toISOString();\n const tokenRequestMade = logged(this.checks, 'token-request');\n\n checks.push({\n id: 'sep-2468-client-proceed-no-iss',\n name: 'Client proceeds when iss absent and not advertised',\n description: tokenRequestMade\n ? 'Client proceeded to token exchange when neither metadata advertised iss support nor redirect contained iss'\n : 'Client did not proceed to token exchange — should proceed when iss is absent and not advertised',\n status: tokenRequestMade ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: { tokenRequestMade }\n });\n\n return checks;\n }\n}\n\n/**\n * Scenario: ISS Parameter Advertised but Missing from Redirect (client must reject)\n *\n * Server advertises authorization_response_iss_parameter_supported: true but\n * omits iss from the redirect. A conformant client MUST reject this response.\n */\nexport class IssParameterSupportedMissingScenario extends AuthHandlerScenario {\n name = 'auth/iss-supported-missing';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client rejects authorization response when server advertised iss support but omitted iss from redirect';\n allowClientError = true;\n\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n issParameterSupported: true,\n issInRedirect: 'omit', // advertise support but don't send iss\n onTokenRequest: issueToken\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n requiredScopes: [],\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const timestamp = new Date().toISOString();\n\n if (!checks.some((c) => c.id === 'sep-2468-client-reject-missing-iss')) {\n checks.push(\n issRejectionCheck({\n id: 'sep-2468-client-reject-missing-iss',\n name: 'Client rejects missing iss when required',\n passDescription:\n 'Client correctly rejected authorization response missing required iss parameter',\n failDescription:\n 'Client MUST reject authorization response when server advertised iss support but iss is absent from redirect',\n ...issFlow(this.checks),\n observations: {\n serverAdvertisedSupport: true,\n issSentInRedirect: false\n },\n timestamp\n })\n );\n }\n\n return checks;\n }\n}\n\n/**\n * Scenario: ISS Parameter Has Wrong Value (client must reject)\n *\n * Server advertises authorization_response_iss_parameter_supported: true and\n * includes an iss value that does not match the server's actual issuer. A\n * conformant client MUST reject this response.\n */\nexport class IssParameterWrongIssuerScenario extends AuthHandlerScenario {\n name = 'auth/iss-wrong-issuer';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client rejects authorization response when iss does not match the authorization server issuer';\n allowClientError = true;\n\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n issParameterSupported: true,\n issInRedirect: 'wrong', // send iss that doesn't match metadata issuer\n onTokenRequest: issueToken\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n requiredScopes: [],\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const timestamp = new Date().toISOString();\n\n if (!checks.some((c) => c.id === 'sep-2468-client-compare-iss-supported')) {\n checks.push(\n issRejectionCheck({\n id: 'sep-2468-client-compare-iss-supported',\n name: 'Client rejects mismatched iss',\n passDescription:\n 'Client correctly rejected authorization response with mismatched iss parameter',\n failDescription:\n 'Client MUST reject authorization response when iss does not match the authorization server issuer',\n ...issFlow(this.checks),\n observations: {\n serverAdvertisedSupport: true,\n issSentInRedirect: 'https://evil.example.com'\n },\n timestamp\n })\n );\n }\n\n return checks;\n }\n}\n\n/**\n * Scenario: ISS Parameter Sent but Not Advertised, Mismatched (client must reject)\n *\n * Server does not advertise authorization_response_iss_parameter_supported but\n * includes a mismatched iss value in the redirect. Per the SEP-2468 spec table\n * row 3, a conformant client MUST compare a present iss against the recorded\n * issuer regardless of metadata advertisement, and reject on mismatch.\n */\nexport class IssParameterUnexpectedScenario extends AuthHandlerScenario {\n name = 'auth/iss-unexpected';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client compares iss against recorded issuer even when not advertised, and rejects on mismatch';\n allowClientError = true;\n\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n issParameterSupported: null,\n issInRedirect: 'wrong', // send mismatched iss without advertising support\n onTokenRequest: issueToken\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n requiredScopes: [],\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const timestamp = new Date().toISOString();\n\n if (\n !checks.some((c) => c.id === 'sep-2468-client-compare-iss-unadvertised')\n ) {\n checks.push(\n issRejectionCheck({\n id: 'sep-2468-client-compare-iss-unadvertised',\n name: 'Client compares unadvertised iss and rejects mismatch',\n passDescription:\n 'Client correctly compared unadvertised iss against recorded issuer and rejected the mismatch',\n failDescription:\n 'Client MUST compare a present iss against the recorded issuer regardless of metadata advertisement, and reject on mismatch',\n ...issFlow(this.checks),\n observations: {\n serverAdvertisedSupport: false,\n issSentInRedirect: 'https://evil.example.com'\n },\n timestamp\n })\n );\n }\n\n return checks;\n }\n}\n\n/**\n * Scenario: ISS Parameter Is a Normalization-Equivalent Variant (client must reject)\n *\n * Server advertises authorization_response_iss_parameter_supported: true and\n * includes an iss value that differs from the recorded issuer only by RFC 3986\n * normalization (a trailing slash on an empty path — exactly what\n * `new URL(x).href` round-tripping produces). SEP-2468 requires simple string\n * comparison with no scheme/host case folding, default-port elision,\n * trailing-slash, or percent-encoding normalization, so a conformant client\n * MUST treat the variant as a mismatch and reject the response.\n */\nexport class IssParameterNormalizedVariantScenario extends AuthHandlerScenario {\n name = 'auth/iss-normalized';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client compares iss using simple string comparison without applying URL normalization';\n allowClientError = true;\n\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n issParameterSupported: true,\n issInRedirect: 'normalized', // correct issuer + trailing slash\n onTokenRequest: issueToken\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n requiredScopes: [],\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const timestamp = new Date().toISOString();\n\n if (!checks.some((c) => c.id === 'sep-2468-client-no-normalization')) {\n // The issuer as the log shows it; a client that never fetched the\n // metadata document never recorded one, and neither does the check.\n const recordedIssuer = declaredIssuer(this.checks);\n checks.push(\n issRejectionCheck({\n id: 'sep-2468-client-no-normalization',\n name: 'Client compares iss without URL normalization',\n passDescription:\n 'Client rejected an iss value that only matches the recorded issuer after URL normalization',\n failDescription:\n 'Client MUST NOT apply scheme/host case folding, default-port elision, trailing-slash, or percent-encoding normalization to iss before comparison; a trailing-slash variant of the issuer must be treated as a mismatch',\n ...issFlow(this.checks),\n observations:\n recordedIssuer === undefined\n ? {}\n : { recordedIssuer, issSentInRedirect: `${recordedIssuer}/` },\n timestamp\n })\n );\n }\n\n return checks;\n }\n}\n\n/**\n * Scenario: AS Metadata Issuer Mismatch (client must not use the metadata)\n *\n * The authorization server metadata document declares an `issuer` that is not\n * identical to the issuer identifier used to construct the well-known URL.\n * Per RFC 8414 §3.3 / OpenID Connect Discovery §4.3 (incorporated by\n * SEP-2468), the client MUST validate the issuer and MUST NOT use the\n * metadata on mismatch. The endpoints in the poisoned document live under a\n * non-default route prefix, so any request that reaches them proves the\n * client used the metadata.\n */\nexport class MetadataIssuerMismatchScenario extends AuthHandlerScenario {\n name = 'auth/metadata-issuer-mismatch';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client rejects authorization server metadata whose issuer does not match the issuer used to construct the well-known URL';\n allowClientError = true;\n\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n tokenVerifier,\n // The well-known URL is constructed from the AS URL advertised in PRM\n // (the bare origin), so the document's issuer must equal that origin.\n // Serve something else entirely.\n metadataIssuer: 'https://attacker.example.com',\n // Park the endpoints under a prefix only discoverable via the poisoned\n // metadata, so \"client used the metadata\" is observable as a request.\n routePrefix: '/mismatched-as',\n onRegistrationRequest: () => ({\n clientId: 'test-client-id',\n clientSecret: 'test-client-secret'\n }),\n onTokenRequest: issueToken\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl, {\n requiredScopes: [],\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const timestamp = new Date().toISOString();\n\n if (\n !checks.some((c) => c.id === 'sep-2468-client-validate-metadata-issuer')\n ) {\n const metadataRequested = logged(\n this.checks,\n 'authorization-server-metadata'\n );\n // Any request to the endpoints the poisoned document names.\n const metadataEndpointsUsed = [\n 'client-registration',\n 'authorization-request',\n 'token-request'\n ].some((id) => logged(this.checks, id));\n // The issuer the PRM sent the client to, when the log shows it.\n const expectedIssuer = advertisedAuthorizationServer(this.checks);\n const observations = {\n ...(expectedIssuer !== undefined && { expectedIssuer }),\n metadataIssuer: 'https://attacker.example.com',\n metadataRequested,\n metadataEndpointsUsed\n };\n const failDescription =\n 'Client MUST NOT use authorization server metadata whose issuer differs from the issuer identifier used to construct the well-known URL; client used endpoints from the mismatched metadata';\n\n // This check already bound its verdict to the metadata fetch, but\n // reported the unreached case as a plain violation. Per #248 a\n // requirement that could not be exercised is untestable, so the report\n // distinguishes \"client used the poisoned metadata\" from \"client never\n // fetched it\" instead of collapsing both into FAILURE (#467).\n if (!metadataRequested) {\n const check = untestableCheck(\n 'sep-2468-client-validate-metadata-issuer',\n 'Client validates metadata issuer against well-known URL',\n failDescription,\n 'client never retrieved the authorization server metadata document, so issuer validation could not be observed',\n metadataSpecRefs\n );\n check.details = {\n ...check.details,\n ...observations,\n propertyReached: false,\n stopReason: 'as-metadata-not-requested'\n };\n checks.push(check);\n } else {\n const correctlyRejected = !metadataEndpointsUsed;\n checks.push({\n id: 'sep-2468-client-validate-metadata-issuer',\n name: 'Client validates metadata issuer against well-known URL',\n description: correctlyRejected\n ? 'Client rejected authorization server metadata whose issuer does not match the issuer identifier used to construct the well-known URL'\n : failDescription,\n status: correctlyRejected ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: metadataSpecRefs,\n details: {\n ...observations,\n propertyReached: true,\n stopReason: correctlyRejected\n ? 'declined-poisoned-metadata'\n : 'used-poisoned-metadata-endpoints'\n }\n });\n }\n }\n\n return checks;\n }\n}\n",[],[142,474,796,929,987],"f7bf93f5-df45-4dc4-9041-e83e3d5c007e","d7111a94-ad13-11f1-8600-1607ee4eb77e",79,["D",1789046853642],"import { Scenario } from '../../../types.ts';\nimport { metadataScenarios } from './discovery-metadata.ts';\nimport { AuthBasicCIMDScenario } from './basic-cimd.ts';\nimport {\n Auth20250326OAuthMetadataBackcompatScenario,\n Auth20250326OEndpointFallbackScenario\n} from './march-spec-backcompat.ts';\nimport {\n ScopeFromWwwAuthenticateScenario,\n ScopeFromScopesSupportedScenario,\n ScopeOmittedWhenUndefinedScenario,\n ScopeStepUpAuthScenario,\n ScopeRetryLimitScenario\n} from './scope-handling.ts';\nimport {\n ClientSecretBasicAuthScenario,\n ClientSecretPostAuthScenario,\n PublicClientAuthScenario\n} from './token-endpoint-auth.ts';\nimport {\n ClientCredentialsJwtScenario,\n ClientCredentialsBasicScenario\n} from './client-credentials.ts';\nimport { ResourceMismatchScenario } from './resource-mismatch.ts';\nimport { PreRegistrationScenario } from './pre-registration.ts';\nimport { EnterpriseManagedAuthorizationScenario } from './enterprise-managed-authorization.ts';\nimport { WifJwtBearerScenario } from './wif-jwt-bearer.ts';\nimport { DPoPClientScenario } from './dpop.ts';\nimport {\n OfflineAccessScopeScenario,\n OfflineAccessNotSupportedScenario\n} from './offline-access.ts';\nimport { AuthorizationServerMigrationScenario } from './authorization-server-migration.ts';\nimport {\n IssParameterSupportedScenario,\n IssParameterNotAdvertisedScenario,\n IssParameterSupportedMissingScenario,\n IssParameterWrongIssuerScenario,\n IssParameterUnexpectedScenario,\n IssParameterNormalizedVariantScenario,\n MetadataIssuerMismatchScenario\n} from './issuer-parameter.ts';\n\n// Auth scenarios (required for tier 1)\nexport const authScenariosList: Scenario[] = [\n ...metadataScenarios,\n new AuthBasicCIMDScenario(),\n new ScopeFromWwwAuthenticateScenario(),\n new ScopeFromScopesSupportedScenario(),\n new ScopeOmittedWhenUndefinedScenario(),\n new ScopeStepUpAuthScenario(),\n new ScopeRetryLimitScenario(),\n new ClientSecretBasicAuthScenario(),\n new ClientSecretPostAuthScenario(),\n new PublicClientAuthScenario(),\n new PreRegistrationScenario()\n];\n\n// Back-compat scenarios (optional - backward compatibility with older spec versions)\nexport const backcompatScenariosList: Scenario[] = [\n new Auth20250326OAuthMetadataBackcompatScenario(),\n new Auth20250326OEndpointFallbackScenario()\n];\n\n// Extension scenarios (optional for tier 1 - protocol extensions)\nexport const extensionScenariosList: Scenario[] = [\n new ClientCredentialsJwtScenario(),\n new ClientCredentialsBasicScenario(),\n new EnterpriseManagedAuthorizationScenario(),\n new DPoPClientScenario(false), // auth/dpop — nonce-less baseline (common case)\n new DPoPClientScenario(true), // auth/dpop-nonce — server-required nonce (§8/§9)\n new WifJwtBearerScenario()\n];\n\n// Draft scenarios (informational - not scored for tier assessment)\nexport const draftScenariosList: Scenario[] = [\n new ResourceMismatchScenario(),\n new OfflineAccessScopeScenario(),\n new OfflineAccessNotSupportedScenario(),\n new AuthorizationServerMigrationScenario(),\n new IssParameterSupportedScenario(),\n new IssParameterNotAdvertisedScenario(),\n new IssParameterSupportedMissingScenario(),\n new IssParameterWrongIssuerScenario(),\n new IssParameterUnexpectedScenario(),\n new IssParameterNormalizedVariantScenario(),\n new MetadataIssuerMismatchScenario()\n];\n",[],[142,474,796,929,357],"e7410f46-f1e6-4d80-b054-5f708ac98472","enterprise-managed-authorization.ts","e1c8a150-ad13-11f1-a41e-1607ee4eb77e",132,["D",1789046888565],"import type { ScenarioContext } from '../../../mock-server/index.ts';\nimport * as jose from 'npm:jose@^6.1.2';\nimport type { CryptoKey } from 'npm:jose@^6.1.2';\nimport express, { type Request, type Response } from 'npm:express@^5.1.0';\nimport type { Scenario, ConformanceCheck, ScenarioUrls } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { JWT_BEARER_GRANT_TYPE } from './helpers/createWorkloadJwt.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport { SpecReferences } from './spec-references.ts';\n\nconst CONFORMANCE_TEST_CLIENT_ID = 'conformance-test-xaa-client';\nconst CONFORMANCE_TEST_CLIENT_SECRET = 'conformance-test-xaa-secret';\nconst IDP_CLIENT_ID = 'conformance-test-idp-client';\nconst DEMO_USER_ID = 'demo-user@example.com';\n\n/**\n * Generate an EC P-256 keypair for IDP ID token signing.\n */\nasync function generateIdpKeypair(): Promise<{\n publicKey: CryptoKey;\n privateKey: CryptoKey;\n}> {\n const { publicKey, privateKey } = await jose.generateKeyPair('ES256', {\n extractable: true\n });\n return { publicKey, privateKey };\n}\n\n/**\n * Create a signed ID token from the IDP\n */\nasync function createIdpIdToken(\n privateKey: CryptoKey,\n idpIssuer: string,\n audience: string,\n userId: string = DEMO_USER_ID\n): Promise {\n return await new jose.SignJWT({\n sub: userId,\n email: userId,\n aud: audience\n })\n .setProtectedHeader({ alg: 'ES256' })\n .setIssuer(idpIssuer)\n .setIssuedAt()\n .setExpirationTime('1h')\n .sign(privateKey);\n}\n\n/**\n * Scenario: Enterprise-Managed Authorization (SEP-990)\n *\n * Tests the complete SEP-990 flow: IDP ID token -> authorization grant -> access token\n * This scenario combines both RFC 8693 token exchange and RFC 7523 JWT bearer grant.\n */\nexport class EnterpriseManagedAuthorizationScenario implements Scenario {\n name = 'auth/enterprise-managed-authorization';\n readonly source = {\n extensionId: 'io.modelcontextprotocol/enterprise-managed-authorization'\n } as const;\n description =\n 'Tests complete SEP-990 flow: token exchange + JWT bearer grant (Enterprise-Managed Authorization)';\n\n private idpServer = new ServerLifecycle();\n private authServer = new ServerLifecycle();\n private mcpServer = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private idpPublicKey?: CryptoKey;\n private idpPrivateKey?: CryptoKey;\n private grantKeypairs: Map = new Map();\n\n async start(ctx: ScenarioContext): Promise {\n this.checks = [];\n\n // Generate IDP keypair\n const { publicKey, privateKey } = await generateIdpKeypair();\n this.idpPublicKey = publicKey;\n this.idpPrivateKey = privateKey;\n\n // Shared token verifier ensures MCP server only accepts tokens\n // actually issued by the auth server\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n // Start IDP server\n await this.startIdpServer();\n\n // Start auth server with JWT bearer grant support only\n // Token exchange is handled by IdP\n const authApp = createAuthServer(ctx, this.checks, this.authServer.getUrl, {\n grantTypesSupported: [JWT_BEARER_GRANT_TYPE],\n tokenEndpointAuthMethodsSupported: ['client_secret_basic'],\n tokenVerifier,\n onTokenRequest: async ({\n grantType,\n body,\n timestamp,\n authBaseUrl,\n authorizationHeader\n }) => {\n // Auth server only handles JWT bearer grant (ID-JAG -> access token)\n if (grantType === JWT_BEARER_GRANT_TYPE) {\n const mcpResourceUrl = `${this.mcpServer.getUrl()}/mcp`;\n return await this.handleJwtBearerGrant(\n body,\n timestamp,\n authBaseUrl,\n authorizationHeader,\n mcpResourceUrl\n );\n }\n\n return {\n error: 'unsupported_grant_type',\n errorDescription: `Auth server only supports jwt-bearer grant, got ${grantType}`\n };\n }\n });\n\n await this.authServer.start(authApp);\n\n // Start MCP server with shared token verifier\n const mcpApp = createServer(\n ctx,\n this.checks,\n this.mcpServer.getUrl,\n this.authServer.getUrl,\n { tokenVerifier }\n );\n\n await this.mcpServer.start(mcpApp);\n\n // Generate IDP ID token for client\n const idpIdToken = await createIdpIdToken(\n this.idpPrivateKey!,\n this.idpServer.getUrl(),\n IDP_CLIENT_ID\n );\n\n return {\n serverUrl: `${this.mcpServer.getUrl()}/mcp`,\n context: {\n client_id: CONFORMANCE_TEST_CLIENT_ID,\n client_secret: CONFORMANCE_TEST_CLIENT_SECRET,\n idp_client_id: IDP_CLIENT_ID,\n idp_id_token: idpIdToken,\n idp_issuer: this.idpServer.getUrl(),\n idp_token_endpoint: `${this.idpServer.getUrl()}/token`\n }\n };\n }\n\n private async startIdpServer(): Promise {\n const app = express();\n app.use(express.json());\n app.use(express.urlencoded({ extended: true }));\n\n // IDP metadata endpoint\n app.get(\n '/.well-known/openid-configuration',\n (req: Request, res: Response) => {\n res.json({\n issuer: this.idpServer.getUrl(),\n authorization_endpoint: `${this.idpServer.getUrl()}/authorize`,\n token_endpoint: `${this.idpServer.getUrl()}/token`,\n jwks_uri: `${this.idpServer.getUrl()}/.well-known/jwks.json`,\n grant_types_supported: [\n 'urn:ietf:params:oauth:grant-type:token-exchange'\n ]\n });\n }\n );\n\n // IDP token endpoint - handles token exchange (IDP ID token -> ID-JAG)\n app.post('/token', async (req: Request, res: Response) => {\n const timestamp = new Date().toISOString();\n const grantType = req.body.grant_type;\n const subjectToken = req.body.subject_token;\n const subjectTokenType = req.body.subject_token_type;\n const requestedTokenType = req.body.requested_token_type;\n const audience = req.body.audience;\n const resource = req.body.resource;\n\n // Only handle token exchange at IdP\n if (grantType !== 'urn:ietf:params:oauth:grant-type:token-exchange') {\n this.checks.push({\n id: 'complete-flow-token-exchange',\n name: 'CompleteFlowTokenExchange',\n description: `IdP expected token-exchange grant, got ${grantType}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_8693_TOKEN_EXCHANGE]\n });\n res.status(400).json({\n error: 'unsupported_grant_type',\n error_description: 'IdP only supports token-exchange'\n });\n return;\n }\n\n // Verify all required token exchange parameters per SEP-990\n const missingParams: string[] = [];\n if (!subjectToken) missingParams.push('subject_token');\n if (subjectTokenType !== 'urn:ietf:params:oauth:token-type:id_token') {\n missingParams.push(\n `subject_token_type (expected urn:ietf:params:oauth:token-type:id_token, got ${subjectTokenType || 'missing'})`\n );\n }\n if (requestedTokenType !== 'urn:ietf:params:oauth:token-type:id-jag') {\n missingParams.push(\n `requested_token_type (expected urn:ietf:params:oauth:token-type:id-jag, got ${requestedTokenType || 'missing'})`\n );\n }\n if (!audience) missingParams.push('audience');\n if (!resource) missingParams.push('resource');\n\n if (missingParams.length > 0) {\n this.checks.push({\n id: 'complete-flow-token-exchange',\n name: 'CompleteFlowTokenExchange',\n description: `Token exchange missing or invalid required parameters: ${missingParams.join(', ')}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [\n SpecReferences.RFC_8693_TOKEN_EXCHANGE,\n SpecReferences.SEP_990_ENTERPRISE_OAUTH\n ]\n });\n res.status(400).json({\n error: 'invalid_request',\n error_description: `Missing or invalid required parameters: ${missingParams.join(', ')}`\n });\n return;\n }\n\n try {\n // Verify the IDP ID token\n const { payload } = await jose.jwtVerify(\n subjectToken,\n this.idpPublicKey!,\n {\n audience: IDP_CLIENT_ID,\n issuer: this.idpServer.getUrl()\n }\n );\n\n this.checks.push({\n id: 'complete-flow-token-exchange',\n name: 'CompleteFlowTokenExchange',\n description:\n 'Successfully exchanged IDP ID token for ID-JAG at IdP with all required parameters',\n status: 'SUCCESS',\n timestamp,\n specReferences: [\n SpecReferences.RFC_8693_TOKEN_EXCHANGE,\n SpecReferences.SEP_990_ENTERPRISE_OAUTH\n ]\n });\n\n // Create ID-JAG (ID-bound JSON Assertion Grant)\n // Include resource and client_id claims per SEP-990\n const userId = payload.sub as string;\n const { publicKey, privateKey } = await jose.generateKeyPair('ES256');\n this.grantKeypairs.set(userId, publicKey);\n\n // The IdP uses CONFORMANCE_TEST_CLIENT_ID (the MCP Client's client_id\n // at the AS), not the IdP client_id from the request body.\n // Per Section 6.1: \"the IdP will need to be aware of the MCP Client's\n // client_id that it normally uses with the MCP Server.\"\n const idJag = await new jose.SignJWT({\n sub: userId,\n resource: resource,\n client_id: CONFORMANCE_TEST_CLIENT_ID\n })\n .setProtectedHeader({ alg: 'ES256', typ: 'oauth-id-jag+jwt' })\n .setIssuer(this.idpServer.getUrl())\n .setAudience(audience)\n .setIssuedAt()\n .setExpirationTime('5m')\n .setJti(crypto.randomUUID())\n .sign(privateKey);\n\n res.json({\n access_token: idJag,\n issued_token_type: 'urn:ietf:params:oauth:token-type:id-jag',\n token_type: 'N_A'\n });\n } catch (e) {\n const errorMessage = e instanceof Error ? e.message : String(e);\n this.checks.push({\n id: 'complete-flow-token-exchange',\n name: 'CompleteFlowTokenExchange',\n description: `Token exchange failed: ${errorMessage}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_8693_TOKEN_EXCHANGE]\n });\n res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid ID token'\n });\n }\n });\n\n await this.idpServer.start(app);\n }\n\n private async handleJwtBearerGrant(\n body: Record,\n timestamp: string,\n authBaseUrl: string,\n authorizationHeader?: string,\n mcpResourceUrl?: string\n ): Promise {\n // 1. Verify client authentication (client_secret_basic)\n if (!authorizationHeader || !authorizationHeader.startsWith('Basic ')) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description:\n 'Missing or invalid Authorization header for client_secret_basic authentication',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH],\n details: {\n expected: 'Authorization: Basic ',\n received: authorizationHeader || 'missing'\n }\n });\n return {\n error: 'invalid_client',\n errorDescription:\n 'Client authentication required (client_secret_basic)',\n statusCode: 401\n };\n }\n\n const base64Credentials = authorizationHeader.slice('Basic '.length);\n const decoded = Buffer.from(base64Credentials, 'base64').toString('utf-8');\n const separatorIndex = decoded.indexOf(':');\n if (separatorIndex === -1) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: 'Malformed Basic auth header (no colon separator)',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH]\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Malformed Basic auth',\n statusCode: 401\n };\n }\n\n const authClientId = decodeURIComponent(decoded.slice(0, separatorIndex));\n const authClientSecret = decodeURIComponent(\n decoded.slice(separatorIndex + 1)\n );\n\n if (\n authClientId !== CONFORMANCE_TEST_CLIENT_ID ||\n authClientSecret !