[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_751":752,"_753":754},"routes/_app.x.$handle.$name",{"_95":94,"_32":46,"_103":85,"_27":104,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":25,"_118":119,"_120":121,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":-5,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",103,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","src/hosted/server.ts","latestPath","fileId","b70c0f02-5b64-11f1-8713-ee650bb23af1","name","server.ts","fileType","script","content","/**\n * Hosted conformance server — direct-mount, no loopback proxy.\n *\n * URL scheme (run-id is path-embedded so stateless-transport clients work):\n *\n * ALL /s//[/] Mounted scenario handler. The run\n * is created lazily on first hit;\n * pick any you like.\n * GET /s/ Convenience: mints a fresh run-id\n * and returns {mcpUrl, resultsUrl}.\n * GET /results/ JSON {summary, checks}\n * GET /results/.html Pretty HTML report\n * GET /scenarios JSON list of hostable scenarios\n * GET / Landing page\n * POST /mcp Meta-MCP: list_scenarios,\n * start_run, get_results\n *\n * Scenarios are mounted via Scenario.handler() — the same RequestListener the\n * CLI runner wraps in http.createServer — so there is no loopback port and\n * this works on serverless hosts. Each run gets a fresh Scenario instance.\n */\n\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { ServerResponse } from 'node:http';\nimport { timingSafeEqual } from 'node:crypto';\nimport { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n CallToolResult\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport {\n SessionManager,\n HostedRun,\n UnknownScenarioError,\n NotHostableError,\n listHostableScenarios\n} from './session.ts';\nimport { renderLanding, renderResults } from './html.ts';\nimport { getScenario } from '../scenarios/index.ts';\nimport {\n ConformanceCheck,\n AuxOriginRole,\n AuthHandlerScenario,\n RequestListener,\n Scenario\n} from '../types.ts';\n\nexport interface HostedServerOptions {\n publicOrigin?: string;\n ttlMs?: number;\n /**\n * Public origins of the AS/IdP relay deployments. When set, scenarios that\n * implement `authHandlers()` become hostable; their per-run AS issuer is\n * `/r/`. See examples/hosted/valtown-relay.ts.\n */\n auxOrigins?: Partial>;\n /**\n * Shared secret the relay sends in `x-relay-secret`. `/__aux/*` rejects\n * requests without it so the aux backchannel can't be hit directly. Set\n * the same value in the relay's env.\n */\n relaySecret?: string;\n}\n\n/** Only allow run-ids that are safe in a single path segment. */\nconst RUN_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;\n\nconst AUX_ROLES: readonly AuxOriginRole[] = ['as', 'as2', 'idp'];\n\n// ---------------------------------------------------------------------------\n// Stateless (\"/x\") mounting support.\n//\n// /x/ mounts a scenario with NO run-id and NO results polling: a\n// fresh scenario instance judges each request on its own content, and if the\n// request itself violates a conformance requirement the response is replaced\n// with a 400 explaining which checks failed. This only behaves sensibly for\n// scenarios whose checks are per-request (no cross-request memory) — which\n// is also exactly what serverless hosts with multiple isolates can support.\n// ---------------------------------------------------------------------------\n\n/** Scenarios whose checks need cross-request or timing state — excluded. */\nconst NOT_STATELESS = new Set(['sse-retry']);\n\n/**\n * The aux relay correlates flows by a /r/ in the path. In stateless\n * mode that segment encodes the scenario name instead of a run-id\n * ('auth/metadata-default' → 'x--auth--metadata-default'); run-ids can't\n * collide with it because '--' never appears in minted ids and the prefix is\n * reserved.\n */\nconst STATELESS_SLUG_PREFIX = 'x--';\nfunction statelessSlug(scenarioName: string): string {\n return STATELESS_SLUG_PREFIX + scenarioName.split('/').join('--');\n}\nfunction decodeStatelessSlug(segment: string): string | undefined {\n if (!segment.startsWith(STATELESS_SLUG_PREFIX)) return undefined;\n return segment.slice(STATELESS_SLUG_PREFIX.length).split('--').join('/');\n}\n\ninterface CapturedResponse {\n status: number;\n headers: Record;\n body: Buffer;\n}\n\n/**\n * Run a scenario listener against a buffered response so the outcome can be\n * judged (and replaced) after the handler finishes. Same interception\n * surface the valtown bridge uses: writeHead/setHeader/write/end and the\n * statusCode property — everything express and the SDK transport touch.\n */\nfunction runCaptured(\n listener: RequestListener,\n req: Request,\n rewrittenUrl: string\n): Promise {\n return new Promise((resolve, reject) => {\n const headers: Record = {};\n const chunks: Buffer[] = [];\n let status = 200;\n\n const fake = new ServerResponse(req) as ServerResponse;\n const captureHeaders = (\n h?: Record\n ): void => {\n for (const [k, v] of Object.entries(h ?? {})) {\n headers[k.toLowerCase()] = Array.isArray(v) ? v : String(v);\n }\n };\n fake.setHeader = ((k: string, v: string | string[] | number) => {\n headers[k.toLowerCase()] = Array.isArray(v) ? v : String(v);\n return fake;\n }) as ServerResponse['setHeader'];\n fake.getHeader = (k: string) => headers[k.toLowerCase()];\n fake.removeHeader = (k: string) => {\n delete headers[k.toLowerCase()];\n };\n fake.writeHead = ((code: number, h?: Record) => {\n status = code;\n captureHeaders(h);\n return fake;\n }) as ServerResponse['writeHead'];\n fake.write = ((c: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n return true;\n }) as ServerResponse['write'];\n fake.flushHeaders = () => {};\n Object.defineProperty(fake, 'statusCode', {\n get: () => status,\n set: (v: number) => {\n status = v;\n }\n });\n fake.end = ((c?: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n resolve({ status, headers, body: Buffer.concat(chunks) });\n return fake;\n }) as ServerResponse['end'];\n\n req.url = rewrittenUrl;\n try {\n listener(req, fake);\n } catch (e) {\n reject(e instanceof Error ? e : new Error(String(e)));\n }\n });\n}\n\nexport function createHostedApp(opts: HostedServerOptions = {}): {\n app: express.Application;\n sessions: SessionManager;\n} {\n const auxOrigins = opts.auxOrigins ?? {};\n const haveAux = AUX_ROLES.filter((r) => auxOrigins[r]);\n const sessions = new SessionManager({ ttlMs: opts.ttlMs, auxOrigins });\n const app = express();\n const hostable = new Set(listHostableScenarios(haveAux));\n\n function origin(req: Request): string {\n if (opts.publicOrigin) return opts.publicOrigin;\n const proto = (req.header('x-forwarded-proto') ?? req.protocol) || 'http';\n const host = req.header('x-forwarded-host') ?? req.header('host');\n return `${proto}://${host}`;\n }\n\n function runBaseUrl(req: Request, scenario: string, runId: string): string {\n return `${origin(req)}/s/${scenario}/${runId}`;\n }\n\n /**\n * Resolve \"//\" against the hostable set.\n * Scenario names may contain '/', so try progressively longer prefixes.\n * Returns undefined if no hostable scenario matches the prefix.\n */\n function resolveRun(rest: string):\n | {\n scenarioName: string;\n runId: string | undefined;\n suffix: string;\n }\n | undefined {\n const segments = rest.split('/');\n for (let i = 1; i <= segments.length; i++) {\n const candidate = segments.slice(0, i).join('/');\n if (hostable.has(candidate)) {\n const runId = segments[i] || undefined;\n const suffix = '/' + segments.slice(i + 1).join('/');\n return { scenarioName: candidate, runId, suffix };\n }\n }\n return undefined;\n }\n\n /**\n * Dispatch (req, res) to `listener` after rewriting `req.url` so the\n * scenario sees the path it would have under start()/stop() — i.e. with\n * the run-prefix stripped and (for well-known dispatch) the well-known\n * prefix re-prepended.\n */\n function dispatch(\n run: HostedRun,\n listener: (req: Request, res: Response) => void,\n req: Request,\n res: Response,\n rewrittenUrl: string\n ) {\n res.setHeader(\n 'link',\n `<${origin(req)}/results/${run.id}>; rel=\"conformance-results\"`\n );\n req.url = rewrittenUrl;\n listener(req, res);\n }\n\n // ---------- discovery ----------\n\n app.get('/', (req, res) => {\n res.type('html').send(renderLanding(origin(req), Array.from(hostable)));\n });\n\n app.get('/scenarios', (_req, res) => {\n res.json(\n Array.from(hostable).map((name) => {\n const s = getScenario(name)!;\n return {\n name,\n description: s.description,\n source: s.source,\n mcpPath: s.mcpPath ?? ''\n };\n })\n );\n });\n\n // ---------- scenario mounting ----------\n //\n // We can't pre-register an express route per (scenario, run-id) because\n // run-ids are open-ended. Instead a single catch-all route resolves the\n // run, rewrites req.url to strip the /s// prefix, and hands\n // off to the run's listener — exactly what app.use(prefix, fn) would do,\n // but with a dynamic prefix.\n\n app.all(/^\\/s\\/(.+)$/, (req, res, next) => {\n const rest = req.params[0]; // \"//\"\n const resolved = resolveRun(rest);\n if (!resolved) {\n // Distinguish \"exists but not hostable\" from \"unknown\"\n const segments = rest.split('/');\n for (let i = 1; i <= segments.length; i++) {\n if (getScenario(segments.slice(0, i).join('/'))) {\n res.status(501).json({\n error: `scenario '${segments.slice(0, i).join('/')}' is not hostable here`\n });\n return;\n }\n }\n res.status(404).json({ error: `unknown scenario '${segments[0]}'` });\n return;\n }\n const { scenarioName, runId, suffix } = resolved;\n\n // GET /s/ with no run-id → mint one and tell the caller where\n // to point their client.\n if (!runId) {\n if (req.method !== 'GET') {\n res.status(400).json({\n error:\n 'Missing run-id. Use /s//, or GET /s/ to mint one.'\n });\n return;\n }\n try {\n const run = sessions.getOrCreate(scenarioName, undefined, (id) =>\n runBaseUrl(req, scenarioName, id)\n );\n res.json({\n runId: run.id,\n mcpUrl: `${runBaseUrl(req, scenarioName, run.id)}${run.mcpPath}`,\n resultsUrl: `${origin(req)}/results/${run.id}`,\n resultsHtmlUrl: `${origin(req)}/results/${run.id}.html`,\n context: run.context\n });\n } catch (e) {\n next(e);\n }\n return;\n }\n\n if (!RUN_ID_RE.test(runId)) {\n res.status(400).json({ error: 'invalid run-id' });\n return;\n }\n\n let run;\n try {\n run = sessions.getOrCreate(scenarioName, runId, (id) =>\n runBaseUrl(req, scenarioName, id)\n );\n } catch (e) {\n if (e instanceof UnknownScenarioError || e instanceof NotHostableError) {\n res.status(400).json({ error: e.message });\n return;\n }\n throw e;\n }\n\n // Rewrite to the path the scenario expects (it thinks it's at root).\n // The query string is preserved because we keep the express req object.\n dispatch(\n run,\n run.listener,\n req,\n res,\n suffix === '/' ? run.mcpPath || '/' : suffix\n );\n });\n\n // ---------- stateless mounting (no run-id, fail-fast) ----------\n //\n // /x/[/] judges every request on its own content with a\n // fresh scenario instance. A request that records a FAILURE check gets a\n // 400 explaining what went wrong instead of the scenario's response — the\n // client-under-test finds out immediately, no results polling, no mint.\n\n interface StatelessInstance {\n scenario: Scenario;\n listener: RequestListener;\n auxListeners?: Partial>;\n mcpPath: string;\n }\n\n function instantiateStateless(\n scenarioName: string,\n baseUrl: string\n ): StatelessInstance {\n const proto = getScenario(scenarioName);\n if (!proto) throw new UnknownScenarioError(scenarioName);\n const Ctor = proto.constructor as new () => Scenario;\n const scenario = new Ctor();\n\n if (scenario instanceof AuthHandlerScenario) {\n const missing = scenario.auxRoles.filter((r) => !auxOrigins[r]);\n if (missing.length) {\n throw new NotHostableError(\n scenarioName,\n `needs aux origin(s) [${missing.join(', ')}] — start with --as-origin`\n );\n }\n const handlers = scenario.authHandlers({\n getRsBaseUrl: () => baseUrl,\n getAuxBaseUrl: (role) =>\n `${auxOrigins[role]}/r/${statelessSlug(scenarioName)}`\n });\n return {\n scenario,\n listener: handlers.rs,\n auxListeners: handlers.aux,\n mcpPath: scenario.mcpPath ?? ''\n };\n }\n if (scenario.handler) {\n return {\n scenario,\n listener: scenario.handler(() => baseUrl),\n mcpPath: scenario.mcpPath ?? ''\n };\n }\n throw new NotHostableError(scenarioName);\n }\n\n /**\n * Resolve \"/\" (no run-id segment) against the\n * hostable set, longest scenario-name prefix first.\n */\n function resolveStateless(\n rest: string\n ): { scenarioName: string; suffix: string } | undefined {\n const segments = rest.split('/');\n for (let i = segments.length; i >= 1; i--) {\n const candidate = segments.slice(0, i).join('/');\n if (hostable.has(candidate) && !NOT_STATELESS.has(candidate)) {\n return {\n scenarioName: candidate,\n suffix: '/' + segments.slice(i).join('/')\n };\n }\n }\n return undefined;\n }\n\n /** Emit the captured response, or replace it with a 400 on FAILUREs. */\n function finishStateless(\n res: Response,\n scenario: Scenario,\n captured: CapturedResponse,\n scenarioName: string\n ): void {\n const checks = scenario.rawChecks?.() ?? scenario.getChecks();\n const failures = checks.filter((c) => c.status === 'FAILURE');\n if (failures.length > 0) {\n res.status(400).json({\n error: 'conformance failure',\n scenario: scenarioName,\n failures: failures.map(({ id, description, details }) => ({\n id,\n description,\n details\n }))\n });\n return;\n }\n for (const [k, v] of Object.entries(captured.headers)) {\n res.setHeader(k, v);\n }\n res.setHeader(\n 'mcp-conformance',\n `pass; checks=${checks.filter((c) => c.status === 'SUCCESS').length}`\n );\n res.status(captured.status);\n res.end(captured.body.length ? captured.body : undefined);\n }\n\n app.all(/^\\/x\\/(.+)$/, async (req, res) => {\n const rest = req.params[0];\n const resolved = resolveStateless(rest);\n if (!resolved) {\n const segments = rest.split('/');\n for (let i = 1; i <= segments.length; i++) {\n const candidate = segments.slice(0, i).join('/');\n if (NOT_STATELESS.has(candidate)) {\n res.status(501).json({\n error: `scenario '${candidate}' needs cross-request state and cannot run stateless — use /s/${candidate}/`\n });\n return;\n }\n if (getScenario(candidate)) {\n res.status(501).json({\n error: `scenario '${candidate}' is not hostable here`\n });\n return;\n }\n }\n res.status(404).json({ error: `unknown scenario '${segments[0]}'` });\n return;\n }\n const { scenarioName, suffix } = resolved;\n\n let inst: StatelessInstance;\n try {\n inst = instantiateStateless(\n scenarioName,\n `${origin(req)}/x/${scenarioName}`\n );\n } catch (e) {\n if (e instanceof UnknownScenarioError || e instanceof NotHostableError) {\n res.status(400).json({ error: e.message });\n return;\n }\n throw e;\n }\n\n const captured = await runCaptured(\n inst.listener,\n req,\n suffix === '/' ? inst.mcpPath || '/' : suffix\n );\n finishStateless(res, inst.scenario, captured, scenarioName);\n });\n\n // RFC 9728 root well-known for stateless mounts: PRM URL for MCP URL\n // /x//mcp is /.well-known/oauth-protected-resource/x//mcp.\n app.get(\n /^\\/\\.well-known\\/oauth-protected-resource\\/x\\/(.+)$/,\n async (req, res) => {\n const resolved = resolveStateless(req.params[0]);\n if (!resolved) {\n res.status(404).json({ error: 'no scenario for this resource path' });\n return;\n }\n let inst: StatelessInstance;\n try {\n inst = instantiateStateless(\n resolved.scenarioName,\n `${origin(req)}/x/${resolved.scenarioName}`\n );\n } catch {\n res.status(404).json({ error: 'no scenario for this resource path' });\n return;\n }\n const rewritten =\n '/.well-known/oauth-protected-resource' +\n (resolved.suffix === '/' ? '' : resolved.suffix);\n const captured = await runCaptured(inst.listener, req, rewritten);\n finishStateless(res, inst.scenario, captured, resolved.scenarioName);\n }\n );\n\n // ---------- root well-known dispatch (RS side) ----------\n //\n // RFC 9728: a client given MCP URL /s///mcp derives the PRM\n // URL as /.well-known/oauth-protected-resource/s///mcp —\n // i.e. at the *origin root*, not under the run prefix. We catch that here,\n // recover (scenario, run-id) from the path suffix, and re-dispatch to the\n // run's RS handler with the path it would have seen on its own origin.\n //\n // Requests that arrive *under* the run prefix (because the WWW-Authenticate\n // header points there) already work via the /s/* mount above.\n\n app.get(/^\\/\\.well-known\\/oauth-protected-resource\\/s\\/(.+)$/, (req, res) => {\n const resolved = resolveRun(req.params[0]);\n if (!resolved?.runId || !RUN_ID_RE.test(resolved.runId)) {\n res.status(404).json({ error: 'no run for this resource path' });\n return;\n }\n const run = sessions.get(resolved.runId);\n if (!run) {\n res.status(404).json({ error: 'no run for this resource path' });\n return;\n }\n // Scenario expects e.g. '/.well-known/oauth-protected-resource/mcp'\n const rewritten =\n '/.well-known/oauth-protected-resource' +\n (resolved.suffix === '/' ? '' : resolved.suffix);\n dispatch(run, run.listener, req, res, rewritten);\n });\n\n // ---------- aux-origin backchannel (relay target) ----------\n //\n // The AS relay (examples/hosted/valtown-relay.ts) forwards every request it\n // receives to /__aux/. The per-run AS issuer is\n // /r/, so every path the client hits — endpoints\n // (/r//authorize) and RFC 8414 well-known\n // (/.well-known/oauth-authorization-server/r/[/tenant]) — carries\n // `/r/` somewhere in it. We extract the id, strip that segment, and\n // dispatch to the run's aux handler so it sees exactly the path\n // createAuthServer registered.\n //\n // Guarded by a shared secret so this internal mount can't be hit directly\n // to forge checks into someone else's run.\n\n if (haveAux.length) {\n const secret = opts.relaySecret ?? process.env.CONFORMANCE_RELAY_SECRET;\n const guard = (req: Request, res: Response): boolean => {\n const got = req.header('x-relay-secret') ?? '';\n // Constant-time compare; mismatch length → fast 403 is fine.\n const ok =\n !!secret &&\n got.length === secret.length &&\n timingSafeEqual(Buffer.from(got), Buffer.from(secret));\n if (!ok) {\n res\n .status(403)\n .json({ error: 'forbidden: /__aux is the relay backchannel' });\n }\n return ok;\n };\n\n app.all(/^\\/__aux\\/([a-z0-9]+)(\\/.*)$/, async (req, res) => {\n if (!guard(req, res)) return;\n const role = req.params[0] as AuxOriginRole;\n const path = req.params[1];\n if (!AUX_ROLES.includes(role)) {\n res.status(404).json({ error: `unknown aux role '${role}'` });\n return;\n }\n\n // Find /r/ anywhere in the path and excise it.\n const m = path.match(/^(.*?)\\/r\\/([A-Za-z0-9_-]{1,64})(\\/.*)?$/);\n if (!m) {\n res\n .status(404)\n .json({ error: 'aux request path missing /r/ segment' });\n return;\n }\n const [, prefix, runId, suffix = ''] = m;\n const search = req.url.includes('?')\n ? req.url.slice(req.url.indexOf('?'))\n : '';\n\n // Stateless flows encode the scenario name (not a run-id) in the /r/\n // segment; per-flow OAuth state rides inside the artifacts themselves\n // (auth code, token), so a fresh instance per request is enough.\n const slugScenario = decodeStatelessSlug(runId);\n if (slugScenario !== undefined) {\n let inst: StatelessInstance;\n try {\n inst = instantiateStateless(\n slugScenario,\n `${origin(req)}/x/${slugScenario}`\n );\n } catch {\n res\n .status(404)\n .json({ error: `no stateless scenario '${slugScenario}'` });\n return;\n }\n const listener = inst.auxListeners?.[role];\n if (!listener) {\n res.status(404).json({ error: `no aux '${role}' handler` });\n return;\n }\n const captured = await runCaptured(\n listener,\n req,\n (prefix + suffix || '/') + search\n );\n finishStateless(res, inst.scenario, captured, slugScenario);\n return;\n }\n\n const run = sessions.get(runId);\n const listener = run?.auxListeners?.[role];\n if (!run || !listener) {\n res.status(404).json({ error: `no aux '${role}' handler for run` });\n return;\n }\n dispatch(run, listener, req, res, (prefix + suffix || '/') + search);\n });\n }\n\n // ---------- results ----------\n\n app.get('/results/:id.html', (req, res) => {\n const run = sessions.get(req.params.id);\n const checks = sessions.results(req.params.id);\n if (!run || !checks) {\n res\n .status(404)\n .type('html')\n .send(`

No run ${req.params.id}