== CONFORMANCE_TEST_CLIENT_SECRET\n ) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: `Client authentication failed: invalid credentials (client_id: ${authClientId})`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH]\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Invalid client credentials',\n statusCode: 401\n };\n }\n\n // 2. Verify assertion is present\n const assertion = body.assertion;\n if (!assertion) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: 'Missing assertion in JWT bearer grant',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_7523_JWT_BEARER]\n });\n return {\n error: 'invalid_request',\n errorDescription: 'Missing assertion'\n };\n }\n\n try {\n // 3. Verify the ID-JAG header has the correct typ\n const header = jose.decodeProtectedHeader(assertion);\n if (header.typ !== 'oauth-id-jag+jwt') {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: `ID-JAG has wrong typ header: expected oauth-id-jag+jwt, got ${header.typ}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH]\n });\n return {\n error: 'invalid_grant',\n errorDescription: 'Invalid ID-JAG typ header'\n };\n }\n\n // 4. Decode and verify the ID-JAG\n const decoded = jose.decodeJwt(assertion);\n const userId = decoded.sub as string;\n const publicKey = this.grantKeypairs.get(userId);\n\n if (!publicKey) {\n throw new Error('Unknown authorization grant');\n }\n\n // Verify signature and audience\n const withoutSlash = authBaseUrl.replace(/\\/+$/, '');\n const withSlash = `${withoutSlash}/`;\n\n await jose.jwtVerify(assertion, publicKey, {\n audience: [withoutSlash, withSlash],\n clockTolerance: 30\n });\n\n // 5. Verify client_id in ID-JAG matches the authenticating client (Section 5.1)\n const jagClientId = decoded.client_id as string | undefined;\n if (jagClientId !== authClientId) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: `ID-JAG client_id (${jagClientId}) does not match authenticating client (${authClientId})`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH],\n details: {\n jagClientId,\n authClientId\n }\n });\n return {\n error: 'invalid_grant',\n errorDescription:\n 'ID-JAG client_id does not match authenticating client'\n };\n }\n\n // 6. Verify resource claim in ID-JAG matches the MCP server resource\n const jagResource = decoded.resource as string | undefined;\n if (mcpResourceUrl && jagResource !== mcpResourceUrl) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: `ID-JAG resource (${jagResource}) does not match MCP server resource (${mcpResourceUrl})`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH],\n details: {\n jagResource,\n expectedResource: mcpResourceUrl\n }\n });\n return {\n error: 'invalid_grant',\n errorDescription: 'ID-JAG resource does not match MCP server resource'\n };\n }\n\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description:\n 'Successfully verified client auth, ID-JAG claims, and exchanged for access token',\n status: 'SUCCESS',\n timestamp,\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_990_ENTERPRISE_OAUTH\n ]\n });\n\n const scopes = body.scope ? body.scope.split(' ') : [];\n return {\n token: `test-token-${Date.now()}`,\n scopes\n };\n } catch (e) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: `JWT bearer grant failed: ${e}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_7523_JWT_BEARER]\n });\n return {\n error: 'invalid_grant',\n errorDescription: 'Invalid authorization grant'\n };\n }\n }\n\n async stop() {\n await this.idpServer.stop();\n await this.authServer.stop();\n await this.mcpServer.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const hasTokenExchangeCheck = this.checks.some(\n (c) => c.id === 'complete-flow-token-exchange'\n );\n const hasJwtBearerCheck = this.checks.some(\n (c) => c.id === 'complete-flow-jwt-bearer'\n );\n\n if (!hasTokenExchangeCheck) {\n this.checks.push({\n id: 'complete-flow-token-exchange',\n name: 'CompleteFlowTokenExchange',\n description: 'Client did not perform token exchange',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_8693_TOKEN_EXCHANGE,\n SpecReferences.SEP_990_ENTERPRISE_OAUTH\n ]\n });\n }\n\n if (!hasJwtBearerCheck) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: 'Client did not perform JWT bearer grant exchange',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_990_ENTERPRISE_OAUTH\n ]\n });\n }\n\n return this.checks;\n }\n}\n",[],[142,474,796,929,1002],"c56c0765-00bc-499e-9055-6f8ccb85df7a","dpop.ts","75cf7e12-ad1b-11f1-9ded-1607ee4eb77e",130,["D",1789046887724],"import type { ScenarioContext } from '../../../mock-server/index.ts';\nimport type {\n Scenario,\n ConformanceCheck,\n CheckStatus,\n SpecReference\n} from '../../../types.ts';\nimport { ScenarioUrls } from '../../../types.ts';\nimport {\n createAuthServer,\n type DpopTokenRequestObservation\n} from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport {\n createDpopResourceAuth,\n newDpopClientObservations,\n type DpopClientObservations\n} from './helpers/dpopResourceAuth.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { collapseDuplicateChecks } from '../../../checks/collapse.ts';\n\nconst PRM_PATH = '/.well-known/oauth-protected-resource/mcp';\n\n/** Static id → (name, description, spec references) for each emitted check. */\nconst CHECK_DEFS: Record<\n string,\n { name: string; description: string; specReferences: SpecReference[] }\n> = {\n 'sep-1932-client-dpop-auth-scheme': {\n name: 'DpopAuthScheme',\n description:\n 'Client presents the access token with the DPoP Authorization scheme (not Bearer)',\n specReferences: [\n SpecReferences.SEP_1932_DPOP,\n SpecReferences.DPOP_EXTENSION,\n SpecReferences.RFC_9449_AUTH_SCHEME\n ]\n },\n 'sep-1932-client-fresh-proof': {\n name: 'DpopFreshProof',\n description:\n 'Client includes a fresh, well-formed DPoP proof in the DPoP header on each MCP POST request',\n specReferences: [\n SpecReferences.RFC_9449_CHECKING_PROOFS,\n SpecReferences.RFC_9449_PROOF_SYNTAX,\n SpecReferences.DPOP_EXTENSION\n ]\n },\n 'sep-1932-client-token-request-proof': {\n name: 'DpopTokenRequestProof',\n description:\n 'Client includes a valid DPoP proof in the DPoP header of its token request — the prerequisite for obtaining a DPoP-bound access token (RFC 9449 §5)',\n specReferences: [\n SpecReferences.SEP_1932_DPOP,\n SpecReferences.DPOP_EXTENSION,\n SpecReferences.RFC_9449_TOKEN_REQUEST\n ]\n },\n 'sep-1932-client-as-nonce': {\n name: 'DpopAsNonce',\n description:\n 'On a use_dpop_nonce challenge from the token endpoint, the client retries the token request with the server-supplied nonce (RFC 9449 §8)',\n specReferences: [\n SpecReferences.SEP_1932_DPOP,\n SpecReferences.DPOP_EXTENSION,\n SpecReferences.RFC_9449_AS_NONCE\n ]\n },\n 'sep-1932-client-rs-nonce': {\n name: 'DpopRsNonce',\n description:\n 'On a use_dpop_nonce challenge from the MCP server, the client retries the request with the server-supplied nonce (RFC 9449 §9)',\n specReferences: [\n SpecReferences.SEP_1932_DPOP,\n SpecReferences.DPOP_EXTENSION,\n SpecReferences.RFC_9449_RS_NONCE\n ]\n }\n};\n\n/**\n * Scenario: DPoP sender-constrained tokens — MCP client (SEP-1932 / RFC 9449).\n *\n * The test authorization server (DPoP-capable `createAuthServer`) issues a\n * DPoP-bound token; the test MCP server judges how the client presents it.\n *\n * Registered in two postures, because server-provided nonces are OPTIONAL in\n * RFC 9449 (AS §8 \"MAY\", RS §9 \"can also choose\") and the two are mutually\n * exclusive for a given run:\n *\n * - `auth/dpop` (`requireNonce = false`) — the common, nonce-less baseline.\n * Neither the AS nor the MCP server issues a nonce challenge; the client\n * completes the flow with plain proofs. Emits three checks:\n * · token acquisition — a valid DPoP proof at the token request, obtaining\n * a sender-constrained token (RFC 9449 §5);\n * · the token is presented with the `DPoP` Authorization scheme (§7.1);\n * · a fresh, well-formed DPoP proof accompanies each request (unique `jti`).\n *\n * - `auth/dpop-nonce` (`requireNonce = true`) — the AS and MCP server both\n * require a server-provided nonce (§8/§9), exercising the client's nonce\n * handling. Emits the three baseline checks plus two more:\n * · the client retries the token request with the AS-supplied nonce (§8);\n * · the client retries the MCP request with the server-supplied nonce (§9).\n */\nfunction newTokenReqObs(): DpopTokenRequestObservation {\n return {\n recorded: false,\n validProof: false,\n asNonceChallengeIssued: false,\n asNonceHonored: false\n };\n}\n\nexport class DPoPClientScenario implements Scenario {\n readonly name: string;\n readonly source = {\n extensionId: 'io.modelcontextprotocol/auth/dpop'\n } as const;\n readonly description: string;\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private obs: DpopClientObservations = newDpopClientObservations();\n private tokenReqObs: DpopTokenRequestObservation = newTokenReqObs();\n\n /**\n * @param requireNonce when true (`auth/dpop-nonce`) the test AS and MCP server\n * both demand a server-provided nonce (RFC 9449 §8/§9); when false\n * (`auth/dpop`) neither challenges and the client completes with plain\n * proofs — the common, nonce-less baseline.\n */\n constructor(private readonly requireNonce: boolean) {\n this.name = requireNonce ? 'auth/dpop-nonce' : 'auth/dpop';\n this.description = requireNonce\n ? 'Tests that an MCP client, when the authorization server and MCP server require a DPoP nonce, retries the token request and the MCP request with the server-supplied nonce (RFC 9449 §8/§9) — on top of requesting a DPoP-bound token and presenting it with the DPoP Authorization scheme and a fresh proof per request (SEP-1932 / RFC 9449 §5, §7.1, §4.2–4.3).'\n : 'Tests that an MCP client requests a DPoP-bound access token (a valid DPoP proof at the token request) and presents it using the DPoP Authorization scheme (not Bearer) with a fresh, well-formed DPoP proof on each POST /mcp request, when the server does not require a nonce (SEP-1932 / RFC 9449 §5, §7.1, §4.2–4.3).';\n }\n\n async start(ctx: ScenarioContext): Promise {\n this.checks = [];\n this.obs = newDpopClientObservations();\n this.tokenReqObs = newTokenReqObs();\n\n const authApp = createAuthServer(ctx, this.checks, this.authServer.getUrl, {\n dpopSigningAlgValuesSupported: ['ES256'],\n dpopTokenRequestObs: this.tokenReqObs,\n dpopRequireNonce: this.requireNonce\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n ctx,\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n {\n authMiddleware: createDpopResourceAuth(\n this.obs,\n () => `${this.server.getUrl()}/mcp`,\n () => `${this.server.getUrl()}${PRM_PATH}`,\n this.requireNonce\n )\n }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop(): Promise {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n // Only the nonce posture re-POSTs /token (challenge → retry), which\n // duplicates the shared token-flow checks (token-request, pkce-*); collapse\n // those. The baseline (`auth/dpop`) is left untouched so genuinely distinct\n // repeated attempts (e.g. a restarted authorization flow) keep both entries.\n const shared = this.requireNonce\n ? collapseDuplicateChecks(this.checks)\n : this.checks;\n const checks: ConformanceCheck[] = [\n ...shared,\n this.tokenRequestProofCheck(),\n this.authSchemeCheck(),\n this.freshProofCheck()\n ];\n // The nonce checks only apply to the nonce-requiring posture: in the\n // baseline (`auth/dpop`) neither server issues a `use_dpop_nonce`\n // challenge, so there is no nonce behaviour to assert.\n if (this.requireNonce) {\n checks.push(this.asNonceCheck(), this.rsNonceCheck());\n }\n return checks;\n }\n\n private asNonceCheck(): ConformanceCheck {\n const challenged = this.tokenReqObs.asNonceChallengeIssued;\n const honored = this.tokenReqObs.asNonceHonored;\n // SUCCESS requires that a challenge was actually issued AND then honored —\n // grading `honored` alone would let a client that pre-sends the nonce\n // (never challenged) pass vacuously.\n const pass = challenged && honored;\n return this.build(\n 'sep-1932-client-as-nonce',\n pass ? 'SUCCESS' : 'FAILURE',\n {\n errorMessage: pass\n ? undefined\n : challenged\n ? 'Client did not complete the token request with the server-supplied nonce after a use_dpop_nonce challenge (it either did not retry or the retried proof was rejected)'\n : 'Client never presented a valid proof that was answered with a use_dpop_nonce challenge',\n details: {\n challengeIssued: challenged,\n nonceHonored: honored\n }\n }\n );\n }\n\n private rsNonceCheck(): ConformanceCheck {\n const challenged = this.obs.rsNonceChallengeIssued;\n const honored = this.obs.rsNonceHonored;\n // SUCCESS requires that a challenge was actually issued AND then honored —\n // see asNonceCheck; grading `honored` alone permits a vacuous pass.\n const pass = challenged && honored;\n return this.build(\n 'sep-1932-client-rs-nonce',\n pass ? 'SUCCESS' : 'FAILURE',\n {\n errorMessage: pass\n ? undefined\n : challenged\n ? 'Client did not complete the MCP request with the server-supplied nonce after a use_dpop_nonce challenge (it either did not retry or the retried proof was rejected)'\n : 'Client never made an MCP request with a valid proof that was answered with a use_dpop_nonce challenge',\n details: {\n challengeIssued: challenged,\n nonceHonored: honored\n }\n }\n );\n }\n\n private tokenRequestProofCheck(): ConformanceCheck {\n let status: CheckStatus;\n let errorMessage: string | undefined;\n if (!this.tokenReqObs.recorded) {\n status = 'FAILURE';\n errorMessage =\n 'Client never completed an authorization_code token request, so it obtained no DPoP-bound token';\n } else if (!this.tokenReqObs.validProof) {\n status = 'FAILURE';\n errorMessage = `Client did not present a valid DPoP proof at the token endpoint: ${this.tokenReqObs.error}`;\n } else {\n status = 'SUCCESS';\n }\n return this.build('sep-1932-client-token-request-proof', status, {\n errorMessage,\n details: {\n tokenRequestObserved: this.tokenReqObs.recorded,\n validProofPresented: this.tokenReqObs.validProof\n }\n });\n }\n\n private authSchemeCheck(): ConformanceCheck {\n let status: CheckStatus;\n let errorMessage: string | undefined;\n if (this.obs.authenticatedRequests === 0) {\n status = 'FAILURE';\n errorMessage = 'Client never presented an access token to the MCP server';\n } else if (this.obs.nonDpopSchemeSeen) {\n status = 'FAILURE';\n errorMessage = `Client presented the token with a non-DPoP Authorization scheme (${[...new Set(this.obs.observedSchemes)].join(', ')})`;\n } else {\n status = 'SUCCESS';\n }\n return this.build('sep-1932-client-dpop-auth-scheme', status, {\n errorMessage,\n details: {\n authenticatedRequests: this.obs.authenticatedRequests,\n observedSchemes: [...new Set(this.obs.observedSchemes)]\n }\n });\n }\n\n private freshProofCheck(): ConformanceCheck {\n let status: CheckStatus;\n let errorMessage: string | undefined;\n if (this.obs.authenticatedRequests === 0) {\n status = 'FAILURE';\n errorMessage = 'Client never presented an access token to the MCP server';\n } else if (!this.obs.allProofsWellFormed) {\n status = 'FAILURE';\n errorMessage = `DPoP proof was missing or malformed: ${this.obs.proofError}`;\n } else if (this.obs.replayDetected) {\n status = 'FAILURE';\n errorMessage =\n 'Client reused a DPoP proof (duplicate jti) across requests instead of sending a fresh one';\n } else {\n status = 'SUCCESS';\n }\n return this.build('sep-1932-client-fresh-proof', status, {\n errorMessage,\n details: {\n authenticatedRequests: this.obs.authenticatedRequests,\n distinctJtis: this.obs.jtisSeen.length,\n replayDetected: this.obs.replayDetected\n }\n });\n }\n\n private build(\n id: string,\n status: CheckStatus,\n opts: { errorMessage?: string; details?: Record } = {}\n ): ConformanceCheck {\n const def = CHECK_DEFS[id];\n return {\n id,\n name: def.name,\n description: def.description,\n status,\n timestamp: new Date().toISOString(),\n specReferences: def.specReferences,\n ...(opts.errorMessage ? { errorMessage: opts.errorMessage } : {}),\n ...(opts.details ? { details: opts.details } : {})\n };\n }\n}\n",[],[142,474,796,929,1010],"48ba48f8-a830-4d7d-8f8f-7db62d973134","discovery-metadata.ts","d6b7450a-ad13-11f1-9b49-1607ee4eb77e",160,["D",1789048039494],"/**\n * OAuth Metadata Discovery Scenarios\n *\n * These scenarios test different combinations of PRM and OAuth metadata locations.\n * The configurations are defined in SCENARIO_CONFIGS below and scenarios are\n * generated from them.\n */\n\nimport {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n ConformanceCheck\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport {\n addResourceParameterChecks,\n observeResourceParameters\n} from './helpers/resourceParameterChecks.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { Request, Response } from 'npm:express@^5.1.0';\n\n/**\n * Configuration for a metadata discovery scenario.\n */\ninterface MetadataScenarioConfig {\n name: string;\n prmLocation: string;\n inWwwAuth: boolean;\n oauthMetadataLocation: string;\n /** Route prefix for the auth server (e.g., '/tenant1') */\n authRoutePrefix?: string;\n /** If true, add a trap for root PRM requests */\n trapRootPrm?: boolean;\n}\n\n/**\n * Scenario configurations table:\n *\n * | Scenario | PRM Location | In WWW-Auth | OAuth Metadata Location |\n * |------------------|-------------------------------------------|-------------|------------------------------------------------|\n * | metadata-default | /.well-known/oauth-protected-resource/mcp | Yes | /.well-known/oauth-authorization-server |\n * | metadata-var1 | /.well-known/oauth-protected-resource/mcp | No | /.well-known/openid-configuration |\n * | metadata-var2 | /.well-known/oauth-protected-resource | No | /.well-known/oauth-authorization-server/tenant1|\n * | metadata-var3 | /custom/metadata/location.json | Yes | /tenant1/.well-known/openid-configuration |\n */\nconst SCENARIO_CONFIGS: MetadataScenarioConfig[] = [\n {\n name: 'metadata-default',\n prmLocation: '/.well-known/oauth-protected-resource/mcp',\n inWwwAuth: true,\n oauthMetadataLocation: '/.well-known/oauth-authorization-server',\n trapRootPrm: true\n },\n {\n name: 'metadata-var1',\n prmLocation: '/.well-known/oauth-protected-resource/mcp',\n inWwwAuth: false,\n oauthMetadataLocation: '/.well-known/openid-configuration'\n },\n {\n name: 'metadata-var2',\n prmLocation: '/.well-known/oauth-protected-resource',\n inWwwAuth: false,\n oauthMetadataLocation: '/.well-known/oauth-authorization-server/tenant1',\n authRoutePrefix: '/tenant1'\n },\n {\n name: 'metadata-var3',\n prmLocation: '/custom/metadata/location.json',\n inWwwAuth: true,\n oauthMetadataLocation: '/tenant1/.well-known/openid-configuration',\n authRoutePrefix: '/tenant1'\n }\n];\n\n/**\n * Base for the table-driven discovery scenarios. Each subclass binds a row\n * of SCENARIO_CONFIGS; we use real classes (not factory-returned literals)\n * so the hosted runner can do `new Ctor()` for a fresh instance per run.\n */\nabstract class MetadataDiscoveryScenario extends AuthHandlerScenario {\n protected abstract readonly config: MetadataScenarioConfig;\n readonly source = { introducedIn: '2025-11-25' } as const;\n private checks: ConformanceCheck[] = [];\n\n // Track resource parameters for RFC 8707 validation. metadata-var2 serves\n // the PRM at the root, so its `resource` is a bare origin: the case a URL\n // parser rewrites with a trailing slash.\n private authorizationResource: string | undefined;\n private tokenResource: string | undefined;\n private prmResource: string | undefined;\n\n get name() {\n return `auth/${this.config.name}`;\n }\n get description() {\n return `Tests Basic OAuth metadata discovery flow.\n\n**PRM:** ${this.config.prmLocation}${this.config.inWwwAuth ? '' : ' (not in WWW-Authenticate)'}\n**OAuth metadata:** ${this.config.oauthMetadataLocation}\n`;\n }\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n this.authorizationResource = undefined;\n this.tokenResource = undefined;\n this.prmResource = undefined;\n const config = this.config;\n const routePrefix = config.authRoutePrefix || '';\n const isOpenIdConfiguration = config.oauthMetadataLocation.includes(\n 'openid-configuration'\n );\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n metadataPath: config.oauthMetadataLocation,\n isOpenIdConfiguration,\n ...(routePrefix && { routePrefix }),\n onAuthorizationRequest: ({ resource }) => {\n this.authorizationResource = resource;\n },\n onTokenRequest: ({ body }) => {\n this.tokenResource = body.resource;\n // Same token the auth server mints by default; these scenarios\n // request no scopes.\n return { token: `test-token-${Date.now()}`, scopes: [] };\n }\n });\n\n // If path-based OAuth metadata, trap root requests\n if (routePrefix) {\n authApp.get('/.well-known/oauth-authorization-server', (req, res) => {\n this.checks.push({\n id: 'authorization-server-metadata-wrong-path',\n name: 'AuthorizationServerMetadataWrongPath',\n description:\n 'Client requested authorization server at the root path when the AS URL has a path-based location',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_AUTH_SERVER_METADATA_REQUEST,\n SpecReferences.MCP_AUTH_DISCOVERY\n ],\n details: {\n url: req.url\n }\n });\n res.status(404).send('Not Found');\n });\n }\n\n const getAuthServerUrl = routePrefix\n ? () => `${getAsUrl()}${routePrefix}`\n : getAsUrl;\n\n const rsApp = createServer(\n ctx,\n this.checks,\n ctx.getRsBaseUrl,\n getAuthServerUrl,\n {\n prmPath: config.prmLocation,\n includePrmInWwwAuth: config.inWwwAuth,\n onPrmRequest: ({ resource }) => {\n this.prmResource = resource;\n }\n }\n );\n\n // Add trap for root PRM requests if configured\n if (config.trapRootPrm) {\n rsApp.get(\n '/.well-known/oauth-protected-resource',\n (req: Request, res: Response) => {\n this.checks.push({\n id: 'prm-priority-order',\n name: 'PRM Priority Order',\n description:\n 'Client requested PRM metadata at root location on a server with path-based PRM',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_PRM_DISCOVERY,\n SpecReferences.MCP_PRM_DISCOVERY\n ],\n details: {\n url: req.url,\n path: req.path\n }\n });\n\n res.status(404).json({\n error: 'not_found',\n error_description: 'PRM metadata not available at root location'\n });\n }\n );\n }\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n rawChecks(): ConformanceCheck[] {\n return this.checks;\n }\n\n getChecks(): ConformanceCheck[] {\n const isPathBasedPrm =\n this.config.prmLocation === '/.well-known/oauth-protected-resource/mcp';\n const expectedSlugs = [\n ...(isPathBasedPrm ? ['prm-pathbased-requested'] : []),\n 'authorization-server-metadata',\n 'client-registration',\n 'authorization-request',\n 'token-request'\n ];\n\n for (const slug of expectedSlugs) {\n if (!this.checks.find((c) => c.id === slug)) {\n this.checks.push({\n id: slug,\n name: `Expected Check Missing: ${slug}`,\n description: `Expected Check Missing: ${slug}`,\n status: 'FAILURE',\n timestamp: new Date().toISOString()\n });\n }\n }\n\n // RFC 8707 Resource Parameter Validation Checks. The private fields are\n // empty when a fresh instance re-judges a persisted log (hosted server),\n // so fall back to what the request logger recorded.\n const observed = observeResourceParameters(this.checks);\n addResourceParameterChecks(\n this.checks,\n {\n authorizationResource:\n this.authorizationResource ?? observed.authorizationResource,\n tokenResource: this.tokenResource ?? observed.tokenResource,\n prmResource: this.prmResource ?? observed.prmResource\n },\n new Date().toISOString()\n );\n\n return this.checks;\n }\n}\n\nexport class AuthMetadataDefaultScenario extends MetadataDiscoveryScenario {\n protected readonly config = SCENARIO_CONFIGS[0];\n}\nexport class AuthMetadataVar1Scenario extends MetadataDiscoveryScenario {\n protected readonly config = SCENARIO_CONFIGS[1];\n}\nexport class AuthMetadataVar2Scenario extends MetadataDiscoveryScenario {\n protected readonly config = SCENARIO_CONFIGS[2];\n}\nexport class AuthMetadataVar3Scenario extends MetadataDiscoveryScenario {\n protected readonly config = SCENARIO_CONFIGS[3];\n}\n\n// Export all scenarios as an array for convenience\nexport const metadataScenarios = [\n new AuthMetadataDefaultScenario(),\n new AuthMetadataVar1Scenario(),\n new AuthMetadataVar2Scenario(),\n new AuthMetadataVar3Scenario()\n];\n\n// Export function to list metadata scenario names (for suite support)\nexport function listMetadataScenarios(): string[] {\n return metadataScenarios.map((s) => s.name);\n}\n",[],[142,474,796,929,1018],"3547c7c5-a5d1-48b4-9a16-fabc36923d1e","client-credentials.ts","e2aae3b2-ad13-11f1-a218-1607ee4eb77e",135,["D",1789046889580],"import type { ScenarioContext } from '../../../mock-server/index.ts';\nimport * as jose from 'npm:jose@^6.1.2';\nimport type { CryptoKey } from 'npm:jose@^6.1.2';\nimport type { Scenario, ConformanceCheck, ScenarioUrls } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport { SpecReferences } from './spec-references.ts';\n\nconst CONFORMANCE_TEST_CLIENT_ID = 'conformance-test-client';\nconst CONFORMANCE_TEST_CLIENT_SECRET = 'conformance-test-secret';\n\n/**\n * Generate an EC P-256 keypair for JWT signing.\n * Returns both public key (for server verification) and private key PEM (for client signing).\n */\nasync function generateTestKeypair(): Promise<{\n publicKey: CryptoKey;\n privateKeyPem: string;\n}> {\n const { publicKey, privateKey } = await jose.generateKeyPair('ES256', {\n extractable: true\n });\n const privateKeyPem = await jose.exportPKCS8(privateKey);\n return { publicKey, privateKeyPem };\n}\n\n/**\n * Scenario: Client Credentials with JWT Authentication (SEP-1046)\n *\n * Tests OAuth client_credentials flow with private_key_jwt authentication.\n * Client authenticates using a JWT assertion signed with a dynamically generated keypair.\n */\nexport class ClientCredentialsJwtScenario implements Scenario {\n name = 'auth/client-credentials-jwt';\n readonly source = {\n extensionId: 'io.modelcontextprotocol/oauth-client-credentials'\n } as const;\n description =\n 'Tests OAuth client_credentials flow with private_key_jwt authentication (SEP-1046)';\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(ctx: ScenarioContext): Promise {\n this.checks = [];\n\n // Generate a fresh keypair for this test run\n const { publicKey, privateKeyPem } = await generateTestKeypair();\n\n const authApp = createAuthServer(ctx, this.checks, this.authServer.getUrl, {\n grantTypesSupported: ['client_credentials'],\n tokenEndpointAuthMethodsSupported: ['private_key_jwt'],\n tokenEndpointAuthSigningAlgValuesSupported: ['ES256'],\n onTokenRequest: async ({ grantType, body, timestamp, authBaseUrl }) => {\n if (grantType !