`);\n return;\n }\n res.type('html').send(renderResults(run.scenarioName, run.id, checks));\n });\n\n app.get('/results/:id', (req, res) => {\n const run = sessions.get(req.params.id);\n const checks = sessions.results(req.params.id);\n if (!run || !checks) {\n res.status(404).json({ error: 'unknown run' });\n return;\n }\n res.json(summarise(run.scenarioName, run.id, checks));\n });\n\n app.delete('/results/:id', async (req, res) => {\n await sessions.destroy(req.params.id);\n res.status(204).end();\n });\n\n // ---------- meta MCP server ----------\n\n app.post('/mcp', express.json(), async (req, res) => {\n const server = createMetaMcpServer(sessions, origin(req), (s, id) =>\n runBaseUrl(req, s, id)\n );\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n await transport.handleRequest(req, res, req.body);\n res.on('close', () => {\n transport.close();\n server.close();\n });\n });\n\n return { app, sessions };\n}\n\nfunction summarise(scenario: string, id: string, checks: ConformanceCheck[]) {\n const counts = { SUCCESS: 0, FAILURE: 0, WARNING: 0, SKIPPED: 0, INFO: 0 };\n for (const c of checks) counts[c.status]++;\n return {\n runId: id,\n scenario,\n summary: {\n passed: counts.SUCCESS,\n failed: counts.FAILURE,\n warnings: counts.WARNING,\n info: counts.INFO,\n skipped: counts.SKIPPED,\n total: checks.length\n },\n checks\n };\n}\n\nfunction createMetaMcpServer(\n sessions: SessionManager,\n publicOrigin: string,\n runBaseUrl: (scenario: string, runId: string) => string\n): Server {\n const server = new Server(\n { name: 'mcp-conformance-hosted', version: '0.2.0' },\n { capabilities: { tools: {} } }\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => ({\n tools: [\n {\n name: 'list_scenarios',\n description:\n 'List client-conformance scenarios this hosted instance can serve.',\n inputSchema: { type: 'object', properties: {} }\n },\n {\n name: 'start_run',\n description:\n 'Create a fresh run for a scenario and return the MCP URL to point ' +\n 'the client-under-test at, plus the results URL. The run-id is ' +\n 'embedded in the path so this works with stateless transports.',\n inputSchema: {\n type: 'object',\n properties: {\n scenario: {\n type: 'string',\n description: 'Scenario name, e.g. \"initialize\" or \"tools_call\".'\n },\n run_id: {\n type: 'string',\n description:\n 'Optional. Supply your own [A-Za-z0-9_-]{1,64} id; ' +\n 'otherwise one is generated.'\n }\n },\n required: ['scenario']\n }\n },\n {\n name: 'get_results',\n description:\n 'Fetch the conformance checks recorded for a run. Same shape as ' +\n 'GET /results/.',\n inputSchema: {\n type: 'object',\n properties: { run_id: { type: 'string' } },\n required: ['run_id']\n }\n }\n ]\n }));\n\n server.setRequestHandler(\n CallToolRequestSchema,\n async (request): Promise => {\n const args = (request.params.arguments ?? {}) as Record;\n switch (request.params.name) {\n case 'list_scenarios':\n return text(\n JSON.stringify(\n listHostableScenarios().map((name) => ({\n name,\n description: getScenario(name)!.description\n })),\n null,\n 2\n )\n );\n\n case 'start_run': {\n if (args.run_id && !RUN_ID_RE.test(args.run_id)) {\n return errorText(`invalid run_id (must match ${RUN_ID_RE})`);\n }\n try {\n const run = sessions.getOrCreate(args.scenario, args.run_id, (id) =>\n runBaseUrl(args.scenario, id)\n );\n return text(\n JSON.stringify(\n {\n runId: run.id,\n mcpUrl: `${runBaseUrl(run.scenarioName, run.id)}${run.mcpPath}`,\n resultsUrl: `${publicOrigin}/results/${run.id}`,\n resultsHtmlUrl: `${publicOrigin}/results/${run.id}.html`,\n context: run.context\n },\n null,\n 2\n )\n );\n } catch (e) {\n if (\n e instanceof UnknownScenarioError ||\n e instanceof NotHostableError\n ) {\n return errorText(e.message);\n }\n throw e;\n }\n }\n\n case 'get_results': {\n const run = sessions.get(args.run_id);\n const checks = sessions.results(args.run_id);\n if (!run || !checks) return errorText(`no run '${args.run_id}'`);\n return text(\n JSON.stringify(summarise(run.scenarioName, run.id, checks), null, 2)\n );\n }\n\n default:\n return errorText(`unknown tool ${request.params.name}`);\n }\n }\n );\n\n return server;\n}\n\nfunction text(t: string): CallToolResult {\n return { content: [{ type: 'text', text: t }] };\n}\n\nfunction errorText(t: string): CallToolResult {\n return { content: [{ type: 'text', text: t }], isError: true };\n}\n","createdAt",["D",1780655710179],"branchVersion","branchId","b62d0bb8-5b64-11f1-a2b2-ee650bb23af1","id","b6283b42-5b64-11f1-a2b2-ee650bb23af1","mcp-conformance",["D",1780062353614],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","1d3af61b-92b3-4fbf-b22a-ca08b2122f4d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_102":98},"org",{"_95":94,"_96":-5,"_97":98,"_18":55,"_99":100,"_101":25},"branch",{"_13":84,"_32":85,"_44":43,"_86":45,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":46,"_93":94},"isOwned",108,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pcarleton","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yZjg2YXM0MEVRM0hKQzVqcFJ5aHZteXUxUjUifQ","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_32":46,"_39":747,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":-5,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":748,"_79":749,"_81":750,"_83":25},"tree",[163,166,231],"files",[163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231],"counts",{"_153":61,"_154":150,"_155":61,"_156":157,"_158":159},"contents",[126,127,128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_44":147,"_32":148,"_30":149,"_132":-5,"_42":43,"_41":150,"_134":121,"_39":151,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_27":152},{"_44":140,"_32":141,"_30":142,"_132":-5,"_42":43,"_41":143,"_134":121,"_39":144,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_27":146},{"_44":129,"_32":130,"_30":131,"_132":-5,"_42":43,"_41":133,"_134":121,"_39":135,"_13":61,"_34":136,"_36":137,"_24":25,"_138":-5,"_27":139},"c3d04dde-5b64-11f1-b520-ee650bb23af1","http.ts","c3d04eb0-5b64-11f1-b520-ee650bb23af1","parentId",57,"latest",["D",1780062376520],"http","export { default } from './examples/hosted/valtown.ts';\n","label",[130],"b70c7d16-5b64-11f1-8713-ee650bb23af1","src","724673a5-9883-491f-af30-67377464f321",2,["D",1780062355087],"directory",[141],"b6abbca6-5b64-11f1-bb92-ee650bb23af1","examples","52dfe22a-3fc8-4d4b-b364-a3c11b4e7425",1,["D",1780062354427],[148],"pulls","branches","forks","envVars",{"_160":143,"_162":61},"connections",{"_160":61,"_161":61},"count","unfilledCount","emptyCount",{"_44":147,"_32":148,"_30":149,"_132":-5,"_42":43,"_41":150,"_134":121,"_39":744,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_233":745,"_27":746},{"_44":740,"_32":690,"_30":734,"_132":149,"_42":43,"_41":150,"_134":121,"_39":741,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_233":742,"_27":743},{"_44":731,"_32":732,"_30":733,"_132":734,"_42":43,"_41":735,"_134":25,"_39":736,"_13":428,"_34":35,"_36":737,"_24":25,"_138":-5,"_233":738,"_27":739},{"_44":140,"_32":141,"_30":142,"_132":-5,"_42":43,"_41":143,"_134":121,"_39":728,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_233":729,"_27":730},{"_44":724,"_32":715,"_30":709,"_132":142,"_42":43,"_41":710,"_134":121,"_39":725,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_233":726,"_27":727},{"_44":716,"_32":717,"_30":718,"_132":709,"_42":43,"_41":719,"_134":121,"_39":720,"_13":61,"_34":35,"_36":721,"_24":25,"_138":-5,"_233":722,"_27":723},{"_44":707,"_32":256,"_30":708,"_132":709,"_42":43,"_41":710,"_134":121,"_39":711,"_13":61,"_34":35,"_36":712,"_24":25,"_138":-5,"_233":713,"_27":714},{"_44":703,"_32":690,"_30":684,"_132":142,"_42":43,"_41":143,"_134":121,"_39":704,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_233":705,"_27":706},{"_44":695,"_32":696,"_30":697,"_132":684,"_42":43,"_41":698,"_134":121,"_39":699,"_13":61,"_34":35,"_36":700,"_24":25,"_138":-5,"_233":701,"_27":702},{"_44":691,"_32":33,"_30":31,"_132":684,"_42":43,"_41":14,"_134":121,"_39":692,"_13":241,"_34":35,"_36":38,"_24":25,"_138":-5,"_233":693,"_27":694},{"_44":681,"_32":682,"_30":683,"_132":684,"_42":43,"_41":685,"_134":121,"_39":686,"_13":428,"_34":35,"_36":687,"_24":25,"_138":-5,"_233":688,"_27":689},{"_44":677,"_32":254,"_30":248,"_132":142,"_42":43,"_41":428,"_134":121,"_39":678,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_233":679,"_27":680},{"_44":673,"_32":672,"_30":666,"_132":248,"_42":43,"_41":667,"_134":121,"_39":674,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_233":675,"_27":676},{"_44":663,"_32":664,"_30":665,"_132":666,"_42":43,"_41":667,"_134":121,"_39":668,"_13":61,"_34":35,"_36":669,"_24":25,"_138":-5,"_233":670,"_27":671},{"_44":658,"_32":422,"_30":416,"_132":248,"_42":43,"_41":659,"_134":121,"_39":660,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_233":661,"_27":662},{"_44":653,"_32":511,"_30":505,"_132":416,"_42":43,"_41":654,"_134":121,"_39":655,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_233":656,"_27":657},{"_44":649,"_32":624,"_30":618,"_132":505,"_42":43,"_41":636,"_134":121,"_39":650,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_233":651,"_27":652},{"_44":641,"_32":642,"_30":643,"_132":618,"_42":43,"_41":644,"_134":121,"_39":645,"_13":241,"_34":35,"_36":646,"_24":25,"_138":-5,"_233":647,"_27":648},{"_44":633,"_32":634,"_30":635,"_132":618,"_42":43,"_41":636,"_134":121,"_39":637,"_13":61,"_34":35,"_36":638,"_24":25,"_138":-5,"_233":639,"_27":640},{"_44":625,"_32":626,"_30":627,"_132":618,"_42":43,"_41":628,"_134":121,"_39":629,"_13":61,"_34":35,"_36":630,"_24":25,"_138":-5,"_233":631,"_27":632},{"_44":615,"_32":616,"_30":617,"_132":618,"_42":43,"_41":619,"_134":121,"_39":620,"_13":61,"_34":35,"_36":621,"_24":25,"_138":-5,"_233":622,"_27":623},{"_44":607,"_32":608,"_30":609,"_132":505,"_42":43,"_41":610,"_134":121,"_39":611,"_13":61,"_34":35,"_36":612,"_24":25,"_138":-5,"_233":613,"_27":614},{"_44":599,"_32":600,"_30":601,"_132":505,"_42":43,"_41":602,"_134":121,"_39":603,"_13":143,"_34":35,"_36":604,"_24":25,"_138":-5,"_233":605,"_27":606},{"_44":591,"_32":592,"_30":593,"_132":505,"_42":43,"_41":594,"_134":121,"_39":595,"_13":61,"_34":35,"_36":596,"_24":25,"_138":-5,"_233":597,"_27":598},{"_44":583,"_32":584,"_30":585,"_132":505,"_42":43,"_41":586,"_134":121,"_39":587,"_13":241,"_34":35,"_36":588,"_24":25,"_138":-5,"_233":589,"_27":590},{"_44":575,"_32":576,"_30":577,"_132":505,"_42":43,"_41":578,"_134":121,"_39":579,"_13":61,"_34":35,"_36":580,"_24":25,"_138":-5,"_233":581,"_27":582},{"_44":568,"_32":256,"_30":569,"_132":505,"_42":43,"_41":570,"_134":121,"_39":571,"_13":61,"_34":35,"_36":572,"_24":25,"_138":-5,"_233":573,"_27":574},{"_44":560,"_32":561,"_30":562,"_132":505,"_42":43,"_41":563,"_134":121,"_39":564,"_13":61,"_34":35,"_36":565,"_24":25,"_138":-5,"_233":566,"_27":567},{"_44":552,"_32":553,"_30":554,"_132":505,"_42":43,"_41":555,"_134":121,"_39":556,"_13":61,"_34":35,"_36":557,"_24":25,"_138":-5,"_233":558,"_27":559},{"_44":544,"_32":545,"_30":546,"_132":505,"_42":43,"_41":547,"_134":121,"_39":548,"_13":61,"_34":35,"_36":549,"_24":25,"_138":-5,"_233":550,"_27":551},{"_44":536,"_32":537,"_30":538,"_132":505,"_42":43,"_41":539,"_134":121,"_39":540,"_13":143,"_34":35,"_36":541,"_24":25,"_138":-5,"_233":542,"_27":543},{"_44":528,"_32":529,"_30":530,"_132":505,"_42":43,"_41":531,"_134":121,"_39":532,"_13":61,"_34":35,"_36":533,"_24":25,"_138":-5,"_233":534,"_27":535},{"_44":520,"_32":521,"_30":522,"_132":505,"_42":43,"_41":523,"_134":121,"_39":524,"_13":61,"_34":35,"_36":525,"_24":25,"_138":-5,"_233":526,"_27":527},{"_44":512,"_32":513,"_30":514,"_132":505,"_42":43,"_41":515,"_134":121,"_39":516,"_13":61,"_34":35,"_36":517,"_24":25,"_138":-5,"_233":518,"_27":519},{"_44":502,"_32":503,"_30":504,"_132":505,"_42":43,"_41":506,"_134":121,"_39":507,"_13":61,"_34":35,"_36":508,"_24":25,"_138":-5,"_233":509,"_27":510},{"_44":495,"_32":378,"_30":496,"_132":416,"_42":43,"_41":497,"_134":121,"_39":498,"_13":143,"_34":35,"_36":499,"_24":25,"_138":-5,"_233":500,"_27":501},{"_44":487,"_32":488,"_30":489,"_132":416,"_42":43,"_41":490,"_134":121,"_39":491,"_13":61,"_34":35,"_36":492,"_24":25,"_138":-5,"_233":493,"_27":494},{"_44":479,"_32":480,"_30":481,"_132":416,"_42":43,"_41":482,"_134":121,"_39":483,"_13":143,"_34":35,"_36":484,"_24":25,"_138":-5,"_233":485,"_27":486},{"_44":472,"_32":362,"_30":473,"_132":416,"_42":43,"_41":474,"_134":121,"_39":475,"_13":143,"_34":35,"_36":476,"_24":25,"_138":-5,"_233":477,"_27":478},{"_44":464,"_32":465,"_30":466,"_132":416,"_42":43,"_41":467,"_134":121,"_39":468,"_13":143,"_34":35,"_36":469,"_24":25,"_138":-5,"_233":470,"_27":471},{"_44":456,"_32":457,"_30":458,"_132":416,"_42":43,"_41":459,"_134":121,"_39":460,"_13":143,"_34":35,"_36":461,"_24":25,"_138":-5,"_233":462,"_27":463},{"_44":448,"_32":449,"_30":450,"_132":416,"_42":43,"_41":451,"_134":121,"_39":452,"_13":143,"_34":35,"_36":453,"_24":25,"_138":-5,"_233":454,"_27":455},{"_44":440,"_32":441,"_30":442,"_132":416,"_42":43,"_41":443,"_134":121,"_39":444,"_13":143,"_34":35,"_36":445,"_24":25,"_138":-5,"_233":446,"_27":447},{"_44":432,"_32":433,"_30":434,"_132":416,"_42":43,"_41":435,"_134":121,"_39":436,"_13":61,"_34":35,"_36":437,"_24":25,"_138":-5,"_233":438,"_27":439},{"_44":423,"_32":424,"_30":425,"_132":416,"_42":43,"_41":426,"_134":25,"_39":427,"_13":428,"_34":35,"_36":429,"_24":25,"_138":-5,"_233":430,"_27":431},{"_44":413,"_32":414,"_30":415,"_132":416,"_42":43,"_41":417,"_134":121,"_39":418,"_13":143,"_34":35,"_36":419,"_24":25,"_138":-5,"_233":420,"_27":421},{"_44":409,"_32":272,"_30":266,"_132":248,"_42":43,"_41":364,"_134":121,"_39":410,"_13":61,"_34":145,"_36":-5,"_24":25,"_138":-5,"_233":411,"_27":412},{"_44":401,"_32":402,"_30":403,"_132":266,"_42":43,"_41":404,"_134":121,"_39":405,"_13":61,"_34":35,"_36":406,"_24":25,"_138":-5,"_233":407,"_27":408},{"_44":393,"_32":394,"_30":395,"_132":266,"_42":43,"_41":396,"_134":121,"_39":397,"_13":61,"_34":35,"_36":398,"_24":25,"_138":-5,"_233":399,"_27":400},{"_44":385,"_32":386,"_30":387,"_132":266,"_42":43,"_41":388,"_134":121,"_39":389,"_13":61,"_34":35,"_36":390,"_24":25,"_138":-5,"_233":391,"_27":392},{"_44":377,"_32":378,"_30":379,"_132":266,"_42":43,"_41":380,"_134":121,"_39":381,"_13":61,"_34":35,"_36":382,"_24":25,"_138":-5,"_233":383,"_27":384},{"_44":369,"_32":370,"_30":371,"_132":266,"_42":43,"_41":372,"_134":121,"_39":373,"_13":61,"_34":35,"_36":374,"_24":25,"_138":-5,"_233":375,"_27":376},{"_44":361,"_32":362,"_30":363,"_132":266,"_42":43,"_41":364,"_134":121,"_39":365,"_13":61,"_34":35,"_36":366,"_24":25,"_138":-5,"_233":367,"_27":368},{"_44":353,"_32":354,"_30":355,"_132":266,"_42":43,"_41":356,"_134":121,"_39":357,"_13":61,"_34":35,"_36":358,"_24":25,"_138":-5,"_233":359,"_27":360},{"_44":345,"_32":346,"_30":347,"_132":266,"_42":43,"_41":348,"_134":121,"_39":349,"_13":61,"_34":35,"_36":350,"_24":25,"_138":-5,"_233":351,"_27":352},{"_44":337,"_32":338,"_30":339,"_132":266,"_42":43,"_41":340,"_134":121,"_39":341,"_13":61,"_34":35,"_36":342,"_24":25,"_138":-5,"_233":343,"_27":344},{"_44":329,"_32":330,"_30":331,"_132":266,"_42":43,"_41":332,"_134":121,"_39":333,"_13":61,"_34":35,"_36":334,"_24":25,"_138":-5,"_233":335,"_27":336},{"_44":321,"_32":322,"_30":323,"_132":266,"_42":43,"_41":324,"_134":121,"_39":325,"_13":61,"_34":35,"_36":326,"_24":25,"_138":-5,"_233":327,"_27":328},{"_44":313,"_32":314,"_30":315,"_132":266,"_42":43,"_41":316,"_134":121,"_39":317,"_13":61,"_34":35,"_36":318,"_24":25,"_138":-5,"_233":319,"_27":320},{"_44":305,"_32":306,"_30":307,"_132":266,"_42":43,"_41":308,"_134":121,"_39":309,"_13":61,"_34":35,"_36":310,"_24":25,"_138":-5,"_233":311,"_27":312},{"_44":297,"_32":298,"_30":299,"_132":266,"_42":43,"_41":300,"_134":121,"_39":301,"_13":61,"_34":35,"_36":302,"_24":25,"_138":-5,"_233":303,"_27":304},{"_44":289,"_32":290,"_30":291,"_132":266,"_42":43,"_41":292,"_134":121,"_39":293,"_13":61,"_34":35,"_36":294,"_24":25,"_138":-5,"_233":295,"_27":296},{"_44":281,"_32":282,"_30":283,"_132":266,"_42":43,"_41":284,"_134":121,"_39":285,"_13":61,"_34":35,"_36":286,"_24":25,"_138":-5,"_233":287,"_27":288},{"_44":273,"_32":274,"_30":275,"_132":266,"_42":43,"_41":276,"_134":121,"_39":277,"_13":61,"_34":35,"_36":278,"_24":25,"_138":-5,"_233":279,"_27":280},{"_44":263,"_32":264,"_30":265,"_132":266,"_42":43,"_41":267,"_134":121,"_39":268,"_13":61,"_34":35,"_36":269,"_24":25,"_138":-5,"_233":270,"_27":271},{"_44":255,"_32":256,"_30":257,"_132":248,"_42":43,"_41":258,"_134":121,"_39":259,"_13":150,"_34":35,"_36":260,"_24":25,"_138":-5,"_233":261,"_27":262},{"_44":245,"_32":246,"_30":247,"_132":248,"_42":43,"_41":249,"_134":121,"_39":250,"_13":61,"_34":35,"_36":251,"_24":25,"_138":-5,"_233":252,"_27":253},{"_44":236,"_32":237,"_30":238,"_132":142,"_42":43,"_41":239,"_134":121,"_39":240,"_13":241,"_34":35,"_36":242,"_24":25,"_138":-5,"_233":243,"_27":244},{"_44":129,"_32":130,"_30":131,"_132":-5,"_42":43,"_41":133,"_134":121,"_39":232,"_13":61,"_34":136,"_36":137,"_24":25,"_138":-5,"_233":234,"_27":235},["D",1780062376520],"children",[],[130],"f86af6cc-5f4a-11f1-812a-1607ee4eb77e","types.ts","b7487b72-5b64-11f1-955e-ee650bb23af1",83,["D",1780491102495],3,"export type CheckStatus =\n | 'SUCCESS'\n | 'FAILURE'\n | 'WARNING'\n | 'SKIPPED'\n | 'INFO';\n\nexport interface SpecReference {\n id: string;\n url?: string;\n}\n\nexport interface ConformanceCheck {\n id: string;\n name: string;\n description: string;\n status: CheckStatus;\n timestamp: string;\n specReferences?: SpecReference[];\n details?: Record;\n metadata?: Record;\n errorMessage?: string;\n logs?: string[];\n}\n\nexport const DATED_SPEC_VERSIONS = [\n '2025-03-26',\n '2025-06-18',\n '2025-11-25'\n] as const;\n\nexport type DatedSpecVersion = (typeof DATED_SPEC_VERSIONS)[number];\n\nexport const LATEST_SPEC_VERSION: DatedSpecVersion = '2025-11-25';\n\n/**\n * Wire `protocolVersion` for the in-progress spec. Mirrors\n * `LATEST_PROTOCOL_VERSION` in the spec repo's `schema/draft/schema.ts`;\n * bump when that constant changes.\n */\nexport const DRAFT_PROTOCOL_VERSION = 'DRAFT-2026-v1';\n\n// Wire protocolVersion strings the mock server will negotiate on initialize.\nexport const NEGOTIABLE_PROTOCOL_VERSIONS: readonly string[] = [\n '2025-06-18',\n LATEST_SPEC_VERSION,\n DRAFT_PROTOCOL_VERSION\n];\n\n/**\n * A spec revision the conformance suite can target via `--spec-version`.\n * Always a wire `protocolVersion` string. The CLI also accepts `'draft'` as\n * an alias for {@link DRAFT_PROTOCOL_VERSION}.\n */\nexport type SpecVersion = DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION;\n\n// Scenarios may also be tagged 'extension' to mark them as off-timeline\n// (selectable via --suite extensions, never via --spec-version). See #256.\nexport type ScenarioSpecTag = SpecVersion | 'extension';\n\n/**\n * Known protocol extensions that this suite has scenarios for.\n * Values are SEP-2133 extension identifiers (the keys used in\n * `capabilities.extensions`).\n */\nexport const EXTENSION_IDS = [\n 'io.modelcontextprotocol/oauth-client-credentials',\n 'io.modelcontextprotocol/enterprise-managed-authorization'\n] as const;\nexport type ExtensionId = (typeof EXTENSION_IDS)[number];\n\n/**\n * Where a scenario's requirement comes from. Either the dated spec timeline\n * (`introducedIn`/`removedIn`) or a named protocol extension that lives\n * outside the spec release cycle. Extensions never match `--spec-version`.\n */\nexport type ScenarioSource =\n | {\n introducedIn: DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION;\n removedIn?: DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION;\n }\n | { extensionId: ExtensionId };\n\nexport interface ScenarioUrls {\n serverUrl: string;\n authUrl?: string;\n /**\n * Optional context to pass to the client via MCP_CONFORMANCE_CONTEXT env var.\n * This is a JSON-serializable object containing scenario-specific data like credentials.\n */\n context?: Record;\n}\n\n/** A Node-style request handler — what `http.createServer` accepts. */\nexport type RequestListener = (\n req: import('http').IncomingMessage,\n res: import('http').ServerResponse\n) => void;\n\nexport interface Scenario {\n name: string;\n description: string;\n source: ScenarioSource;\n /**\n * If true, a non-zero client exit code is expected and will not cause the test to fail.\n * Use this for scenarios where the client is expected to error (e.g., rejecting invalid auth).\n */\n allowClientError?: boolean;\n /**\n * Sub-path of the MCP endpoint relative to the handler root. The CLI runner\n * appends this to the listen URL; the hosted runner appends it to the\n * mounted prefix. Default: '' (handler root is the MCP endpoint).\n */\n mcpPath?: string;\n /**\n * Return the request handler without binding a port. The hosted runner\n * mounts this directly under a path prefix so scenarios can run on\n * serverless hosts that don't allow loopback listeners.\n *\n * `getBaseUrl` returns the public URL this handler is reachable at (no\n * trailing slash) — use it for scenarios that embed self-referential\n * absolute URLs in responses. Called lazily so `start()` can resolve it\n * after the OS assigns a port.\n *\n * Implementations should reset per-run state here, not in `start()`.\n * If omitted, the scenario only runs via `start()`/`stop()` (e.g. auth\n * scenarios that need a second origin).\n */\n handler?(getBaseUrl: () => string): RequestListener;\n start(): Promise;\n stop(): Promise;\n getChecks(): ConformanceCheck[];\n /**\n * Checks recorded so far WITHOUT end-of-flow finalization. Some scenarios'\n * `getChecks()` appends aggregate failures for flow steps never observed\n * (\"expected check missing\"); those judgments are only meaningful when one\n * instance saw the whole flow. Stateless mounting (`/x/...`) judges each\n * request on its own content, so it reads this view when present.\n */\n rawChecks?(): ConformanceCheck[];\n}\n\n/**\n * Convenience: implement `handler()` + `mcpPath` and get `start()`/`stop()`\n * for free. Covers every scenario that just needs one HTTP origin.\n */\nexport abstract class HandlerScenario implements Scenario {\n abstract name: string;\n abstract description: string;\n abstract readonly source: ScenarioSource;\n allowClientError?: boolean;\n mcpPath = '';\n\n private _server: import('http').Server | null = null;\n private _baseUrl = '';\n\n abstract handler(getBaseUrl: () => string): RequestListener;\n abstract getChecks(): ConformanceCheck[];\n\n async start(): Promise {\n const http = await import('node:http');\n const listener = this.handler(() => this._baseUrl);\n return new Promise((resolve, reject) => {\n this._server = http.createServer(listener);\n this._server.on('error', reject);\n this._server.listen(0, () => {\n const addr = this._server!.address();\n if (!addr || typeof addr !== 'object') {\n return reject(new Error('Failed to get server address'));\n }\n this._baseUrl = `http://localhost:${addr.port}`;\n resolve({ serverUrl: `${this._baseUrl}${this.mcpPath}` });\n });\n });\n }\n\n async stop(): Promise {\n if (!this._server) return;\n await new Promise((resolve) => {\n // closeAllConnections so hung SSE streams don't keep the process alive\n this._server!.closeAllConnections?.();\n this._server!.close(() => resolve());\n });\n this._server = null;\n }\n}\n\n/**\n * Named extra origins a multi-origin scenario needs beyond the resource\n * server. `as` is the OAuth authorization server; `as2`/`idp` cover the\n * three-origin scenarios (authorization-server-migration, EMA).\n */\nexport type AuxOriginRole = 'as' | 'as2' | 'idp';\n\nexport interface AuthHandlerContext {\n /** Public URL of the resource-server mount (no trailing slash). */\n getRsBaseUrl: () => string;\n /**\n * Public URL of an aux origin for this run (no trailing slash). When\n * hosted, this is `/r/` so the run-id is recoverable\n * from any path the client constructs from it (RFC 8414 well-known\n * insertion, endpoint paths, etc.).\n */\n getAuxBaseUrl: (role: AuxOriginRole) => string;\n}\n\nexport interface AuthHandlers {\n /** Resource-server handler — serves /mcp and PRM. */\n rs: RequestListener;\n /** Aux-origin handlers keyed by role. */\n aux: Partial>;\n}\n\n/**\n * Convenience: implement `authHandlers()` and get `start()`/`stop()` for\n * free. `start()` binds one ephemeral localhost port per origin, exactly as\n * the auth scenarios did with `ServerLifecycle` before; the hosted runner\n * mounts the same handlers behind path prefixes + an AS relay instead.\n */\nexport abstract class AuthHandlerScenario implements Scenario {\n abstract name: string;\n abstract description: string;\n abstract readonly source: ScenarioSource;\n allowClientError?: boolean;\n mcpPath = '/mcp';\n\n /** Aux origins this scenario needs. Override for 3-origin scenarios. */\n readonly auxRoles: readonly AuxOriginRole[] = ['as'];\n\n private _servers: import('http').Server[] = [];\n private _urls: { rs: string; aux: Partial> } = {\n rs: '',\n aux: {}\n };\n\n abstract authHandlers(ctx: AuthHandlerContext): AuthHandlers;\n abstract getChecks(): ConformanceCheck[];\n\n /** Optional context to pass to the client (credentials etc). */\n protected scenarioContext?(): Record;\n\n async start(): Promise {\n const http = await import('node:http');\n const handlers = this.authHandlers({\n getRsBaseUrl: () => this._urls.rs,\n getAuxBaseUrl: (role) => {\n const u = this._urls.aux[role];\n if (!u) throw new Error(`aux role '${role}' not started`);\n return u;\n }\n });\n\n const listen = (h: RequestListener): Promise =>\n new Promise((resolve, reject) => {\n const srv = http.createServer(h);\n srv.on('error', reject);\n srv.listen(0, () => {\n const addr = srv.address();\n if (!addr || typeof addr !== 'object') {\n return reject(new Error('Failed to get server address'));\n }\n this._servers.push(srv);\n resolve(`http://localhost:${addr.port}`);\n });\n });\n\n // Aux origins must come up first — RS handlers reference their URLs.\n for (const role of this.auxRoles) {\n const h = handlers.aux[role];\n if (!h) throw new Error(`authHandlers() missing aux role '${role}'`);\n this._urls.aux[role] = await listen(h);\n }\n this._urls.rs = await listen(handlers.rs);\n\n return {\n serverUrl: `${this._urls.rs}${this.mcpPath}`,\n ...(this.scenarioContext && { context: this.scenarioContext() })\n };\n }\n\n async stop(): Promise {\n await Promise.all(\n this._servers.map(\n (s) =>\n new Promise((resolve) => {\n s.closeAllConnections?.();\n s.close(() => resolve());\n })\n )\n );\n this._servers = [];\n this._urls = { rs: '', aux: {} };\n }\n}\n\nexport interface ClientScenario {\n name: string;\n description: string;\n source: ScenarioSource;\n run(serverUrl: string): Promise;\n}\n\nexport interface ClientScenarioForAuthorizationServer {\n name: string;\n description: string;\n source: ScenarioSource;\n run(serverUrl: string): Promise;\n}\n",[],[141,237],"c2cff312-5b64-11f1-83e8-ee650bb23af1","request-logger.ts","c2cff3d0-5b64-11f1-83e8-ee650bb23af1","ec547970-9fd6-4c74-ae5e-72dd42f06d81",52,["D",1780062374839],"import { Request, Response, NextFunction } from 'npm:express@^5.1.0';\nimport { ConformanceCheck } from '../types.ts';\n\nexport interface LoggerOptions {\n incomingId: string;\n outgoingId: string;\n mcpRoute?: string;\n}\n\nexport function createRequestLogger(\n checks: ConformanceCheck[],\n options: LoggerOptions\n) {\n return (req: Request, res: Response, next: NextFunction) => {\n // Log incoming request\n let requestDescription = `Received ${req.method} request for ${req.path}`;\n const requestDetails: any = {\n method: req.method,\n path: req.path,\n body: req.body\n };\n\n // Add query parameters to details if they exist\n if (Object.keys(req.query).length > 0) {\n requestDetails.query = req.query;\n }\n\n // Extract MCP method if this is the MCP route\n if (\n options.mcpRoute &&\n req.path === options.mcpRoute &&\n req.get('content-type')?.includes('application/json') &&\n req.body &&\n typeof req.body === 'object' &&\n req.body.method\n ) {\n const mcpMethod = req.body.method;\n requestDescription += ` (method: ${mcpMethod})`;\n requestDetails.mcpMethod = mcpMethod;\n }\n\n checks.push({\n id: options.incomingId,\n name:\n options.incomingId.charAt(0).toUpperCase() +\n options.incomingId.slice(1),\n description: requestDescription,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: requestDetails\n });\n\n // Capture response body\n const oldWrite = res.write.bind(res);\n const oldEnd = res.end.bind(res);\n const chunks: (Buffer | string)[] = [];\n\n (res.write as any) = function (chunk: any, ...args: any[]) {\n chunks.push(chunk);\n return oldWrite(chunk, ...args);\n };\n\n (res.end as any) = function (chunk?: any, ...args: any[]) {\n if (chunk) {\n chunks.push(chunk);\n }\n\n const buffers = chunks.map((c) =>\n typeof c === 'string' ? Buffer.from(c) : c\n );\n const body = Buffer.concat(buffers).toString('utf8');\n let responseDescription = `Sent ${res.statusCode} response for ${req.method} ${req.path}`;\n const responseDetails: any = {\n method: req.method,\n path: req.path,\n statusCode: res.statusCode\n };\n\n // Include MCP method in response log if present\n if (requestDetails.mcpMethod) {\n responseDescription += ` (method: ${requestDetails.mcpMethod})`;\n responseDetails.mcpMethod = requestDetails.mcpMethod;\n }\n\n // Add response headers\n const headers = res.getHeaders();\n if (Object.keys(headers).length > 0) {\n responseDetails.headers = headers;\n }\n\n // Add response body if available\n if (body) {\n try {\n responseDetails.body = JSON.parse(body);\n } catch {\n responseDetails.body = body;\n }\n }\n\n checks.push({\n id: options.outgoingId,\n name:\n options.outgoingId.charAt(0).toUpperCase() +\n options.outgoingId.slice(1),\n description: responseDescription,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: responseDetails\n });\n\n return oldEnd(chunk, ...args);\n };\n\n next();\n };\n}\n",[],[141,254,246],"scenarios","f88f1110-5f4a-11f1-9a3f-1607ee4eb77e","index.ts","b794027c-5b64-11f1-9ce4-ee650bb23af1",84,["D",1780491102727],"import {\n Scenario,\n ClientScenario,\n ClientScenarioForAuthorizationServer,\n ScenarioSource,\n SpecVersion,\n DatedSpecVersion,\n ScenarioSpecTag,\n DATED_SPEC_VERSIONS,\n DRAFT_PROTOCOL_VERSION\n} from '../types.ts';\nimport { InitializeScenario } from './client/initialize.ts';\nimport { ToolsCallScenario } from './client/tools_call.ts';\nimport { StatelessGauntletScenario } from './client/stateless-gauntlet.ts';\nimport { ElicitationClientDefaultsScenario } from './client/elicitation-defaults.ts';\nimport { SSERetryScenario } from './client/sse-retry.ts';\nimport { RequestMetadataScenario } from './client/request-metadata.ts';\nimport { MRTRClientScenario } from './client/mrtr-client.ts';\n\n// Import all new server test scenarios\nimport { ServerInitializeScenario } from './server/lifecycle.ts';\nimport { ServerStatelessScenario } from './server/stateless.ts';\n\nimport {\n PingScenario,\n LoggingSetLevelScenario,\n CompletionCompleteScenario\n} from './server/utils.ts';\n\nimport {\n ToolsListScenario,\n ToolsCallSimpleTextScenario,\n ToolsCallImageScenario,\n ToolsCallMultipleContentTypesScenario,\n ToolsCallWithLoggingScenario,\n ToolsCallErrorScenario,\n ToolsCallWithProgressScenario,\n ToolsCallSamplingScenario,\n ToolsCallElicitationScenario,\n ToolsCallAudioScenario,\n ToolsCallEmbeddedResourceScenario\n} from './server/tools.ts';\n\nimport { JsonSchema2020_12Scenario } from './server/json-schema-2020-12.ts';\n\nimport { ElicitationDefaultsScenario } from './server/elicitation-defaults.ts';\nimport { ElicitationEnumsScenario } from './server/elicitation-enums.ts';\nimport { ServerSSEPollingScenario } from './server/sse-polling.ts';\nimport { ServerSSEMultipleStreamsScenario } from './server/sse-multiple-streams.ts';\n\nimport {\n ResourcesListScenario,\n ResourcesReadTextScenario,\n ResourcesReadBinaryScenario,\n ResourcesTemplateReadScenario,\n ResourcesSubscribeScenario,\n ResourcesUnsubscribeScenario,\n ResourcesNotFoundErrorScenario\n} from './server/resources.ts';\n\nimport {\n PromptsListScenario,\n PromptsGetSimpleScenario,\n PromptsGetWithArgsScenario,\n PromptsGetEmbeddedResourceScenario,\n PromptsGetWithImageScenario\n} from './server/prompts.ts';\n\nimport { DNSRebindingProtectionScenario } from './server/dns-rebinding.ts';\nimport { CachingScenario } from './server/caching.ts';\n\n// InputRequiredResult scenarios from (SEP-2322)\nimport {\n InputRequiredResultBasicElicitationScenario,\n InputRequiredResultBasicSamplingScenario,\n InputRequiredResultBasicListRootsScenario,\n InputRequiredResultRequestStateScenario,\n InputRequiredResultMultipleInputRequestsScenario,\n InputRequiredResultMultiRoundScenario,\n InputRequiredResultMissingInputResponseScenario,\n InputRequiredResultNonToolRequestScenario,\n InputRequiredResultResultTypeScenario,\n InputRequiredResultUnsupportedMethodsScenario,\n InputRequiredResultTamperedStateScenario,\n InputRequiredResultCapabilityCheckScenario,\n InputRequiredResultIgnoreExtraParamsScenario,\n InputRequiredResultValidateInputScenario\n} from './server/input-required-result.ts';\n\nimport {\n HttpHeaderValidationScenario,\n HttpCustomHeaderServerValidationScenario\n} from './server/http-standard-headers.ts';\n\nimport {\n authScenariosList,\n backcompatScenariosList,\n draftScenariosList,\n extensionScenariosList\n} from './client/auth/index.ts';\nimport { listMetadataScenarios } from './client/auth/discovery-metadata.ts';\nimport { AuthorizationServerMetadataEndpointScenario } from './authorization-server/authorization-server-metadata.ts';\n\nimport { HttpStandardHeadersScenario } from './client/http-standard-headers.ts';\nimport {\n HttpCustomHeadersScenario,\n HttpInvalidToolHeadersScenario\n} from './client/http-custom-headers.ts';\nimport { JsonSchemaRefDerefScenario } from './client/json-schema-ref-deref.ts';\n\n// Pending client scenarios (not yet fully tested/implemented)\nconst pendingClientScenariosList: ClientScenario[] = [\n // JSON Schema 2020-12 (SEP-1613)\n // This test is pending until the SDK includes PR #1135 which preserves\n // $schema, $defs, and additionalProperties fields in tool schemas.\n new JsonSchema2020_12Scenario(),\n\n // On hold until server-side SSE improvements are made\n // https://github.com/modelcontextprotocol/typescript-sdk/pull/1129\n new ServerSSEPollingScenario(),\n\n // HTTP Standardization (SEP-2243)\n // Pending until the everything-server fully implements SEP-2243\n // header validation (case-insensitive names, whitespace trimming, -32001 error code)\n new HttpHeaderValidationScenario(),\n new HttpCustomHeaderServerValidationScenario()\n];\n\n// All client scenarios\nconst allClientScenariosList: ClientScenario[] = [\n // Lifecycle scenarios\n new ServerInitializeScenario(),\n new ServerStatelessScenario(),\n\n // Utilities scenarios\n new LoggingSetLevelScenario(),\n new PingScenario(),\n new CompletionCompleteScenario(),\n\n // Tools scenarios\n new ToolsListScenario(),\n new ToolsCallSimpleTextScenario(),\n new ToolsCallImageScenario(),\n new ToolsCallAudioScenario(),\n new ToolsCallEmbeddedResourceScenario(),\n new ToolsCallMultipleContentTypesScenario(),\n new ToolsCallWithLoggingScenario(),\n new ToolsCallErrorScenario(),\n new ToolsCallWithProgressScenario(),\n new ToolsCallSamplingScenario(),\n new ToolsCallElicitationScenario(),\n\n // JSON Schema 2020-12 support (SEP-1613)\n new JsonSchema2020_12Scenario(),\n\n // Elicitation scenarios (SEP-1034)\n new ElicitationDefaultsScenario(),\n\n // SSE Polling scenarios (SEP-1699)\n new ServerSSEPollingScenario(),\n new ServerSSEMultipleStreamsScenario(),\n\n // Elicitation scenarios (SEP-1330) - pending\n new ElicitationEnumsScenario(),\n\n // Resources scenarios\n new ResourcesListScenario(),\n new ResourcesReadTextScenario(),\n new ResourcesReadBinaryScenario(),\n new ResourcesTemplateReadScenario(),\n new ResourcesSubscribeScenario(),\n new ResourcesUnsubscribeScenario(),\n\n // Resources error handling (SEP-2164)\n new ResourcesNotFoundErrorScenario(),\n\n // Prompts scenarios\n new PromptsListScenario(),\n new PromptsGetSimpleScenario(),\n new PromptsGetWithArgsScenario(),\n new PromptsGetEmbeddedResourceScenario(),\n new PromptsGetWithImageScenario(),\n\n // Security scenarios\n new DNSRebindingProtectionScenario(),\n\n // Caching scenarios (SEP-2549)\n new CachingScenario(),\n // HTTP Standardization scenarios (SEP-2243)\n new HttpHeaderValidationScenario(),\n new HttpCustomHeaderServerValidationScenario(),\n\n // InputRequiredResult scenarios (SEP-2322)\n new InputRequiredResultBasicElicitationScenario(),\n new InputRequiredResultBasicSamplingScenario(),\n new InputRequiredResultBasicListRootsScenario(),\n new InputRequiredResultRequestStateScenario(),\n new InputRequiredResultMultipleInputRequestsScenario(),\n new InputRequiredResultMultiRoundScenario(),\n new InputRequiredResultMissingInputResponseScenario(),\n new InputRequiredResultNonToolRequestScenario(),\n new InputRequiredResultResultTypeScenario(),\n new InputRequiredResultUnsupportedMethodsScenario(),\n new InputRequiredResultTamperedStateScenario(),\n new InputRequiredResultCapabilityCheckScenario(),\n new InputRequiredResultIgnoreExtraParamsScenario(),\n new InputRequiredResultValidateInputScenario()\n];\n\n// Scenarios that test requirements introduced in the in-progress draft spec.\n// They run via `--suite draft` (or `--suite all`) and are excluded from the\n// default `active` suite until the draft is published as a dated release.\nconst draftClientScenariosList: ClientScenario[] =\n allClientScenariosList.filter(\n (scenario) =>\n 'introducedIn' in scenario.source &&\n scenario.source.introducedIn === DRAFT_PROTOCOL_VERSION\n );\n\n// Active client scenarios (excludes pending and draft)\nconst activeClientScenariosList: ClientScenario[] =\n allClientScenariosList.filter(\n (scenario) =>\n !pendingClientScenariosList.some(\n (pending) => pending.name === scenario.name\n ) &&\n !draftClientScenariosList.some((draft) => draft.name === scenario.name)\n );\n\n// Client scenarios map - built from list\nexport const clientScenarios = new Map(\n allClientScenariosList.map((scenario) => [scenario.name, scenario])\n);\n\n// All client scenarios for authorization server\nconst allClientScenariosListForAuthorizationServer: ClientScenario[] = [\n // Authorization server scenarios\n new AuthorizationServerMetadataEndpointScenario()\n];\n\n// Client scenarios map for authorization server - built from list\nexport const clientScenariosForAuthorizationServer = new Map<\n string,\n ClientScenario\n>(\n allClientScenariosListForAuthorizationServer.map((scenario) => [\n scenario.name,\n scenario\n ])\n);\n\n// All client test scenarios (core + backcompat + extensions)\nconst scenariosList: Scenario[] = [\n new InitializeScenario(),\n new ToolsCallScenario(),\n new ElicitationClientDefaultsScenario(),\n new SSERetryScenario(),\n new RequestMetadataScenario(),\n ...authScenariosList,\n ...backcompatScenariosList,\n ...draftScenariosList,\n ...extensionScenariosList,\n\n // MRTR client conformance (SEP-2322)\n new MRTRClientScenario(),\n\n // HTTP Standardization scenarios (SEP-2243)\n new HttpStandardHeadersScenario(),\n new HttpCustomHeadersScenario(),\n new HttpInvalidToolHeadersScenario(),\n\n // JSON Schema network $ref dereferencing (SEP-2106)\n new JsonSchemaRefDerefScenario(),\n\n // Stateless gauntlet — single server, validating tools, no run-id needed\n new StatelessGauntletScenario()\n];\n\n// Core scenarios (tier 1 requirements)\nconst coreScenariosList: Scenario[] = [\n new InitializeScenario(),\n new ToolsCallScenario(),\n new ElicitationClientDefaultsScenario(),\n new SSERetryScenario(),\n ...authScenariosList\n];\n\n// Scenarios map - built from list\nexport const scenarios = new Map(\n scenariosList.map((scenario) => [scenario.name, scenario])\n);\n\nexport function registerScenario(name: string, scenario: Scenario): void {\n scenarios.set(name, scenario);\n}\n\nexport function getScenario(name: string): Scenario | undefined {\n return scenarios.get(name);\n}\n\nexport function getClientScenario(name: string): ClientScenario | undefined {\n return clientScenarios.get(name);\n}\n\nexport function getClientScenarioForAuthorizationServer(\n name: string\n): ClientScenarioForAuthorizationServer | undefined {\n return clientScenariosForAuthorizationServer.get(name);\n}\n\nexport function listScenarios(): string[] {\n return Array.from(scenarios.keys());\n}\n\nexport function listClientScenarios(): string[] {\n return Array.from(clientScenarios.keys());\n}\n\nexport function listActiveClientScenarios(): string[] {\n return activeClientScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listPendingClientScenarios(): string[] {\n return pendingClientScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listAuthScenarios(): string[] {\n return authScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listCoreScenarios(): string[] {\n return coreScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listExtensionScenarios(): string[] {\n return extensionScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listBackcompatScenarios(): string[] {\n return backcompatScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listClientScenariosForAuthorizationServer(): string[] {\n return Array.from(clientScenariosForAuthorizationServer.keys());\n}\n\n// All client-testing scenarios that target the draft spec, derived from the\n// declared `source.introducedIn` rather than a hand-maintained list (covers\n// both the auth draft scenarios and the non-auth ones, e.g. SEP-2243/2575).\nconst draftSpecScenariosList: Scenario[] = scenariosList.filter(\n (scenario) =>\n 'introducedIn' in scenario.source &&\n scenario.source.introducedIn === DRAFT_PROTOCOL_VERSION\n);\n\nexport function listDraftScenarios(): string[] {\n return draftSpecScenariosList.map((scenario) => scenario.name);\n}\n\nexport function listDraftClientScenarios(): string[] {\n return draftClientScenariosList.map((scenario) => scenario.name);\n}\n\nexport { listMetadataScenarios };\n\n// All valid spec versions, used by the CLI to validate --spec-version input.\n// 'extension' is intentionally excluded — extension scenarios are off-timeline\n// and selected via `--suite extensions`, not `--spec-version`.\nexport const ALL_SPEC_VERSIONS: SpecVersion[] = [\n ...DATED_SPEC_VERSIONS,\n DRAFT_PROTOCOL_VERSION\n];\n\nexport function resolveSpecVersion(value: string): SpecVersion {\n if (value === 'draft') return DRAFT_PROTOCOL_VERSION;\n if (ALL_SPEC_VERSIONS.includes(value as SpecVersion)) {\n return value as SpecVersion;\n }\n console.error(`Unknown spec version: ${value}`);\n console.error(\n `Valid versions: ${ALL_SPEC_VERSIONS.join(', ')} (or 'draft' as an alias for ${DRAFT_PROTOCOL_VERSION})`\n );\n process.exit(1);\n}\n\nfunction versionIndex(\n v: DatedSpecVersion | typeof DRAFT_PROTOCOL_VERSION\n): number {\n return ALL_SPEC_VERSIONS.indexOf(v);\n}\n\n// Off-timeline sources (extensions etc.) are never selected by --spec-version.