== 'client_credentials') {\n this.checks.push({\n id: 'client-credentials-grant-type',\n name: 'ClientCredentialsGrantType',\n description: `Expected grant_type=client_credentials, got ${grantType}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS\n ]\n });\n return {\n error: 'unsupported_grant_type',\n errorDescription: 'Only client_credentials grant is supported'\n };\n }\n\n const clientAssertion = body.client_assertion;\n const clientAssertionType = body.client_assertion_type;\n\n // Verify assertion type\n if (\n clientAssertionType !==\n 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'\n ) {\n this.checks.push({\n id: 'client-credentials-assertion-type',\n name: 'ClientCredentialsAssertionType',\n description: `Invalid client_assertion_type: ${clientAssertionType}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_JWT_CLIENT_AUTH]\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Invalid client_assertion_type',\n statusCode: 401\n };\n }\n\n // Verify JWT signature and claims using the generated public key\n try {\n // Per RFC 7523bis, audience MUST be the issuer identifier.\n // Per RFC 3986, URLs with and without trailing slash are equivalent,\n // so we accept both forms for interoperability (e.g. Pydantic normalizes\n // URLs by adding trailing slashes).\n // Strip any trailing slashes first, then accept both the bare form\n // and the form with exactly one trailing slash.\n const withoutSlash = authBaseUrl.replace(/\\/+$/, '');\n const withSlash = `${withoutSlash}/`;\n const { payload } = await jose.jwtVerify(clientAssertion, publicKey, {\n audience: [withoutSlash, withSlash],\n clockTolerance: 30\n });\n\n // Verify iss claim matches expected client_id\n if (payload.iss !== CONFORMANCE_TEST_CLIENT_ID) {\n this.checks.push({\n id: 'client-credentials-jwt-iss',\n name: 'ClientCredentialsJwtIss',\n description: `JWT iss claim '${payload.iss}' does not match expected client_id '${CONFORMANCE_TEST_CLIENT_ID}'`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_JWT_CLIENT_AUTH],\n details: {\n expected: CONFORMANCE_TEST_CLIENT_ID,\n actual: payload.iss\n }\n });\n return {\n error: 'invalid_client',\n errorDescription:\n 'JWT iss claim does not match expected client_id',\n statusCode: 401\n };\n }\n\n // Verify sub claim matches expected client_id\n if (payload.sub !== CONFORMANCE_TEST_CLIENT_ID) {\n this.checks.push({\n id: 'client-credentials-jwt-sub',\n name: 'ClientCredentialsJwtSub',\n description: `JWT sub claim '${payload.sub}' does not match expected client_id '${CONFORMANCE_TEST_CLIENT_ID}'`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_JWT_CLIENT_AUTH],\n details: {\n expected: CONFORMANCE_TEST_CLIENT_ID,\n actual: payload.sub\n }\n });\n return {\n error: 'invalid_client',\n errorDescription:\n 'JWT sub claim does not match expected client_id',\n statusCode: 401\n };\n }\n\n // Success!\n this.checks.push({\n id: 'client-credentials-jwt-verified',\n name: 'ClientCredentialsJwtVerified',\n description:\n 'Client successfully authenticated with signed JWT assertion',\n status: 'SUCCESS',\n timestamp,\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS,\n SpecReferences.RFC_JWT_CLIENT_AUTH\n ],\n details: {\n iss: payload.iss,\n sub: payload.sub,\n aud: payload.aud\n }\n });\n\n const scopes = body.scope ? body.scope.split(' ') : [];\n return {\n token: `cc-token-${Date.now()}`,\n scopes\n };\n } catch (e) {\n const errorMessage = e instanceof Error ? e.message : String(e);\n this.checks.push({\n id: 'client-credentials-jwt-verified',\n name: 'ClientCredentialsJwtVerified',\n description: `JWT verification failed: ${errorMessage}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_JWT_CLIENT_AUTH],\n details: { error: errorMessage }\n });\n return {\n error: 'invalid_client',\n errorDescription: `JWT verification failed: ${errorMessage}`,\n statusCode: 401\n };\n }\n }\n });\n\n await this.authServer.start(authApp);\n\n const app = createServer(\n ctx,\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl\n );\n\n await this.server.start(app);\n\n return {\n serverUrl: `${this.server.getUrl()}/mcp`,\n context: {\n client_id: CONFORMANCE_TEST_CLIENT_ID,\n private_key_pem: privateKeyPem,\n signing_algorithm: 'ES256'\n }\n };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n // Ensure we have the JWT verification check\n const hasJwtCheck = this.checks.some(\n (c) => c.id === 'client-credentials-jwt-verified'\n );\n if (!hasJwtCheck) {\n this.checks.push({\n id: 'client-credentials-jwt-verified',\n name: 'ClientCredentialsJwtVerified',\n description: 'Client did not make a client_credentials token request',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS\n ]\n });\n }\n\n return this.checks;\n }\n}\n\n/**\n * Scenario: Client Credentials with client_secret_basic Authentication\n *\n * Tests OAuth client_credentials flow with HTTP Basic authentication.\n */\nexport class ClientCredentialsBasicScenario implements Scenario {\n name = 'auth/client-credentials-basic';\n readonly source = {\n extensionId: 'io.modelcontextprotocol/oauth-client-credentials'\n } as const;\n description =\n 'Tests OAuth client_credentials flow with client_secret_basic authentication';\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(ctx: ScenarioContext): Promise {\n this.checks = [];\n\n const authApp = createAuthServer(ctx, this.checks, this.authServer.getUrl, {\n grantTypesSupported: ['client_credentials'],\n tokenEndpointAuthMethodsSupported: ['client_secret_basic'],\n onTokenRequest: async ({\n grantType,\n body,\n timestamp,\n authorizationHeader\n }) => {\n if (grantType !== 'client_credentials') {\n this.checks.push({\n id: 'client-credentials-grant-type',\n name: 'ClientCredentialsGrantType',\n description: `Expected grant_type=client_credentials, got ${grantType}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS\n ]\n });\n return {\n error: 'unsupported_grant_type',\n errorDescription: 'Only client_credentials grant is supported'\n };\n }\n\n // Verify Basic auth header\n const authHeader = authorizationHeader;\n if (!authHeader || !authHeader.startsWith('Basic ')) {\n this.checks.push({\n id: 'client-credentials-basic-auth',\n name: 'ClientCredentialsBasicAuth',\n description:\n 'Missing or invalid Authorization header for Basic auth',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_1046_CLIENT_CREDENTIALS]\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Missing or invalid Authorization header',\n statusCode: 401\n };\n }\n\n const base64Credentials = authHeader.slice(6);\n const credentials = Buffer.from(base64Credentials, 'base64').toString(\n 'utf-8'\n );\n const [clientId, clientSecret] = credentials.split(':');\n\n if (\n clientId !== CONFORMANCE_TEST_CLIENT_ID ||\n clientSecret !== CONFORMANCE_TEST_CLIENT_SECRET\n ) {\n this.checks.push({\n id: 'client-credentials-basic-auth',\n name: 'ClientCredentialsBasicAuth',\n description: 'Invalid client credentials',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_1046_CLIENT_CREDENTIALS],\n details: { clientId }\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Invalid client credentials',\n statusCode: 401\n };\n }\n\n // Success!\n this.checks.push({\n id: 'client-credentials-basic-auth',\n name: 'ClientCredentialsBasicAuth',\n description:\n 'Client successfully authenticated with client_secret_basic',\n status: 'SUCCESS',\n timestamp,\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS\n ],\n details: { clientId }\n });\n\n const scopes = body.scope ? body.scope.split(' ') : [];\n return {\n token: `cc-token-${Date.now()}`,\n scopes\n };\n }\n });\n\n await this.authServer.start(authApp);\n\n const app = createServer(\n ctx,\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl\n );\n\n await this.server.start(app);\n\n return {\n serverUrl: `${this.server.getUrl()}/mcp`,\n context: {\n client_id: CONFORMANCE_TEST_CLIENT_ID,\n client_secret: CONFORMANCE_TEST_CLIENT_SECRET\n }\n };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n // Ensure we have the basic auth check\n const hasBasicAuthCheck = this.checks.some(\n (c) => c.id === 'client-credentials-basic-auth'\n );\n if (!hasBasicAuthCheck) {\n this.checks.push({\n id: 'client-credentials-basic-auth',\n name: 'ClientCredentialsBasicAuth',\n description: 'Client did not make a client_credentials token request',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS\n ]\n });\n }\n\n return this.checks;\n }\n}\n",[],[142,474,796,929,1026],"9a0ff7f6-222e-4055-9da6-aee244256dca","basic-cimd.ts","e3fd3012-ad13-11f1-a1e4-1607ee4eb77e",247,["D",1789335379203],"import {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n ConformanceCheck\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { SpecReferences } from './spec-references.ts';\n\n/**\n * Fixed client metadata URL that clients should use for CIMD tests.\n * This URL doesn't need to resolve - the server will accept it as-is\n * and use hardcoded metadata.\n */\nexport const CIMD_CLIENT_METADATA_URL =\n 'https://conformance-test.local/client-metadata.json';\n\n/**\n * Whether `clientId` is a URL-based client ID: an https URL. A real client\n * publishes its own metadata document (e.g. at its product's domain), so any\n * https URL counts, not only CIMD_CLIENT_METADATA_URL.\n */\nexport function isUrlClientId(clientId: string | undefined): boolean {\n if (!clientId) return false;\n try {\n return new URL(clientId).protocol === 'https:';\n } catch {\n return false;\n }\n}\n\n/**\n * Scenario: Client ID Metadata Documents (SEP-991/URL-based client IDs)\n *\n * Tests that when a server advertises client_id_metadata_document_supported=true,\n * clients SHOULD use a URL as their client_id instead of using dynamic client\n * registration.\n */\nexport class AuthBasicCIMDScenario extends AuthHandlerScenario {\n name = 'auth/basic-cimd';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests OAuth flow with Client ID Metadata Documents (SEP-991/URL-based client IDs). Server advertises client_id_metadata_document_supported=true and client should use URL as client_id instead of DCR.';\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const authApp = createAuthServer(ctx, this.checks, getAsUrl, {\n clientIdMetadataDocumentSupported: true,\n onAuthorizationRequest: (data) => {\n // Check if client used URL-based client ID\n const usedUrlClientId = isUrlClientId(data.clientId);\n this.checks.push({\n id: 'cimd-client-id-used',\n name: 'Client ID Metadata Document Usage',\n description: usedUrlClientId\n ? 'Client correctly used URL-based client ID when server supports client_id_metadata_document_supported'\n : 'Client SHOULD use URL-based client ID when server advertises client_id_metadata_document_supported=true',\n status: usedUrlClientId ? 'SUCCESS' : 'WARNING',\n timestamp: data.timestamp,\n specReferences: [\n SpecReferences.MCP_CLIENT_ID_METADATA_DOCUMENTS,\n SpecReferences.IETF_CIMD\n ],\n details: {\n expectedClientId: `an https URL, such as ${CIMD_CLIENT_METADATA_URL}`,\n actualClientId: data.clientId || 'none'\n }\n });\n }\n });\n\n const rsApp = createServer(ctx, this.checks, ctx.getRsBaseUrl, getAsUrl);\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n // Ensure we have the CIMD check - if not, the client didn't make an auth request\n const hasCimdCheck = this.checks.some(\n (c) => c.id === 'cimd-client-id-used'\n );\n if (!hasCimdCheck) {\n this.checks.push({\n id: 'cimd-client-id-used',\n name: 'Client ID Metadata Document Usage',\n description:\n 'Client did not make an authorization request to test CIMD support',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.MCP_CLIENT_ID_METADATA_DOCUMENTS,\n SpecReferences.IETF_CIMD\n ]\n });\n }\n\n return this.checks;\n }\n}\n",[],[142,474,796,929,1034],"9642a5a0-75ce-472f-8810-32001165d9c2","authorization-server-migration.ts","e116223c-ad13-11f1-b438-1607ee4eb77e",230,["D",1789332107334],"/**\n * SEP-2352 — Authorization-server binding and migration.\n *\n * The MCP server's PRM initially lists AS₁. The client registers, authorizes,\n * and calls tools/list. The harness then invalidates the token and flips PRM\n * to AS₂. On the next 401 the client re-discovers PRM, sees a new issuer, and\n * MUST re-register with AS₂ rather than reuse AS₁'s client credentials.\n */\nimport type { Request, Response, NextFunction } from 'npm:express@^5.1.0';\nimport {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n AuxOriginRole,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\nimport { SpecReferences } from './spec-references.ts';\n\n/** AS₁ issues a recognizable client_id so AS₂ can detect cross-AS reuse. */\nconst AS1_CLIENT_ID = 'as1-client-id-LEAKED-IF-SEEN-AT-AS2';\n\n/**\n * What the client sent AS₂. Both authorization servers log through the same\n * helpers, so these are recorded explicitly: the verdicts are read from the\n * log, where a fresh instance judging a merged log (the hosted server,\n * across processes) finds them too.\n */\nconst NEW_AS_REQUEST = 'new-authorization-server-request';\n\nfunction basicAuthClientId(h?: string): string | undefined {\n if (!h?.startsWith('Basic ')) return undefined;\n try {\n const [id] = Buffer.from(h.slice(6), 'base64').toString('utf8').split(':');\n return id;\n } catch {\n return undefined;\n }\n}\n\nexport class AuthorizationServerMigrationScenario extends AuthHandlerScenario {\n name = 'auth/authorization-server-migration';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that a client, when the PRM authorization_servers changes to a new issuer, re-registers with the new authorization server and does not reuse credentials from the previous one (SEP-2352).';\n readonly auxRoles: readonly AuxOriginRole[] = ['as', 'as2'];\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const as1Url = () => ctx.getAuxBaseUrl('as');\n const as2Url = () => ctx.getAuxBaseUrl('as2');\n const tokenVerifier = new MockTokenVerifier(this.checks, ['mcp:basic']);\n\n const observeAtAs2 = (\n endpoint: 'register' | 'authorize' | 'token',\n clientId: string | undefined,\n timestamp = new Date().toISOString()\n ) => {\n this.checks.push({\n id: NEW_AS_REQUEST,\n name: 'NewAuthorizationServerRequest',\n description: `Client sent a ${endpoint} request to the new authorization server`,\n status: 'INFO',\n timestamp,\n specReferences: [SpecReferences.MCP_DCR],\n details: { endpoint, ...(clientId !== undefined && { clientId }) }\n });\n };\n\n // ── AS₁ ────────────────────────────────────────────────────────────────\n const as1App = createAuthServer(ctx, this.checks, as1Url, {\n tokenVerifier,\n onRegistrationRequest: () => ({\n clientId: AS1_CLIENT_ID,\n clientSecret: 'as1-client-secret'\n })\n });\n\n // ── AS₂ ────────────────────────────────────────────────────────────────\n const as2App = createAuthServer(ctx, this.checks, as2Url, {\n tokenVerifier,\n onRegistrationRequest: () => {\n observeAtAs2('register', undefined);\n return { clientId: 'as2-client-id', clientSecret: 'as2-client-secret' };\n },\n onAuthorizationRequest: (data) => {\n observeAtAs2('authorize', data.clientId, data.timestamp);\n },\n onTokenRequest: (data) => {\n const cid =\n data.body.client_id ?? basicAuthClientId(data.authorizationHeader);\n observeAtAs2('token', cid, data.timestamp);\n const scopes = data.scope ? data.scope.split(' ') : ['mcp:basic'];\n // createAuthServer registers the token it hands out, with its scopes.\n return { token: `test-token-as2-${Date.now()}`, scopes };\n }\n });\n\n // ── MCP server with mutable PRM authorization_servers ──────────────────\n // Migrated once the resource server has accepted a token: the verifier\n // logs every token it accepts, so the phase is read from the log (which\n // a serverless host replays into each process) rather than a flag.\n const migrated = () =>\n this.checks.some((c) => c.id === 'valid-bearer-token');\n const currentAuthServerUrl = () => (migrated() ? as2Url() : as1Url());\n\n const resourceMetadataUrl = () =>\n `${ctx.getRsBaseUrl()}/.well-known/oauth-protected-resource/mcp`;\n\n const middleware = async (\n req: Request,\n res: Response,\n next: NextFunction\n ) => {\n let body = req.body;\n if (typeof body === 'string') body = JSON.parse(body);\n const method = body?.method;\n // initialize / notifications never require auth\n if (method === 'initialize' || method?.startsWith('notifications/'))\n return next();\n\n const auth = req.headers.authorization;\n if (!auth || !auth.startsWith('Bearer ')) {\n return res\n .status(401)\n .set(\n 'WWW-Authenticate',\n `Bearer scope=\"mcp:basic\", resource_metadata=\"${resourceMetadataUrl()}\"`\n )\n .json({ error: 'invalid_token' });\n }\n const token = auth.substring('Bearer '.length);\n const wasMigrated = migrated();\n const info = await tokenVerifier.verifyAccessToken(token);\n\n // Phase 1: accept any verified token, then flip PRM to AS₂ for the next\n // call. Phase 2: reject the (now-stale) AS₁ token so the client\n // re-discovers PRM and sees AS₂.\n if (!wasMigrated) {\n return next();\n }\n // After migration, only AS₂ tokens are valid.\n if (!info.token.startsWith('test-token-as2-')) {\n return res\n .status(401)\n .set(\n 'WWW-Authenticate',\n `Bearer scope=\"mcp:basic\", resource_metadata=\"${resourceMetadataUrl()}\"`\n )\n .json({\n error: 'invalid_token',\n error_description: 'authorization server has changed'\n });\n }\n return next();\n };\n\n const rsApp = createServer(\n ctx,\n this.checks,\n ctx.getRsBaseUrl,\n currentAuthServerUrl,\n {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: ['mcp:basic'],\n includeScopeInWwwAuth: true,\n authMiddleware: middleware,\n tokenVerifier\n }\n );\n\n return { rs: rsApp, aux: { as: as1App, as2: as2App } };\n }\n\n getChecks(): ConformanceCheck[] {\n const checks = [...this.checks];\n const atAs2 = this.checks\n .filter((c) => c.id === NEW_AS_REQUEST)\n .map((c) => c.details ?? {});\n const as2SawRegister = atAs2.some((d) => d.endpoint === 'register');\n const as2SawAs1ClientId = atAs2.some(\n (d) => d.endpoint === 'authorize' && d.clientId === AS1_CLIENT_ID\n );\n const as2SawAs1ClientIdAtToken = atAs2.some(\n (d) => d.endpoint === 'token' && d.clientId === AS1_CLIENT_ID\n );\n\n const ts = new Date().toISOString();\n const reusedAtAS2 = as2SawAs1ClientId || as2SawAs1ClientIdAtToken;\n checks.push({\n id: 'sep-2352-reregister-on-as-change',\n name: 'Client re-registers with the new authorization server',\n description: as2SawRegister\n ? 'Client performed Dynamic Client Registration with the new authorization server after PRM authorization_servers changed'\n : 'Client MUST re-register with the new authorization server when PRM authorization_servers changes (SEP-2352); no registration request was observed at the new AS',\n status: as2SawRegister ? 'SUCCESS' : 'FAILURE',\n timestamp: ts,\n specReferences: [SpecReferences.MCP_DCR]\n });\n checks.push({\n id: 'sep-2352-no-reuse-on-as-change',\n name: 'Client does not reuse the previous AS client credentials',\n description: reusedAtAS2\n ? 'Client MUST NOT reuse client credentials from a different authorization server (SEP-2352); the previous AS client_id was observed at the new AS'\n : 'Client did not present the previous AS client_id at the new authorization server',\n status: reusedAtAS2 ? 'FAILURE' : 'SUCCESS',\n timestamp: ts,\n specReferences: [SpecReferences.MCP_DCR],\n details: {\n previousClientId: AS1_CLIENT_ID,\n seenAtAuthorize: as2SawAs1ClientId,\n seenAtToken: as2SawAs1ClientIdAtToken\n }\n });\n // The \"no cross-AS credential reuse\" general MUST NOT is the same wire\n // observation as no-reuse-on-as-change in this scenario; emit it as a\n // distinct id so the yaml traceability is 1:1.\n checks.push({\n id: 'sep-2352-no-cross-as-credential-reuse',\n name: 'Client does not assume credentials are portable across authorization servers',\n description: reusedAtAS2\n ? 'Client MUST NOT assume that credentials valid for one authorization server will be accepted by another (SEP-2352)'\n : 'Client treated credentials as bound to the issuing authorization server',\n status: reusedAtAS2 ? 'FAILURE' : 'SUCCESS',\n timestamp: ts,\n specReferences: [SpecReferences.MCP_DCR]\n });\n return checks;\n }\n}\n",[],[142,474,796,929,1042],"719f6f4c-ca88-4f04-b9b6-9708a17d6945","serverLifecycle.ts","e6264f4a-ad13-11f1-8744-1607ee4eb77e","b85beddf-8327-41a0-94d9-2f182822625e",61,["D",1789043640221],"import express from 'npm:express@^5.1.0';\n\nexport class ServerLifecycle {\n private app: express.Application | null = null;\n private httpServer: any = null;\n private baseUrl: string = '';\n\n // Arrow function to avoid needing lots of .bind(this)\n getUrl = (): string => {\n return this.baseUrl;\n };\n\n async start(app: express.Application): Promise {\n this.app = app;\n this.httpServer = this.app.listen(0);\n const port = this.httpServer.address().port;\n this.baseUrl = `http://localhost:${port}`;\n return this.baseUrl;\n }\n\n async stop(): Promise {\n if (this.httpServer) {\n await new Promise((resolve) => {\n this.httpServer.closeAllConnections?.();\n this.httpServer.close(() => resolve());\n });\n this.httpServer = null;\n }\n this.app = null;\n }\n}\n",[],[142,474,796,929,1058,1050],"helpers","602c3115-d26b-4868-9f89-885c43e8145b","resourceParameterChecks.ts","74372d20-ad1b-11f1-962d-1607ee4eb77e",161,["D",1789048054482],"import type { ConformanceCheck } from '../../../../types.ts';\nimport { SpecReferences } from '../spec-references.ts';\n\n/**\n * What a scenario's mock servers observed about the RFC 8707 `resource`\n * parameter: the values the client sent to the authorization and token\n * endpoints, and the identifier the protected resource metadata served.\n */\nexport interface ResourceParameterObservation {\n /** `resource` query parameter the client sent to the authorization endpoint. */\n authorizationResource?: string;\n /** `resource` form parameter the client sent to the token endpoint. */\n tokenResource?: string;\n /** `resource` value the protected resource metadata document served. */\n prmResource?: string;\n}\n\n/**\n * Recover a ResourceParameterObservation from the raw check log alone.\n *\n * Scenarios observe the `resource` parameter through createAuthServer /\n * createServer callbacks into private fields. The hosted server re-judges a\n * run's merged log in a *fresh* scenario instance (possibly in a different\n * process/isolate from the one that served the OAuth flow), where those\n * fields are empty. The request logger already records every authorize query\n * and token body, and the PRM route records the identifier it served, so the\n * same facts can be read back from the log.\n */\nexport function observeResourceParameters(\n checks: ConformanceCheck[]\n): ResourceParameterObservation {\n const observed: ResourceParameterObservation = {};\n const str = (v: unknown): string | undefined =>\n typeof v === 'string' ? v : undefined;\n for (const c of checks) {\n const d = c.details as Record | undefined;\n if (!d) continue;\n if (c.id === 'incoming-auth-request') {\n const path = str(d.path) ?? '';\n if (path.endsWith('/authorize')) {\n const q = d.query as Record | undefined;\n observed.authorizationResource =\n str(q?.resource) ?? observed.authorizationResource;\n } else if (path.endsWith('/token')) {\n const b = d.body as Record | undefined;\n observed.tokenResource = str(b?.resource) ?? observed.tokenResource;\n }\n } else if (c.id === 'prm-pathbased-requested') {\n observed.prmResource = str(d.resource) ?? observed.prmResource;\n }\n }\n return observed;\n}\n\n/**\n * RFC 8707 resource-parameter checks, shared by every client-auth scenario\n * whose mock servers observe the authorization and token requests. The check\n * IDs are stable across scenarios so one slug finds every emission.\n *\n * Each check is emitted once per scenario run; a check already present under\n * the same id is left alone.\n */\nexport function addResourceParameterChecks(\n checks: ConformanceCheck[],\n observed: ResourceParameterObservation,\n timestamp: string\n): void {\n const { authorizationResource, tokenResource, prmResource } = observed;\n const specRefs = [\n SpecReferences.RFC_8707_RESOURCE_INDICATORS,\n SpecReferences.MCP_RESOURCE_PARAMETER\n ];\n\n // Check 1: Resource parameter in authorization request\n if (!checks.some((c) => c.id === 'resource-parameter-in-authorization')) {\n const hasResource = !!authorizationResource;\n checks.push({\n id: 'resource-parameter-in-authorization',\n name: 'Resource parameter in authorization request',\n description: hasResource\n ? 'Client included resource parameter in authorization request'\n : 'Client MUST include resource parameter in authorization request per RFC 8707',\n status: hasResource ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n resource: authorizationResource || 'not provided'\n }\n });\n }\n\n // Check 2: Resource parameter in token request\n if (!checks.some((c) => c.id === 'resource-parameter-in-token')) {\n const hasResource = !!tokenResource;\n checks.push({\n id: 'resource-parameter-in-token',\n name: 'Resource parameter in token request',\n description: hasResource\n ? 'Client included resource parameter in token request'\n : 'Client MUST include resource parameter in token request per RFC 8707',\n status: hasResource ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n resource: tokenResource || 'not provided'\n }\n });\n }\n\n // Check 3: Resource parameter is valid canonical URI\n if (!checks.some((c) => c.id === 'resource-parameter-valid-uri')) {\n const resourceToValidate = authorizationResource || tokenResource;\n if (resourceToValidate) {\n const validation = validateCanonicalUri(resourceToValidate);\n checks.push({\n id: 'resource-parameter-valid-uri',\n name: 'Resource parameter is valid canonical URI',\n description: validation.valid\n ? 'Resource parameter is a valid canonical URI (has scheme, no fragment)'\n : `Resource parameter is invalid: ${validation.error}`,\n status: validation.valid ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n resource: resourceToValidate,\n ...