\nfunction matchesSpecVersion(\n source: ScenarioSource,\n version: SpecVersion\n): boolean {\n if ('extensionId' in source) return false;\n return (\n versionIndex(source.introducedIn) <= versionIndex(version) &&\n (source.removedIn === undefined ||\n versionIndex(version) < versionIndex(source.removedIn))\n );\n}\n\nexport function listScenariosForSpec(version: SpecVersion): string[] {\n return scenariosList\n .filter((s) => matchesSpecVersion(s.source, version))\n .map((s) => s.name);\n}\n\nexport function listClientScenariosForSpec(version: SpecVersion): string[] {\n return allClientScenariosList\n .filter((s) => matchesSpecVersion(s.source, version))\n .map((s) => s.name);\n}\n\nexport function listClientScenariosForAuthorizationServerForSpec(\n version: SpecVersion\n): string[] {\n return allClientScenariosListForAuthorizationServer\n .filter((s) => matchesSpecVersion(s.source, version))\n .map((s) => s.name);\n}\n\nexport function getScenarioSpecVersions(\n name: string\n): ScenarioSpecTag[] | undefined {\n const s =\n scenarios.get(name) ??\n clientScenarios.get(name) ??\n clientScenariosForAuthorizationServer.get(name);\n if (!s) return undefined;\n if ('extensionId' in s.source) return ['extension'];\n const result: ScenarioSpecTag[] = [];\n for (const v of ALL_SPEC_VERSIONS) {\n if (matchesSpecVersion(s.source, v)) result.push(v);\n }\n return result;\n}\n\nexport type { SpecVersion, ScenarioSpecTag };\n",[],[141,254,256],"bc24e70c-5b64-11f1-a759-ee650bb23af1","utils.ts","bc24e7a2-5b64-11f1-a759-ee650bb23af1","39bcecba-59ca-438c-8d5d-c30bd3bd5cb2",25,["D",1780062363647],"/**\n * Utilities test scenarios for MCP servers\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../types.ts';\nimport { connectToServer } from './client-helper.ts';\n\nexport class LoggingSetLevelScenario implements ClientScenario {\n name = 'logging-set-level';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test setting logging level.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`logging/setLevel\\`\n\n**Requirements**:\n- Accept log level setting\n- Filter subsequent log notifications based on level\n- Return empty object \\`{}\\`\n\n**Log Levels** (in order of severity):\n- \\`debug\\`\n- \\`info\\`\n- \\`notice\\`\n- \\`warning\\`\n- \\`error\\`\n- \\`critical\\`\n- \\`alert\\`\n- \\`emergency\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n // Send logging/setLevel request\n const result = await connection.client.setLoggingLevel('info');\n\n // Validate response (should return empty object {})\n const errors: string[] = [];\n if (result && Object.keys(result).length > 0) {\n errors.push('Expected empty object {} response');\n }\n\n checks.push({\n id: 'logging-set-level',\n name: 'LoggingSetLevel',\n description: 'Server accepts logging level setting',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Logging',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/logging'\n }\n ],\n details: {\n result\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'logging-set-level',\n name: 'LoggingSetLevel',\n description: 'Server accepts logging level setting',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Logging',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/logging'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class PingScenario implements ClientScenario {\n name = 'ping';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test ping utility for connection health check.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`ping\\`\n\n**Requirements**:\n- Accept ping request with no parameters\n- Respond promptly with empty object \\`{}\\`\n\n**Request Format**:\n\n\\`\\`\\`json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": \"123\",\n \"method\": \"ping\"\n}\n\\`\\`\\`\n\n**Response Format**:\n\n\\`\\`\\`json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": \"123\",\n \"result\": {}\n}\n\\`\\`\\`\n\n**Implementation Note**: The ping utility allows either party to verify that their counterpart is still responsive and the connection is alive.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n // Send ping request\n const result = await connection.client.ping();\n\n // Validate response (should return empty object {})\n const errors: string[] = [];\n if (result && Object.keys(result).length > 0) {\n errors.push('Expected empty object {} response');\n }\n\n checks.push({\n id: 'ping',\n name: 'Ping',\n description: 'Server responds to ping requests',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Ping',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/ping'\n }\n ],\n details: {\n result\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'ping',\n name: 'Ping',\n description: 'Server responds to ping requests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Ping',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/ping'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class CompletionCompleteScenario implements ClientScenario {\n name = 'completion-complete';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test completion endpoint.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`completion/complete\\`\n\n**Requirements**:\n- Accept completion requests for prompt or resource template arguments\n- Provide contextual suggestions based on partial input\n- Return array of completion values ranked by relevance\n\n**Request Format**:\n\n\\`\\`\\`json\n{\n \"method\": \"completion/complete\",\n \"params\": {\n \"ref\": {\n \"type\": \"ref/prompt\",\n \"name\": \"test_prompt_with_arguments\"\n },\n \"argument\": {\n \"name\": \"arg1\",\n \"value\": \"par\"\n }\n }\n}\n\\`\\`\\`\n\n**Response Format**:\n\n\\`\\`\\`json\n{\n \"completion\": {\n \"values\": [\"paris\", \"park\", \"party\"],\n \"total\": 150,\n \"hasMore\": false\n }\n}\n\\`\\`\\`\n\n**Implementation Note**: For conformance testing, completion support can be minimal or return empty arrays. The capability just needs to be declared and the endpoint must respond correctly.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n // Send completion/complete request\n const result = await connection.client.complete({\n ref: {\n type: 'ref/prompt',\n name: 'test_prompt_with_arguments'\n },\n argument: {\n name: 'arg1',\n value: 'test'\n }\n });\n\n // Validate response structure\n const errors: string[] = [];\n if (!result.completion) {\n errors.push('Missing completion field');\n } else {\n if (!result.completion.values)\n errors.push('Missing values array in completion');\n if (!Array.isArray(result.completion.values))\n errors.push('completion.values is not an array');\n }\n\n checks.push({\n id: 'completion-complete',\n name: 'CompletionComplete',\n description: 'Server responds to completion requests',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Completion',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/completion'\n }\n ],\n details: {\n result\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'completion-complete',\n name: 'CompletionComplete',\n description: 'Server responds to completion requests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Completion',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/completion'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[141,254,272,264],"server","bbe9e134-5b64-11f1-b618-ee650bb23af1","tools.ts","bbe9e1e8-5b64-11f1-b618-ee650bb23af1",24,["D",1780062363264],"/**\n * Tools test scenarios for MCP servers\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../types.ts';\nimport { connectToServer, NotificationCollector } from './client-helper.ts';\nimport {\n CallToolResultSchema,\n CreateMessageRequestSchema,\n ElicitRequestSchema,\n Progress\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\n\nconst TOOL_NAME_PATTERN = /^[A-Za-z0-9_./-]+$/;\nconst TOOL_NAME_MAX_LENGTH = 64;\n\nconst TOOLS_NAME_FORMAT_SPEC_REFS = [\n {\n id: 'MCP-Tools-List',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/server/tools#listing-tools'\n },\n {\n id: 'SEP-986',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/server/tools#tool-names'\n }\n];\n\nexport function validateToolNameFormat(name: string): string | null {\n if (name.length < 1 || name.length > TOOL_NAME_MAX_LENGTH) {\n return `length ${name.length} is outside 1-${TOOL_NAME_MAX_LENGTH}`;\n }\n if (!TOOL_NAME_PATTERN.test(name)) {\n return 'contains characters outside [A-Za-z0-9_./-]';\n }\n return null;\n}\n\nexport function buildToolsNameFormatCheck(\n tools: ReadonlyArray<{ name?: unknown }> | undefined\n): ConformanceCheck {\n const timestamp = new Date().toISOString();\n const baseCheck = {\n id: 'tools-name-format',\n name: 'ToolsNameFormat',\n description: 'Tool names are 1-64 characters and match ^[A-Za-z0-9_./-]+$',\n specReferences: TOOLS_NAME_FORMAT_SPEC_REFS,\n timestamp\n };\n\n if (!Array.isArray(tools) || tools.length === 0) {\n return {\n ...baseCheck,\n status: 'INFO',\n errorMessage: 'No tools advertised; nothing to validate',\n details: { toolCount: 0 }\n };\n }\n\n const toolResults: Record = {};\n const violations: string[] = [];\n\n tools.forEach((tool, index) => {\n const name = typeof tool.name === 'string' ? tool.name : '';\n const key = name || ``;\n const reason =\n typeof tool.name === 'string'\n ? validateToolNameFormat(tool.name)\n : 'name is not a string';\n if (reason) {\n toolResults[key] = `invalid: ${reason}`;\n violations.push(`${key}: ${reason}`);\n } else {\n toolResults[key] = 'valid';\n }\n });\n\n return {\n ...baseCheck,\n status: violations.length === 0 ? 'SUCCESS' : 'FAILURE',\n errorMessage:\n violations.length > 0\n ? `${violations.length} tool name(s) violate SEP-986 format: ${violations.join('; ')}`\n : undefined,\n details: {\n toolCount: tools.length,\n results: toolResults\n }\n };\n}\n\nexport class ToolsListScenario implements ClientScenario {\n name = 'tools-list';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test listing available tools.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`tools/list\\`\n\n**Requirements**:\n- Return array of all available tools\n- Each tool MUST have:\n - \\`name\\` (string, 1-64 chars, matching \\`^[A-Za-z0-9_./-]+$\\`)\n - \\`description\\` (string)\n - \\`inputSchema\\` (valid JSON Schema object)`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.listTools();\n\n // Validate response structure\n const errors: string[] = [];\n if (!result.tools) {\n errors.push('Missing tools array');\n } else {\n if (!Array.isArray(result.tools)) {\n errors.push('tools is not an array');\n }\n\n result.tools.forEach((tool, index) => {\n if (!tool.name) errors.push(`Tool ${index}: missing name`);\n if (!tool.description)\n errors.push(`Tool ${index}: missing description`);\n if (!tool.inputSchema)\n errors.push(`Tool ${index}: missing inputSchema`);\n });\n }\n\n checks.push({\n id: 'tools-list',\n name: 'ToolsList',\n description: 'Server lists available tools with valid structure',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#listing-tools'\n }\n ],\n details: {\n toolCount: result.tools?.length || 0,\n tools: result.tools?.map((t) => t.name)\n }\n });\n\n // Validate tool name format per SEP-986:\n // names MUST be 1-64 chars matching ^[A-Za-z0-9_./-]+$\n checks.push(buildToolsNameFormatCheck(result.tools));\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-list',\n name: 'ToolsList',\n description: 'Server lists available tools with valid structure',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#listing-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallSimpleTextScenario implements ClientScenario {\n name = 'tools-call-simple-text';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test calling a tool that returns simple text.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_simple_text\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"This is a simple text response for testing.\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.callTool({\n name: 'test_simple_text'\n /* omit arguments as it is not required in the schema */\n });\n\n // Validate response\n const errors: string[] = [];\n const content = (result as any).content;\n if (!content) errors.push('Missing content array');\n if (!Array.isArray(content)) errors.push('content is not an array');\n if (content && content.length === 0)\n errors.push('content array is empty');\n\n const textContent =\n content && content.find((c: any) => c.type === 'text');\n if (!textContent) errors.push('No text content found');\n if (textContent && !textContent.text)\n errors.push('Text content missing text field');\n\n checks.push({\n id: 'tools-call-simple-text',\n name: 'ToolsCallSimpleText',\n description: 'Tool returns simple text content',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ],\n details: {\n result\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-simple-text',\n name: 'ToolsCallSimpleText',\n description: 'Tool returns simple text content',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallImageScenario implements ClientScenario {\n name = 'tools-call-image';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test calling a tool that returns image content.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_image_content\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"image\",\n \"data\": \"\",\n \"mimeType\": \"image/png\"\n }\n ]\n}\n\\`\\`\\`\n\n**Implementation Note**: Use a minimal test image (e.g., 1x1 red pixel PNG)`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.callTool({\n name: 'test_image_content',\n arguments: {}\n });\n\n // Validate response\n const errors: string[] = [];\n const content = (result as any).content;\n if (!content) errors.push('Missing content array');\n\n const imageContent =\n content && content.find((c: any) => c.type === 'image');\n if (!imageContent) errors.push('No image content found');\n if (imageContent && !imageContent.data)\n errors.push('Image content missing data field');\n if (imageContent && !imageContent.mimeType)\n errors.push('Image content missing mimeType');\n\n checks.push({\n id: 'tools-call-image',\n name: 'ToolsCallImage',\n description: 'Tool returns image content',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ],\n details: {\n mimeType: imageContent?.mimeType,\n hasData: !!imageContent?.data\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-image',\n name: 'ToolsCallImage',\n description: 'Tool returns image content',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallMultipleContentTypesScenario implements ClientScenario {\n name = 'tools-call-mixed-content';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test tool returning multiple content types.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_multiple_content_types\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"Multiple content types test:\"\n },\n {\n \"type\": \"image\",\n \"data\": \"\",\n \"mimeType\": \"image/png\"\n },\n {\n \"type\": \"resource\",\n \"resource\": {\n \"uri\": \"test://mixed-content-resource\",\n \"mimeType\": \"application/json\",\n \"text\": \"{\"test\":\"data\",\"value\":123}\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.callTool({\n name: 'test_multiple_content_types',\n arguments: {}\n });\n\n // Validate response\n const errors: string[] = [];\n const content = (result as any).content;\n if (!content) errors.push('Missing content array');\n if (content && content.length < 2)\n errors.push('Expected multiple content items');\n\n const hasText = content && content.some((c: any) => c.type === 'text');\n const hasImage = content && content.some((c: any) => c.type === 'image');\n const hasResource =\n content && content.some((c: any) => c.type === 'resource');\n\n if (!hasText) errors.push('Missing text content');\n if (!hasImage) errors.push('Missing image content');\n if (!hasResource) errors.push('Missing resource content');\n\n checks.push({\n id: 'tools-call-mixed-content',\n name: 'ToolsCallMixedContent',\n description: 'Tool returns multiple content types',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ],\n details: {\n contentCount: content ? content.length : 0,\n contentTypes: content ? content.map((c: any) => c.type) : []\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-mixed-content',\n name: 'ToolsCallMixedContent',\n description: 'Tool returns multiple content types',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallWithLoggingScenario implements ClientScenario {\n name = 'tools-call-with-logging';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test tool that sends log messages during execution.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_tool_with_logging\\` with no arguments.\n\n**Behavior**: During execution, send 3 log notifications at info level:\n1. \"Tool execution started\"\n2. \"Tool processing data\" (after ~50ms delay)\n3. \"Tool execution completed\" (after another ~50ms delay)\n\n**Returns**: Text content confirming execution\n\n**Implementation Note**: The delays are important to test that clients can receive multiple log notifications during tool execution`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n const notifications = new NotificationCollector(connection.client);\n\n // Set logging level to debug\n await connection.client.setLoggingLevel('debug');\n\n await connection.client.callTool({\n name: 'test_tool_with_logging',\n arguments: {}\n });\n\n // Wait a bit for notifications to arrive\n await new Promise((resolve) => setTimeout(resolve, 200));\n\n // Check for log notifications from the NotificationCollector\n const logNotifications = notifications.getNotifications();\n\n const errors: string[] = [];\n if (logNotifications.length === 0) {\n errors.push('No log notifications received');\n } else if (logNotifications.length < 3) {\n errors.push(\n `Expected at least 3 log messages, got ${logNotifications.length}`\n );\n }\n\n checks.push({\n id: 'tools-call-with-logging',\n name: 'ToolsCallWithLogging',\n description: 'Tool sends log messages during execution',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Logging',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/logging'\n }\n ],\n details: {\n logCount: logNotifications.length,\n logs: logNotifications.map((n: any) => n.params)\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-with-logging',\n name: 'ToolsCallWithLogging',\n description: 'Tool sends log messages during execution',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Logging',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/logging'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallErrorScenario implements ClientScenario {\n name = 'tools-call-error';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test tool error reporting.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_error_handling\\` with no arguments.\n\n**Behavior**: Always throw an error\n\n**Returns**: JSON-RPC response with \\`isError: true\\`\n\n\\`\\`\\`json\n{\n \"isError\": true,\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"This tool intentionally returns an error for testing\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result: any = await connection.client.callTool({\n name: 'test_error_handling',\n arguments: {}\n });\n\n // Check if result has isError flag\n const hasIsError = result.isError === true;\n const hasContent = result.content && result.content.length > 0;\n const hasErrorMessage = hasContent && result.content[0].text;\n\n checks.push({\n id: 'tools-call-error',\n name: 'ToolsCallError',\n description: 'Tool returns error correctly',\n status: hasIsError && hasErrorMessage ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: !hasIsError\n ? 'Tool did not return isError: true'\n : !hasErrorMessage\n ? 'Error result missing error message'\n : undefined,\n specReferences: [\n {\n id: 'MCP-Error-Handling',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle'\n }\n ],\n details: {\n result\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-error',\n name: 'ToolsCallError',\n description: 'Tool returns error correctly',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Error-Handling',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallWithProgressScenario implements ClientScenario {\n name = 'tools-call-with-progress';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test tool that reports progress notifications.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_tool_with_progress\\` with no arguments.\n\n**Behavior**: If \\`_meta.progressToken\\` is provided in request:\n- Send progress notification: \\`0/100\\`\n- Wait ~50ms\n- Send progress notification: \\`50/100\\`\n- Wait ~50ms\n- Send progress notification: \\`100/100\\`\n\nIf no progress token provided, just execute with delays.\n\n**Returns**: Text content confirming execution\n\n**Progress Notification Format**:\n\n\\`\\`\\`json\n{\n \"method\": \"notifications/progress\",\n \"params\": {\n \"progressToken\": \"\",\n \"progress\": 50,\n \"total\": 100\n }\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n const progressUpdates: Array = [];\n // TODO: investigate why await connection.client.callTool didn't work for progress.\n const result = await connection.client.request(\n {\n method: 'tools/call',\n params: {\n name: 'test_tool_with_progress',\n arguments: {},\n _meta: {\n progressToken: 'progress-test-1'\n }\n }\n },\n CallToolResultSchema,\n {\n onprogress: (progress) => {\n progressUpdates.push(progress);\n }\n }\n );\n\n const errors: string[] = [];\n if (progressUpdates.length === 0) {\n errors.push('No progress notifications received');\n } else if (progressUpdates.length < 3) {\n errors.push(\n `Expected at least 3 progress notifications, got ${progressUpdates.length}`\n );\n }\n\n if (progressUpdates.length >= 3) {\n const progress0 = progressUpdates[0].progress;\n const progress1 = progressUpdates[1].progress;\n const progress2 = progressUpdates[2].progress;\n\n if (!(progress0 <= progress1 && progress1 <= progress2)) {\n errors.push('Progress values should be increasing');\n }\n }\n\n checks.push({\n id: 'tools-call-with-progress',\n name: 'ToolsCallWithProgress',\n description: 'Tool reports progress notifications',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Progress',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/progress'\n }\n ],\n details: {\n progressCount: progressUpdates.length,\n progressNotifications: progressUpdates.map((n: Progress) => n),\n result\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-with-progress',\n name: 'ToolsCallWithProgress',\n description: 'Tool reports progress notifications',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Progress',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/progress'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallSamplingScenario implements ClientScenario {\n name = 'tools-call-sampling';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test tool that requests LLM sampling from client.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_sampling\\` with argument:\n- \\`prompt\\` (string, required) - The prompt to send to the LLM\n\n**Behavior**: Request LLM sampling from the client using \\`sampling/createMessage\\`\n\n**Sampling Request**:\n\n\\`\\`\\`json\n{\n \"method\": \"sampling/createMessage\",\n \"params\": {\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"text\",\n \"text\": \"\"\n }\n }\n ],\n \"maxTokens\": 100\n }\n}\n\\`\\`\\`\n\n**Returns**: Text content with the LLM's response\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"LLM response: \"\n }\n ]\n}\n\\`\\`\\`\n\n**Implementation Note**: If the client doesn't support sampling (no \\`sampling\\` capability), return an error.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n let samplingRequested = false;\n connection.client.setRequestHandler(\n CreateMessageRequestSchema,\n async (_request) => {\n samplingRequested = true;\n return {\n role: 'assistant',\n content: {\n type: 'text',\n text: 'This is a test response from the client'\n },\n model: 'test-model',\n stopReason: 'endTurn'\n };\n }\n );\n\n const result = await connection.client.callTool({\n name: 'test_sampling',\n arguments: {\n prompt: 'Test prompt for sampling'\n }\n });\n\n const errors: string[] = [];\n if (!samplingRequested) {\n errors.push('Server did not request sampling from client');\n }\n\n const content = (result as any).content;\n if (!content || content.length === 0) {\n errors.push('Tool did not return content');\n }\n\n checks.push({\n id: 'tools-call-sampling',\n name: 'ToolsCallSampling',\n description: 'Tool requests LLM sampling from client',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Sampling',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/sampling'\n }\n ],\n details: {\n samplingRequested,\n result\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-sampling',\n name: 'ToolsCallSampling',\n description: 'Tool requests LLM sampling from client',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Sampling',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/sampling'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallElicitationScenario implements ClientScenario {\n name = 'tools-call-elicitation';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test tool that requests user input (elicitation) from client.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_elicitation\\` with argument:\n- \\`message\\` (string, required) - The message to show the user\n\n**Behavior**: Request user input from the client using \\`elicitation/create\\`\n\n**Elicitation Request**:\n\n\\`\\`\\`json\n{\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": {\n \"username\": {\n \"type\": \"string\",\n \"description\": \"User's response\"\n },\n \"email\": {\n \"type\": \"string\",\n \"description\": \"User's email address\"\n }\n },\n \"required\": [\"username\", \"email\"]\n }\n }\n}\n\\`\\`\\`\n\n**Returns**: Text content with the user's response\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"User response: \"\n }\n ]\n}\n\\`\\`\\`\n\n**Implementation Note**: If the client doesn't support elicitation (no \\`elicitation\\` capability), return an error.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n let elicitationRequested = false;\n connection.client.setRequestHandler(\n ElicitRequestSchema,\n async (_request) => {\n elicitationRequested = true;\n return {\n action: 'accept',\n content: {\n username: 'testuser',\n email: 'test@example.com'\n }\n };\n }\n );\n\n const result = await connection.client.callTool({\n name: 'test_elicitation',\n arguments: {\n message: 'Please provide your information'\n }\n });\n\n const errors: string[] = [];\n if (!elicitationRequested) {\n errors.push('Server did not request elicitation from client');\n }\n\n const content = (result as any).content;\n if (!content || content.length === 0) {\n errors.push('Tool did not return content');\n }\n\n checks.push({\n id: 'tools-call-elicitation',\n name: 'ToolsCallElicitation',\n description: 'Tool requests user input from client',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Elicitation',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/elicitation'\n }\n ],\n details: {\n elicitationRequested,\n result\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-elicitation',\n name: 'ToolsCallElicitation',\n description: 'Tool requests user input from client',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Elicitation',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/elicitation'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallAudioScenario implements ClientScenario {\n name = 'tools-call-audio';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test calling a tool that returns audio content.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_audio_content\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"audio\",\n \"data\": \"\",\n \"mimeType\": \"audio/wav\"\n }\n ]\n}\n\\`\\`\\`\n\n**Implementation Note**: Use a minimal test audio file`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.callTool({\n name: 'test_audio_content',\n arguments: {}\n });\n\n // Validate response\n const errors: string[] = [];\n const content = (result as any).content;\n if (!content) errors.push('Missing content array');\n if (!Array.isArray(content)) errors.push('content is not an array');\n if (content && content.length === 0)\n errors.push('content array is empty');\n\n const audioContent =\n content && content.find((c: any) => c.type === 'audio');\n if (!audioContent) errors.push('No audio content found');\n if (audioContent && !audioContent.data)\n errors.push('Audio content missing data field');\n if (audioContent && !audioContent.mimeType)\n errors.push('Audio content missing mimeType field');\n if (audioContent && audioContent.mimeType !== 'audio/wav')\n errors.push(\n `Expected mimeType 'audio/wav', got '${audioContent.mimeType}'`\n );\n\n checks.push({\n id: 'tools-call-audio',\n name: 'ToolsCallAudio',\n description: 'Tool returns audio content',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ],\n details: {\n hasAudioContent: !!audioContent,\n audioDataLength: audioContent?.data?.length || 0\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-audio',\n name: 'ToolsCallAudio',\n description: 'Tool returns audio content',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ToolsCallEmbeddedResourceScenario implements ClientScenario {\n name = 'tools-call-embedded-resource';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test calling a tool that returns embedded resource content.\n\n**Server Implementation Requirements:**\n\nImplement tool \\`test_embedded_resource\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"resource\",\n \"resource\": {\n \"uri\": \"test://embedded-resource\",\n \"mimeType\": \"text/plain\",\n \"text\": \"This is an embedded resource content.\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.callTool({\n name: 'test_embedded_resource',\n arguments: {}\n });\n\n // Validate response\n const errors: string[] = [];\n const content = (result as any).content;\n if (!content) errors.push('Missing content array');\n if (!Array.isArray(content)) errors.push('content is not an array');\n if (content && content.length === 0)\n errors.push('content array is empty');\n\n const resourceContent =\n content && content.find((c: any) => c.type === 'resource');\n if (!resourceContent) errors.push('No resource content found');\n if (resourceContent && !resourceContent.resource)\n errors.push('Resource content missing resource field');\n if (resourceContent?.resource) {\n if (!resourceContent.resource.uri)\n errors.push('Resource missing uri field');\n if (!resourceContent.resource.mimeType)\n errors.push('Resource missing mimeType field');\n if (!resourceContent.resource.text && !resourceContent.resource.blob) {\n errors.push('Resource missing both text and blob fields');\n }\n }\n\n checks.push({\n id: 'tools-call-embedded-resource',\n name: 'ToolsCallEmbeddedResource',\n description: 'Tool returns embedded resource content',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ],\n details: {\n hasResourceContent: !!resourceContent,\n resourceUri: resourceContent?.resource?.uri\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'tools-call-embedded-resource',\n name: 'ToolsCallEmbeddedResource',\n description: 'Tool returns embedded resource content',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Tools-Call',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[141,254,272,274],"bc7e4234-5b64-11f1-9c4b-ee650bb23af1","stateless.ts","bc7e4392-5b64-11f1-9c4b-ee650bb23af1",26,["D",1780062364232],"/**\n * Stateless MCP test scenarios for MCP servers (SEP-2575)\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport {\n buildStandardHeaders,\n readSseJsonRpcResponse\n} from './stateless-client.ts';\n\nconst SPEC_REF = [\n {\n id: 'SEP-2575',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2575'\n }\n];\n\nexport class ServerStatelessScenario implements ClientScenario {\n name = 'server-stateless';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test stateless MCP server architecture (SEP-2575).\n\n**Server Implementation Requirements:**\n\n**Endpoints**:\n- \\`server/discover\\`: Returns supportedVersions, capabilities, and serverInfo metadata.\n- \\`tools/call\\`: Implement structural test tools like \\`test_missing_capability\\` requiring explicit capabilities in \\`_meta\\`.\n\n**Grouped Specification Requirements**:\n\n1. **Per-Request _meta Validation (4 Checks)**\n - Rejects requests missing \\`_meta\\` or lacking structural required internal subfields (\\`protocolVersion\\`, \\`clientInfo\\`, \\`clientCapabilities\\`) with a JSON-RPC \\`-32602 Invalid params\\` error signature.\n2. **Discovery & Capabilities (3 Checks)**\n - Implements \\`server/discover\\` mapping exact mandatory protocol elements.\n - Dynamically checks prompt capability declaration constraints, validates that active RPC handlers match advertised discovery capacities.\n3. **Version Negotiation & Headers (3 Checks)**\n - Mismatched or unknown protocol versions must return an \\`UnsupportedProtocolVersionError\\` (HTTP status code \\`400 Bad Request\\`) carrying precise version tracking arrays.\n - Absent or altered protocol version header metadata must trigger a \\`-32001 Header Mismatch\\` error with an HTTP 400 boundary state.\n4. **Client Capability Constraints (2 Checks)**\n - Accessing platform capabilities without explicit declaration drops requests with a \\`-32003 MissingRequiredClientCapabilityError\\` containing needed capabilities, returning an HTTP status code \\`400 Bad Request\\`.\n5. **Methods & Routing Mechanics (5 Checks)**\n - Removed legacy endpoints (\\`initialize\\`, \\`ping\\`, \\`logging/setLevel\\`, etc.) or generic unknown methods must cleanly yield an HTTP status code \\`404 Not Found\\` alongside a JSON-RPC \\`-32601 Method not found\\` payload. All error returns must preserve original request ID mappings.\n - Validates response streams contain only \\`IncompleteResult\\` chunks and never independent top-level JSON-RPC requests, while enforcing that no log messages are emitted when \\`_meta.../logLevel\\` is omitted.\n6. **Subscription Streams & Filtering (3 Checks)**\n - Mandates that \\`notifications/subscriptions/acknowledged\\` is the first message on a \\`subscriptions/listen\\` stream, and that subsequent notifications carry a matching \\`_meta.../subscriptionId\\`.\n - Verifies strict containment where servers do not dispatch notification types that fall outside the client's explicit requested subscription filter list.\n7. **Dynamic List Mutations (2 Checks)**\n - Evaluates that list-changed capable servers notify active listen streams with \\`promptsListChanged: true\\` or \\`toolsListChanged: true\\` upon live configuration or capability modifications. `;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n const timestamp = new Date().toISOString();\n\n // Executes a validation rule and pushes the structural result metadata.\n async function runCheck(\n id: string,\n name: string,\n description: string,\n fn: () =>\n | Promise<{\n error?: string;\n warning?: boolean;\n skipped?: boolean;\n details?: any;\n } | void>\n | ({\n error?: string;\n warning?: boolean;\n skipped?: boolean;\n details?: any;\n } | void),\n fallbackDetails = {}\n ) {\n try {\n const result = await fn();\n const errorMessage = result?.error;\n // SHOULD-level requirements report WARNING rather than FAILURE\n // (severity follows the spec keyword).\n const status = errorMessage\n ? result?.warning\n ? 'WARNING'\n : 'FAILURE'\n : result?.skipped\n ? 'SKIPPED'\n : 'SUCCESS';\n\n checks.push({\n id,\n name,\n description,\n status,\n timestamp,\n errorMessage: errorMessage || undefined,\n specReferences: SPEC_REF,\n details: result?.details || fallbackDetails\n });\n } catch (e) {\n checks.push({\n id,\n name,\n description,\n status: 'FAILURE',\n timestamp,\n errorMessage: String(e),\n specReferences: SPEC_REF,\n details: fallbackDetails\n });\n }\n }\n\n // Helper to send raw RPC requests via fetch\n const sendRpc = async (\n method: string,\n params?: any,\n headersOverrides?: Record,\n id: string | number | null = 1\n ) => {\n // The cross-cutting SEP-2243 headers (Mcp-Method, Mcp-Name, Accept,\n // MCP-Protocol-Version) are not what this scenario exercises, so they\n // are always sent conformantly; overrides only alter the dimension a\n // test case is about (issue #312).\n const headers = buildStandardHeaders(method, params, {\n headers: headersOverrides\n });\n\n const body = JSON.stringify({\n jsonrpc: '2.0',\n id,\n method,\n ...(params !== undefined ? { params } : {})\n });\n\n const res = await fetch(serverUrl, { method: 'POST', headers, body });\n let data: any = null;\n // Servers may answer single requests over text/event-stream; pick the\n // JSON-RPC message matching this request id instead of failing to parse\n // the stream as JSON.\n const contentType =\n typeof res.headers?.get === 'function'\n ? (res.headers.get('content-type') ?? '')\n : '';\n if (contentType.includes('text/event-stream')) {\n const { body: matched } = await readSseJsonRpcResponse(res, id);\n data = matched ?? null;\n } else {\n try {\n data = await res.json();\n } catch {\n // Response might not be JSON\n }\n }\n return { res, data };\n };\n\n // Helper to read multi-frame streaming endpoints (like subscriptions/listen).\n // `onFirstFrame` runs once after the first frame arrives (i.e. after the\n // server has acknowledged the subscription) so callers can trigger\n // side effects on a separate connection while this stream is still open.\n const listenToStream = async (\n method: string,\n params?: any,\n maxFrames = 3,\n timeoutMs = 1000,\n onFirstFrame?: () => Promise\n ): Promise => {\n const headers = buildStandardHeaders(method, params);\n\n const body = JSON.stringify({\n jsonrpc: '2.0',\n id: Date.now(),\n method,\n ...(params !== undefined ? { params } : {})\n });\n\n const controller = new AbortController();\n const timeoutId = setTimeout(() => {\n controller.abort();\n }, timeoutMs);\n\n try {\n const res = await fetch(serverUrl, {\n method: 'POST',\n headers,\n body,\n signal: controller.signal\n });\n\n if (!res.body) {\n clearTimeout(timeoutId);\n return [];\n }\n\n const reader = res.body.getReader();\n const decoder = new TextDecoder();\n const frames: any[] = [];\n let buffer = '';\n let firstFrameCallbackFired = false;\n const maybeFireFirstFrameCallback = async () => {\n if (firstFrameCallbackFired || frames.length === 0 || !onFirstFrame)\n return;\n firstFrameCallbackFired = true;\n try {\n await onFirstFrame();\n } catch {\n // The trigger failed; the caller inspects its own captured result.\n }\n };\n\n try {\n while (frames.length < maxFrames) {\n let value: Uint8Array | undefined;\n let done = false;\n try {\n ({ value, done } = await reader.read());\n } catch {\n // The stream was aborted (timeout) or dropped. A compliant\n // server holds a subscriptions/listen stream open indefinitely,\n // so hitting the timeout is the normal way these reads end —\n // return whatever frames arrived before it fired.\n break;\n }\n\n if (value) {\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(/\\r?\\n/);\n buffer = lines.pop() || '';\n\n for (const line of lines) {\n const cleanLine = line.trim();\n if (!cleanLine) continue;\n\n const jsonText = cleanLine.startsWith('data:')\n ? cleanLine.replace(/^data:\\s*/, '')\n : cleanLine;\n try {\n frames.push(JSON.parse(jsonText));\n } catch {\n // Keep segment buffering\n }\n }\n await maybeFireFirstFrameCallback();\n }\n\n if (done) {\n const finalLine = buffer.trim();\n if (finalLine) {\n const jsonText = finalLine.startsWith('data:')\n ? finalLine.replace(/^data:\\s*/, '')\n : finalLine;\n try {\n frames.push(JSON.parse(jsonText));\n } catch {\n // Trailing formatting mismatch\n }\n }\n break;\n }\n }\n } finally {\n reader.releaseLock();\n }\n\n clearTimeout(timeoutId);\n return frames;\n } catch {\n clearTimeout(timeoutId);\n return [];\n }\n };\n\n const validMeta = {\n 'io.modelcontextprotocol/protocolVersion': DRAFT_PROTOCOL_VERSION,\n 'io.modelcontextprotocol/clientInfo': {\n name: 'conformance-client',\n version: '1.0.0'\n },\n 'io.modelcontextprotocol/clientCapabilities': {}\n };\n\n // Helper to check JSON-RPC ID matching on error responses\n const checkErrorId = (data: any, expectedId: string | number) => {\n if (data && data.error) {\n if (data.id !== expectedId) {\n checks.push({\n id: 'sep-2575-http-server-error-jsonrpc-id',\n name: 'HttpServerErrorJsonrpcId',\n description: 'All error responses carry the request JSON-RPC id',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Expected error response id ${expectedId}, got ${data.id}`,\n specReferences: SPEC_REF\n });\n }\n }\n };\n\n // ==========================================\n // 1. Per-request _meta Validation (4 Checks)\n // ==========================================\n const metaValidationTestCases = [\n {\n slug: 'missing-meta',\n description:\n 'Rejects request with missing _meta with -32602 Invalid params',\n params: {},\n rpcId: 101\n },\n {\n slug: 'missing-protocol-version',\n description:\n 'Rejects request with _meta missing io.modelcontextprotocol/protocolVersion',\n params: {\n _meta: {\n 'io.modelcontextprotocol/clientInfo':\n validMeta['io.modelcontextprotocol/clientInfo'],\n 'io.modelcontextprotocol/clientCapabilities':\n validMeta['io.modelcontextprotocol/clientCapabilities']\n }\n },\n rpcId: 102\n },\n {\n slug: 'missing-client-info',\n description:\n 'Rejects request with _meta missing io.modelcontextprotocol/clientInfo',\n params: {\n _meta: {\n 'io.modelcontextprotocol/protocolVersion':\n validMeta['io.modelcontextprotocol/protocolVersion'],\n 'io.modelcontextprotocol/clientCapabilities':\n validMeta['io.modelcontextprotocol/clientCapabilities']\n }\n },\n rpcId: 103\n },\n {\n slug: 'missing-client-capabilities',\n description:\n 'Rejects request with _meta missing io.modelcontextprotocol/clientCapabilities',\n params: {\n _meta: {\n 'io.modelcontextprotocol/protocolVersion':\n validMeta['io.modelcontextprotocol/protocolVersion'],\n 'io.modelcontextprotocol/clientInfo':\n validMeta['io.modelcontextprotocol/clientInfo']\n }\n },\n rpcId: 104\n }\n ];\n for (const testCase of metaValidationTestCases) {\n await runCheck(\n `sep-2575-request-meta-invalid-${testCase.slug}`,\n 'RequestMetaInvalid',\n testCase.description,\n async () => {\n const { data } = await sendRpc(\n 'server/discover',\n testCase.params,\n undefined,\n testCase.rpcId\n );\n checkErrorId(data, testCase.rpcId);\n\n if (data?.error?.code !