(validation.error && { error: validation.error })\n }\n });\n }\n }\n\n // Check 4: Resource parameter consistency between requests\n if (!checks.some((c) => c.id === 'resource-parameter-consistency')) {\n if (authorizationResource && tokenResource) {\n const consistent = authorizationResource === tokenResource;\n checks.push({\n id: 'resource-parameter-consistency',\n name: 'Resource parameter consistency',\n description: consistent\n ? 'Resource parameter is consistent between authorization and token requests'\n : 'Resource parameter MUST be consistent between authorization and token requests',\n status: consistent ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n authorizationResource,\n tokenResource\n }\n });\n }\n }\n\n // Check 5: Resource parameter equals the identifier published in PRM.\n // The MCP spec requires the canonical URI, which it defines as the RFC 9728\n // `resource` value; RFC 9728 §3.3 requires that value to be identical to the\n // identifier the client used. Re-serializing it through a URL parser is the\n // usual way to break this: `new URL('https://example.com').href` is\n // `https://example.com/`, and authorization servers that match the\n // indicator exactly reject the extra slash.\n if (!checks.some((c) => c.id === 'resource-parameter-matches-prm')) {\n const sent: Array<[request: string, value: string]> = [];\n if (authorizationResource !== undefined) {\n sent.push(['authorization', authorizationResource]);\n }\n if (tokenResource !== undefined) {\n sent.push(['token', tokenResource]);\n }\n if (prmResource !== undefined && sent.length > 0) {\n const mismatched = sent\n .filter(([, value]) => value !== prmResource)\n .map(([request]) => request);\n const matches = mismatched.length === 0;\n const errorMessage = `Client MUST send the resource identifier exactly as published in protected resource metadata; the ${mismatched.join(' and ')} request sent a different value (a URL parser that appends \"/\" to a pathless identifier is the usual cause)`;\n checks.push({\n id: 'resource-parameter-matches-prm',\n name: 'Resource parameter matches protected resource metadata',\n description: matches\n ? 'Client sent the resource identifier exactly as published in protected resource metadata'\n : errorMessage,\n status: matches ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [\n ...specRefs,\n SpecReferences.MCP_CANONICAL_SERVER_URI,\n SpecReferences.RFC_9728_RESOURCE_IDENTITY\n ],\n ...(!matches && { errorMessage }),\n details: {\n prmResource,\n authorizationResource: authorizationResource ?? 'not provided',\n tokenResource: tokenResource ?? 'not provided'\n }\n });\n }\n }\n}\n\nfunction validateCanonicalUri(uri: string): {\n valid: boolean;\n error?: string;\n} {\n try {\n const parsed = new URL(uri);\n // Check for fragment (RFC 8707: MUST NOT include fragment)\n if (parsed.hash) {\n return {\n valid: false,\n error: 'contains fragment (not allowed per RFC 8707)'\n };\n }\n return { valid: true };\n } catch {\n return { valid: false, error: 'invalid URI format' };\n }\n}\n",[],[142,474,796,929,1058,1060],"0a409f24-6bcc-407c-ba45-30b1a2e32c1b","mockTokenVerifier.ts","e5e45608-ad13-11f1-b374-1607ee4eb77e",238,["D",1789333474343],"import { OAuthTokenVerifier } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/auth/provider.js';\nimport { AuthInfo } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/auth/types.js';\nimport { InvalidTokenError } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/auth/errors.js';\nimport type { ConformanceCheck } from '../../../../types.ts';\nimport { SpecReferences } from '../spec-references.ts';\n\nconst SCOPES_SEPARATOR = '.scopes.';\n\n/**\n * Append the granted scopes to an opaque test token. The resource server\n * that verifies a token is not always the process that minted it — on\n * serverless hosts (val.town) the token request and the MCP request land on\n * isolates that share no memory — so the token itself carries what the\n * verifier would otherwise look up. Like the flow code in createAuthServer,\n * it is a state carrier for a test fixture, not a credential: nothing signs\n * or checks it.\n */\nexport function tokenWithScopes(token: string, scopes: string[]): string {\n return `${token}${SCOPES_SEPARATOR}${Buffer.from(scopes.join(' ')).toString('base64url')}`;\n}\n\nfunction scopesFromToken(token: string): string[] | undefined {\n const at = token.lastIndexOf(SCOPES_SEPARATOR);\n if (at < 0) return undefined;\n const scope = Buffer.from(\n token.slice(at + SCOPES_SEPARATOR.length),\n 'base64url'\n ).toString();\n return scope ? scope.split(' ') : [];\n}\n\nexport class MockTokenVerifier implements OAuthTokenVerifier {\n private tokenScopes: Map = new Map();\n\n constructor(\n private checks: ConformanceCheck[],\n private expectedScopes: string[] = []\n ) {}\n\n registerToken(token: string, scopes: string[]) {\n this.tokenScopes.set(token, scopes);\n }\n\n async verifyAccessToken(token: string): Promise {\n // Accept tokens that start with known prefixes\n if (token.startsWith('test-token') || token.startsWith('cc-token')) {\n // Scopes registered in this process, else those the token carries\n // (minted by another process), else none.\n const scopes =\n this.tokenScopes.get(token) ?? scopesFromToken(token) ?? [];\n\n this.checks.push({\n id: 'valid-bearer-token',\n name: 'ValidBearerToken',\n description: 'Client provided valid bearer token',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_ACCESS_TOKEN_USAGE],\n details: {\n token: token.substring(0, 15) + '...',\n scopes\n }\n });\n return {\n token,\n clientId: 'test-client',\n scopes,\n expiresAt: Math.floor(Date.now() / 1000) + 3600\n };\n }\n\n this.checks.push({\n id: 'invalid-bearer-token',\n name: 'InvalidBearerToken',\n description: 'Client provided invalid bearer token',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_ACCESS_TOKEN_USAGE],\n details: {\n message: 'Token verification failed',\n token: token ? token.substring(0, 10) + '...' : 'missing'\n }\n });\n throw new InvalidTokenError('Invalid token');\n }\n}\n",[],[142,474,796,929,1058,1068],"985b7f9d-4854-4f31-a08b-620683bf17a9","dpopToken.ts","5842ef40-ad1c-11f1-bcb9-1607ee4eb77e",148,["D",1789047267630],"import * as jose from 'npm:jose@^6.1.2';\nimport type { JWK, CryptoKey } from 'npm:jose@^6.1.2';\n\n/**\n * DPoP-bound access-token minting (RFC 9449 §6).\n *\n * Transport-free: this issues a signed JWT access token carrying the\n * `cnf.jkt` confirmation that binds the token to a DPoP key. It is the\n * token-issuing *core* shared across the DPoP scenarios:\n *\n * - #369 server: the scenario (acting as client) mints a bound token to\n * PRESENT to the server under test.\n * - #370 AS / #368 client: the compliant/test authorization-server fixtures\n * call this to ISSUE bound tokens (wrapped by an HTTP token endpoint).\n *\n * `jkt` is a parameter (not derived here) so the same function works whether\n * the bound key is ours (#369/#370) or extracted from a client's proof (#368).\n */\n\nconst DEFAULT_ALG = 'ES256';\n\nexport interface TokenIssuerKey {\n privateKey: CryptoKey;\n publicKey: CryptoKey;\n publicJwk: JWK;\n alg: string;\n}\n\n/** Generate an asymmetric signing key for the (test) token issuer. */\nexport async function generateIssuerKey(\n alg: string = DEFAULT_ALG\n): Promise {\n const { publicKey, privateKey } = await jose.generateKeyPair(alg, {\n extractable: true\n });\n const publicJwk = await jose.exportJWK(publicKey);\n return { privateKey, publicKey, publicJwk, alg };\n}\n\n/**\n * Reconstruct a {@link TokenIssuerKey} from a private JWK (e.g. supplied to a\n * scenario via env), deriving the public JWK by stripping the private scalar.\n * EC/OKP keys only (sufficient for the ES256 test issuer).\n */\nexport async function importIssuerKey(\n privateJwk: JWK,\n alg: string = DEFAULT_ALG\n): Promise {\n const privateKey = (await jose.importJWK(privateJwk, alg)) as CryptoKey;\n const publicJwk: JWK = { ...privateJwk };\n delete (publicJwk as Record).d;\n const publicKey = (await jose.importJWK(publicJwk, alg)) as CryptoKey;\n return { privateKey, publicKey, publicJwk, alg };\n}\n\nexport interface MintDpopBoundTokenOptions {\n /** Issuer signing key (the server under test must trust its public key). */\n issuerKey: TokenIssuerKey;\n /** `iss` claim — the token issuer identifier. */\n issuer: string;\n /** `aud` claim — the resource the token is for (the MCP server's canonical URI). */\n audience: string;\n /** Thumbprint bound as `cnf.jkt` (RFC 7638 JWK thumbprint of the DPoP public key). */\n jkt: string;\n /** `sub` claim. Defaults to a fixed test subject. */\n subject?: string;\n /** `scope` claim, if any. */\n scope?: string;\n /** `iat` in epoch seconds. Defaults to now. */\n iat?: number;\n /** Token lifetime in seconds. Defaults to 3600. */\n expiresInSeconds?: number;\n\n // --- override knobs for crafting deliberately-invalid variants ---\n /** Omit `cnf` entirely — an unbound (bearer-style) token. */\n omitCnf?: boolean;\n /** Bind to a different (foreign/wrong) thumbprint than the presented proof. */\n jktOverride?: string;\n /** Issue an already-expired token (`exp` in the past). */\n expired?: boolean;\n /** Additional claims to merge into the payload. */\n extraClaims?: Record;\n}\n\n/**\n * Mint a signed JWT access token. With no override knobs set, produces a\n * valid DPoP-bound token whose `cnf.jkt` equals {@link MintDpopBoundTokenOptions.jkt}.\n */\nexport async function mintDpopBoundToken(\n options: MintDpopBoundTokenOptions\n): Promise {\n const iat = options.iat ?? Math.floor(Date.now() / 1000);\n const lifetime = options.expiresInSeconds ?? 3600;\n const exp = options.expired ? iat - 60 : iat + lifetime;\n\n const payload: Record = { ...(options.extraClaims ?? {}) };\n if (options.scope !== undefined) payload.scope = options.scope;\n if (!options.omitCnf) {\n payload.cnf = { jkt: options.jktOverride ?? options.jkt };\n }\n\n return new jose.SignJWT(payload)\n .setProtectedHeader({ alg: options.issuerKey.alg, typ: 'at+jwt' })\n .setIssuer(options.issuer)\n .setAudience(options.audience)\n .setSubject(options.subject ?? 'conformance-test-subject')\n .setIssuedAt(iat)\n .setExpirationTime(exp)\n .sign(options.issuerKey.privateKey);\n}\n",[],[142,474,796,929,1058,1076],"a43056e6-663f-4831-a8de-f23a1f95a838","dpopResourceAuth.ts","594f18a0-ad1c-11f1-9d37-1607ee4eb77e",150,["D",1789047269395],"import type { Request, Response, NextFunction, RequestHandler } from 'npm:express@^5.1.0';\nimport * as jose from 'npm:jose@^6.1.2';\nimport { createHash } from 'node:crypto';\n\n/** Fixed nonce the judge hands out when `requireNonce` is set (RFC 9449 §9). */\nconst RS_DPOP_NONCE = 'conformance-rs-dpop-nonce';\n\n/** Asymmetric JWS algorithms acceptable for a DPoP proof (RFC 9449 §4.3 / §11.6). */\nconst DPOP_ASYMMETRIC_ALGS = [\n 'ES256',\n 'ES384',\n 'ES512',\n 'RS256',\n 'RS384',\n 'RS512',\n 'PS256',\n 'PS384',\n 'PS512',\n 'EdDSA'\n];\n\n/**\n * Accumulated observations of how the client presented its access token and\n * per-request DPoP proof. The scenario turns these into the two\n * sep-1932-client-* checks in getChecks() — freshness needs cross-request\n * state (unique `jti` per request), so we accumulate rather than emit inline.\n */\nexport interface DpopClientObservations {\n authenticatedRequests: number;\n nonDpopSchemeSeen: boolean;\n observedSchemes: string[];\n jtisSeen: string[];\n replayDetected: boolean;\n allProofsWellFormed: boolean;\n proofError?: string;\n /** The judge issued a `use_dpop_nonce` challenge (RFC 9449 §9). */\n rsNonceChallengeIssued: boolean;\n /** The client retried the request carrying the correct nonce. */\n rsNonceHonored: boolean;\n}\n\nexport function newDpopClientObservations(): DpopClientObservations {\n return {\n authenticatedRequests: 0,\n nonDpopSchemeSeen: false,\n observedSchemes: [],\n jtisSeen: [],\n replayDetected: false,\n allProofsWellFormed: true,\n rsNonceChallengeIssued: false,\n rsNonceHonored: false\n };\n}\n\n/**\n * Test MCP server DPoP judge (SEP-1932 / RFC 9449), passed to `createServer`\n * via its `options.authMiddleware` hook. An unauthenticated request gets a\n * `401 DPoP` discovery challenge; an authenticated one is observed (scheme +\n * per-request proof) and allowed through so the MCP session can complete and\n * multiple requests can be examined for proof freshness.\n *\n * Proof validation is hand-rolled with jose — deliberately an INDEPENDENT code\n * path from the suite's proof builder, so a shared bug surfaces rather than hides.\n */\nexport function createDpopResourceAuth(\n obs: DpopClientObservations,\n getResourceUrl: () => string,\n getPrmUrl: () => string,\n requireNonce = false\n): RequestHandler {\n return async (\n req: Request,\n res: Response,\n next: NextFunction\n ): Promise => {\n const authorization = req.headers.authorization;\n if (!authorization) {\n res\n .status(401)\n .set('WWW-Authenticate', `DPoP resource_metadata=\"${getPrmUrl()}\"`)\n .json({ error: 'unauthorized' });\n return;\n }\n\n obs.authenticatedRequests++;\n const { scheme, token } = splitAuthorization(authorization);\n obs.observedSchemes.push(scheme);\n if (scheme.toLowerCase() !== 'dpop') {\n obs.nonDpopSchemeSeen = true;\n }\n\n const proofHeader = req.headers['dpop'];\n // Node collapses duplicate DPoP request headers into one comma-joined value;\n // validateResourceProof rejects a comma (RFC 9449 §4.2 — at most one proof).\n const proofValue = Array.isArray(proofHeader)\n ? proofHeader.join(', ')\n : proofHeader;\n const result = await validateResourceProof(\n proofValue,\n token,\n req.method,\n getResourceUrl()\n );\n if (!result.ok) {\n obs.allProofsWellFormed = false;\n obs.proofError ??= result.error;\n next();\n return;\n }\n\n // Record proof freshness on ANY valid proof, before the nonce gate. A\n // nonce-challenged (but otherwise valid) proof still demonstrates freshness,\n // so fresh-proof is never asserted on zero `jti` evidence, and a client that\n // never honours the nonce fails only rs-nonce (not fresh-proof as well).\n //\n // Deliberate consequence: a client that re-sends the *identical* proof\n // across the challenge/retry boundary (same `jti`) trips replay detection.\n // That is a genuine RFC 9449 §4.2 violation (`jti` MUST be unique per proof)\n // — a conformant client mints a fresh proof, carrying the nonce, on retry.\n if (obs.jtisSeen.includes(result.jti)) {\n obs.replayDetected = true;\n } else {\n obs.jtisSeen.push(result.jti);\n }\n\n // RFC 9449 §9: require a server-provided nonce. A valid proof without the\n // correct nonce is challenged (401 use_dpop_nonce + DPoP-Nonce); the client\n // is expected to retry with it.\n if (requireNonce) {\n let proofNonce: unknown;\n try {\n proofNonce = proofValue ? jose.decodeJwt(proofValue).nonce : undefined;\n } catch {\n proofNonce = undefined;\n }\n if (proofNonce !== RS_DPOP_NONCE) {\n obs.rsNonceChallengeIssued = true;\n res\n .status(401)\n .set(\n 'WWW-Authenticate',\n `DPoP error=\"use_dpop_nonce\", resource_metadata=\"${getPrmUrl()}\"`\n )\n .set('DPoP-Nonce', RS_DPOP_NONCE)\n .json({ error: 'use_dpop_nonce' });\n return;\n }\n obs.rsNonceHonored = true;\n }\n\n next();\n };\n}\n\nfunction splitAuthorization(authorization: string): {\n scheme: string;\n token: string;\n} {\n const idx = authorization.indexOf(' ');\n if (idx === -1) return { scheme: authorization, token: '' };\n return {\n scheme: authorization.slice(0, idx),\n token: authorization.slice(idx + 1).trim()\n };\n}\n\n/**\n * Canonicalize an `htu` for comparison per RFC 9449 §4.3 (RFC 3986 scheme-based\n * normalization): lowercase scheme/host, drop the default port, ignore a\n * trailing slash. Query/fragment are rejected by the caller (RFC 9449 §4.2),\n * not silently stripped here.\n */\nfunction normalizeHtu(u: string): string {\n try {\n const url = new URL(u);\n // Tolerate a single trailing slash only; `/mcp//` is a distinct path.\n return `${url.protocol}//${url.host}${url.pathname.replace(/\\/$/, '')}`;\n } catch {\n return u;\n }\n}\n\n/**\n * Validate a per-request DPoP proof presented alongside an access token\n * (RFC 9449 §4.3, resource-request subset): well-formed `dpop+jwt`, asymmetric\n * alg, embedded public jwk, htm/htu match, `ath` binds the token, signature\n * verifies, and the proof key's thumbprint matches the token's `cnf.jkt`.\n */\nexport async function validateResourceProof(\n proof: string | undefined,\n token: string,\n method: string,\n resourceUrl: string\n): Promise<{ ok: true; jti: string } | { ok: false; error: string }> {\n if (!proof) return { ok: false, error: 'missing DPoP proof header' };\n // RFC 9449 §4.2: at most one DPoP header. A single proof JWT has no comma, so\n // a comma means duplicate headers were sent (Node joins them with \", \").\n if (proof.includes(',')) {\n return { ok: false, error: 'multiple DPoP proof headers' };\n }\n\n let header: jose.ProtectedHeaderParameters;\n try {\n header = jose.decodeProtectedHeader(proof);\n } catch {\n return { ok: false, error: 'DPoP proof is not a well-formed JWT' };\n }\n if (header.typ !== 'dpop+jwt')\n return { ok: false, error: 'typ must be dpop+jwt' };\n if (!header.alg || !DPOP_ASYMMETRIC_ALGS.includes(header.alg)) {\n return { ok: false, error: 'alg must be a supported asymmetric algorithm' };\n }\n const jwk = header.jwk as jose.JWK | undefined;\n if (!jwk) return { ok: false, error: 'missing jwk header parameter' };\n if ((jwk as Record).d !== undefined) {\n return { ok: false, error: 'jwk must not contain a private key' };\n }\n\n let claims: jose.JWTPayload;\n try {\n const key = await jose.importJWK(jwk, header.alg);\n claims = (\n await jose.jwtVerify(proof, key, { algorithms: DPOP_ASYMMETRIC_ALGS })\n ).payload;\n } catch {\n return { ok: false, error: 'DPoP proof signature does not verify' };\n }\n if (typeof claims.jti !== 'string')\n return { ok: false, error: 'missing jti claim' };\n if (claims.htm !== method)\n return { ok: false, error: 'htm does not match the request method' };\n if (typeof claims.htu !== 'string') {\n return { ok: false, error: 'htu does not match the request URI' };\n }\n if (claims.htu.includes('?') || claims.htu.includes('#')) {\n return {\n ok: false,\n error: 'htu MUST NOT contain a query or fragment (RFC 9449 §4.2)'\n };\n }\n if (normalizeHtu(claims.htu) !== normalizeHtu(resourceUrl)) {\n return { ok: false, error: 'htu does not match the request URI' };\n }\n if (\n typeof claims.iat !== 'number' ||\n Math.abs(Math.floor(Date.now() / 1000) - claims.iat) > 300\n ) {\n return { ok: false, error: 'iat outside the acceptable window' };\n }\n // Recompute ath and the thumbprint inline (jose + node crypto) rather than\n // via the proof builder's helpers, so this validator stays a fully\n // independent path.\n const expectedAth = createHash('sha256')\n .update(token, 'ascii')\n .digest('base64url');\n if (typeof claims.ath !== 'string' || claims.ath !== expectedAth) {\n return {\n ok: false,\n error: 'ath does not match the presented access token'\n };\n }\n\n // Possession: the proof key must be the key the token is bound to.\n try {\n const tokenClaims = jose.decodeJwt(token);\n const cnf = tokenClaims.cnf as { jkt?: unknown } | undefined;\n const thumbprint = await jose.calculateJwkThumbprint(jwk, 'sha256');\n if (!cnf || cnf.jkt !== thumbprint) {\n return {\n ok: false,\n error: 'proof key thumbprint does not match the token cnf.jkt'\n };\n }\n } catch {\n return { ok: false, error: 'access token is not a decodable JWT' };\n }\n\n return { ok: true, jti: claims.jti };\n}\n",[],[142,474,796,929,1058,1084],"fa49d4af-69fb-410a-9fa3-ab8e62428f41","createWorkloadJwt.ts","59df8390-ad1c-11f1-bd30-1607ee4eb77e",151,["D",1789047270349],"import * as jose from 'npm:jose@^6.1.2';\n\nexport const JWT_BEARER_GRANT_TYPE =\n 'urn:ietf:params:oauth:grant-type:jwt-bearer';\nexport const DEFAULT_WORKLOAD_JWT_ALG = 'ES256';\n\n// Scope values used by the WIF scenario's mock AS and broken-client runners.\n// Exported here so both sides stay in sync without manual duplication.\nexport const WIF_TRIGGER_UNAUTHORIZED_SCOPE = 'wif.trigger-unauthorized';\nexport const WIF_REJECTED_SCOPE = 'wif.rejected';\n\nexport interface CreateWorkloadJwtOptions {\n issuer: string;\n subject: string;\n audience: string | string[];\n privateKey: jose.CryptoKey;\n /** Jose duration string (e.g. '5m', '-60s', '60 seconds ago'). Use a negative offset to construct already-expired tokens for negative tests. */\n expiresIn?: string;\n jwtId?: string;\n issuedAt?: number;\n notBefore?: number;\n algorithm?: string;\n additionalClaims?: Record;\n}\n\nexport async function createWorkloadJwt(\n opts: CreateWorkloadJwtOptions\n): Promise {\n const {\n issuer,\n subject,\n audience,\n privateKey,\n expiresIn = '5m',\n jwtId = crypto.randomUUID(),\n issuedAt,\n notBefore,\n algorithm = DEFAULT_WORKLOAD_JWT_ALG,\n additionalClaims\n } = opts;\n\n // additionalClaims are merged first; reserved claims set via builder methods\n // overwrite any same-named key already in the payload, so callers cannot\n // accidentally override iss/sub/aud/exp/iat/jti via additionalClaims.\n const extra: Record = additionalClaims\n ? { ...additionalClaims }\n : {};\n\n let builder = new jose.SignJWT(extra)\n .setProtectedHeader({ alg: algorithm })\n .setIssuer(issuer)\n .setSubject(subject)\n .setAudience(audience)\n .setExpirationTime(expiresIn)\n .setJti(jwtId);\n\n if (issuedAt !== undefined) {\n builder = builder.setIssuedAt(issuedAt);\n } else {\n builder = builder.setIssuedAt();\n }\n\n if (notBefore !== undefined) {\n builder = builder.setNotBefore(notBefore);\n }\n\n return builder.sign(privateKey);\n}\n\nexport interface WorkloadKeypair {\n publicKey: jose.CryptoKey;\n privateKey: jose.CryptoKey;\n privateKeyPem: string;\n publicJwk: jose.JWK;\n}\n\nexport async function generateWorkloadKeypair(\n alg: string = DEFAULT_WORKLOAD_JWT_ALG\n): Promise {\n const { publicKey, privateKey } = await jose.generateKeyPair(alg, {\n extractable: true\n });\n const privateKeyPem = await jose.exportPKCS8(privateKey);\n const publicJwk = await jose.exportJWK(publicKey);\n return { publicKey, privateKey, privateKeyPem, publicJwk };\n}\n",[],[142,474,796,929,1058,1092],"23a6e80b-c40b-49be-9f44-2dfcd1d8d186","createServer.ts","e00a1542-ad13-11f1-9a10-1607ee4eb77e",246,["D",1789335375730],6,"import { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n CallToolResult,\n ErrorCode,\n ListToolsRequestSchema,\n McpError\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport { requireBearerAuth } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/auth/middleware/bearerAuth.js';\nimport express, { Request, Response, NextFunction } from 'npm:express@^5.1.0';\nimport type { ConformanceCheck } from '../../../../types.ts';\nimport {\n validateStatelessRequest,\n withRequiredDraftResultFields,\n type ScenarioContext\n} from '../../../../mock-server/index.ts';\nimport { isStatefulVersion } from '../../../../connection/select.ts';\nimport { createRequestLogger } from '../../../request-logger.ts';\nimport { MockTokenVerifier } from './mockTokenVerifier.ts';\nimport { SpecReferences } from '../spec-references.ts';\n\n/** Clients may refuse to call a tool that is not described. */\nconst TEST_TOOL_DESCRIPTION =\n 'Returns the text \"test\". Call it to confirm an authorized request reaches the server.';\n\nexport interface ServerOptions {\n prmPath?: string | null;\n requiredScopes?: string[];\n scopesSupported?: string[];\n includePrmInWwwAuth?: boolean;\n includeScopeInWwwAuth?: boolean;\n authMiddleware?: express.RequestHandler;\n tokenVerifier?: MockTokenVerifier;\n /** Override the resource field in PRM response (for testing resource mismatch) */\n prmResourceOverride?: string;\n /** Observe the `resource` identifier the PRM route served (RFC 8707 checks) */\n onPrmRequest?: (requestData: { resource: string; timestamp: string }) => void;\n}\n\nexport function createServer(\n ctx: ScenarioContext,\n checks: ConformanceCheck[],\n getBaseUrl: () => string,\n getAuthServerUrl: () => string,\n options: ServerOptions = {}\n): express.Application {\n const {\n prmPath = '/.well-known/oauth-protected-resource/mcp',\n requiredScopes = [],\n scopesSupported,\n includePrmInWwwAuth = true,\n includeScopeInWwwAuth = false,\n tokenVerifier,\n prmResourceOverride,\n onPrmRequest\n } = options;\n // Factory: create a fresh Server per request to avoid \"Already connected\" errors\n // after the v1.26.0 security fix (GHSA-345p-7cg4-v4c7)\n function createMcpServer() {\n const server = new Server(\n {\n name: 'auth-prm-pathbased-server',\n version: '1.0.0'\n },\n {\n capabilities: {\n tools: {}\n }\n }\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => {\n return {\n tools: [\n {\n name: 'test-tool',\n description: TEST_TOOL_DESCRIPTION,\n inputSchema: { type: 'object' }\n }\n ]\n };\n });\n\n server.setRequestHandler(\n CallToolRequestSchema,\n async (request): Promise => {\n if (request.params.name === 'test-tool') {\n return {\n content: [{ type: 'text', text: 'test' }]\n };\n }\n throw new McpError(\n ErrorCode.InvalidParams,\n `Tool ${request.params.name} not found`\n );\n }\n );\n\n return server;\n }\n\n const app = express();\n app.use(express.json());\n\n app.use(\n createRequestLogger(checks, {\n incomingId: 'incoming-request',\n outgoingId: 'outgoing-response',\n mcpRoute: '/mcp'\n })\n );\n\n if (prmPath !== null) {\n app.get(prmPath, (req: Request, res: Response) => {\n // Resource is usually $baseUrl/mcp, but if PRM is at the root,\n // the resource identifier is the root.\n // Can be overridden via prmResourceOverride for testing resource mismatch.\n const resource =\n prmResourceOverride ??\n (prmPath === '/.well-known/oauth-protected-resource'\n ? getBaseUrl()\n : `${getBaseUrl()}/mcp`);\n const authorizationServers = [getAuthServerUrl()];\n\n checks.push({\n id: 'prm-pathbased-requested',\n name: 'PRMPathBasedRequested',\n description: 'Client requested PRM metadata at path-based location',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_PRM_DISCOVERY,\n SpecReferences.MCP_PRM_DISCOVERY\n ],\n details: {\n url: req.url,\n path: req.path,\n // Recorded so the RFC 8707 checks can be re-derived from the log\n // (see observeResourceParameters), and verdicts about the issuer\n // the client was sent to likewise.\n resource,\n authorizationServers\n }\n });\n\n onPrmRequest?.