== -32602) {\n return {\n error: `Expected error code -32602, got ${data?.error?.code}`,\n details: { fieldIssue: testCase.slug, response: data }\n };\n }\n return { details: { fieldIssue: testCase.slug, response: data } };\n },\n { fieldIssue: testCase.slug }\n );\n }\n\n // ==========================================\n // 2. Discovery & Capabilities (4 Checks)\n // ==========================================\n let discoverSupportedVersions: string[] = [];\n let discoverCapabilities: any = {};\n let discoverResult: any = null;\n let discoverRpcError: any = null;\n\n try {\n const { data } = await sendRpc(\n 'server/discover',\n { _meta: validMeta },\n undefined,\n 201\n );\n discoverResult = data?.result;\n\n if (Array.isArray(discoverResult?.supportedVersions)) {\n discoverSupportedVersions = discoverResult.supportedVersions;\n }\n if (\n discoverResult?.capabilities &&\n typeof discoverResult.capabilities === 'object'\n ) {\n discoverCapabilities = discoverResult.capabilities;\n }\n } catch (e) {\n discoverRpcError = e;\n }\n\n await runCheck(\n 'sep-2575-server-implements-discover',\n 'ServerImplementsDiscover',\n 'Servers MUST implement server/discover.',\n () => {\n if (discoverRpcError)\n return { error: `Discovery failed: ${discoverRpcError.message}` };\n if (\n !discoverResult?.supportedVersions ||\n !discoverResult?.capabilities ||\n !discoverResult?.serverInfo\n ) {\n return {\n error: 'Missing mandatory fields in discover response setup',\n details: { result: discoverResult }\n };\n }\n return { details: { result: discoverResult } };\n }\n );\n\n await runCheck(\n 'sep-2575-server-declares-prompts-in-discover',\n 'ServerDeclaresPromptsInDiscover',\n 'Servers that support prompts MUST declare the prompts capability in their DiscoverResult.',\n async () => {\n if (discoverRpcError)\n return { error: `Prerequisite missing: ${discoverRpcError.message}` };\n const { data: promptsData } = await sendRpc(\n 'prompts/list',\n { _meta: validMeta },\n undefined,\n 203\n );\n const methodExists =\n promptsData?.result?.prompts || promptsData?.error?.code !== -32601;\n\n if (methodExists && !discoverCapabilities.prompts) {\n return {\n error:\n 'Server handles prompts but did not declare prompts capability in discover result',\n details: { discoverCapabilities }\n };\n }\n return { details: { discoverCapabilities, response: promptsData } };\n }\n );\n\n // Dynamic verification helper to check capability consistency against true handlers\n await runCheck(\n 'sep-2575-discover-capabilities-match-handlers',\n 'DiscoverCapabilitiesMatchHandlers',\n 'capabilities matches what the server honors on real RPC calls',\n async () => {\n if (discoverRpcError)\n return {\n error: `Discovery runtime check failed: ${discoverRpcError.message}`\n };\n const { data: toolsData } = await sendRpc(\n 'tools/list',\n { _meta: validMeta },\n undefined,\n 202\n );\n\n if (discoverCapabilities.tools) {\n const toolsPassed = Array.isArray(toolsData?.result?.tools);\n if (!toolsPassed)\n return {\n error: 'Advertised tools capability but tools/list call failed',\n details: { response: toolsData }\n };\n } else {\n if (toolsData?.error?.code !== -32601)\n return {\n error:\n 'Did not advertise tools capability but tools/list did not yield -32601',\n details: { response: toolsData }\n };\n }\n return { details: { response: toolsData } };\n }\n );\n\n // ==========================================\n // 3. Version Negotiation & Headers (3 Checks)\n // ==========================================\n const unsupportedMeta = {\n ...validMeta,\n 'io.modelcontextprotocol/protocolVersion': 'v999.0.0'\n };\n const response301 = await sendRpc(\n 'server/discover',\n { _meta: unsupportedMeta },\n { 'MCP-Protocol-Version': 'v999.0.0' },\n 301\n ).catch(() => null);\n const res301: any = response301?.res ?? null;\n const data301: any = response301?.data ?? null;\n if (data301) checkErrorId(data301, 301);\n\n await runCheck(\n 'sep-2575-server-unsupported-version-error',\n 'ServerUnsupportedVersionError',\n 'If the server does not implement the requested version (whether the version is unknown to the server, or is a known version the server has chosen not to support), it MUST respond with an UnsupportedProtocolVersionError listing the versions it does support.',\n () => {\n if (!data301)\n return { error: 'Unsupported version invocation failed completely' };\n const errSupportedVersions = data301?.error?.data?.supported;\n const hasErrVersions =\n Array.isArray(errSupportedVersions) &&\n errSupportedVersions.length > 0;\n\n const validMatch =\n hasErrVersions &&\n errSupportedVersions.every((v: string) =>\n discoverSupportedVersions.includes(v)\n );\n if (!validMatch)\n return {\n error: `Returned supported versions data layout does not correlate to active server metrics: ${JSON.stringify(errSupportedVersions)}`\n };\n return { details: { response: data301 } };\n }\n );\n\n await runCheck(\n 'sep-2575-http-server-unsupported-version-400',\n 'HttpServerUnsupportedVersion400',\n 'If the server does not implement the requested protocol version, it MUST respond with 400 Bad Request and an UnsupportedProtocolVersionError listing its supported versions.',\n () => {\n if (!res301)\n return { error: 'Network transaction context unavailable' };\n if (res301.status !== 400)\n return {\n error: `Expected HTTP 400 Bad Request, got status code ${res301.status}`\n };\n return { details: { response: data301 } };\n }\n );\n\n const headerMismatchMeta = {\n ...validMeta,\n 'io.modelcontextprotocol/protocolVersion': 'v999.0.0'\n };\n const responseAbsent = await sendRpc(\n 'server/discover',\n { _meta: headerMismatchMeta },\n { 'MCP-Protocol-Version': DRAFT_PROTOCOL_VERSION },\n 302\n ).catch(() => null);\n const resAbsent: any = responseAbsent?.res ?? null;\n const dataAbsent: any = responseAbsent?.data ?? null;\n\n await runCheck(\n 'sep-2575-http-server-header-mismatch-400',\n 'HttpServerHeaderMismatch400',\n 'If the values do not match, the server MUST reject the request with 400 Bad Request and a HeaderMismatch JSON-RPC error.',\n () => {\n if (!resAbsent)\n return { error: 'Header verification endpoint network hit failed' };\n if (resAbsent.status !== 400 || dataAbsent?.error?.code !== -32001) {\n return {\n error: `Expected HTTP 400 and JSON-RPC error -32001, got status ${resAbsent.status} with code ${dataAbsent?.error?.code}`\n };\n }\n return { details: { response: dataAbsent } };\n }\n );\n\n // ==========================================\n // 4. Client Capability Constraints (2 Checks)\n // ==========================================\n const response401 = await sendRpc(\n 'tools/call',\n { name: 'test_missing_capability', arguments: {}, _meta: validMeta },\n undefined,\n 401\n ).catch(() => null);\n const res401: any = response401?.res ?? null;\n const data401: any = response401?.data ?? null;\n if (data401) checkErrorId(data401, 401);\n\n // Determine if this server actively enforces client capabilities\n const serverRequiresCapability = data401?.error?.code === -32003;\n\n await runCheck(\n 'sep-2575-server-rejects-undeclared-capability',\n 'ServerRejectsUndeclaredCapability',\n 'A server MUST NOT rely on capabilities the client has not declared. If processing a request requires a capability the client did not include in io.modelcontextprotocol/clientCapabilities, the server MUST return a MissingRequiredClientCapabilityError (-32003).',\n () => {\n if (!res401)\n return {\n error:\n 'Capability checking call sequence timed out or dropped connection'\n };\n\n if (!serverRequiresCapability) {\n // The server didn't return -32003, so this requirement isn't\n // exercised for this method. Report SKIPPED rather than a green PASS.\n return {\n skipped: true,\n details: {\n note: 'Skipped requirement tracking: Server returned a non-32003 response, indicating it does not require explicit client capability authorization constraints for this method.',\n response: data401\n }\n };\n }\n\n // If it DOES return -32003, strictly validate the requirement payload structure\n const reqCaps = data401?.error?.data?.requiredCapabilities;\n if (!Array.isArray(reqCaps) || !reqCaps.includes('sampling')) {\n return {\n error: `Server responded with error code -32003 but failed to provide an array containing the expected 'sampling' capability in error.data.requiredCapabilities`,\n details: { response: data401 }\n };\n }\n\n return { details: { response: data401 } };\n }\n );\n\n await runCheck(\n 'sep-2575-missing-capability-http-400',\n 'MissingCapabilityHttp400',\n 'On HTTP, the response status MUST be 400 Bad Request [for MissingRequiredClientCapabilityError].',\n () => {\n if (!res401)\n return {\n error: 'Network transport layer layer context failed to instantiate'\n };\n\n if (!serverRequiresCapability) {\n // No -32003 means the HTTP-400 requirement doesn't apply here.\n // Report SKIPPED rather than a green PASS.\n return {\n skipped: true,\n details: {\n note: 'Skipped status tracking: Server did not return a MissingRequiredClientCapabilityError.',\n httpStatus: res401.status\n }\n };\n }\n\n // If it did trigger the capability error, it MUST use HTTP 400\n if (res401.status !== 400) {\n return {\n error: `Expected HTTP status code 400 Bad Request for an undeclared capability error response, got ${res401.status}`,\n details: { response: data401 }\n };\n }\n\n return { details: { response: data401 } };\n }\n );\n\n // ==========================================\n // 5. Methods & Routing Mechanics (5 Checks)\n // ==========================================\n const expectedSlugs = [\n 'initialize',\n 'ping',\n 'logging/setLevel',\n 'resources/subscribe',\n 'resources/unsubscribe'\n ];\n for (const slug of expectedSlugs) {\n const cleanMethodParam = slug.toLowerCase().replace('/', '-');\n const response500 = await sendRpc(\n slug,\n { _meta: validMeta },\n undefined,\n 500\n ).catch(() => null);\n const res500: any = response500?.res ?? null;\n const data500: any = response500?.data ?? null;\n\n await runCheck(\n `sep-2575-http-server-method-not-found-404-${cleanMethodParam}`,\n `HttpServerMethodNotFound404${slug.replace('/', '')}`,\n `If the server does not implement the removed RPC method '${slug}', it MUST respond with 404 Not Found and a JSON-RPC error with code -32601 (Method not found).`,\n () => {\n if (!res500 || !data500)\n return {\n error:\n 'Removed method validation hit dropped connections unexpectedly'\n };\n if (res500.status !== 404 || data500?.error?.code !== -32601) {\n return {\n error: `Expected HTTP 404 and code -32601 for removed methods, got HTTP ${res500.status} and code ${data500?.error?.code}`\n };\n }\n return { details: { response: data500 } };\n }\n );\n }\n\n // Explicit generic unknown method fallback test\n const response601 = await sendRpc(\n 'unknown/method',\n { _meta: validMeta },\n undefined,\n 601\n ).catch(() => null);\n const res601: any = response601?.res ?? null;\n const data601: any = response601?.data ?? null;\n\n await runCheck(\n 'sep-2575-http-server-method-not-found-404',\n 'HttpServerMethodNotFound404',\n 'If the server does not implement the requested RPC method, it MUST respond with 404 Not Found and a JSON-RPC error with code -32601 (Method not found).',\n () => {\n if (!res601 || !data601)\n return {\n error: 'Unknown fallback test target returned an invalid layout'\n };\n if (res601.status !== 404 || data601?.error?.code !== -32601) {\n return {\n error: `Expected HTTP 404 and JSON-RPC error code -32601, got HTTP ${res601.status} and code ${data601?.error?.code}`\n };\n }\n return { details: { response: data601 } };\n }\n );\n\n await runCheck(\n 'sep-2575-http-server-no-independent-requests-on-stream',\n 'HttpServerNoIndependentRequestsOnStream',\n 'Request stream contains only IncompleteResult, never independent JSON-RPC requests',\n async () => {\n const frames = await listenToStream(\n 'tools/call',\n {\n name: 'test_streaming_elicitation',\n arguments: {},\n _meta: validMeta\n },\n 3,\n 600\n );\n\n if (frames.length === 0) {\n return {\n error:\n 'Failed to receive progressive stream chunk execution frames from tools/call handler endpoint'\n };\n }\n\n // If the call was rejected outright (e.g. the diagnostic tool does\n // not exist), nothing was streamed and the requirement was not\n // exercised - report SKIPPED rather than a vacuous SUCCESS.\n if (frames.every((f) => f?.error !== undefined)) {\n return {\n skipped: true,\n details: {\n note: 'Server does not expose diagnostic tool test_streaming_elicitation; the response stream could not be exercised.',\n response: frames[0]\n }\n };\n }\n\n const hasIndependentRequest = frames.some(\n (f) => f.method && !f.method.startsWith('notifications/')\n );\n if (hasIndependentRequest) {\n return {\n error:\n 'Server emitted an independent standard request layout inside a response progress execution block stream context',\n details: { frames }\n };\n }\n return { details: { inspectedFramesCount: frames.length } };\n }\n );\n\n await runCheck(\n 'sep-2575-server-no-log-without-loglevel',\n 'ServerNoLogWithoutLogLevel',\n \"No notifications/message for requests that didn't set _meta.../logLevel\",\n async () => {\n const frames = await listenToStream(\n 'tools/call',\n { name: 'test_logging_tool', arguments: {}, _meta: validMeta },\n 3,\n 500\n );\n\n if (frames.length === 0) {\n return {\n error:\n 'Logging target endpoint context dropped or failed to yield frame structures'\n };\n }\n\n // If the call was rejected outright (e.g. the diagnostic tool does\n // not exist), the server never had anything to log and the\n // requirement was not exercised - report SKIPPED rather than a\n // vacuous SUCCESS.\n if (frames.every((f) => f?.error !== undefined)) {\n return {\n skipped: true,\n details: {\n note: 'Server does not expose diagnostic tool test_logging_tool; the no-log-without-logLevel requirement could not be exercised.',\n response: frames[0]\n }\n };\n }\n\n const logFrame = frames.find(\n (f) => f.method === 'notifications/message'\n );\n if (logFrame) {\n return {\n error:\n 'Server dispatched a notifications/message payload chunk even though the client request did not authorize a log level context descriptor',\n details: { logFrame }\n };\n }\n return { details: { framesFound: frames.length } };\n }\n );\n\n // ==========================================\n // 6. Subscription Streams & Filtering (3 Checks)\n // ==========================================\n const subscriptionParams = {\n _meta: validMeta,\n notifications: { toolsListChanged: true }\n };\n\n // Open a tools-filtered stream and (best-effort) trigger a tool-list\n // change once it is acknowledged, so the stream carries at least one\n // post-acknowledgment notification for the subscription-id check.\n let streamFrames: any[] = [];\n try {\n streamFrames = await listenToStream(\n 'subscriptions/listen',\n subscriptionParams,\n 2,\n 800,\n async () => {\n await sendRpc('tools/call', {\n name: 'test_trigger_tool_change',\n arguments: {},\n _meta: validMeta\n });\n }\n );\n } catch {\n // Stream pipeline tracking failed\n }\n\n await runCheck(\n 'sep-2575-server-sends-subscription-ack',\n 'ServerSendsSubscriptionAck',\n 'notifications/subscriptions/acknowledged is the first message on a subscriptions/listen stream',\n () => {\n if (streamFrames[0]?.error?.code === -32601) {\n return {\n skipped: true,\n details: {\n note: 'Server does not support subscriptions/listen (Method not found)'\n }\n };\n }\n if (streamFrames.length === 0) {\n return {\n error:\n 'Failed to open or receive frames from the subscriptions/listen stream endpoint'\n };\n }\n const firstFrame = streamFrames[0];\n if (firstFrame?.method !== 'notifications/subscriptions/acknowledged') {\n return {\n error: `Expected first frame method to be 'notifications/subscriptions/acknowledged', got '${firstFrame?.method}'`,\n details: { firstFrame }\n };\n }\n return { details: { firstFrame } };\n }\n );\n\n await runCheck(\n 'sep-2575-server-tags-subscription-id',\n 'ServerTagsSubscriptionId',\n 'Listen-stream notifications carry _meta.../subscriptionId',\n () => {\n if (streamFrames[0]?.error?.code === -32601) {\n return {\n skipped: true,\n details: {\n note: 'Server does not support subscriptions/listen (Method not found)'\n }\n };\n }\n if (streamFrames.length === 0) {\n return {\n error:\n 'Failed to open stream line or tracking frames are missing completely'\n };\n }\n\n // Every notification delivered on the stream (the acknowledgment and\n // anything after it) must carry the subscription id in params._meta.\n const notificationFrames = streamFrames.filter(\n (f) =>\n typeof f?.method === 'string' &&\n f.method.startsWith('notifications/')\n );\n if (notificationFrames.length === 0) {\n return {\n error:\n 'subscriptions/listen stream carried no notification frames to inspect',\n details: { streamFrames }\n };\n }\n\n const untaggedFrames = notificationFrames.filter(\n (f) => !f?.params?._meta?.['io.modelcontextprotocol/subscriptionId']\n );\n if (untaggedFrames.length > 0) {\n return {\n error: `${untaggedFrames.length} of ${notificationFrames.length} listen-stream notification(s) are missing io.modelcontextprotocol/subscriptionId in params._meta`,\n details: { untaggedFrames }\n };\n }\n\n const subId =\n notificationFrames[0]?.params?._meta?.[\n 'io.modelcontextprotocol/subscriptionId'\n ];\n return {\n details: {\n subscriptionId: subId,\n inspectedNotificationCount: notificationFrames.length\n }\n };\n }\n );\n\n await runCheck(\n 'sep-2575-server-honors-notification-filter',\n 'ServerHonorsNotificationFilter',\n \"Server doesn't send notification types the client didn't request\",\n async () => {\n const narrowParams = {\n _meta: validMeta,\n notifications: { promptsListChanged: true }\n };\n\n // Open a stream filtered to prompts only, then mutate the *tool* list\n // on a separate connection once the subscription is acknowledged. A\n // compliant server must not deliver the resulting tools notification\n // to this stream.\n const narrowFrames = await listenToStream(\n 'subscriptions/listen',\n narrowParams,\n 3,\n 1500,\n async () => {\n await sendRpc('tools/call', {\n name: 'test_trigger_tool_change',\n arguments: {},\n _meta: validMeta\n });\n }\n );\n\n if (narrowFrames[0]?.error?.code === -32601) {\n return {\n skipped: true,\n details: {\n note: 'Server does not support subscriptions/listen (Method not found)'\n }\n };\n }\n if (narrowFrames.length === 0) {\n return {\n error:\n 'Strict subscription filtering line failed to return communication frames'\n };\n }\n\n const leakedToolFrame = narrowFrames.find(\n (f) => f?.method === 'notifications/tools/list_changed'\n );\n\n if (leakedToolFrame) {\n return {\n error:\n 'Server leaked a tools/list-changed notification over a stream explicitly filtered to prompts only',\n details: { leakedToolFrame }\n };\n }\n return { details: { narrowFramesCount: narrowFrames.length } };\n }\n );\n\n // ==========================================\n // 7. Dynamic List Mutations (2 Checks)\n // ==========================================\n await runCheck(\n 'sep-2575-server-sends-prompts-list-changed-on-subscription',\n 'ServerSendsPromptsListChangedOnSubscription',\n 'List-changed-capable servers notify listen streams with promptsListChanged: true (SHOULD)',\n async () => {\n // Automatically pass/skip if the server didn't declare this capability during discovery\n if (!discoverCapabilities?.prompts?.listChanged) {\n return {\n skipped: true,\n details: {\n note: 'Server did not declare prompts.listChanged capability in server/discover'\n }\n };\n }\n\n const promptsParams = {\n _meta: validMeta,\n notifications: { promptsListChanged: true }\n };\n\n // Open the subscription first; mutate the prompt list on a separate\n // connection once it is acknowledged. A compliant server only\n // notifies streams that are open at the time of the change.\n let trigger: any = null;\n const frames = await listenToStream(\n 'subscriptions/listen',\n promptsParams,\n 2,\n 1500,\n async () => {\n trigger = await sendRpc('tools/call', {\n name: 'test_trigger_prompt_change',\n arguments: {},\n _meta: validMeta\n });\n }\n );\n if (trigger?.data?.error?.code === -32601) {\n return {\n skipped: true,\n details: {\n note: 'Server does not expose diagnostic hook test_trigger_prompt_change to mutate lists'\n }\n };\n }\n\n if (frames.length === 0) {\n return {\n warning: true,\n error:\n 'Failed to open or receive frames from the subscriptions/listen stream endpoint'\n };\n }\n\n const changeFrame = frames.find(\n (f) => f.method === 'notifications/prompts/list_changed'\n );\n if (!changeFrame) {\n return {\n warning: true,\n error:\n 'Mutated the prompt list but no notifications/prompts/list_changed arrived on the open subscription stream. This is a SHOULD requirement.'\n };\n }\n return { details: { changeFrame } };\n }\n );\n\n await runCheck(\n 'sep-2575-server-sends-tools-list-changed-on-subscription',\n 'ServerSendsToolsListChangedOnSubscription',\n 'List-changed-capable servers notify listen streams with toolsListChanged: true (SHOULD)',\n async () => {\n // Automatically pass/skip if the server didn't declare this capability during discovery\n if (!discoverCapabilities?.tools?.listChanged) {\n return {\n skipped: true,\n details: {\n note: 'Server did not declare tools.listChanged capability in server/discover'\n }\n };\n }\n\n const toolsParams = {\n _meta: validMeta,\n notifications: { toolsListChanged: true }\n };\n\n // Open the subscription first; mutate the tool list on a separate\n // connection once it is acknowledged. A compliant server only\n // notifies streams that are open at the time of the change.\n let trigger: any = null;\n const frames = await listenToStream(\n 'subscriptions/listen',\n toolsParams,\n 2,\n 1500,\n async () => {\n trigger = await sendRpc('tools/call', {\n name: 'test_trigger_tool_change',\n arguments: {},\n _meta: validMeta\n });\n }\n );\n if (trigger?.data?.error?.code === -32601) {\n return {\n skipped: true,\n details: {\n note: 'Server does not expose diagnostic hook test_trigger_tool_change to mutate lists'\n }\n };\n }\n\n if (frames.length === 0) {\n return {\n warning: true,\n error:\n 'Failed to open or receive frames from the subscriptions/listen stream endpoint'\n };\n }\n\n const changeFrame = frames.find(\n (f) => f.method === 'notifications/tools/list_changed'\n );\n if (!changeFrame) {\n return {\n warning: true,\n error:\n 'Mutated the tool list but no notifications/tools/list_changed arrived on the open subscription stream. This is a SHOULD requirement.'\n };\n }\n return { details: { changeFrame } };\n }\n );\n\n if (!checks.some((c) => c.id === 'sep-2575-http-server-error-jsonrpc-id')) {\n checks.push({\n id: 'sep-2575-http-server-error-jsonrpc-id',\n name: 'HttpServerErrorJsonrpcId',\n description: 'All error responses carry the request JSON-RPC id',\n status: 'SUCCESS',\n timestamp,\n specReferences: SPEC_REF\n });\n }\n\n return checks;\n }\n}\n",[],[141,254,272,282],"c23d4a12-5b64-11f1-8e90-ee650bb23af1","stateless-client.ts","c23d4abc-5b64-11f1-8e90-ee650bb23af1",49,["D",1780062373877],"/**\n * Stateless request helpers for server scenarios (SEP-2575 + SEP-2243).\n *\n * Every request the harness sends to a server under test carries the\n * cross-cutting obligations regardless of what a scenario actually tests:\n * the standard headers (MCP-Protocol-Version, Mcp-Method, Mcp-Name, Accept)\n * and the `_meta` fields (protocolVersion, clientInfo, clientCapabilities),\n * pinned to `DRAFT_PROTOCOL_VERSION`. Scenarios exercising these SEPs MUST\n * build their requests through these helpers so a strictly-conformant server\n * never rejects harness traffic for reasons unrelated to the behaviour under\n * test (issues #311, #312, #315).\n */\n\nimport { DRAFT_PROTOCOL_VERSION } from '../../types.ts';\n\nexport interface JsonRpcResponse {\n jsonrpc: '2.0';\n id: number | string | null;\n result?: Record;\n error?: { code: number; message: string; data?: unknown };\n}\n\nexport const CONFORMANCE_CLIENT_INFO = {\n name: 'conformance-test-client',\n version: '1.0.0'\n} as const;\n\nexport const DEFAULT_CLIENT_CAPABILITIES = {\n sampling: {},\n elicitation: {},\n roots: { listChanged: true }\n} as const;\n\nexport interface StatelessResponse {\n status: number;\n headers: Headers;\n contentType?: string;\n /** The parsed JSON-RPC message (for SSE: the event matching the request id). */\n body?: JsonRpcResponse;\n /** All parsed events when the response was an SSE / chunked stream. */\n events?: unknown[];\n /** Raw response text when it could not be parsed as JSON. */\n text?: string;\n}\n\nlet nextRequestId = 1;\n\n/**\n * The `Mcp-Name` source field per SEP-2243: `params.name` for tools/call and\n * prompts/get, `params.uri` for resources/read; absent otherwise.\n */\nexport function mcpNameForRequest(\n method: string,\n params?: Record\n): string | undefined {\n if (method === 'tools/call' || method === 'prompts/get') {\n return typeof params?.name === 'string' ? params.name : undefined;\n }\n if (method === 'resources/read') {\n return typeof params?.uri === 'string' ? params.uri : undefined;\n }\n return undefined;\n}\n\n/**\n * Build the conformant header set for a stateless request: Content-Type,\n * Accept (both content types), MCP-Protocol-Version, Mcp-Method and (when the\n * method carries one) Mcp-Name. `options.headers` overrides or extends the\n * defaults, replacing any default whose name matches case-insensitively.\n */\nexport function buildStandardHeaders(\n method: string,\n params?: Record,\n options: { headers?: Record } = {}\n): Record {\n const headers: Record = {\n 'Content-Type': 'application/json',\n Accept: 'application/json, text/event-stream',\n 'MCP-Protocol-Version': DRAFT_PROTOCOL_VERSION,\n 'Mcp-Method': method\n };\n const name = mcpNameForRequest(method, params);\n if (name !== undefined) {\n headers['Mcp-Name'] = name;\n }\n\n if (options.headers) {\n for (const [key, value] of Object.entries(options.headers)) {\n // Replace any default that differs only by case, then set the override.\n for (const existing of Object.keys(headers)) {\n if (existing.toLowerCase() === key.toLowerCase()) {\n delete headers[existing];\n }\n }\n headers[key] = value;\n }\n }\n\n return headers;\n}\n\n/**\n * Merge params with the conformant `_meta` required on every stateless\n * request. Keys already present in `params._meta` win over the defaults.\n */\nexport function withRequestMeta(\n params?: Record\n): Record {\n return {\n ...params,\n _meta: {\n 'io.modelcontextprotocol/protocolVersion': DRAFT_PROTOCOL_VERSION,\n 'io.modelcontextprotocol/clientInfo': CONFORMANCE_CLIENT_INFO,\n 'io.modelcontextprotocol/clientCapabilities': DEFAULT_CLIENT_CAPABILITIES,\n ...(params?._meta as Record | undefined)\n }\n };\n}\n\nfunction isJsonRpcResponseShaped(event: unknown): event is JsonRpcResponse {\n return (\n typeof event === 'object' &&\n event !== null &&\n ('result' in event || 'error' in event)\n );\n}\n\nfunction parseSseLineInto(events: unknown[], rawLine: string): void {\n const line = rawLine.trim();\n if (!line) return;\n const jsonText = line.startsWith('data:')\n ? line.replace(/^data:\\s*/, '')\n : line;\n try {\n events.push(JSON.parse(jsonText));\n } catch {\n // Non-JSON line (comments, partial frames) — ignore.\n }\n}\n\n/**\n * Read an SSE / chunked-stream response incrementally and resolve as soon as\n * the JSON-RPC response matching `requestId` arrives, without waiting for the\n * stream to close. If the stream ends (or is aborted) first, returns whatever\n * events were parsed, with `body` set to the last response-shaped event.\n */\nexport async function readSseJsonRpcResponse(\n res: Response,\n requestId: number | string | null\n): Promise<{ events: unknown[]; body?: JsonRpcResponse }> {\n const events: unknown[] = [];\n const matchesRequest = (event: unknown): event is JsonRpcResponse =>\n isJsonRpcResponseShaped(event) && event.id === requestId;\n const finish = (): { events: unknown[]; body?: JsonRpcResponse } => {\n const match = events.find(matchesRequest);\n const lastResponseShaped = [...events]\n .reverse()\n .find(isJsonRpcResponseShaped);\n return { events, body: match ?? lastResponseShaped };\n };\n\n if (!res.body) return finish();\n\n const reader = res.body.getReader();\n const decoder = new TextDecoder();\n let buffer = '';\n\n try {\n for (;;) {\n let value: Uint8Array | undefined;\n let done = false;\n try {\n ({ value, done } = await reader.read());\n } catch {\n // The stream was aborted (timeout) or dropped — return what arrived.\n break;\n }\n\n if (value) {\n buffer += decoder.decode(value, { stream: true });\n const lines = buffer.split(/\\r?\\n/);\n buffer = lines.pop() ?? '';\n for (const line of lines) parseSseLineInto(events, line);\n\n if (events.some(matchesRequest)) {\n // The response we were waiting for arrived; stop reading the stream.\n await reader.cancel().catch(() => {});\n break;\n }\n }\n\n if (done) {\n parseSseLineInto(events, buffer);\n buffer = '';\n break;\n }\n }\n } finally {\n try {\n reader.releaseLock();\n } catch {\n // Lock already released (e.g. after cancel) — nothing to do.\n }\n }\n\n return finish();\n}\n\n/**\n * Send a single stateless JSON-RPC request with the full set of cross-cutting\n * headers and `_meta`. Handles both JSON and SSE responses.\n */\nexport async function sendStatelessRequest(\n serverUrl: string,\n method: string,\n params?: Record,\n options: { headers?: Record; timeoutMs?: number } = {}\n): Promise {\n const id = nextRequestId++;\n const headers = buildStandardHeaders(method, params, {\n headers: options.headers\n });\n const body = JSON.stringify({\n jsonrpc: '2.0',\n id,\n method,\n params: withRequestMeta(params)\n });\n\n const controller = new AbortController();\n const timeout = setTimeout(\n () => controller.abort(),\n options.timeoutMs ?? 10000\n );\n try {\n const res = await fetch(serverUrl, {\n method: 'POST',\n headers,\n body,\n signal: controller.signal\n });\n\n const contentType = res.headers.get('content-type') ?? undefined;\n\n if (contentType?.includes('text/event-stream')) {\n // Read the stream incrementally and resolve on the matching response —\n // a server that keeps the stream open must not stall the harness.\n const { events, body: matched } = await readSseJsonRpcResponse(res, id);\n return {\n status: res.status,\n headers: res.headers,\n contentType,\n events,\n body: matched\n };\n }\n\n const text = await res.text();\n try {\n return {\n status: res.status,\n headers: res.headers,\n contentType,\n body: text ? (JSON.parse(text) as JsonRpcResponse) : undefined\n };\n } catch {\n return { status: res.status, headers: res.headers, contentType, text };\n }\n } finally {\n clearTimeout(timeout);\n // Tear down any still-open SSE stream so sockets don't linger.\n controller.abort();\n }\n}\n",[],[141,254,272,290],"bb1d07e0-5b64-11f1-8308-ee650bb23af1","sse-polling.ts","bb1d0880-5b64-11f1-8308-ee650bb23af1",20,["D",1780062361906],"/**\n * SSE Polling conformance test scenarios for MCP servers (SEP-1699)\n *\n * Tests that servers properly implement SSE polling behavior including:\n * - Sending priming events with event ID and empty data on POST SSE streams\n * - Sending retry field in priming events when configured\n * - Closing SSE stream mid-operation and resuming after client reconnects\n * - Replaying events when client reconnects with Last-Event-ID\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../types.ts';\nimport { EventSourceParserStream } from 'npm:eventsource-parser@^3.0.8/stream';\nimport { Client } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/index.js';\nimport { StreamableHTTPClientTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/streamableHttp.js';\n\nfunction createLoggingFetch(checks: ConformanceCheck[]) {\n return async (url: string, options: RequestInit): Promise => {\n const method = options.method || 'GET';\n let description = `Sending ${method} request`;\n if (options.body) {\n try {\n const body = JSON.parse(options.body as string);\n if (body.method) {\n description = `Sending ${method} ${body.method}`;\n }\n } catch {\n // Not JSON\n }\n }\n\n checks.push({\n id: 'outgoing-request',\n name: 'OutgoingRequest',\n description,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n method,\n url,\n headers: options.headers,\n body: options.body ? JSON.parse(options.body as string) : undefined\n }\n });\n\n const response = await fetch(url, options);\n\n const responseHeaders: Record = {};\n response.headers.forEach((value, key) => {\n responseHeaders[key] = value;\n });\n\n checks.push({\n id: 'incoming-response',\n name: 'IncomingResponse',\n description: `Received ${response.status} response for ${method}`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n statusCode: response.status,\n headers: responseHeaders\n }\n });\n\n return response;\n };\n}\n\nexport class ServerSSEPollingScenario implements ClientScenario {\n name = 'server-sse-polling';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Test server SSE polling via test_reconnection tool that closes stream mid-call (SEP-1699)';\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n let sessionId: string | undefined;\n let client: Client | undefined;\n let transport: StreamableHTTPClientTransport | undefined;\n\n try {\n // Step 1: Initialize session with the server\n client = new Client(\n {\n name: 'conformance-test-client',\n version: '1.0.0'\n },\n {\n capabilities: {\n sampling: {},\n elicitation: {}\n }\n }\n );\n\n transport = new StreamableHTTPClientTransport(new URL(serverUrl));\n await client.connect(transport);\n\n // Extract session ID from transport (accessing internal state)\n sessionId = (transport as unknown as { sessionId?: string }).sessionId;\n\n if (!sessionId) {\n checks.push({\n id: 'server-sse-polling-session',\n name: 'ServerSSEPollingSession',\n description: 'Server provides session ID for SSE polling tests',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n message:\n 'Server did not provide session ID - SSE polling tests may not work correctly'\n }\n });\n }\n\n // Step 2: Call test_reconnection tool via raw fetch to observe SSE behavior\n // This tool should close the stream mid-call, requiring reconnection\n const loggingFetch = createLoggingFetch(checks);\n\n const postResponse = await loggingFetch(serverUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Accept: 'text/event-stream, application/json',\n ...(sessionId && { 'mcp-session-id': sessionId }),\n 'mcp-protocol-version': '2025-03-26'\n },\n body: JSON.stringify({\n jsonrpc: '2.0',\n id: 1,\n method: 'tools/call',\n params: {\n name: 'test_reconnection',\n arguments: {}\n }\n })\n });\n\n if (!postResponse.ok) {\n // Check if tool doesn't exist (method not found or similar)\n if (postResponse.status === 400 || postResponse.status === 404) {\n checks.push({\n id: 'server-sse-test-reconnection-tool',\n name: 'ServerTestReconnectionTool',\n description:\n 'Server implements test_reconnection tool for SSE polling tests',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: `Server does not implement test_reconnection tool (HTTP ${postResponse.status}). This tool is recommended for testing SSE polling behavior.`,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ]\n });\n return checks;\n }\n\n checks.push({\n id: 'server-sse-post-request',\n name: 'ServerSSEPostRequest',\n description: 'Server accepts POST request with SSE stream response',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Server returned HTTP ${postResponse.status}`,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ]\n });\n return checks;\n }\n\n // Check if server returned SSE stream\n const contentType = postResponse.headers.get('content-type');\n if (!contentType?.includes('text/event-stream')) {\n checks.push({\n id: 'server-sse-content-type',\n name: 'ServerSSEContentType',\n description: 'Server returns text/event-stream for POST request',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n contentType,\n message:\n 'Server returned JSON instead of SSE stream - priming event tests not applicable'\n }\n });\n return checks;\n }\n\n // Step 3: Parse SSE stream for priming event and tool response\n let hasEventId = false;\n let hasPrimingEvent = false;\n let primingEventIsFirst = false;\n let hasRetryField = false;\n let retryValue: number | undefined;\n let lastEventId: string | undefined;\n let eventCount = 0;\n let receivedToolResponse = false;\n\n if (!postResponse.body) {\n checks.push({\n id: 'server-sse-polling-stream',\n name: 'ServerSSEPollingStream',\n description: 'Server provides SSE response body',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'Response body is null',\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ]\n });\n return checks;\n }\n\n const reader = postResponse.body\n .pipeThrough(new TextDecoderStream())\n .pipeThrough(\n new EventSourceParserStream({\n onRetry: (retryMs: number) => {\n hasRetryField = true;\n retryValue = retryMs;\n }\n })\n )\n .getReader();\n\n // Read events with timeout - expect stream to close before we get the response\n const timeout = setTimeout(() => {\n reader.cancel();\n }, 10000);\n\n try {\n while (true) {\n const { value: event, done } = await reader.read();\n\n if (done) {\n break;\n }\n\n eventCount++;\n\n // Track the last event ID for reconnection\n if (event.id) {\n hasEventId = true;\n lastEventId = event.id;\n\n // Check if this is a priming event (empty or minimal data)\n const isPriming =\n event.data === '' ||\n event.data === '{}' ||\n event.data.trim() === '';\n if (isPriming) {\n hasPrimingEvent = true;\n // Check if priming event is the first event\n if (eventCount === 1) {\n primingEventIsFirst = true;\n }\n }\n\n // Log the SSE event\n checks.push({\n id: 'incoming-sse-event',\n name: 'IncomingSseEvent',\n description: isPriming\n ? `Received SSE priming event (id: ${event.id})`\n : `Received SSE event (id: ${event.id})`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId: event.id,\n eventType: event.event || 'message',\n isPriming,\n hasRetryField,\n retryValue,\n data: event.data\n }\n });\n }\n\n // Check if this is the tool response\n if (event.data) {\n try {\n const parsed = JSON.parse(event.data);\n if (parsed.id === 1 && parsed.result) {\n receivedToolResponse = true;\n const isError = parsed.result?.isError === true;\n checks.push({\n id: 'incoming-sse-event',\n name: 'IncomingSseEvent',\n description: `Received tool response on POST stream`,\n status: isError ? 'FAILURE' : 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId: event.id,\n body: parsed\n },\n ...(isError && { errorMessage: `Tool call failed` })\n });\n }\n } catch {\n // Not JSON, ignore\n }\n }\n }\n } finally {\n clearTimeout(timeout);\n }\n\n // Log stream closure\n checks.push({\n id: 'stream-closed',\n name: 'StreamClosed',\n description: `POST SSE stream closed after ${eventCount} event(s)`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventCount,\n lastEventId,\n receivedToolResponse\n }\n });\n\n // Check 1: Server SHOULD send priming event with ID on POST SSE stream\n let primingStatus: 'SUCCESS' | 'WARNING' = 'SUCCESS';\n let primingErrorMessage: string | undefined;\n\n if (!hasPrimingEvent) {\n primingStatus = 'WARNING';\n primingErrorMessage =\n 'Server did not send priming event with id and empty data on POST SSE stream. This is recommended for resumability.';\n } else if (!primingEventIsFirst) {\n primingStatus = 'WARNING';\n primingErrorMessage =\n 'Priming event was not sent first. It should be sent immediately when the SSE stream is established.';\n }\n\n checks.push({\n id: 'server-sse-priming-event',\n name: 'ServerSendsPrimingEvent',\n description:\n 'Server SHOULD send priming event with id and empty data on POST SSE streams',\n status: primingStatus,\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n hasPrimingEvent,\n primingEventIsFirst,\n hasEventId,\n lastEventId,\n eventCount\n },\n errorMessage: primingErrorMessage\n });\n\n // Check 2: Server SHOULD send retry field in priming event\n checks.push({\n id: 'server-sse-retry-field',\n name: 'ServerSendsRetryField',\n description:\n 'Server SHOULD send retry field to control client reconnection timing',\n status: hasRetryField ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n hasRetryField,\n retryValue\n },\n errorMessage: !hasRetryField\n ? 'Server did not send retry field. This is recommended for controlling client reconnection timing.'