({ resource, timestamp: new Date().toISOString() });\n\n const prmResponse: any = {\n resource,\n authorization_servers: authorizationServers\n };\n\n if (scopesSupported !== undefined) {\n prmResponse.scopes_supported = scopesSupported;\n }\n\n res.json(prmResponse);\n });\n }\n\n app.post('/mcp', async (req: Request, res: Response, next: NextFunction) => {\n // Apply bearer token auth per-request in order to delay setting PRM URL\n // until after the server has started\n // TODO: Find a way to do this w/ pre-applying middleware.\n const verifier =\n tokenVerifier || new MockTokenVerifier(checks, requiredScopes);\n\n const authMiddleware =\n options.authMiddleware ??\n requireBearerAuth({\n verifier,\n // Only pass requiredScopes if we want them in the WWW-Authenticate header\n requiredScopes: includeScopeInWwwAuth ? requiredScopes : [],\n ...(includePrmInWwwAuth &&\n prmPath !== null && {\n resourceMetadataUrl: `${getBaseUrl()}${prmPath}`\n })\n });\n\n authMiddleware(req, res, async (err?: any) => {\n if (err) return next(err);\n if (!isStatefulVersion(ctx.specVersion)) {\n return handleStateless(req, res);\n }\n const server = createMcpServer();\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n\n try {\n await server.connect(transport);\n // Register cleanup before handing the request to the transport so the\n // pair is torn down even when handleRequest throws.\n res.on('close', () => {\n transport.close();\n server.close();\n });\n await transport.handleRequest(req, res, req.body);\n } catch (error) {\n console.error('Error handling MCP request:', error);\n if (!res.headersSent) {\n res.status(500).json({\n jsonrpc: '2.0',\n error: {\n code: -32603,\n message: 'Internal server error'\n },\n id: null\n });\n }\n }\n });\n });\n\n // Stateless lifecycle for the /mcp route: shared SEP-2575 validation +\n // server/discover from mock-server/stateless, then the same tools handlers\n // as createMcpServer. Bearer-auth middleware and PRM route above are\n // version-independent.\n function handleStateless(req: Request, res: Response) {\n const v = validateStatelessRequest(req, { tools: {} }, [ctx.specVersion]);\n if (v.kind === 'reject') {\n const body = req.body as\n | { method?: unknown; params?: { protocolVersion?: unknown } }\n | undefined;\n const error = (v.body as { error?: { code?: number; message?: string } })\n .error;\n if (body?.method === 'initialize') {\n // A dual-era client may fall back to the initialize handshake; the\n // -32022 naming this revision is how it learns the server is modern\n // (2026-07-28 basic/versioning, \"Backward Compatibility with\n // Initialization-Based Versions\"). Era detection, not a failure:\n // whether the client then carries on is judged by the scenario.\n checks.push({\n id: 'stateless-legacy-probe',\n name: 'StatelessLegacyProbe',\n description: `The client sent initialize, the legacy handshake; the ${ctx.specVersion} endpoint answered with the versions it supports`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Versioning-Backward-Compatibility',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/versioning#backward-compatibility-with-initialization-based-versions'\n }\n ],\n details: {\n status: v.status,\n code: error?.code,\n requestedVersion: body.params?.protocolVersion ?? null\n }\n });\n return res.status(v.status).json(v.body);\n }\n // The client never reached the tools handlers: a missing header or\n // _meta, or a version it cannot use. Recorded here, in the scenario's\n // own log, so a cell where every request was turned away cannot read\n // green on the strength of its OAuth checks alone.\n checks.push({\n id: 'stateless-request-rejected',\n name: 'StatelessRequestRejected',\n description:\n 'The stateless MCP endpoint turned the request away before it reached the scenario',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: error?.message,\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#protocol-version-header'\n }\n ],\n details: {\n status: v.status,\n code: error?.code,\n method: body?.method,\n headerVersion: req.headers['mcp-protocol-version'] ?? null\n }\n });\n return res.status(v.status).json(v.body);\n }\n if (v.kind === 'handled') {\n return res.status(v.status).json(v.body);\n }\n const { id, method } = v;\n if (method === 'tools/list') {\n return res.json({\n jsonrpc: '2.0',\n id,\n result: withRequiredDraftResultFields(method, {\n tools: [\n {\n name: 'test-tool',\n description: TEST_TOOL_DESCRIPTION,\n inputSchema: { type: 'object' }\n }\n ]\n })\n });\n }\n if (method === 'tools/call') {\n return res.json({\n jsonrpc: '2.0',\n id,\n result: withRequiredDraftResultFields(method, {\n content: [{ type: 'text', text: 'test' }]\n })\n });\n }\n return res.status(404).json({\n jsonrpc: '2.0',\n id,\n error: { code: -32601, message: 'Method not found' }\n });\n }\n\n return app;\n}\n",[],[142,474,796,929,1058,1100],"3f028d1d-05c7-44ac-803f-86f762c58942","createAuthServer.ts","e06d5044-ad13-11f1-84e1-1607ee4eb77e",228,["D",1789332106633],"import express, { Request, Response } from 'npm:express@^5.1.0';\nimport { createHash } from 'node:crypto';\nimport type { ConformanceCheck } from '../../../../types.ts';\nimport type { ScenarioContext } from '../../../../mock-server/index.ts';\nimport { isStatefulVersion } from '../../../../connection/select.ts';\nimport { createRequestLogger } from '../../../request-logger.ts';\nimport { SpecReferences } from '../spec-references.ts';\nimport { MockTokenVerifier, tokenWithScopes } from './mockTokenVerifier.ts';\nimport * as jose from 'npm:jose@^6.1.2';\nimport {\n generateIssuerKey,\n mintDpopBoundToken,\n type TokenIssuerKey\n} from './dpopToken.ts';\n\n/**\n * The authorization code is opaque to the client, so we use it to carry the\n * per-flow state (PKCE challenge, requested scopes) from /authorize to\n * /token. This keeps the AS stateless across processes — on serverless hosts\n * (val.town) the two requests can land on different isolates, where closure\n * state from /authorize doesn't exist. The closure variables remain as a\n * fallback for flows that don't round-trip our code (e.g. hand-rolled tests).\n *\n * The code is a plain base64url JSON envelope — no secret, no signature, no\n * verification: it is a state carrier for a test fixture, not a credential\n * check, and the helper names say so (they perform no authorization).\n */\ninterface FlowCodeState {\n challenge?: string;\n scopes?: string[];\n}\n\nconst AUTH_CODE_PREFIX = 'test-auth-code';\n\nfunction packFlowCode(state: FlowCodeState): string {\n return `${AUTH_CODE_PREFIX}.${Buffer.from(JSON.stringify(state)).toString('base64url')}`;\n}\n\nfunction unpackFlowCode(code: string | undefined): FlowCodeState | undefined {\n if (!code?.startsWith(`${AUTH_CODE_PREFIX}.`)) return undefined;\n try {\n return JSON.parse(\n Buffer.from(\n code.slice(AUTH_CODE_PREFIX.length + 1),\n 'base64url'\n ).toString()\n ) as FlowCodeState;\n } catch {\n return undefined;\n }\n}\n\n/**\n * Compute S256 code challenge from a code verifier.\n * BASE64URL(SHA256(code_verifier))\n */\nfunction computeS256Challenge(codeVerifier: string): string {\n const hash = createHash('sha256').update(codeVerifier).digest();\n return hash\n .toString('base64')\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_')\n .replace(/=+$/, '');\n}\n\n// Fixed nonce the test AS hands out when `dpopRequireNonce` is set (RFC 9449 §8).\nconst AS_DPOP_NONCE = 'conformance-as-dpop-nonce';\n\n// Asymmetric JWS algorithms acceptable for a DPoP proof (RFC 9449 §4.3, §11.6).\nconst DPOP_ASYMMETRIC_ALGS = [\n 'ES256',\n 'ES384',\n 'ES512',\n 'RS256',\n 'RS384',\n 'RS512',\n 'PS256',\n 'PS384',\n 'PS512',\n 'EdDSA'\n];\n\n/**\n * Canonicalize an `htu` for comparison per RFC 9449 §4.3 (RFC 3986 scheme-based\n * normalization): lowercase scheme/host, drop the default port, ignore a\n * trailing slash. Query/fragment are rejected by the caller (RFC 9449 §4.2),\n * not silently stripped here.\n */\nfunction normalizeHtu(u: string): string {\n try {\n const url = new URL(u);\n // Tolerate a single trailing slash only; `/mcp//` is a distinct path.\n return `${url.protocol}//${url.host}${url.pathname.replace(/\\/$/, '')}`;\n } catch {\n return u;\n }\n}\n\n/**\n * Validate a DPoP proof presented at the token endpoint (the token-request\n * subset of RFC 9449 §4.3). Hand-rolled with jose primitives — deliberately an\n * INDEPENDENT code path from the suite's proof builder, so a shared bug\n * surfaces rather than hides. Returns the JWK thumbprint to bind on success.\n */\nexport async function validateDpopProofAtTokenEndpoint(\n proof: string,\n tokenEndpointUrl: string\n): Promise<{ ok: true; jkt: string } | { ok: false; error: string }> {\n let header: jose.ProtectedHeaderParameters;\n try {\n header = jose.decodeProtectedHeader(proof);\n } catch {\n return { ok: false, error: 'DPoP proof is not a well-formed JWT' };\n }\n if (header.typ !== 'dpop+jwt') {\n return { ok: false, error: 'typ must be dpop+jwt' };\n }\n if (!header.alg || !DPOP_ASYMMETRIC_ALGS.includes(header.alg)) {\n return { ok: false, error: 'alg must be a supported asymmetric algorithm' };\n }\n const jwk = header.jwk as jose.JWK | undefined;\n if (!jwk) {\n return { ok: false, error: 'missing jwk header parameter' };\n }\n if ((jwk as Record).d !== undefined) {\n return { ok: false, error: 'jwk must not contain a private key' };\n }\n let claims: jose.JWTPayload;\n try {\n const key = await jose.importJWK(jwk, header.alg);\n claims = (\n await jose.jwtVerify(proof, key, { algorithms: DPOP_ASYMMETRIC_ALGS })\n ).payload;\n } catch {\n return { ok: false, error: 'DPoP proof signature does not verify' };\n }\n if (typeof claims.jti !== 'string') {\n return { ok: false, error: 'missing jti claim' };\n }\n if (claims.htm !== 'POST') {\n return { ok: false, error: 'htm does not match POST' };\n }\n if (typeof claims.htu !== 'string') {\n return { ok: false, error: 'htu does not match the token endpoint' };\n }\n if (claims.htu.includes('?') || claims.htu.includes('#')) {\n return {\n ok: false,\n error: 'htu MUST NOT contain a query or fragment (RFC 9449 §4.2)'\n };\n }\n if (normalizeHtu(claims.htu) !== normalizeHtu(tokenEndpointUrl)) {\n return { ok: false, error: 'htu does not match the token endpoint' };\n }\n if (\n typeof claims.iat !== 'number' ||\n Math.abs(Math.floor(Date.now() / 1000) - claims.iat) > 300\n ) {\n return { ok: false, error: 'iat outside the acceptable window' };\n }\n const jkt = await jose.calculateJwkThumbprint(jwk, 'sha256');\n return { ok: true, jkt };\n}\n\nexport interface TokenRequestResult {\n token: string;\n scopes: string[];\n}\n\nexport interface TokenRequestError {\n error: string;\n errorDescription?: string;\n statusCode?: number;\n}\n\n/**\n * Sink for the DPoP token-request observation (RFC 9449 §5). The AS writes to\n * it on the authorization_code exchange (sticky-failure: once any exchange\n * lacks a valid proof it stays FAILURE; refresh grants are ignored) so the\n * client scenario can emit sep-1932-client-token-request-proof unconditionally\n * — FAILURE by default when the client never reaches the token endpoint,\n * matching its sibling checks.\n */\nexport interface DpopTokenRequestObservation {\n recorded: boolean;\n validProof: boolean;\n error?: string;\n /** The token endpoint issued a `use_dpop_nonce` challenge (RFC 9449 §8). */\n asNonceChallengeIssued: boolean;\n /** The client retried the token request carrying the correct nonce. */\n asNonceHonored: boolean;\n}\n\nexport interface AuthServerOptions {\n metadataPath?: string;\n isOpenIdConfiguration?: boolean;\n loggingEnabled?: boolean;\n routePrefix?: string;\n scopesSupported?: string[];\n grantTypesSupported?: string[];\n tokenEndpointAuthMethodsSupported?: string[];\n tokenEndpointAuthSigningAlgValuesSupported?: string[];\n clientIdMetadataDocumentSupported?: boolean;\n /** Set to true to NOT advertise registration_endpoint (for pre-registration tests) */\n disableDynamicRegistration?: boolean;\n /** PKCE code_challenge_methods_supported. Set to null to omit from metadata. Default: ['S256'] */\n codeChallengeMethodsSupported?: string[] | null;\n /** Advertise authorization_response_iss_parameter_supported in AS metadata. Default: true. Pass null to omit. */\n issParameterSupported?: boolean | null;\n /**\n * What iss value to include in authorization redirect. Default: 'correct'.\n * 'normalized' sends a normalization-equivalent variant of the correct\n * issuer (trailing slash appended, exactly what `new URL(x).href`\n * round-tripping produces) — equal under RFC 3986 §6.2.2–6.2.3\n * normalization but not under simple string comparison.\n */\n issInRedirect?: 'correct' | 'wrong' | 'omit' | 'normalized';\n /**\n * Override the `issuer` value served in the AS metadata document. Used to\n * test that clients validate the metadata issuer against the issuer\n * identifier used to construct the well-known URL (RFC 8414 §3.3).\n * Accepts a lazy getter for callers that don't know the server URL until\n * after `start()`.\n */\n metadataIssuer?: string | (() => string);\n /**\n * DPoP (SEP-1932 / RFC 9449) — opt-in; absent ⇒ no DPoP behaviour at all.\n * When set, the AS advertises `dpop_signing_alg_values_supported` in its\n * metadata and validates+binds a DPoP proof presented at the token endpoint.\n */\n dpopSigningAlgValuesSupported?: string[];\n /**\n * Negative-test mode: make the AS misbehave in one specific way so a check\n * can be proven to FAIL.\n * - 'omit-alg-values' — drop `dpop_signing_alg_values_supported` entirely\n * - 'empty-alg-values' — advertise the field as an empty array\n * - 'include-none' — list `none` among the supported proof algs\n * - 'unbound-token' — issue a Bearer token ignoring a valid proof\n */\n dpopMisbehavior?:\n | 'omit-alg-values'\n | 'empty-alg-values'\n | 'include-none'\n | 'unbound-token';\n /** Sink for the DPoP token-request observation; see the interface docstring. */\n dpopTokenRequestObs?: DpopTokenRequestObservation;\n /**\n * When true, the token endpoint requires a DPoP nonce (RFC 9449 §8): a\n * proof-bearing request without the correct `nonce` claim is answered with\n * `400 use_dpop_nonce` + a `DPoP-Nonce` header, and the retry carrying the\n * nonce is accepted. Used to exercise the client's nonce handling.\n */\n dpopRequireNonce?: boolean;\n tokenVerifier?: MockTokenVerifier;\n onTokenRequest?: (requestData: {\n scope?: string;\n grantType: string;\n timestamp: string;\n body: Record;\n authBaseUrl: string;\n tokenEndpoint: string;\n authorizationHeader?: string;\n }) =>\n | TokenRequestResult\n | TokenRequestError\n | Promise;\n /** Awaited before the redirect is sent, so what it logs is in the log. */\n onAuthorizationRequest?: (requestData: {\n clientId?: string;\n scope?: string;\n resource?: string;\n timestamp: string;\n }) => void | Promise;\n onRegistrationRequest?: (req: Request) => {\n clientId: string;\n clientSecret?: string;\n tokenEndpointAuthMethod?: string;\n };\n}\n\nexport function createAuthServer(\n ctx: ScenarioContext,\n checks: ConformanceCheck[],\n getAuthBaseUrl: () => string,\n options: AuthServerOptions = {}\n): express.Application {\n const {\n metadataPath = '/.well-known/oauth-authorization-server',\n isOpenIdConfiguration = false,\n loggingEnabled = true,\n routePrefix = '',\n scopesSupported,\n grantTypesSupported = ['authorization_code', 'refresh_token'],\n tokenEndpointAuthMethodsSupported = ['none'],\n tokenEndpointAuthSigningAlgValuesSupported,\n clientIdMetadataDocumentSupported,\n disableDynamicRegistration = false,\n codeChallengeMethodsSupported = ['S256'],\n issParameterSupported = true,\n issInRedirect = 'correct',\n metadataIssuer,\n dpopSigningAlgValuesSupported,\n dpopMisbehavior,\n dpopTokenRequestObs,\n dpopRequireNonce = false,\n tokenVerifier,\n onTokenRequest,\n onAuthorizationRequest,\n onRegistrationRequest\n } = options;\n\n // Track scopes from the most recent authorization request\n let lastAuthorizationScopes: string[] = [];\n // Track PKCE code_challenge for verification in token request\n let storedCodeChallenge: string | undefined;\n // Lazily-created issuer key for minting DPoP-bound JWT access tokens.\n let dpopIssuerKey: TokenIssuerKey | undefined;\n // DPoP behaviour is active only when the caller opts in (any DPoP option).\n const dpopEnabled =\n dpopSigningAlgValuesSupported !== undefined ||\n dpopMisbehavior !== undefined;\n\n // Records whether the client presented a valid DPoP proof at its\n // authorization_code token request (RFC 9449 §5) into the caller's observation\n // sink. Sticky-failure: FAILURE if ANY exchange lacked a valid proof, SUCCESS\n // only if every one had one — so a later proof-less exchange (e.g. a refresh\n // done as authorization_code) can't overwrite an earlier failure, nor vice\n // versa. Refresh grants are ignored entirely. The client scenario reads this\n // to emit sep-1932-client-token-request-proof unconditionally (FAILURE by\n // default when the client never reaches the token endpoint).\n const recordTokenRequestProof = (\n grantType: string,\n ok: boolean,\n detail?: string\n ): void => {\n if (grantType !== 'authorization_code' || !dpopTokenRequestObs) return;\n const valid = dpopTokenRequestObs.recorded\n ? dpopTokenRequestObs.validProof && ok\n : ok;\n dpopTokenRequestObs.recorded = true;\n dpopTokenRequestObs.validProof = valid;\n if (!valid && detail) dpopTokenRequestObs.error ??= detail;\n };\n\n const authRoutes = {\n authorization_endpoint: `${routePrefix}/authorize`,\n token_endpoint: `${routePrefix}/token`,\n registration_endpoint: `${routePrefix}/register`\n };\n\n // The issuer identifier this AS publishes — used for both the metadata\n // `issuer` field and the RFC 9207 callback `iss` parameter, which per\n // RFC 9207 §2.4 must be identical under simple string comparison.\n const resolveIssuer = () =>\n typeof metadataIssuer === 'function'\n ? metadataIssuer()\n : (metadataIssuer ?? `${getAuthBaseUrl()}${routePrefix}`);\n\n const app = express();\n app.use(express.json());\n app.use(express.urlencoded({ extended: true }));\n\n if (loggingEnabled) {\n app.use(\n createRequestLogger(checks, {\n incomingId: 'incoming-auth-request',\n outgoingId: 'outgoing-auth-response'\n })\n );\n }\n\n app.get(metadataPath, (req: Request, res: Response) => {\n checks.push({\n id: 'authorization-server-metadata',\n name: 'AuthorizationServerMetadata',\n description: 'Client requested authorization server metadata',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_AUTH_SERVER_METADATA_REQUEST,\n SpecReferences.MCP_AUTH_DISCOVERY\n ],\n details: {\n url: req.url,\n path: req.path,\n // The issuer this document declares, so a verdict that compares\n // against it can be re-judged from the log alone.\n issuer: resolveIssuer()\n }\n });\n\n const metadata: any = {\n issuer: resolveIssuer(),\n authorization_endpoint: `${getAuthBaseUrl()}${authRoutes.authorization_endpoint}`,\n token_endpoint: `${getAuthBaseUrl()}${authRoutes.token_endpoint}`,\n ...(!disableDynamicRegistration && {\n registration_endpoint: `${getAuthBaseUrl()}${authRoutes.registration_endpoint}`\n }),\n response_types_supported: ['code'],\n grant_types_supported: grantTypesSupported,\n // PKCE support - null means omit from metadata (for negative testing)\n ...(codeChallengeMethodsSupported !== null && {\n code_challenge_methods_supported: codeChallengeMethodsSupported\n }),\n ...(issParameterSupported !== null && {\n authorization_response_iss_parameter_supported: issParameterSupported\n }),\n token_endpoint_auth_methods_supported: tokenEndpointAuthMethodsSupported,\n ...(tokenEndpointAuthSigningAlgValuesSupported && {\n token_endpoint_auth_signing_alg_values_supported:\n tokenEndpointAuthSigningAlgValuesSupported\n }),\n // DPoP AS-metadata support signal (SEP-1932 / RFC 9449 §5.1). Opt-in;\n // misbehaviour modes alter it: 'omit-alg-values' drops the field,\n // 'empty-alg-values' advertises an empty array, 'include-none' adds the\n // forbidden `none` alg. (dpop_bound_access_tokens is client-registration\n // metadata per RFC 9449 §5.2, so it is deliberately NOT advertised here.)\n ...(dpopMisbehavior !== 'omit-alg-values' &&\n dpopSigningAlgValuesSupported !== undefined && {\n dpop_signing_alg_values_supported:\n dpopMisbehavior === 'empty-alg-values'\n ? []\n : dpopMisbehavior === 'include-none'\n ? [...dpopSigningAlgValuesSupported, 'none']\n : dpopSigningAlgValuesSupported\n })\n };\n\n // Add scopes_supported if provided\n if (scopesSupported !== undefined) {\n metadata.scopes_supported = scopesSupported;\n }\n\n // Add client_id_metadata_document_supported if provided\n if (clientIdMetadataDocumentSupported !== undefined) {\n metadata.client_id_metadata_document_supported =\n clientIdMetadataDocumentSupported;\n }\n\n // Add OpenID Configuration specific fields\n if (isOpenIdConfiguration) {\n metadata.jwks_uri = `${getAuthBaseUrl()}/.well-known/jwks.json`;\n metadata.subject_types_supported = ['public'];\n metadata.id_token_signing_alg_values_supported = ['RS256'];\n }\n\n res.json(metadata);\n });\n\n app.get(\n authRoutes.authorization_endpoint,\n async (req: Request, res: Response) => {\n const timestamp = new Date().toISOString();\n checks.push({\n id: 'authorization-request',\n name: 'AuthorizationRequest',\n description: 'Client made authorization request',\n status: 'SUCCESS',\n timestamp,\n specReferences: [SpecReferences.OAUTH_2_1_AUTHORIZATION_ENDPOINT],\n details: {\n query: req.query,\n // The revision the run targets, so a verdict that depends on it can\n // be re-judged from the log alone (a fresh instance has no context).\n specVersion: ctx.specVersion\n }\n });\n\n // PKCE: Store code_challenge for later verification\n const codeChallenge = req.query.code_challenge as string | undefined;\n const codeChallengeMethod = req.query.code_challenge_method as\n | string\n | undefined;\n storedCodeChallenge = codeChallenge;\n\n // PKCE: Check code_challenge is present\n checks.push({\n id: 'pkce-code-challenge-sent',\n name: 'PKCE Code Challenge',\n description: codeChallenge\n ? 'Client sent code_challenge in authorization request'\n : 'Client MUST send code_challenge in authorization request',\n status: codeChallenge ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PKCE]\n });\n\n // PKCE: Check S256 method is used\n checks.push({\n id: 'pkce-s256-method-used',\n name: 'PKCE S256 Method',\n description:\n codeChallengeMethod === 'S256'\n ? 'Client used S256 code challenge method'\n : 'Client MUST use S256 code challenge method when technically capable',\n status: codeChallengeMethod === 'S256' ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PKCE],\n details: {\n method: codeChallengeMethod || 'not specified'\n }\n });\n\n // Track scopes from authorization request for token issuance\n const scopeParam = req.query.scope as string | undefined;\n lastAuthorizationScopes = scopeParam ? scopeParam.split(' ') : [];\n\n if (onAuthorizationRequest) {\n await onAuthorizationRequest({\n clientId: req.query.client_id as string | undefined,\n scope: scopeParam,\n resource: req.query.resource as string | undefined,\n timestamp\n });\n }\n\n const redirectUri = req.query.redirect_uri as string;\n const state = req.query.state as string;\n const redirectUrl = new URL(redirectUri);\n redirectUrl.searchParams.set(\n 'code',\n packFlowCode({\n challenge: codeChallenge,\n scopes: lastAuthorizationScopes\n })\n );\n if (state) {\n redirectUrl.searchParams.set('state', state);\n }\n\n // ISS: Include iss parameter in redirect if configured. The 'correct'\n // value must equal the metadata `issuer` exactly (RFC 9207 §2.4 simple\n // string comparison), so honor the same metadataIssuer override the\n // metadata document does.\n if (issInRedirect === 'correct') {\n redirectUrl.searchParams.set('iss', resolveIssuer());\n } else if (issInRedirect === 'wrong') {\n redirectUrl.searchParams.set('iss', 'https://evil.example.com');\n } else if (issInRedirect === 'normalized') {\n // Normalization-equivalent variant of the correct issuer: identical\n // after RFC 3986 scheme-based normalization (trailing slash on an\n // empty path) but different under simple string comparison.\n redirectUrl.searchParams.set('iss', `${resolveIssuer()}/`);\n }\n\n res.redirect(redirectUrl.toString());\n }\n );\n\n app.post(authRoutes.token_endpoint, async (req: Request, res: Response) => {\n const timestamp = new Date().toISOString();\n const requestedScope = req.body.scope;\n const grantType = req.body.grant_type;\n\n // Recover per-flow state from the code itself (survives process changes\n // on serverless hosts); fall back to closure state for codes we didn't\n // mint via packFlowCode.\n const codeState = unpackFlowCode(req.body.code as string | undefined);\n const flowChallenge = codeState?.challenge ?? storedCodeChallenge;\n const flowScopes = codeState?.scopes ?? lastAuthorizationScopes;\n\n checks.push({\n id: 'token-request',\n name: 'TokenRequest',\n description: 'Client requested access token',\n status: 'SUCCESS',\n timestamp,\n specReferences: [SpecReferences.OAUTH_2_1_TOKEN],\n details: {\n endpoint: '/token',\n grantType\n }\n });\n\n // PKCE: Check code_verifier is present (only for authorization_code grant)\n const codeVerifier = req.body.code_verifier as string | undefined;\n if (grantType === 'authorization_code') {\n checks.push({\n id: 'pkce-code-verifier-sent',\n name: 'PKCE Code Verifier',\n description: codeVerifier\n ? 'Client sent code_verifier in token request'\n : 'Client MUST send code_verifier in token request',\n status: codeVerifier ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PKCE]\n });\n\n // PKCE: Validate code_verifier matches code_challenge (S256)\n // Fail if either is missing\n const computedChallenge =\n codeVerifier && flowChallenge\n ? computeS256Challenge(codeVerifier)\n : undefined;\n const matches =\n computedChallenge !== undefined && computedChallenge === flowChallenge;\n\n let description: string;\n if (!flowChallenge && !codeVerifier) {\n description =\n 'Neither code_challenge nor code_verifier were sent - PKCE is required';\n } else if (!flowChallenge) {\n description =\n 'code_challenge was not sent in authorization request - PKCE is required';\n } else if (!codeVerifier) {\n description =\n 'code_verifier was not sent in token request - PKCE is required';\n } else if (matches) {\n description = 'code_verifier correctly matches code_challenge (S256)';\n } else {\n description = 'code_verifier does not match code_challenge';\n }\n\n checks.push({\n id: 'pkce-verifier-matches-challenge',\n name: 'PKCE Verifier Validation',\n description,\n status: matches ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PKCE],\n details: {\n matches,\n storedChallenge: flowChallenge || 'not sent',\n computedChallenge: computedChallenge || 'not computed'\n }\n });\n }\n\n // ---- DPoP token binding (SEP-1932 / RFC 9449) — opt-in ----\n if (dpopEnabled) {\n const proofHeader = req.headers['dpop'];\n const proofValue = Array.isArray(proofHeader)\n ? proofHeader.join(', ')\n : proofHeader;\n // RFC 9449 §4.2: at most one DPoP header field. Node collapses duplicate\n // request headers into one comma-joined value; a valid proof JWT contains\n // no comma, so a comma means more than one proof was sent.\n if (typeof proofValue === 'string' && proofValue.includes(',')) {\n recordTokenRequestProof(\n grantType,\n false,\n 'multiple DPoP proof headers'\n );\n res.status(400).json({\n error: 'invalid_dpop_proof',\n error_description: 'Multiple DPoP proof headers'\n });\n return;\n }\n const proof = proofValue;\n const tokenEndpointUrl = `${getAuthBaseUrl()}${authRoutes.token_endpoint}`;\n const grantedScopes = requestedScope\n ? requestedScope.split(' ')\n : lastAuthorizationScopes;\n\n // No proof ⇒ DPoP is not being exercised here; fall through to a Bearer\n // token. (Requiring a proof is a per-client `dpop_bound_access_tokens`\n // registration policy — RFC 9449 §5.2 — not a global AS behaviour.) The\n // client-side check still records that the client failed to ask for a\n // bound token.\n if (proof) {\n const result = await validateDpopProofAtTokenEndpoint(\n proof,\n tokenEndpointUrl\n );\n if (!result.ok) {\n recordTokenRequestProof(grantType, false, result.error);\n res.status(400).json({\n error: 'invalid_dpop_proof',\n error_description: result.error\n });\n return;\n }\n // The proof itself is valid — record that now, BEFORE any nonce\n // challenge, so a client that is challenged but does not retry is not\n // mis-reported by token-request-proof as \"never completed a token\n // request\" (its proof was just verified). Sticky + gated on\n // authorization_code inside recordTokenRequestProof.\n recordTokenRequestProof(grantType, true);\n\n // RFC 9449 §8: require a server-provided nonce. A proof without the\n // correct nonce is challenged (400 use_dpop_nonce + DPoP-Nonce); the\n // client is expected to retry with it. The nonce observation is gated\n // on the authorization_code exchange, matching recordTokenRequestProof\n // (honoring a challenge on a refresh exchange must not satisfy §8).\n if (dpopRequireNonce) {\n let proofNonce: unknown;\n try {\n proofNonce = jose.decodeJwt(proof).nonce;\n } catch {\n proofNonce = undefined;\n }\n if (proofNonce !== AS_DPOP_NONCE) {\n if (grantType === 'authorization_code' && dpopTokenRequestObs)\n dpopTokenRequestObs.asNonceChallengeIssued = true;\n res.status(400).set('DPoP-Nonce', AS_DPOP_NONCE).json({\n error: 'use_dpop_nonce',\n error_description: 'Authorization server requires a DPoP nonce'\n });\n return;\n }\n if (grantType === 'authorization_code' && dpopTokenRequestObs)\n dpopTokenRequestObs.asNonceHonored = true;\n }\n\n if (dpopMisbehavior === 'unbound-token') {\n // Misbehaviour: ignore the binding and issue a plain Bearer token.\n const bearer = tokenWithScopes(\n `test-token-${Date.now()}`,\n grantedScopes\n );\n if (tokenVerifier) tokenVerifier.registerToken(bearer, grantedScopes);\n res.json({\n access_token: bearer,\n token_type: 'Bearer',\n expires_in: 3600\n });\n return;\n }\n\n if (!dpopIssuerKey) {\n dpopIssuerKey = await generateIssuerKey();\n }\n const boundToken = await mintDpopBoundToken({\n issuerKey: dpopIssuerKey,\n issuer: resolveIssuer(),\n audience:\n (req.body.resource as string) || 'urn:conformance-test-resource',\n jkt: result.jkt,\n ...(requestedScope && { scope: requestedScope })\n });\n res.json({\n access_token: boundToken,\n token_type: 'DPoP',\n expires_in: 3600,\n ...(requestedScope && { scope: requestedScope })\n });\n return;\n }\n // dpopEnabled but the token request carried no DPoP proof.\n recordTokenRequestProof(\n grantType,\n false,\n 'no DPoP proof in the token request'\n );\n }\n\n let token = `test-token-${Date.now()}`;\n let scopes: string[] = flowScopes;\n\n if (onTokenRequest) {\n const result = await onTokenRequest({\n scope: requestedScope,\n grantType,\n timestamp,\n body: req.body,\n authBaseUrl: getAuthBaseUrl(),\n tokenEndpoint: `${getAuthBaseUrl()}${authRoutes.token_endpoint}`,\n authorizationHeader: req.headers.authorization\n });\n\n // Check if result is an error\n if ('error' in result) {\n res.status(result.statusCode || 400).json({\n error: result.error,\n error_description: result.errorDescription\n });\n return;\n }\n\n token = result.token;\n scopes = result.scopes;\n }\n\n // The resource server may verify this token in another process.\n token = tokenWithScopes(token, scopes);\n\n // Register token with verifier if provided\n if (tokenVerifier) {\n tokenVerifier.registerToken(token, scopes);\n }\n\n res.json({\n access_token: token,\n token_type: 'Bearer',\n expires_in: 3600,\n ...(scopes.length > 0 && { scope: scopes.join(' ') })\n });\n });\n\n app.post(authRoutes.registration_endpoint, (req: Request, res: Response) => {\n let clientId = 'test-client-id';\n let clientSecret: string | undefined = 'test-client-secret';\n let tokenEndpointAuthMethod: string | undefined;\n\n if (onRegistrationRequest) {\n const result = onRegistrationRequest(req);\n clientId = result.clientId;\n clientSecret = result.clientSecret;\n tokenEndpointAuthMethod = result.tokenEndpointAuthMethod;\n }\n\n checks.push({\n id: 'client-registration',\n name: 'ClientRegistration',\n description: 'Client registered with authorization server',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_DCR],\n details: {\n endpoint: '/register',\n clientName: req.body.client_name,\n ...(tokenEndpointAuthMethod && { tokenEndpointAuthMethod })\n }\n });\n\n // SEP-837: clients MUST specify an appropriate application_type during DCR.\n // The harness can't know the client's real class (native vs web), so this\n // checks presence + that the value is one of the two OIDC-defined values.\n // SEP-837 first appears in the draft spec (the same revision that\n // introduces the stateless lifecycle), so the check only exists for runs\n // targeting a version that includes it; at dated versions it is not\n // emitted at all.\n if (!isStatefulVersion(ctx.specVersion)) {\n const appType = req.body.application_type;\n const validAppType = appType === 'native' || appType === 'web';\n checks.push({\n id: 'sep-837-application-type-present',\n name: 'DCR application_type specified',\n description: validAppType\n ? `Client specified application_type \"${appType}\" during Dynamic Client Registration`\n : appType === undefined\n ? 'Client MUST specify an appropriate application_type during Dynamic Client Registration (SEP-837); field was omitted'\n : `Client MUST specify an appropriate application_type during Dynamic Client Registration (SEP-837); got \"${appType}\", expected \"native\" or \"web\"`,\n status: validAppType ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_DCR],\n details: { application_type: appType ?? '(omitted)' }\n });\n }\n\n res.status(201).json({\n client_id: clientId,\n ...(clientSecret && { client_secret: clientSecret }),\n client_name: req.body.client_name || 'test-client',\n redirect_uris: req.body.redirect_uris || [],\n ...(tokenEndpointAuthMethod && {\n token_endpoint_auth_method: tokenEndpointAuthMethod\n })\n });\n });\n\n return app;\n}\n",[],[142,474,796,929,1058,1109],"baa38abc-a03c-47a8-a9e4-609b3afc545a",42,["D",1789043629938],[211,212,213,214,215,216,217,218],[142,474,796,929,1058],"31fab290-500f-4847-9ad7-4cd67426359a",15,["D",1789043614323],[210,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234],[142,474,796,929],"a7cfba3d-3417-4acf-85ba-a2082af37347",11,["D",1789043611708],[209,235,239,240,241,242,243,244,245,246,247,248,249,250,251],[142,474,796],"7a51fb13-0433-46f9-a9e3-217fc3bba2ee","authorization-server-metadata.ts","d6671c56-ad13-11f1-a650-1607ee4eb77e","915f928e-42c4-4864-a297-c3b2a55525d0",77,["D",1789046852951],"/**\n * Authorization server metadata endpoint test scenarios for MCP authorization servers\n */\nimport { AuthorizationServerOptions } from '../../schemas.ts';\nimport {\n CheckStatus,\n ClientScenarioForAuthorizationServer,\n ConformanceCheck\n} from '../../types.ts';\nimport { request } from 'npm:undici@^7.25.0';\nimport { SpecReferences } from './auth/spec-references.ts';\nimport { SpecReferences as ClientSpecReferences } from '../client/auth/spec-references.ts';\n\ntype Status = 'SUCCESS' | 'FAILURE';\n\nexport class AuthorizationServerMetadataEndpointScenario implements ClientScenarioForAuthorizationServer {\n name = 'authorization-server-metadata-endpoint';\n readonly source = { introducedIn: '2025-03-26' } as const;\n description = `Test authorization server metadata endpoint.\n\n**Authorization Server Implementation Requirements:**\n\n**Endpoint**: \\`authorization server metadata\\`\n\n**Requirements**:\n- HTTP response status code MUST be 200 OK\n- Content-Type header MUST be application/json\n- Return a JSON response including issuer, authorization_endpoint, token_endpoint and response_types_supported\n- The issuer value MUST match the URI obtained by removing the well-known URI string from the authorization server metadata URI.\n- (2025-11-25+) SHOULD include client_id_metadata_document_supported=true (Client ID Metadata Document support)`;\n\n async run(\n options: AuthorizationServerOptions,\n _details: Record\n ): Promise {\n let status: Status = 'SUCCESS';\n let errorMessage: string | undefined;\n let details: any;\n let response: any | null = null;\n let body: Record | undefined;\n try {\n const wellKnownUrls = this.createWellKnownUrl(options.url);\n\n for (const url of wellKnownUrls) {\n try {\n const checkResponse = await request(url, { method: 'GET' });\n if (checkResponse.statusCode === 200) {\n response = checkResponse;\n break;\n }\n } catch {\n // Ignore the error and proceed to the next loop.\n }\n }\n\n if (!response) {\n throw new Error(\n 'All authorization server metadata endpoints returned invalid status code.'\n );\n }\n\n this.validateContentType(response.headers['content-type']);\n\n body = await this.parseJson(response);\n const errors: string[] = [];\n this.validateMetadataBody(body, options.url, errors);\n\n if (errors.length > 0) {\n status = 'FAILURE';\n errorMessage = errors.join(', ');\n }\n\n details = {\n contentType: response.headers['content-type'],\n body\n };\n } catch (error) {\n status = 'FAILURE';\n errorMessage = error instanceof Error ? error.message : String(error);\n }\n\n const checks: ConformanceCheck[] = [\n {\n id: 'authorization-server-metadata',\n name: 'AuthorizationServerMetadata',\n description: 'Valid authorization server metadata response',\n status,\n timestamp: new Date().toISOString(),\n errorMessage,\n specReferences: [SpecReferences.MCP_AUTH_DISCOVERY],\n ...(details ? { details } : {})\n }\n ];\n\n if (body) {\n const cimdSupported = body.client_id_metadata_document_supported;\n const cimdStatus: CheckStatus =\n cimdSupported === true ? 'SUCCESS' : 'WARNING';\n const cimdErrorMessage =\n cimdSupported === true\n ? undefined\n : cimdSupported === undefined\n ? 'Authorization server metadata does not include \"client_id_metadata_document_supported\"'\n : `Expected \"client_id_metadata_document_supported\" to be true, got ${JSON.stringify(cimdSupported)}`;\n\n checks.push({\n id: 'authorization-server-metadata-cimd',\n name: 'AuthorizationServerMetadataCIMD',\n description:\n 'Authorization server metadata includes client_id_metadata_document_supported=true (Client ID Metadata Document support)',\n status: cimdStatus,\n source: { introducedIn: '2025-11-25' } as const,\n timestamp: new Date().toISOString(),\n errorMessage: cimdErrorMessage,\n specReferences: [\n ClientSpecReferences.MCP_CLIENT_ID_METADATA_DOCUMENTS,\n ClientSpecReferences.IETF_CIMD\n ],\n details: {\n client_id_metadata_document_supported: cimdSupported\n }\n });\n }\n\n return checks;\n }\n\n private createWellKnownUrl(serverUrl: string): string[] {\n const base = new URL(serverUrl);\n const origin = base.origin;\n const path = base.pathname.replace(/\\/$/, '');\n\n const urls = new Set();\n urls.add(`${origin}/.well-known/oauth-authorization-server${path}`);\n urls.add(`${origin}/.well-known/openid-configuration${path}`);\n urls.add(`${origin}${path}/.well-known/openid-configuration`);\n\n return Array.from(urls);\n }\n\n private validateContentType(contentType?: string | string[]): void {\n const valid =\n typeof contentType === 'string' &&\n contentType.toLowerCase().includes('application/json');\n\n if (!valid) {\n throw new Error(`Invalid Content-Type: ${contentType ?? '(missing)'}`);\n }\n }\n\n private async parseJson(response: any): Promise> {\n const body = await response.body.json();\n if (typeof body !== 'object' || body === null) {\n throw new Error('Response body is not an object');\n }\n return body;\n }\n\n private validateMetadataBody(\n body: Record,\n serverUrl: string,\n errors: string[]\n ): void {\n this.assertString(\n body.authorization_endpoint,\n 'authorization_endpoint',\n errors\n );\n this.assertString(body.token_endpoint, 'token_endpoint', errors);\n\n if (\n !Array.isArray(body.response_types_supported) ||\n !body.response_types_supported.includes('code')\n ) {\n errors.push(\n 'Response body does not include valid \"response_types_supported\" claim'\n );\n }\n\n if (\n !Array.isArray(body.code_challenge_methods_supported) ||\n !body.code_challenge_methods_supported.includes('S256')\n ) {\n errors.push(\n 'Response body does not include valid \"code_challenge_methods_supported\" claim'\n );\n }\n\n if (body.issuer !== serverUrl) {\n errors.push(`Invalid issuer: ${body.issuer ?? '(missing)'}`);\n }\n }\n\n private assertString(value: unknown, name: string, errors: string[]): void {\n if (typeof value !== 'string' || value.length === 0) {\n errors.push(`Response body does not include valid \"${name}\" claim`);\n }\n }\n}\n",[],[142,474,1140,1132],"authorization-server","be3726bc-cdb7-4cd4-bf16-10754cc5dded","authorization-code-grant.ts","60e3c800-ad1b-11f1-89e2-1607ee4eb77e",76,["D",1789046852633],"/**\n * Authorization code grant test scenarios for MCP authorization servers\n */\nimport {\n ClientScenarioForAuthorizationServer,\n ConformanceCheck\n} from '../../types.ts';\nimport { startCallbackServer } from './auth/helpers/createCallbackServer.ts';\nimport { request } from 'npm:undici@^7.25.0';\nimport { createHash, randomBytes } from 'node:crypto';\nimport { AuthorizationServerOptions } from '../../schemas.ts';\nimport { SpecReferences } from './auth/spec-references.ts';\n\nconst REDIRECT_URI_ORIGIN = 'http://127.0.0.1';\nconst REDIRECT_URI_PATH = '/callback';\n\nconst REDACTED_KEYS = ['access_token', 'refresh_token', 'id_token'] as const;\n\n/**\n * Mask live token material so it never lands in checks.json. Keep a short\n * prefix/suffix so the value can still be correlated against AS logs.\n * Tokens shorter than 16 chars are fully redacted.\n */\nfunction redactTokens(body: Record): Record {\n const out: Record = { ...body };\n for (const key of REDACTED_KEYS) {\n const value = out[key];\n if (typeof value === 'string') {\n out[key] =\n value.length < 16\n ? `[redacted, len=${value.length}]`\n : `${value.slice(0, 4)}…${value.slice(-4)} (len=${value.length})`;\n }\n }\n return out;\n}\n\nexport class AuthorizationCodeGrantScenario implements ClientScenarioForAuthorizationServer {\n private state = randomBytes(32).toString('base64url');\n private codeVerifier = '';\n private codeChallenge = '';\n name = 'authorization-code-grant';\n readonly source = { introducedIn: '2025-03-26' } as const;\n description = `Test authorization code grant.\n\n**Authorization Server Implementation Requirements:**\n\n**Endpoint**: \\`authorization endpoint\\`, \\`token endpoint\\`\n\n**Requirements**:\n- The URI in the authorization response MUST match the redirect_uri parameter in the authorization request\n- The code parameter MUST be present in the authorization response query parameters\n- The code parameter MUST have a value\n- The state parameter in the authorization response MUST match the state parameter in the authorization request query parameters if the state parameter is present in the authorization request query parameters\n- The iss parameter in the authorization response MUST match the issuer claim of authorization server metadata if the iss parameter is present in the authorization response query parameters\n- The code, state and iss parameters MUST NOT appear more than once\n- The error parameter MUST NOT be present in the authorization response query parameters\n- HTTP response status code of token response MUST be 200 OK\n- Content-Type header of token response MUST be application/json\n- Cache-Control header of token response MUST be no-store\n- Token response MUST return a JSON response including access_token and token_type`;\n\n async run(\n options: AuthorizationServerOptions,\n details: Record\n ): Promise {\n try {\n if (!options.clientId) {\n return [\n this.skippedCheck('authorization-code-grant requires --client-id')\n ];\n }\n\n this.state = randomBytes(32).toString('base64url');\n this.codeVerifier = randomBytes(32).toString('base64url');\n this.codeChallenge = createHash('sha256')\n .update(this.codeVerifier)\n .digest('base64url');\n\n const resultMetadata = details[\n 'authorization-server-metadata-endpoint'\n ] as { body?: Record };\n if (!resultMetadata?.body) {\n throw new Error('Invalid authorization server metadata');\n }\n const metadata = resultMetadata.body;\n\n // Decide how we'll authenticate to the token endpoint *before*\n // binding a port and asking the user to open a browser.\n const authMethod = this.selectTokenAuthMethod(metadata, options);\n if (authMethod === null) {\n return [\n this.skippedCheck(\n 'Server does not support client_secret_post, client_secret_basic, or none auth methods'\n )\n ];\n }\n\n const callback = startCallbackServer(options.port);\n try {\n const authorizationRequest = this.buildAuthorizationRequest(\n metadata,\n options\n );\n console.log(\n `Ensure ${REDIRECT_URI_ORIGIN}:${options.port}${REDIRECT_URI_PATH} is registered as a redirect URI for client '${options.clientId}'.`\n );\n console.log(\n 'Access the following URL in your browser and complete the authentication process.'\n );\n console.log(authorizationRequest);\n console.log('');\n console.log(\n 'Waiting up to 5 minutes for the authorization callback...'\n );\n\n const authorizationResponseUrl =\n await callback.waitForCallback(300_000);\n\n const errors: string[] = [];\n const code = this.validateAuthorizationResponse(\n authorizationResponseUrl,\n metadata,\n options,\n errors\n );\n\n const tokenResponse = await this.requestToken(\n metadata,\n options,\n code,\n authMethod\n );\n this.validateTokenResponse(tokenResponse, errors);\n\n if (errors.length > 0) {\n return [this.failureCheck(errors.join(', '))];\n }\n\n return [\n this.successCheck({\n authorizationRequest,\n authorizationResponseUrl,\n body: redactTokens(tokenResponse.body)\n })\n ];\n } finally {\n callback.close();\n }\n } catch (error) {\n return [this.failureCheck(error)];\n }\n }\n\n private buildAuthorizationRequest(\n metadata: any,\n options: AuthorizationServerOptions\n ): string {\n if (!metadata?.authorization_endpoint) {\n throw new Error('Unable to obtain authorization endpoint from metadata');\n }\n\n const params = new URLSearchParams({\n response_type: 'code',\n client_id: options.clientId ?? '',\n state: this.state,\n redirect_uri: `${REDIRECT_URI_ORIGIN}:${options.port}${REDIRECT_URI_PATH}`,\n code_challenge: this.codeChallenge,\n code_challenge_method: 'S256'\n });\n if (options.resource) {\n params.set('resource', options.resource);\n }\n\n return `${metadata.authorization_endpoint}?${params.toString()}`;\n }\n\n private validateAuthorizationResponse(\n responseUrl: string,\n metadata: any,\n options: AuthorizationServerOptions,\n errors: string[]\n ): string {\n const url = new URL(responseUrl);\n\n // RFC 6749 §4.1.2.1: an error response and a code response are mutually\n // exclusive. Surface the AS-reported error before any other validation.\n if (url.searchParams.has('error')) {\n const error = url.searchParams.get('error');\n const desc = url.searchParams.get('error_description');\n throw new Error(`Authorization error: ${error} ${desc ?? ''}`.trim());\n }\n\n if (url.origin !== REDIRECT_URI_ORIGIN + ':' + options.port) {\n errors.push(`Invalid origin of redirect URL: ${url.origin}`);\n }\n if (url.pathname !== REDIRECT_URI_PATH) {\n errors.push(`Invalid path of redirect URL: ${url.pathname}`);\n }\n\n // CSRF binding: state mismatch is fatal — never proceed to token\n // exchange with an unbound authorization response.\n const state = url.searchParams.getAll('state');\n if (state.length !== 1 || state[0] !== this.state) {\n throw new Error(\n `Invalid state parameter: ${state.join(',') || 'missing'}`\n );\n }\n\n const code = url.searchParams.getAll('code');\n if (code.length !== 1 || code[0] === '') {\n throw new Error(`Invalid code parameter: ${code.join(',') || 'missing'}`);\n }\n\n const iss = url.searchParams.getAll('iss');\n if (iss.length > 0) {\n if (iss.length !== 1 || iss[0] !== metadata.issuer) {\n errors.push(`Invalid iss parameter: ${iss}`);\n }\n }\n\n return code[0];\n }\n\n private selectTokenAuthMethod(\n metadata: any,\n options: AuthorizationServerOptions\n ): 'none' | 'client_secret_post' | 'client_secret_basic' | null {\n // RFC 8414 §2: omitted token_endpoint_auth_methods_supported means\n // the default is \"client_secret_basic\".\n const authMethods: string[] =\n metadata.token_endpoint_auth_methods_supported ?? ['client_secret_basic'];\n\n if (!options.clientSecret || authMethods.includes('none')) {\n return 'none';\n }\n if (authMethods.includes('client_secret_post')) {\n return 'client_secret_post';\n }\n if (authMethods.includes('client_secret_basic')) {\n return 'client_secret_basic';\n }\n // client_secret_jwt / private_key_jwt / tls_client_auth are not yet\n // implemented; skip rather than fail.\n return null;\n }\n\n private async requestToken(\n metadata: any,\n options: AuthorizationServerOptions,\n code: string,\n authMethod: 'none' | 'client_secret_post' | 'client_secret_basic'\n ): Promise<{ body: any; headers: any }> {\n if (!metadata?.token_endpoint) {\n throw new Error('Unable to obtain token endpoint from metadata');\n }\n\n const redirectUri = `${REDIRECT_URI_ORIGIN}:${options.port}${REDIRECT_URI_PATH}`;\n\n const params = new URLSearchParams({\n grant_type: 'authorization_code',\n code,\n redirect_uri: redirectUri,\n code_verifier: this.codeVerifier\n });\n if (options.resource) {\n params.set('resource', options.resource);\n }\n const headers: Record = {\n 'content-type': 'application/x-www-form-urlencoded'\n };\n\n if (authMethod === 'none') {\n // Public client (PKCE-only). RFC 6749 §3.2.1: client_id in the body.\n params.set('client_id', options.clientId!);\n } else if (authMethod === 'client_secret_post') {\n params.set('client_id', options.clientId!);\n params.set('client_secret', options.clientSecret!);\n } else {\n // RFC 6749 §2.3.1: form-urlencode each component before base64.\n const credentials = Buffer.from(\n `${encodeURIComponent(options.clientId!)}:${encodeURIComponent(options.clientSecret!)}`\n ).toString('base64');\n headers.authorization = `Basic ${credentials}`;\n }\n\n const response = await request(metadata.token_endpoint, {\n method: 'POST',\n headers,\n body: params.toString()\n });\n\n if (response.statusCode !== 200) {\n throw new Error(`Invalid status code: ${response.statusCode}`);\n }\n\n const body = await response.body.json();\n return { body, headers: response.headers };\n }\n\n private validateTokenResponse(\n response: {\n body: any;\n headers: any;\n },\n errors: string[]\n ): void {\n const { body, headers } = response;\n\n this.assertHeader(\n headers['content-type'],\n 'application/json',\n 'Content-Type',\n errors\n );\n this.assertHeader(\n headers['cache-control'],\n 'no-store',\n 'Cache-Control',\n errors\n );\n\n if (typeof body !== 'object' || body === null) {\n throw new Error('Token response body is not an object');\n }\n\n if (typeof body.access_token !== 'string') {\n errors.push('Missing access_token');\n }\n\n if (typeof body.token_type !== 'string') {\n errors.push('Missing token_type');\n }\n }\n\n private assertHeader(\n value: unknown,\n expected: string,\n name: string,\n errors: string[]\n ): void {\n if (typeof value !== 'string' || !value.toLowerCase().includes(expected)) {\n errors.push(`Invalid ${name}: ${value ?? '(missing)'}`);\n }\n }\n\n private successCheck(details: any): ConformanceCheck {\n return {\n id: 'authorization-code-grant',\n name: 'AuthorizationCodeGrant',\n description: 'Valid authorization code grant',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.OAUTH_2_1_AUTHORIZATION_CODE_GRANT],\n details\n };\n }\n\n private failureCheck(error: unknown): ConformanceCheck {\n return {\n id: 'authorization-code-grant',\n name: 'AuthorizationCodeGrant',\n description: 'Valid authorization code grant',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: error instanceof Error ? error.message : String(error),\n specReferences: [SpecReferences.OAUTH_2_1_AUTHORIZATION_CODE_GRANT]\n };\n }\n\n private skippedCheck(reason: string): ConformanceCheck {\n return {\n id: 'authorization-code-grant',\n name: 'AuthorizationCodeGrant',\n description: 'Valid authorization code grant',\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n errorMessage: reason,\n specReferences: [SpecReferences.OAUTH_2_1_AUTHORIZATION_CODE_GRANT]\n };\n }\n}\n",[],[142,474,1140,1142],"7bb55e29-a2e4-48ba-9692-c041d6202b34","7327dc5e-ad1b-11f1-9ed2-1607ee4eb77e","09523158-f2f7-46e9-9f55-b31f9aa745d5",121,["D",1789046883280],"import { SpecReference } from '../../../types.ts';\n\nexport const SpecReferences: { [key: string]: SpecReference } = {\n MCP_AUTH_DISCOVERY: {\n id: 'MCP-Authorization-metadata-discovery',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#authorization-server-metadata-discovery'\n },\n OAUTH_2_1_AUTHORIZATION_CODE_GRANT: {\n id: 'OAUTH-2.1-authorization-code-grant',\n url: 'https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-13.html#section-4.1'\n }\n};\n",[],[142,474,1140,929,939],"4248e539-b21b-4a99-841b-412cd0f0b17e","createCallbackServer.ts","738f451a-ad1b-11f1-9f16-1607ee4eb77e","78e52198-9de3-4840-a4fb-0822b10d2bc6",122,["D",1789046883895],"import express from 'npm:express@^5.1.0';\n\nexport interface CallbackServer {\n waitForCallback: (timeoutMs: number) => Promise;\n close: () => void;\n}\n\nexport function startCallbackServer(port: number): CallbackServer {\n const app = express();\n\n let resolveFn: (url: string) => void;\n let rejectFn: (err: Error) => void;\n\n const promise = new Promise((resolve, reject) => {\n resolveFn = resolve;\n rejectFn = reject;\n });\n\n const server = app.listen(port, '127.0.0.1', () => {\n console.log(`Callback server started: http://127.0.0.1:${port}`);\n });\n\n server.on('error', (err) => {\n rejectFn(err instanceof Error ? err : new Error(String(err)));\n });\n\n app.get('/callback', (req, res) => {\n // Do not derive origin from the client-supplied Host header — reconstruct\n // from the bind address so a forged Host can't influence validation.\n const fullUrl = `http://127.0.0.1:${port}${req.originalUrl}`;\n res.send('OK. You can close this page.');\n\n server.close();\n resolveFn(fullUrl);\n });\n\n const close = () => {\n server.close();\n };\n\n return {\n close,\n waitForCallback: (timeoutMs: number) => {\n let timer: NodeJS.Timeout;\n const timeout = new Promise((_, reject) => {\n timer = setTimeout(() => {\n server.close();\n reject(new Error('Timeout: No callback received'));\n }, timeoutMs);\n timer.unref();\n });\n return Promise.race([promise, timeout]).finally(() =>\n clearTimeout(timer)\n );\n }\n };\n}\n",[],[142,474,1140,929,1058,1158],"ff1a58c2-5b93-4269-aa15-9ea710f2858b",["D",1789046883895],[204],[142,474,1140,929,1058],"01934eae-7663-47ae-8130-0e47f7aa3c42",["D",1789046883280],[203,205],[142,474,1140,929],"163255dc-656a-4a7a-80e4-cb2410065855",14,["D",1789043613775],[202,206,207],[142,474,1140],"b6f6630c-f135-467b-8460-f1158f0e04dd",7,["D",1789043609699],[201,208,252,290,291,292],[142,474],"6ed54151-cd5f-4e7c-b0bb-0eca8c80504a","70b91c9e-ad1b-11f1-bc57-1607ee4eb77e","bdf43a0a-301f-4980-aa94-1f7a9be8bec7",225,["D",1789332104191],"/**\n * Stateless mock server: 2026-x lifecycle (SEP-2575).\n *\n * No initialize handshake. Validates `_meta` (protocolVersion /\n * clientCapabilities — `clientInfo` is a SHOULD since spec PR #3002 and is\n * never required) and the `MCP-Protocol-Version` header on every request,\n * serves `server/discover`, and routes other methods to the supplied handlers.\n * Implemented with raw express so it can front-run SDK support.\n */\n\nimport express from 'npm:express@^5.1.0';\nimport { DRAFT_PROTOCOL_VERSION, type SpecVersion } from '../types.ts';\nimport type { JSONRPCRequest } from '../spec-types/2025-11-25.ts';\nimport type { MockHandler, MockServer, RequestHandlers } from './index.ts';\nimport { STATELESS_SPEC_VERSIONS } from '../connection/select.ts';\nimport { validateWireMessage } from '../validation/wire-schema.ts';\nimport { capabilitiesFromHandlers, listenMockHandler } from './stateful.ts';\n\n/**\n * The required per-request `_meta` keys. `io.modelcontextprotocol/clientInfo`\n * is deliberately absent: spec PR #3002 demoted it to SHOULD, so a request\n * without it is valid.\n */\nconst META_KEYS = [\n 'io.modelcontextprotocol/protocolVersion',\n 'io.modelcontextprotocol/clientCapabilities'\n] as const;\n\n/**\n * Operations whose results the 2026-07-28 revision marks cacheable: servers\n * MUST include the caching hints `ttlMs` and `cacheScope` on these results\n * (draft `CacheableResult`, server/utilities/caching).\n */\nexport const CACHEABLE_RESULT_METHODS: ReadonlySet = new Set([\n 'server/discover',\n 'tools/list',\n 'prompts/list',\n 'resources/list',\n 'resources/templates/list',\n 'resources/read'\n]);\n\n/**\n * Fill in the result members the 2026-07-28 revision requires of servers when\n * the handler did not set them itself: every result MUST carry `resultType`,\n * and results of the cacheable operations MUST also carry `ttlMs` and\n * `cacheScope`. Members the handler set are preserved (e.g. a handler may\n * return `resultType: 'input_required'`); only absent (or undefined) ones are\n * filled. A scenario that needs to send a deliberately non-conformant result\n * must build its own server instead of routing through this mock.\n */\nexport function withRequiredDraftResultFields(\n method: string,\n result: unknown\n): unknown {\n if (result === null || typeof result !== 'object' || Array.isArray(result)) {\n return result;\n }\n const stamped: Record = { ...result };\n stamped.resultType ??= 'complete';\n if (CACHEABLE_RESULT_METHODS.has(method)) {\n stamped.ttlMs ??= 0;\n stamped.cacheScope ??= 'private';\n }\n return stamped;\n}\n\ntype IncomingHeaders = Record;\n\nexport type StatelessValidation =\n | { kind: 'reject'; status: number; body: object }\n | { kind: 'handled'; status: number; body: object }\n | {\n kind: 'route';\n id: string | number | null;\n method: string;\n params: Record;\n };\n\n/**\n * Shared SEP-2575 request validation: header presence, `_meta` 3-key check,\n * header/`_meta` version match, version-supported check, and `server/discover`\n * handling. Returns `reject` when validation failed, `handled` when the\n * request was valid and already answered (`server/discover`), and `route`\n * when the caller should dispatch to its own handlers. Consumers write\n * `res.status(v.status).json(v.body)` for `reject` and `handled` alike and\n * route only on `route`.\n *\n * Exported so any mock server that needs a stateless `/mcp` route (e.g.\n * `auth/helpers/createServer.ts`) uses the same validation as this module.\n *\n * `supportedVersions` is the list of wire protocolVersion strings this\n * endpoint accepts; anything else is rejected with -32022 carrying\n * `{ supported, requested }` in the error data, and the list is echoed in\n * the `server/discover` result.\n */\nexport function validateStatelessRequest(\n req: { headers: IncomingHeaders; body: unknown },\n capabilities: Record,\n supportedVersions: readonly string[]\n): StatelessValidation {\n const body = (req.body ?? {}) as Record;\n const id = (body.id ?? null) as string | number | null;\n const method = body.method as string;\n const params = (body.params ?? {}) as Record;\n const meta = params._meta as Record | undefined;\n\n const reject = (status: number, code: number, message: string) =>\n ({\n kind: 'reject',\n status,\n body: { jsonrpc: '2.0', id, error: { code, message } }\n }) as const;\n\n const headerVersion = req.headers['mcp-protocol-version'];\n // initialize is the dated revisions' handshake. A server that supports only\n // modern versions SHOULD name them in any error it returns to an initialize\n // (2026-07-28 basic/versioning), so a dual-era client that opens this way\n // learns what to retry with. It is answered before the header and _meta\n // checks, which would otherwise turn it away without naming a version.\n if (method === 'initialize') {\n return {\n kind: 'reject',\n status: 400,\n body: {\n jsonrpc: '2.0',\n id,\n error: {\n code: -32022,\n message: 'Unsupported protocol version',\n data: {\n supported: supportedVersions,\n requested: String(params.protocolVersion ?? headerVersion ?? '')\n }\n }\n }\n };\n }\n if (!headerVersion) {\n return reject(400, -32020, 'Missing MCP-Protocol-Version header');\n }\n const missing = META_KEYS.filter((k) => meta?.[k] === undefined);\n if (missing.length > 0) {\n return reject(\n 400,\n -32602,\n `Invalid params: missing _meta keys: ${missing.join(', ')}`\n );\n }\n if (meta?.[META_KEYS[0]] !== headerVersion) {\n return reject(\n 400,\n -32020,\n 'MCP-Protocol-Version header does not match _meta.protocolVersion'\n );\n }\n if (\n typeof headerVersion !== 'string' ||\n !supportedVersions.includes(headerVersion)\n ) {\n return {\n kind: 'reject',\n status: 400,\n body: {\n jsonrpc: '2.0',\n id,\n error: {\n code: -32022,\n message: 'Unsupported protocol version',\n data: {\n supported: supportedVersions,\n requested: String(headerVersion)\n }\n }\n }\n };\n }\n if (method === 'server/discover') {\n return {\n kind: 'handled',\n status: 200,\n body: {\n jsonrpc: '2.0',\n id,\n result: withRequiredDraftResultFields(method, {\n supportedVersions,\n capabilities,\n // Spec PR #3002: server identity lives in the result `_meta`, not\n // the DiscoverResult body.\n _meta: {\n 'io.modelcontextprotocol/serverInfo': {\n name: 'conformance-mock-server',\n version: '1.0.0'\n }\n }\n })\n }\n };\n }\n return { kind: 'route', id, method, params };\n}\n\n/**\n * When `specVersion` is given (the runner's resolved `--spec-version`), the\n * server accepts exactly that version. Without it, every known stateless\n * version is accepted.\n */\nexport function createHandlerStateless(\n handlers: RequestHandlers,\n specVersion?: SpecVersion\n): MockHandler {\n const recorded: JSONRPCRequest[] = [];\n const capabilities = capabilitiesFromHandlers(handlers);\n const supportedVersions: readonly string[] = specVersion\n ? [specVersion]\n : STATELESS_SPEC_VERSIONS;\n const wireVersion = specVersion ?? DRAFT_PROTOCOL_VERSION;\n\n const app = express();\n app.use(express.json());\n\n app.post('/mcp', async (req, res) => {\n // Record every JSON-RPC request the client sends (excluding the\n // `server/discover` lifecycle preamble) before validation so rejected\n // requests are captured too, matching the stateful impl and the\n // MockServer.recorded contract.\n const body = req.body as Record | undefined;\n // An unparsed body (wrong or missing Content-Type) is a transport fault\n // surfaced by the HTTP-level checks, not a JSON-RPC message to validate.\n if (body !== undefined) {\n validateWireMessage(wireVersion, req.body, {\n origin: 'implementation',\n context: `client request '${body?.method ?? '(unknown)'}' to stateless mock`\n });\n }\n if (body?.method && body.method !== 'server/discover') {\n recorded.push(req.body as JSONRPCRequest);\n }\n const sendJson = (status: number, payload: object, method?: string) => {\n // JSON-RPC 2.0 mandates `id: null` on error replies when the request id\n // could not be determined, but the spec's RequestId is string|integer;\n // validate with a placeholder id so the mandated null is not recorded\n // as a harness violation (mirrors connection/stateless.ts's\n // withNullIdCarveOut).\n const raw = payload as Record;\n const validated =\n raw.error !== undefined && raw.id === null\n ? { ...raw, id: 0 }\n : payload;\n validateWireMessage(wireVersion, validated, {\n origin: 'harness',\n context: `stateless mock response${method ? ` to '${method}'` : ''}`,\n requestMethod: method\n });\n return res.status(status).json(payload);\n };\n const v = validateStatelessRequest(req, capabilities, supportedVersions);\n if (v.kind !== 'route') {\n return sendJson(\n v.status,\n v.body,\n v.kind === 'handled' ? (body?.method as string) : undefined\n );\n }\n const { id, method, params } = v;\n const error = (status: number, code: number, message: string) =>\n sendJson(status, { jsonrpc: '2.0', id, error: { code, message } });\n\n const handler = handlers[method];\n if (!handler) {\n return error(404, -32601, `Method not found: ${method}`);\n }\n try {\n const result = await handler(params, req.body as JSONRPCRequest);\n return sendJson(\n 200,\n {\n jsonrpc: '2.0',\n id,\n result: withRequiredDraftResultFields(method, result)\n },\n method\n );\n } catch (e) {\n return error(500, -32603, e instanceof Error ? e.message : String(e));\n }\n });\n\n return { listener: app, recorded };\n}\n\nexport async function createServerStateless(\n handlers: RequestHandlers,\n specVersion?: SpecVersion\n): Promise {\n return listenMockHandler(createHandlerStateless(handlers, specVersion));\n}\n",[],[142,1192,509],"mock-server","37aefe58-0094-4f1f-98f0-fdd3e49c7684","stateful.ts","711778c0-ad1b-11f1-b4aa-1607ee4eb77e",115,["D",1789046879815],"/**\n * Stateful mock server: 2025-x lifecycle (initialize handshake).\n *\n * Backed by the SDK's `Server` + `StreamableHTTPServerTransport` so we don't\n * reimplement the handshake or SSE response framing. The SDK is the scaffold\n * here, not the system-under-test; the client-under-test connecting to this\n * mock is what's being verified.\n */\n\nimport express from 'npm:express@^5.1.0';\nimport http from 'node:http';\nimport { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport { ErrorCode, McpError } from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport { z } from 'npm:zod@^4.3.6';\nimport type { JSONRPCRequest } from '../spec-types/2025-11-25.ts';\nimport { isSpecVersion, type SpecVersion } from '../types.ts';\nimport { validateWireMessage } from '../validation/wire-schema.ts';\nimport type { MockHandler, MockServer, RequestHandlers } from './index.ts';\n\nconst CAPABILITY_BY_PREFIX: Record = {\n tools: 'tools',\n prompts: 'prompts',\n resources: 'resources',\n completion: 'completions',\n logging: 'logging'\n};\n\n/**\n * Derive the server `capabilities` object from the registered handler method\n * names so the SDK's `assertRequestHandlerCapability` gate is always satisfied.\n * Shared with the stateless impl for `server/discover`.\n */\nexport function capabilitiesFromHandlers(\n handlers: RequestHandlers\n): Record {\n const out: Record = {};\n for (const method of Object.keys(handlers)) {\n const cap = CAPABILITY_BY_PREFIX[method.split('/')[0]];\n if (cap) out[cap] = {};\n }\n return out;\n}\n\nexport function createHandlerStateful(\n handlers: RequestHandlers,\n specVersion: SpecVersion\n): MockHandler {\n const recorded: JSONRPCRequest[] = [];\n const capabilities = capabilitiesFromHandlers(handlers);\n\n // Fresh SDK Server per HTTP request (the SDK transport is single-shot in\n // sessionless mode after GHSA-345p-7cg4-v4c7).\n function newServer(): Server {\n const server = new Server(\n { name: 'conformance-mock-server', version: '1.0.0' },\n { capabilities }\n );\n for (const [method, handler] of Object.entries(handlers)) {\n // The SDK's setRequestHandler matches by parsing against the schema's\n // method literal; build a minimal schema so any method string works.\n const schema = z.object({\n method: z.literal(method),\n params: z.unknown().optional()\n });\n server.setRequestHandler(schema, async (request) => {\n try {\n const result = (await handler(\n (request.params ?? {}) as Record,\n request as JSONRPCRequest\n )) as Record;\n // The SDK builds the response envelope; validate the\n // harness-authored result against its typed definition.\n validateWireMessage(\n specVersion,\n { jsonrpc: '2.0', id: 0, result },\n {\n origin: 'harness',\n context: `stateful mock result for '${method}'`,\n requestMethod: method\n }\n );\n return result;\n } catch (e) {\n if (e instanceof McpError) throw e;\n throw new McpError(\n ErrorCode.InternalError,\n e instanceof Error ? e.message : String(e)\n );\n }\n });\n }\n return server;\n }\n\n const app = express();\n app.use(express.json());\n\n app.post('/mcp', async (req, res) => {\n // Record every JSON-RPC request the client sends (excluding the lifecycle\n // preamble) at the HTTP layer so unregistered methods are captured too,\n // matching the stateless impl and the MockServer.recorded contract.\n const body = req.body;\n // An unparsed body (wrong or missing Content-Type) is a transport fault\n // the SDK transport rejects itself, not a JSON-RPC message to validate.\n if (body !== undefined) {\n // Clients may legitimately negotiate a different protocol version than\n // the run's (the README permits ignoring the forwarded --spec-version),\n // and they declare it on every post-initialize request; validate their\n // traffic against the version they actually speak.\n const headerVersion = req.headers['mcp-protocol-version'];\n // Absent header: the header only exists from 2025-06-18, whose spec\n // says to assume 2025-03-26 — a header-less legacy client is not a\n // violation of the run version.\n const inboundVersion = isSpecVersion(headerVersion)\n ? headerVersion\n : headerVersion === undefined\n ? '2025-03-26'\n : specVersion;\n validateWireMessage(inboundVersion, body, {\n origin: 'implementation',\n context: `client request '${body?.method ?? '(unknown)'}' to stateful mock`\n });\n }\n if (\n body?.method &&\n body.method !== 'initialize' &&\n body.method !== 'notifications/initialized'\n ) {\n recorded.push(body as JSONRPCRequest);\n }\n try {\n const server = newServer();\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n // Register cleanup before handing the request to the transport so the\n // pair is torn down even when handleRequest throws.\n res.on('close', () => {\n transport.close();\n server.close();\n });\n await transport.handleRequest(req, res, req.body);\n } catch (e) {\n if (!res.headersSent) {\n res.status(500).json({\n jsonrpc: '2.0',\n id: req.body?.id ?? null,\n error: { code: -32603, message: String(e) }\n });\n }\n }\n });\n\n return { listener: app, recorded };\n}\n\nexport async function createServerStateful(\n handlers: RequestHandlers,\n specVersion: SpecVersion\n): Promise {\n return listenMockHandler(createHandlerStateful(handlers, specVersion));\n}\n\n/**\n * Bind a `MockHandler` to an ephemeral localhost port — the CLI runner's\n * path. Shared with the stateless impl.\n */\nexport function listenMockHandler(mock: MockHandler): Promise {\n return new Promise((resolve, reject) => {\n const httpServer = http.createServer(mock.listener);\n httpServer.on('error', reject);\n httpServer.listen(0, () => {\n const addr = httpServer.address();\n const port = typeof addr === 'object' && addr ? addr.port : 0;\n const baseUrl = `http://localhost:${port}`;\n resolve({\n url: `${baseUrl}/mcp`,\n baseUrl,\n recorded: mock.recorded,\n close: () =>\n new Promise((res) => {\n httpServer.closeAllConnections?.();\n httpServer.close(() => res());\n })\n });\n });\n });\n}\n",[],[142,1192,1194],"db04765e-010a-4383-97e7-faaebfe893f7","select.ts","7077da0e-ad1b-11f1-817c-1607ee4eb77e",113,["D",1789046878773],"import type { SpecVersion } from '../types.ts';\nimport type { MockHandler, MockServer, RequestHandlers } from './index.ts';\nimport { isStatefulVersion } from '../connection/select.ts';\nimport { createHandlerStateful, createServerStateful } from './stateful.ts';\nimport { createHandlerStateless, createServerStateless } from './stateless.ts';\n\nexport function createServerFor(\n specVersion: SpecVersion\n): (handlers: RequestHandlers) => Promise {\n return isStatefulVersion(specVersion)\n ? (handlers) => createServerStateful(handlers, specVersion)\n : (handlers) => createServerStateless(handlers, specVersion);\n}\n\nexport function createHandlerFor(\n specVersion: SpecVersion\n): (handlers: RequestHandlers) => MockHandler {\n return isStatefulVersion(specVersion)\n ? (handlers) => createHandlerStateful(handlers, specVersion)\n : (handlers) => createHandlerStateless(handlers, specVersion);\n}\n",[],[142,1192,1202],"be7fb138-fb32-4db6-803d-65af71b82e0a","5ed7bbc0-ad1b-11f1-9cd6-1607ee4eb77e",70,["D",1789046849163],"/**\n * Version-aware mock-server abstraction for client-conformance scenarios.\n *\n * A `MockServer` is the HTTP server a client-under-test connects to. The\n * lifecycle scaffold (initialize handshake vs per-request `_meta` validation)\n * is supplied by the runner based on `--spec-version`; the scenario only\n * provides per-method handlers and asserts on the recorded requests.\n *\n * This is the client-conformance mirror of `Connection` in `../connection`.\n */\n\nimport type { RequestListener, SpecVersion } from '../types.ts';\nimport type { JSONRPCRequest } from '../spec-types/2025-11-25.ts';\n\n/**\n * Per-method response handlers. Called with the request `params` object;\n * return value becomes the JSON-RPC `result`. Throw to produce an error\n * response.\n */\nexport type RequestHandlers = Record<\n string,\n (\n params: Record,\n request: JSONRPCRequest\n ) => unknown | Promise\n>;\n\nexport interface MockServer {\n /** Full URL of the `/mcp` endpoint. */\n url: string;\n /** Base URL (no `/mcp` suffix), for scenarios that serve sibling routes. */\n baseUrl: string;\n /**\n * Every JSON-RPC request the client sent, in arrival order, excluding the\n * lifecycle preamble (`initialize` / `notifications/initialized` under the\n * stateful impl; `server/discover` under stateless). Recording happens\n * before validation, so requests the server rejects (e.g. missing header\n * or `_meta`) still appear here.\n */\n readonly recorded: JSONRPCRequest[];\n close(): Promise;\n}\n\n/**\n * The same mock as `MockServer` but not bound to a port: a request listener\n * the caller mounts itself — `http.createServer(listener)` in the CLI\n * runner, a path-prefix mount in the hosted runner. `Scenario.handler()`\n * implementations use this so one scenario body serves both.\n */\nexport interface MockHandler {\n /** Serves `/mcp` — hand it to `http.createServer` or mount it. */\n listener: RequestListener;\n /** See `MockServer.recorded`. */\n readonly recorded: JSONRPCRequest[];\n}\n\n/**\n * Per-run context handed to `Scenario.start()`. The runner constructs this\n * from the resolved `--spec-version`.\n */\nexport interface ScenarioContext {\n specVersion: SpecVersion;\n /**\n * Create a version-appropriate mock server. Scenarios that test the\n * lifecycle itself (initialize, SSE-retry) bypass this and build a raw\n * `http.createServer`.\n */\n createServer(handlers: RequestHandlers): Promise;\n /**\n * Same mock, unbound. What `Scenario.handler()` implementations call so\n * the scenario can be mounted without a loopback port (see src/hosted).\n */\n createHandler(handlers: RequestHandlers): MockHandler;\n}\n\nexport { createServerStateful, createHandlerStateful } from './stateful.ts';\nexport {\n createServerStateless,\n createHandlerStateless,\n validateStatelessRequest,\n withRequiredDraftResultFields,\n CACHEABLE_RESULT_METHODS\n} from './stateless.ts';\nexport { createServerFor, createHandlerFor } from './select.ts';\n",[],[142,1192,357],"b457f810-d9bc-4bec-921b-9d48479a9b80",["D",1789046849163],[196,197,198,199],[142,1192],"601368f2-31dd-455d-a04a-0da6398b26e1","wire.ts","0f9d7306-ae29-11f1-bb76-1607ee4eb77e","11abc952-e3be-41e6-ac33-6929c3af1284",242,["D",1789335354375],"/**\n * What the wire said about a dispatched MCP request: the client's request as\n * a JSON-RPC message (method, requested version), the response the cell gave\n * it (status, body), and the two judgements the hosted layer records from\n * them so a cell cannot read green when every request was turned away:\n *\n * hosted-wire-rejected a 4xx whose body is one of the lifecycle\n * rejections (missing header / _meta, unsupported\n * protocol version) — the scenario never saw a\n * request it could judge;\n * hosted-wrong-revision the client spoke a revision other than the one\n * the cell is served on (a stateful `initialize` on\n * the stateless wire, a header naming another\n * revision).\n *\n * Both are FAILUREs, so they decide the cell's verdict (see report.ts). A\n * request that is both is one mistake and records only the wrong revision,\n * with the rejection folded in. On a dated cell a request at a foreign\n * revision that the wire turned away is version negotiation and records\n * neither (see isNegotiation()); on the stateless wire an `initialize` is a\n * legacy probe, noted as INFO and never failed (see isLegacyProbe()).\n */\n\nimport type { ServerResponse } from 'node:http';\nimport { isStatefulVersion } from '../connection/select.ts';\nimport type { ConformanceCheck, SpecVersion } from '../types.ts';\n\nexport const WIRE_REJECTED_CHECK_ID = 'hosted-wire-rejected';\nexport const WRONG_REVISION_CHECK_ID = 'hosted-wrong-revision';\n\n/** Response bodies above this are not captured (a rejection is small). */\nexport const RESPONSE_CAP = 64 * 1024;\n\nconst META_PROTOCOL_VERSION = 'io.modelcontextprotocol/protocolVersion';\n\nfunction asRecord(v: unknown): Record | undefined {\n return typeof v === 'object' && v !== null && !Array.isArray(v)\n ? (v as Record)\n : undefined;\n}\n\nfunction str(v: unknown): string | undefined {\n return typeof v === 'string' && v.length > 0 ? v : undefined;\n}\n\n/** The JSON-RPC message(s) of a body: one object, or a batch. */\nfunction messagesOfJson(text: string): Record[] {\n try {\n const parsed: unknown = JSON.parse(text);\n const list = Array.isArray(parsed) ? parsed : [parsed];\n return list.map(asRecord).filter((m): m is Record => !!m);\n } catch {\n return [];\n }\n}\n\n/**\n * JSON-RPC messages in a response body: a JSON object or batch, or the\n * `data:` lines of an SSE stream (the SDK transport answers a POST that\n * way — `event: message\\ndata: {...}\\n\\n`).\n */\nexport function jsonRpcMessages(\n body: string | undefined,\n contentType: string | undefined\n): Record[] {\n if (body === undefined) return [];\n if (/^text\\/event-stream\\b/i.test(contentType ?? '')) {\n const out: Record[] = [];\n for (const event of body.split(/\\r?\\n\\r?\\n/)) {\n const data = event\n .split(/\\r?\\n/)\n .filter((line) => line.startsWith('data:'))\n .map((line) => line.slice('data:'.length).replace(/^ /, ''))\n .join('\\n');\n if (data) out.push(...messagesOfJson(data));\n }\n return out;\n }\n return messagesOfJson(body);\n}\n\n/** What one request says about itself, read from its JSON-RPC body. */\nexport interface RequestInfo {\n /** JSON-RPC methods carried (one per batch member with a `method`). */\n methods: string[];\n /**\n * The protocol version the client asked for in the body: `initialize`\n * params on the stateful wire, `_meta` on the stateless one.\n */\n bodyVersion?: string;\n}\n\nexport function describeRequest(\n body: Buffer | string | undefined\n): RequestInfo {\n const messages = body === undefined ? [] : messagesOfJson(body.toString());\n const methods: string[] = [];\n let bodyVersion: string | undefined;\n for (const m of messages) {\n const method = str(m.method);\n if (method) methods.push(method);\n const params = asRecord(m.params);\n const meta = asRecord(params?._meta);\n bodyVersion ??=\n str(meta?.[META_PROTOCOL_VERSION]) ??\n (method === 'initialize' ? str(params?.protocolVersion) : undefined);\n }\n return { methods, ...(bodyVersion && { bodyVersion }) };\n}\n\n/** The response a cell gave, as captured by tapResponse(). */\nexport interface CapturedResponse {\n status: number;\n contentType?: string;\n /** Undefined when the body was over RESPONSE_CAP. */\n body?: string;\n}\n\n/**\n * Wrap `res.write`/`res.end` so `onEnd` sees the status and (up to\n * RESPONSE_CAP) the body once the response is complete. `onEnd` runs after\n * the original `end`, synchronously, so a bridge that resolves its Response\n * from `end` still sees whatever `onEnd` records before it flushes.\n */\nexport function tapResponse(\n res: ServerResponse,\n onEnd: (captured: CapturedResponse) => void\n): void {\n const chunks: Buffer[] = [];\n let size = 0;\n let overflow = false;\n let ended = false;\n const capture = (chunk: unknown, encoding?: unknown) => {\n if (overflow) return;\n let buf: Buffer;\n if (Buffer.isBuffer(chunk)) buf = chunk;\n else if (chunk instanceof Uint8Array)\n buf = Buffer.from(chunk); // hono/node-server\n else if (typeof chunk === 'string')\n buf = Buffer.from(\n chunk,\n typeof encoding === 'string' ? (encoding as BufferEncoding) : 'utf8'\n );\n else return; // end(cb), end()\n size += buf.length;\n if (size > RESPONSE_CAP) overflow = true;\n else chunks.push(buf);\n };\n const write = res.write;\n const end = res.end;\n res.write = function (this: ServerResponse, ...args: unknown[]) {\n capture(args[0], args[1]);\n return (write as (...a: unknown[]) => boolean).apply(this, args);\n } as ServerResponse['write'];\n res.end = function (this: ServerResponse, ...args: unknown[]) {\n capture(args[0], args[1]);\n const out = (end as (...a: unknown[]) => ServerResponse).apply(this, args);\n if (!ended) {\n ended = true;\n const contentType = res.getHeader('content-type');\n onEnd({\n status: res.statusCode,\n ...(typeof contentType === 'string' && { contentType }),\n ...(!overflow && { body: Buffer.concat(chunks).toString('utf8') })\n });\n }\n return out;\n } as ServerResponse['end'];\n}\n\nexport interface WireRejection {\n status: number;\n code: number;\n message: string;\n}\n\n/**\n * The lifecycle rejection in a 4xx response, if that is what it is: a\n * JSON-RPC error with code -32020 / -32022 (protocol-version header), -32602\n * naming `_meta`, or -32000 saying \"Unsupported protocol version\" (the SDK\n * transport's stateful negotiation failure).\n *\n * An unsupported-version rejection of a request whose header already names\n * the cell's revision `served` is not the client's doing — it is a\n * scenario's deliberate probe (request-metadata rejects a run's first\n * request to exercise the client's retry) — and is not one.\n */\nexport function wireRejection(\n response: CapturedResponse,\n served: SpecVersion,\n headerVersion: string | undefined\n): WireRejection | undefined {\n if (response.status < 400 || response.status >= 500) return undefined;\n for (const m of jsonRpcMessages(response.body, response.contentType)) {\n const error = asRecord(m.error);\n if (!error || typeof error.code !== 'number') continue;\n const code = error.code;\n const message = str(error.message) ?? '';\n const unsupportedVersion =\n code === -32022 ||\n (code === -32000 && message.includes('Unsupported protocol version'));\n if (unsupportedVersion && headerVersion === served) continue;\n if (\n unsupportedVersion ||\n code === -32020 ||\n (code === -32602 && message.includes('_meta'))\n ) {\n return { status: response.status, code, message };\n }\n }\n return undefined;\n}\n\n/**\n * Whether a request to a dated cell was version negotiation rather than a\n * client at the wrong revision: its header named a revision `served` does\n * not serve and the wire turned it away for it — a 4xx whose body is a\n * lifecycle rejection (see wireRejection()) or a -32601 method-not-found\n * (the probe method does not exist on the dated wire). A dual-era client\n * opens a dated cell that way — `server/discover` at 2026-07-28 is\n * rejected, then it falls back to `initialize` — so neither judgement\n * applies to the rejected request. A foreign-revision request the wire\n * accepted is still the client carrying on at the wrong revision, and on\n * the stateless wire nothing is negotiation.\n */\nexport function isNegotiation(\n served: SpecVersion,\n headerVersion: string | undefined,\n response: CapturedResponse\n): boolean {\n if (!isStatefulVersion(served)) return false;\n if (headerVersion === undefined || headerVersion === served) return false;\n if (response.status < 400 || response.status >= 500) return false;\n if (wireRejection(response, served, headerVersion)) return true;\n return jsonRpcMessages(response.body, response.contentType).some(\n (m) => asRecord(m.error)?.code === -32601\n );\n}\n\n/**\n * Why a request is not one the cell's revision `served` should receive, or\n * undefined when it is. On the stateless wire every request must carry the\n * cell's revision in the header and `initialize` does not exist; on a dated\n * (stateful) revision `initialize` negotiates and is exempt, and every later\n * request's header, when present, must name the cell's revision — unless\n * the wire rejected it as negotiation (isNegotiation()), which the caller\n * decides from the response.\n */\nexport function wrongRevision(\n served: SpecVersion,\n method: string,\n headerVersion: string | undefined\n): string | undefined {\n if (isStatefulVersion(served)) {\n if (method === 'initialize') return undefined;\n if (headerVersion !== undefined && headerVersion !== served)\n return `sent ${headerVersion}`;\n return undefined;\n }\n if (method === 'initialize') return 'sent initialize';\n if (headerVersion !== served)\n return headerVersion === undefined\n ? 'sent no MCP-Protocol-Version header'\n : `sent ${headerVersion}`;\n return undefined;\n}\n\nexport const LEGACY_PROBE_CHECK_ID = 'hosted-legacy-probe';\n\n/**\n * Whether `method` on a cell served at `served` is a legacy probe: an\n * `initialize` on the stateless wire. A dual-era client may open that way to\n * learn the server's era, and a modern-only server answers it with an error\n * naming its versions (2026-07-28 basic/versioning, \"Backward Compatibility\n * with Initialization-Based Versions\"), so it is negotiation, not a wrong\n * revision — and it explains any rejection it drew.\n */\nexport function isLegacyProbe(served: SpecVersion, method: string): boolean {\n return method === 'initialize' && !isStatefulVersion(served);\n}\n\n/**\n * The answer every cell on the stateless wire gives a legacy `initialize`,\n * or undefined when `body` is not one (or the cell is on a dated revision):\n * HTTP 400 with -32022 naming the revision the cell serves, as a modern-only\n * server should (2026-07-28 basic/versioning). The hosted layer sends it\n * before the scenario sees the request, so every cell of the column agrees —\n * a scenario whose bundled SDK server would complete the handshake (the CLI\n * runner's SDK clients rely on json-schema-ref-no-deref doing so) cannot\n * accept it here and then fail the client for following that answer.\n */\nexport function legacyInitializeReply(\n served: SpecVersion,\n body: Buffer | undefined,\n headerVersion: string | undefined\n): { status: number; body: Record } | undefined {\n if (isStatefulVersion(served) || body === undefined) return undefined;\n let message: Record | undefined;\n try {\n message = asRecord(JSON.parse(body.toString()));\n } catch {\n return undefined;\n }\n if (message?.method !== 'initialize') return undefined;\n const params = asRecord(message.params);\n return {\n status: 400,\n body: {\n jsonrpc: '2.0',\n id: message.id ?? null,\n error: {\n code: -32022,\n message: 'Unsupported protocol version',\n data: {\n supported: [served],\n requested: String(params?.protocolVersion ?? headerVersion ?? '')\n }\n }\n }\n };\n}\n\nexport function legacyProbeCheck(\n served: SpecVersion,\n headerVersion: string | undefined,\n rejection?: WireRejection,\n requestedVersion?: string\n): ConformanceCheck {\n return {\n id: LEGACY_PROBE_CHECK_ID,\n name: 'LegacyProbe',\n description:\n `The client opened with initialize, the legacy handshake, on a cell served on ${served}. ` +\n 'On this revision that is era detection, not a failure' +\n (rejection\n ? `; the cell answered ${response(rejection)}: ${rejection.message}`\n : '; the cell accepted it'),\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n served,\n headerVersion: headerVersion ?? null,\n ...(requestedVersion && { requestedVersion }),\n ...(rejection && {\n rejected: {\n status: rejection.status,\n code: rejection.code,\n message: rejection.message\n }\n })\n }\n };\n}\n\nexport const GET_ON_MCP_CHECK_ID = 'hosted-get-on-mcp-path';\n\n/**\n * The 405 a cell answers a GET on its MCP endpoint with when its scenario\n * serves no GET stream there, shaped like the SDK transport's own.\n */\nexport const GET_ON_MCP_REPLY = {\n jsonrpc: '2.0',\n error: { code: -32000, message: 'Method not allowed.' },\n id: null\n} as const;\n\n/**\n * A GET to the MCP endpoint of a cell that serves no stream there: a client\n * opening a standalone SSE stream, or falling back to the old HTTP+SSE\n * transport after a POST was turned away. Noted so the client's author sees\n * it; the spec allows either, so it never decides the verdict.\n */\nexport function getOnMcpCheck(served: SpecVersion): ConformanceCheck {\n return {\n id: GET_ON_MCP_CHECK_ID,\n name: 'GetOnMcpPath',\n description:\n 'The client sent GET to the MCP endpoint — to open a server-sent event stream, ' +\n 'or to fall back to the old HTTP+SSE transport after a POST was turned away. ' +\n 'This cell serves no such stream, so it answered 405 Method Not Allowed; ' +\n 'a client should carry on with POST',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: { served, status: 405 }\n };\n}\n\nexport function wireRejectedCheck(\n rejection: WireRejection,\n request: RequestInfo,\n headerVersion: string | undefined\n): ConformanceCheck {\n const method = request.methods[0];\n return {\n id: WIRE_REJECTED_CHECK_ID,\n name: 'WireRejected',\n description:\n 'The cell turned a request away before the scenario could judge it',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `${response(rejection)}${method ? ` to ${method}` : ''}: ${rejection.message}`,\n details: {\n status: rejection.status,\n code: rejection.code,\n message: rejection.message,\n ...(method && { method }),\n requestedVersion: headerVersion ?? request.bodyVersion ?? null\n }\n };\n}\n\nfunction response(r: WireRejection): string {\n return `HTTP ${r.status}, JSON-RPC error ${r.code}`;\n}\n\n/**\n * `rejection` is the wire turning the same request away: one mistake, so it\n * is folded into this check rather than recorded as hosted-wire-rejected too.\n */\nexport function wrongRevisionCheck(\n served: SpecVersion,\n method: string,\n headerVersion: string | undefined,\n reason: string,\n rejection?: WireRejection\n): ConformanceCheck {\n return {\n id: WRONG_REVISION_CHECK_ID,\n name: 'WrongRevision',\n description: `The client spoke a revision other than the one this cell is served on`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n `cell is served on ${served}; client ${reason}` +\n (rejection\n ? ` (turned away: ${response(rejection)}: ${rejection.message})`\n : ''),\n details: {\n served,\n method,\n headerVersion: headerVersion ?? null,\n ...(rejection && {\n rejected: {\n status: rejection.status,\n code: rejection.code,\n message: rejection.message\n }\n })\n }\n };\n}\n",[],[142,1229,1221],"hosted","a305d23a-4497-4541-a395-46a5f09672dd","store.ts","d343f09e-ad13-11f1-892b-1607ee4eb77e",170,["D",1789153931381],"/**\n * Run persistence for the hosted conformance server.\n *\n * A long-lived Node process keeps every run in memory and needs none of this.\n * Serverless hosts (val.town, Deno Deploy, …) load-balance one run's requests\n * across short-lived isolates, so the isolate that answers GET /results is\n * often not the one that saw the MCP traffic. A RunStore lets each isolate\n * write through what it observed and lets any isolate serve a merged view:\n *\n * - run metadata (cell id → scenario) so the results page can list which\n * cells of a run were exercised, and tear them all down together;\n * - checks, keyed by (run, writer): each isolate owns its own row and\n * replaces it wholesale after every request, so concurrent writers never\n * clobber each other and no append ordering is needed.\n *\n * The merged log is re-judged at results time by a fresh scenario instance\n * (see SessionManager.results), which is what turns \"isolate B never saw a\n * tools/call\" from a false FAILURE into the union of what A and B saw.\n */\n\nimport type { ConformanceCheck } from '../types.ts';\n\nexport interface RunStore {\n saveRun(id: string, scenarioName: string): Promise;\n /** Scenario name for a run id, or undefined if no isolate ever saw it. */\n loadRun(id: string): Promise;\n /**\n * Every saved run whose id starts with `prefix`. Cell ids are\n * `//`, so `/` lists one run's cells.\n */\n listRuns(\n prefix: string\n ): Promise>;\n saveChecks(\n id: string,\n writer: string,\n checks: ConformanceCheck[]\n ): Promise;\n /** All writers' check lists for a run, keyed by writer id. */\n loadChecks(id: string): Promise>;\n deleteRun(id: string): Promise;\n}\n\n/** In-process store — used by tests to exercise the merge path. */\nexport class MemoryRunStore implements RunStore {\n private runs = new Map();\n private checks = new Map>();\n\n async saveRun(id: string, scenarioName: string): Promise {\n if (!this.runs.has(id)) this.runs.set(id, scenarioName);\n }\n async loadRun(id: string): Promise {\n return this.runs.get(id);\n }\n async listRuns(\n prefix: string\n ): Promise> {\n return Array.from(this.runs.entries())\n .filter(([id]) => id.startsWith(prefix))\n .map(([id, scenarioName]) => ({ id, scenarioName }));\n }\n async saveChecks(\n id: string,\n writer: string,\n checks: ConformanceCheck[]\n ): Promise {\n let byWriter = this.checks.get(id);\n if (!byWriter) this.checks.set(id, (byWriter = new Map()));\n byWriter.set(\n writer,\n checks.map((c) => ({ ...c }))\n );\n }\n async loadChecks(id: string): Promise> {\n return new Map(this.checks.get(id) ?? []);\n }\n async deleteRun(id: string): Promise {\n this.runs.delete(id);\n this.checks.delete(id);\n }\n}\n",[],[142,1229,1231],"37dc36c6-852a-4609-8e4d-83d644c5db38","session.ts","d48fd9ae-ad13-11f1-9b49-1607ee4eb77e",245,["D",1789335356770],5,"/**\n * Session management for the hosted conformance server.\n *\n * A \"cell\" is one scenario exercised at one specification revision inside a\n * run. Its id, `//`, is at once the URL path the\n * client is pointed at, the store key and the results path. Each cell owns a\n * fresh Scenario instance built for that revision's wire and the\n * RequestListener it returns from handler() — no loopback port, no proxy.\n * Cells are created lazily on first reference and can be rebuilt from their\n * id alone, which is what lets a cold serverless isolate answer for a run it\n * never saw (an aux-origin request arriving before the RS was ever hit, say).\n */\n\nimport { randomBytes } from 'node:crypto';\nimport {\n Scenario,\n ConformanceCheck,\n RequestListener,\n AuthHandlerScenario,\n AuxOriginRole,\n SpecVersion,\n isSpecVersion\n} from '../types.ts';\nimport { createHandlerFor, type ScenarioContext } from '../mock-server/index.ts';\nimport { getScenario, scenarios } from '../scenarios/index.ts';\nimport type { RunStore } from './store.ts';\nimport {\n addProtocolVersion,\n identityCheck,\n identityChecksIn,\n identityKey,\n identityOf,\n IDENTITY_CHECK_ID,\n type IdentityObservation\n} from './identity.ts';\n\n/** Store writer suffix for the hosted layer's own checks (client identity). */\nconst HOSTED_WRITER_SUFFIX = '/hosted';\n\n/** Run ids are one path segment: safe in URLs and after the relay's /r/. */\nexport const RUN_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;\n\nexport function mintRunId(): string {\n return randomBytes(6).toString('base64url');\n}\n\n/** One scenario at one revision inside one run. */\nexport interface CellRef {\n runId: string;\n revision: SpecVersion;\n scenarioName: string;\n}\n\n/** `//` — scenario names may contain '/'. */\nexport function cellId(ref: CellRef): string {\n return `${ref.runId}/${ref.revision}/${ref.scenarioName}`;\n}\n\nexport function parseCellId(id: string): CellRef | undefined {\n const [runId, revision, ...rest] = id.split('/');\n if (!RUN_ID_RE.test(runId ?? '') || !isSpecVersion(revision) || !rest.length)\n return undefined;\n return { runId, revision, scenarioName: rest.join('/') };\n}\n\n/**\n * Per-cell context for a hosted scenario: the column's revision is the wire\n * the mock speaks, exactly as `--spec-version` sets it for the CLI runner\n * (src/runner/client.ts). `createServer()` would bind a loopback port, which\n * serverless hosts don't allow — hosted scenarios use `createHandler()`.\n */\nexport function hostedScenarioContext(\n specVersion: SpecVersion\n): ScenarioContext {\n return {\n specVersion,\n createServer: () =>\n Promise.reject(\n new Error(\n 'ScenarioContext.createServer() binds a loopback port and is not available when hosted; use createHandler()'\n )\n ),\n createHandler: (handlers) => createHandlerFor(specVersion)(handlers)\n };\n}\n\nexport interface HostedRun extends CellRef {\n /** Cell id — see cellId(). */\n id: string;\n scenario: Scenario;\n /** The mounted RS handler — invoke directly with (req, res). */\n listener: RequestListener;\n /** Aux-origin handlers (AS, IdP, …) for auth scenarios. */\n auxListeners?: Partial>;\n /** Sub-path under the cell URL where the MCP endpoint lives. */\n mcpPath: string;\n createdAt: number;\n lastSeenAt: number;\n /** Scenario-provided client context (credentials, steps, …). */\n context?: Record;\n /** Whether the store has been told this cell exists. */\n saved: boolean;\n /**\n * Whether any request was dispatched to the cell. A cell created only to\n * answer a config request has not been exercised and stays out of the\n * results listing.\n */\n touched: boolean;\n /**\n * Checks the hosted layer records about the cell (client identity, wire\n * rejections, revision discipline), kept apart from the scenario's own log\n * so they never enter its judgement.\n */\n hostedChecks: ConformanceCheck[];\n /** The identity check per client (name, version) already recorded. */\n identities: Map;\n /** Keys of hosted checks already recorded, so each finding is one check. */\n hostedKeys: Set;\n /**\n * Checks seeded into the scenario from other processes' persisted rows\n * (see hydrate()), each with its JSON as seeded. They are those writers'\n * to persist, not ours — unless the scenario has changed one since.\n */\n seeded: Map;\n /** Settled once the cell has been seeded from the store (or never will be). */\n hydration?: Promise;\n}\n\nexport interface SessionManagerOptions {\n /** Idle ms after which a cell is evicted from memory. Default 5 minutes. */\n ttlMs?: number;\n sweepIntervalMs?: number;\n /**\n * Public origins of the relay deployments, keyed by role. Required for any\n * scenario that exposes `authHandlers()`. Each value is the relay's public\n * URL (no trailing slash); the per-cell AS issuer becomes\n * `/r///`.\n */\n auxOrigins?: Partial>;\n /**\n * Optional persistence so results survive being load-balanced across\n * processes (serverless isolates). Omit for a single long-lived process.\n */\n store?: RunStore;\n}\n\n/** Results view: the cell plus its judged checks. */\nexport interface RunResults extends CellRef {\n checks: ConformanceCheck[];\n /**\n * How many checks were recorded from traffic: the scenario's own raw log\n * (before judgement, which may add \"expected but never seen\" failures)\n * plus the hosted layer's FAILUREs (a request the wire turned away is\n * traffic too), but not its INFO checks. Zero means nothing was exercised.\n */\n recorded: number;\n}\n\n/** Hosted checks that count as exercise: what went wrong on the wire. */\nfunction hostedFailures(checks: ConformanceCheck[]): number {\n return checks.filter((c) => c.status === 'FAILURE').length;\n}\n\n/**\n * The scenario's raw event log — what it actually observed — as opposed to\n * getChecks(), which for most client scenarios also appends \"expected X,\n * never saw it\" FAILUREs (and mutates). Persisting the raw log per process\n * and judging the merged log once is what makes multi-process hosting work.\n */\nexport function rawChecksOf(scenario: Scenario): ConformanceCheck[] {\n if (scenario.rawChecks) return scenario.rawChecks();\n const bag = (scenario as unknown as { checks?: unknown }).checks;\n if (Array.isArray(bag)) return bag as ConformanceCheck[];\n return scenario.getChecks();\n}\n\n/**\n * New, unstarted instance of a registered scenario. Prefers `Scenario.fresh()`\n * so scenarios registered with constructor parameters keep them; falls back\n * to the no-arg constructor.\n */\nexport function freshScenario(proto: Scenario): Scenario {\n if (typeof proto.fresh === 'function') return proto.fresh();\n const Ctor = proto.constructor as new () => Scenario;\n return new Ctor();\n}\n\n/**\n * Judge a merged raw log with the scenario's own end-of-run logic by loading\n * it into a fresh instance. Falls back to the raw log for scenarios that\n * don't keep a plain `checks` array.\n */\nexport function finalizeChecks(\n scenarioName: string,\n merged: ConformanceCheck[],\n revision?: SpecVersion\n): ConformanceCheck[] {\n const proto = getScenario(scenarioName);\n if (!proto) return merged;\n try {\n const scenario = freshScenario(proto);\n if (revision) scenario.judgeAt?.(revision);\n const fresh = scenario as unknown as {\n checks?: unknown;\n getChecks(): ConformanceCheck[];\n };\n if (!Array.isArray(fresh.checks)) return merged;\n fresh.checks = merged.map((c) => ({ ...c }));\n return fresh.getChecks();\n } catch {\n return merged;\n }\n}\n\nexport class SessionManager {\n private runs = new Map();\n private readonly ttlMs: number;\n private readonly auxOrigins: Partial>;\n private sweeper: ReturnType;\n readonly store: RunStore | undefined;\n private pending = new Set>();\n /** Identifies this process's rows in the store. */\n readonly writerId = randomBytes(4).toString('hex');\n\n constructor(opts: SessionManagerOptions = {}) {\n this.ttlMs = opts.ttlMs ?? 5 * 60_000;\n this.auxOrigins = opts.auxOrigins ?? {};\n this.store = opts.store;\n const sweepIntervalMs = opts.sweepIntervalMs ?? 30_000;\n this.sweeper = setInterval(() => this.sweep(), sweepIntervalMs);\n this.sweeper.unref?.();\n }\n\n /**\n * Get the cell, creating it on first reference. `baseUrlFor` is the public\n * URL of the cell (no trailing slash) — the scenario embeds it in\n * self-referential responses (PRM `resource`, canary `$ref`s).\n */\n getOrCreate(ref: CellRef, baseUrlFor: (ref: CellRef) => string): HostedRun {\n const id = cellId(ref);\n const existing = this.runs.get(id);\n if (existing) {\n existing.lastSeenAt = Date.now();\n return existing;\n }\n\n const proto = getScenario(ref.scenarioName);\n if (!proto) throw new UnknownScenarioError(ref.scenarioName);\n\n const scenario = freshScenario(proto);\n const ctx = hostedScenarioContext(ref.revision);\n\n let listener: RequestListener;\n let auxListeners: HostedRun['auxListeners'];\n let context: Record | undefined;\n\n if (scenario instanceof AuthHandlerScenario) {\n // Multi-origin scenario: build RS + aux handlers from authHandlers().\n // Aux issuer is /r/ so the cell is recoverable\n // from any RFC 8414 well-known path the client constructs from it.\n const missing = scenario.auxRoles.filter((r) => !this.auxOrigins[r]);\n if (missing.length) {\n throw new NotHostableError(\n ref.scenarioName,\n `needs relay origin(s) [${missing.join(', ')}]`\n );\n }\n const handlers = scenario.authHandlers({\n ...ctx,\n getRsBaseUrl: () => baseUrlFor(ref),\n getAuxBaseUrl: (role) => `${this.auxOrigins[role]}/r/${id}`\n });\n listener = handlers.rs;\n auxListeners = handlers.aux;\n } else if (scenario.handler) {\n listener = scenario.handler(() => baseUrlFor(ref), ctx);\n } else {\n throw new NotHostableError(ref.scenarioName);\n }\n\n // What start() would hand the CLI runner's client (credentials, tool\n // arguments, …): a hosted cell never runs start(), so ask directly.\n context = (\n scenario as unknown as {\n scenarioContext?: () => Record;\n }\n ).scenarioContext?.();\n const steps = (scenario as Scenario).steps;\n if (steps) context = { ...context, steps };\n\n const run: HostedRun = {\n ...ref,\n id,\n scenario,\n listener,\n auxListeners,\n mcpPath: scenario.mcpPath ?? '',\n createdAt: Date.now(),\n lastSeenAt: Date.now(),\n context,\n saved: false,\n touched: false,\n hostedChecks: [],\n identities: new Map(),\n hostedKeys: new Set(),\n seeded: new Map()\n };\n this.runs.set(id, run);\n return run;\n }\n\n /**\n * getOrCreate() plus hydrate(): the cell, seeded with what other processes\n * already recorded about it. What every request must go through before it\n * is dispatched, so a scenario that keys its behaviour on its own log (the\n * one-time rejection in request-metadata, say) sees the run's history and\n * not just this process's.\n */\n async acquire(\n ref: CellRef,\n baseUrlFor: (ref: CellRef) => string\n ): Promise {\n const run = this.getOrCreate(ref, baseUrlFor);\n await this.hydrate(run);\n return run;\n }\n\n /**\n * Seed the cell's scenario with the merged raw log the store holds for it,\n * once per cell per process. Only scenarios that keep a plain `checks`\n * array can be

Hold on — this client led with initialize

MCP Checker — 2026-07-28

How it works

What is checked

Old clients

Try it

MCP Checker — Auth Chain

Hold on — this client led with `initialize`

Diff · v249