\n : undefined\n });\n\n // Step 4: If tool response wasn't received, reconnect with Last-Event-ID\n if (!receivedToolResponse && lastEventId && sessionId) {\n // Make a GET request with Last-Event-ID to get the tool response\n const getResponse = await loggingFetch(serverUrl, {\n method: 'GET',\n headers: {\n Accept: 'text/event-stream',\n 'mcp-session-id': sessionId,\n 'mcp-protocol-version': '2025-03-26',\n 'last-event-id': lastEventId\n }\n });\n\n if (getResponse.ok && getResponse.body) {\n const reconnectReader = getResponse.body\n .pipeThrough(new TextDecoderStream())\n .pipeThrough(new EventSourceParserStream())\n .getReader();\n\n const reconnectTimeout = setTimeout(() => {\n reconnectReader.cancel();\n }, 5000);\n\n try {\n while (true) {\n const { value: event, done } = await reconnectReader.read();\n if (done) break;\n\n // Log each event received on GET stream\n checks.push({\n id: 'incoming-sse-event',\n name: 'IncomingSseEvent',\n description: `Received SSE event on GET reconnection stream (id: ${event.id || 'none'})`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId: event.id,\n eventType: event.event || 'message',\n data: event.data\n }\n });\n\n // Check if this is the tool response\n if (event.data) {\n try {\n const parsed = JSON.parse(event.data);\n if (parsed.id === 1 && parsed.result) {\n receivedToolResponse = true;\n break;\n }\n } catch {\n // Not JSON, ignore\n }\n }\n }\n } finally {\n clearTimeout(reconnectTimeout);\n }\n\n checks.push({\n id: 'server-sse-disconnect-resume',\n name: 'ServerDisconnectResume',\n description:\n 'Server closes SSE stream mid-call and resumes after client reconnects with Last-Event-ID',\n status: receivedToolResponse ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n lastEventIdUsed: lastEventId,\n receivedToolResponse,\n message: receivedToolResponse\n ? 'Successfully received tool response after reconnection'\n : 'Tool response not received after reconnection'\n },\n errorMessage: !receivedToolResponse\n ? 'Server did not send tool response after client reconnected with Last-Event-ID'\n : undefined\n });\n } else {\n // Check if server doesn't support standalone GET streams\n if (getResponse.status === 405) {\n checks.push({\n id: 'server-sse-disconnect-resume',\n name: 'ServerDisconnectResume',\n description:\n 'Server supports GET reconnection with Last-Event-ID',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n statusCode: getResponse.status,\n message:\n 'Server does not support standalone GET SSE endpoint (405 Method Not Allowed)'\n }\n });\n } else {\n checks.push({\n id: 'server-sse-disconnect-resume',\n name: 'ServerDisconnectResume',\n description:\n 'Server supports GET reconnection with Last-Event-ID',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n statusCode: getResponse.status,\n lastEventIdUsed: lastEventId,\n message: `Server returned ${getResponse.status} for GET request with Last-Event-ID`\n },\n errorMessage: `Server did not accept reconnection with Last-Event-ID (HTTP ${getResponse.status})`\n });\n }\n }\n } else if (receivedToolResponse) {\n // Tool response was received on the initial POST stream (server didn't disconnect)\n checks.push({\n id: 'server-sse-disconnect-resume',\n name: 'ServerDisconnectResume',\n description:\n 'Server closes SSE stream mid-call and resumes after reconnection',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n receivedToolResponse: true,\n message:\n 'Tool response received on initial POST stream - server did not disconnect mid-call. The test_reconnection tool should close the stream before sending the result.'\n }\n });\n } else {\n checks.push({\n id: 'server-sse-disconnect-resume',\n name: 'ServerDisconnectResume',\n description:\n 'Server closes SSE stream mid-call and resumes after reconnection',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n lastEventId,\n sessionId,\n message:\n 'Could not test disconnect/resume - no last event ID or session ID available'\n }\n });\n }\n } catch (error) {\n checks.push({\n id: 'server-sse-polling-error',\n name: 'ServerSSEPollingTest',\n description: 'Test server SSE polling behavior',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Error: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ]\n });\n } finally {\n // Clean up\n if (client) {\n try {\n await client.close();\n } catch {\n // Ignore cleanup errors\n }\n }\n }\n\n return checks;\n }\n}\n",[],[141,254,272,298],"bae2dcdc-5b64-11f1-a5db-ee650bb23af1","sse-multiple-streams.ts","bae2dd90-5b64-11f1-a5db-ee650bb23af1",19,["D",1780062361534],"/**\n * SSE Multiple Streams conformance test scenarios for MCP servers (SEP-1699)\n *\n * Tests that servers properly support multiple concurrent SSE streams:\n * - Accepting multiple POST requests that return SSE streams simultaneously\n * - Each POST request gets its own stream with unique stream ID\n *\n * Note: The standalone GET stream (without Last-Event-ID) is limited to one per session.\n * Multiple concurrent streams are achieved via POST requests, each getting their own stream.\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../types.ts';\nimport { EventSourceParserStream } from 'npm:eventsource-parser@^3.0.8/stream';\nimport { Client } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/index.js';\nimport { StreamableHTTPClientTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/streamableHttp.js';\n\nexport class ServerSSEMultipleStreamsScenario implements ClientScenario {\n name = 'server-sse-multiple-streams';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Test server supports multiple concurrent POST SSE streams (SEP-1699)';\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n let sessionId: string | undefined;\n let client: Client | undefined;\n let transport: StreamableHTTPClientTransport | undefined;\n\n try {\n // Step 1: Initialize session with the server\n client = new Client(\n {\n name: 'conformance-test-client',\n version: '1.0.0'\n },\n {\n capabilities: {\n sampling: {},\n elicitation: {}\n }\n }\n );\n\n transport = new StreamableHTTPClientTransport(new URL(serverUrl));\n await client.connect(transport);\n\n // Extract session ID from transport\n sessionId = (transport as unknown as { sessionId?: string }).sessionId;\n\n if (!sessionId) {\n checks.push({\n id: 'server-sse-multiple-streams-session',\n name: 'ServerSSEMultipleStreamsSession',\n description: 'Server provides session ID for multiple streams test',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n message:\n 'Server did not provide session ID - multiple streams test may not work correctly'\n }\n });\n return checks;\n }\n\n // Step 2: Open multiple POST SSE streams concurrently\n // Each POST request gets its own stream with unique streamId\n // Spec says: \"The client MAY remain connected to multiple SSE streams simultaneously\"\n const streamResponses: Response[] = [];\n const numStreams = 3;\n\n // Launch all POST requests concurrently\n const postPromises = [];\n for (let i = 0; i < numStreams; i++) {\n const promise = fetch(serverUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Accept: 'text/event-stream, application/json',\n 'mcp-session-id': sessionId,\n 'mcp-protocol-version': '2025-03-26'\n },\n body: JSON.stringify({\n jsonrpc: '2.0',\n id: 1000 + i, // Different request IDs for each stream\n method: 'tools/list',\n params: {}\n })\n });\n postPromises.push(promise);\n }\n\n // Wait for all responses\n const responses = await Promise.all(postPromises);\n streamResponses.push(...responses);\n\n // Check that all streams were accepted (HTTP 200)\n const allAccepted = streamResponses.every((r) => r.ok);\n const statuses = streamResponses.map((r) => r.status);\n const contentTypes = streamResponses.map((r) =>\n r.headers.get('content-type')\n );\n\n // Count how many returned SSE streams vs JSON\n const sseStreams = contentTypes.filter((ct) =>\n ct?.includes('text/event-stream')\n ).length;\n\n checks.push({\n id: 'server-accepts-multiple-post-streams',\n name: 'ServerAcceptsMultiplePostStreams',\n description:\n 'Server allows multiple concurrent POST requests (each may return SSE or JSON)',\n status: allAccepted ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n numStreamsAttempted: numStreams,\n numStreamsAccepted: statuses.filter((s) => s === 200).length,\n numSseStreams: sseStreams,\n statuses,\n contentTypes\n },\n errorMessage: !allAccepted\n ? `Server rejected some requests. Statuses: ${statuses.join(', ')}`\n : undefined\n });\n\n // Step 3: Verify SSE streams are functional by reading events\n // Only test streams that returned SSE content-type\n const eventResults = await Promise.all(\n streamResponses.map(async (response, index) => {\n const contentType = response.headers.get('content-type');\n\n // Skip non-SSE responses (JSON responses are also valid)\n if (!contentType?.includes('text/event-stream')) {\n return { index, type: 'json', skipped: true };\n }\n\n if (!response.ok || !response.body) {\n return { index, type: 'sse', error: 'Stream not available' };\n }\n\n try {\n const reader = response.body\n .pipeThrough(new TextDecoderStream())\n .pipeThrough(new EventSourceParserStream())\n .getReader();\n\n // Wait for one event with timeout\n const timeoutPromise = new Promise((resolve) =>\n setTimeout(() => resolve(null), 2000)\n );\n\n const eventPromise = reader.read().then(({ value }) => value);\n\n const event = await Promise.race([eventPromise, timeoutPromise]);\n\n // Cancel reader\n await reader.cancel();\n\n return { index, type: 'sse', event };\n } catch (error) {\n return {\n index,\n type: 'sse',\n error: error instanceof Error ? error.message : String(error)\n };\n }\n })\n );\n\n // Count functional SSE streams (received event or timed out waiting - both are valid)\n const sseResults = eventResults.filter((r) => r.type === 'sse');\n const functionalSseStreams = sseResults.filter(\n (r) => !('error' in r)\n ).length;\n\n // If server returned SSE streams, they should be functional\n if (sseStreams > 0) {\n checks.push({\n id: 'server-sse-streams-functional',\n name: 'ServerSSEStreamsFunctional',\n description: 'Multiple POST SSE streams should be functional',\n status:\n functionalSseStreams === sseStreams\n ? 'SUCCESS'\n : functionalSseStreams > 0\n ? 'WARNING'\n : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n numSseStreams: sseStreams,\n functionalSseStreams,\n results: eventResults\n },\n errorMessage:\n functionalSseStreams < sseStreams\n ? `Only ${functionalSseStreams}/${sseStreams} SSE streams were functional`\n : undefined\n });\n } else {\n // Server returned JSON for all requests - this is valid but worth noting\n checks.push({\n id: 'server-sse-streams-functional',\n name: 'ServerSSEStreamsFunctional',\n description: 'Server returned JSON responses (SSE streams optional)',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n numSseStreams: 0,\n message:\n 'Server returned JSON for all requests - SSE streaming is optional',\n results: eventResults\n }\n });\n }\n } catch (error) {\n checks.push({\n id: 'server-sse-multiple-streams-error',\n name: 'ServerSSEMultipleStreamsTest',\n description: 'Test server multiple SSE streams behavior',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Error: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ]\n });\n } finally {\n // Clean up\n if (client) {\n try {\n await client.close();\n } catch {\n // Ignore cleanup errors\n }\n }\n }\n\n return checks;\n }\n}\n",[],[141,254,272,306],"bab2c6a0-5b64-11f1-a593-ee650bb23af1","resources.ts","bab2c74a-5b64-11f1-a593-ee650bb23af1",18,["D",1780062361226],"/**\n * Resources test scenarios for MCP servers\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport { connectToServer } from './client-helper.ts';\nimport { sendStatelessRequest } from './stateless-client.ts';\nimport {\n TextResourceContents,\n BlobResourceContents\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\n\nexport class ResourcesListScenario implements ClientScenario {\n name = 'resources-list';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test listing available resources.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`resources/list\\`\n\n**Requirements**:\n- Return array of all available **direct resources** (not templates)\n- Each resource MUST have:\n - \\`uri\\` (string)\n - \\`name\\` (string)\n - \\`description\\` (string)\n - \\`mimeType\\` (string, optional)`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.listResources();\n\n // Validate response structure\n const errors: string[] = [];\n if (!result.resources) {\n errors.push('Missing resources array');\n } else {\n if (!Array.isArray(result.resources)) {\n errors.push('resources is not an array');\n }\n\n result.resources.forEach((resource, index) => {\n if (!resource.uri) errors.push(`Resource ${index}: missing uri`);\n if (!resource.name) errors.push(`Resource ${index}: missing name`);\n });\n }\n\n checks.push({\n id: 'resources-list',\n name: 'ResourcesList',\n description: 'Server lists available resources with valid structure',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Resources-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#listing-resources'\n }\n ],\n details: {\n resourceCount: result.resources?.length || 0,\n resources: result.resources?.map((r) => r.uri)\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'resources-list',\n name: 'ResourcesList',\n description: 'Server lists available resources with valid structure',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#listing-resources'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ResourcesReadTextScenario implements ClientScenario {\n name = 'resources-read-text';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test reading text resource.\n\n**Server Implementation Requirements:**\n\nImplement resource \\`test://static-text\\` that returns:\n\n\\`\\`\\`json\n{\n \"contents\": [\n {\n \"uri\": \"test://static-text\",\n \"mimeType\": \"text/plain\",\n \"text\": \"This is the content of the static text resource.\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.readResource({\n uri: 'test://static-text'\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.contents) errors.push('Missing contents array');\n if (!Array.isArray(result.contents))\n errors.push('contents is not an array');\n if (result.contents.length === 0) errors.push('contents array is empty');\n\n const content = result.contents[0] as TextResourceContents | undefined;\n if (content) {\n if (!content.uri) errors.push('Content missing uri');\n if (!content.mimeType) errors.push('Content missing mimeType');\n if (!content.text) errors.push('Content missing text field');\n }\n\n checks.push({\n id: 'resources-read-text',\n name: 'ResourcesReadText',\n description: 'Read text resource successfully',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Resources-Read',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#reading-resources'\n }\n ],\n details: {\n uri: content?.uri,\n mimeType: content?.mimeType,\n hasText: !!content?.text\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'resources-read-text',\n name: 'ResourcesReadText',\n description: 'Read text resource successfully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-Read',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#reading-resources'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ResourcesReadBinaryScenario implements ClientScenario {\n name = 'resources-read-binary';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test reading binary resource.\n\n**Server Implementation Requirements:**\n\nImplement resource \\`test://static-binary\\` that returns:\n\n\\`\\`\\`json\n{\n \"contents\": [\n {\n \"uri\": \"test://static-binary\",\n \"mimeType\": \"image/png\",\n \"blob\": \"\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.readResource({\n uri: 'test://static-binary'\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.contents) errors.push('Missing contents array');\n if (result.contents.length === 0) errors.push('contents array is empty');\n\n const content = result.contents[0] as BlobResourceContents | undefined;\n if (content) {\n if (!content.uri) errors.push('Content missing uri');\n if (!content.mimeType) errors.push('Content missing mimeType');\n if (!content.blob) errors.push('Content missing blob field');\n }\n\n checks.push({\n id: 'resources-read-binary',\n name: 'ResourcesReadBinary',\n description: 'Read binary resource successfully',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Resources-Read',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#reading-resources'\n }\n ],\n details: {\n uri: content?.uri,\n mimeType: content?.mimeType,\n hasBlob: !!content?.blob\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'resources-read-binary',\n name: 'ResourcesReadBinary',\n description: 'Read binary resource successfully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-Read',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#reading-resources'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ResourcesTemplateReadScenario implements ClientScenario {\n name = 'resources-templates-read';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test reading resource from template.\n\n**Server Implementation Requirements:**\n\nImplement resource template \\`test://template/{id}/data\\` that substitutes parameters.\n\n**Behavior**: When client requests \\`test://template/123/data\\`, substitute \\`{id}\\` with \\`123\\`\n\nReturns (for \\`uri: \"test://template/123/data\"\\`):\n\n\\`\\`\\`json\n{\n \"contents\": [\n {\n \"uri\": \"test://template/123/data\",\n \"mimeType\": \"application/json\",\n \"text\": \"{\"id\":\"123\",\"templateTest\":true,\"data\":\"Data for ID: 123\"}\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.readResource({\n uri: 'test://template/123/data'\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.contents) errors.push('Missing contents array');\n if (result.contents.length === 0) errors.push('contents array is empty');\n\n const content = result.contents[0];\n if (content) {\n if (!content.uri) errors.push('Content missing uri');\n const hasText = 'text' in content;\n const hasBlob = 'blob' in content;\n if (!hasText && !hasBlob) errors.push('Content missing text or blob');\n\n const text = hasText\n ? (content as TextResourceContents).text\n : hasBlob\n ? '[binary]'\n : '';\n if (typeof text === 'string' && !text.includes('123')) {\n errors.push('Parameter substitution not reflected in content');\n }\n }\n\n checks.push({\n id: 'resources-templates-read',\n name: 'ResourcesTemplateRead',\n description: 'Read resource from template with parameter substitution',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Resources-Templates',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#resource-templates'\n }\n ],\n details: {\n uri: content?.uri,\n content: content\n ? 'text' in content\n ? (content as TextResourceContents).text\n : (content as BlobResourceContents).blob\n : undefined\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'resources-templates-read',\n name: 'ResourcesTemplateRead',\n description: 'Read resource from template with parameter substitution',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-Templates',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#resource-templates'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ResourcesSubscribeScenario implements ClientScenario {\n name = 'resources-subscribe';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test subscribing to resource updates.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`resources/subscribe\\`\n\n**Requirements**:\n- Accept subscription request with URI\n- Track subscribed URIs\n- Return empty object \\`{}\\`\n\nExample request:\n\n\\`\\`\\`json\n{\n \"method\": \"resources/subscribe\",\n \"params\": {\n \"uri\": \"test://watched-resource\"\n }\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n await connection.client.subscribeResource({\n uri: 'test://watched-resource'\n });\n\n checks.push({\n id: 'resources-subscribe',\n name: 'ResourcesSubscribe',\n description: 'Subscribe to resource successfully',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Resources-Subscribe',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#resource-subscriptions'\n }\n ]\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'resources-subscribe',\n name: 'ResourcesSubscribe',\n description: 'Subscribe to resource successfully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-Subscribe',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#resource-subscriptions'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class ResourcesNotFoundErrorScenario implements ClientScenario {\n name = 'sep-2164-resource-not-found';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test error handling for non-existent resources (SEP-2164).\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`resources/read\\`\n\nWhen a client requests a URI that does not correspond to any resource, the server:\n\n- **MUST NOT** return a result with an empty \\`contents\\` array\n- **SHOULD** return a JSON-RPC error with code \\`-32602\\` (Invalid Params)\n- **SHOULD** include the requested \\`uri\\` in the error \\`data\\` field\n\nExample error response:\n\n\\`\\`\\`json\n{\n \"jsonrpc\": \"2.0\",\n \"id\": 2,\n \"error\": {\n \"code\": -32602,\n \"message\": \"Resource not found\",\n \"data\": {\n \"uri\": \"test://nonexistent-resource-for-conformance-testing\"\n }\n }\n}\n\\`\\`\\`\n\nThis scenario does not require the server to register any specific resource — it tests behavior when reading a URI the server does not recognize.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n const nonexistentUri =\n 'test://nonexistent-resource-for-conformance-testing';\n const specReferences = [\n {\n id: 'SEP-2164',\n url: 'https://modelcontextprotocol.io/specification/draft/server/resources#error-handling'\n }\n ];\n\n // SEP-2164 is a draft-spec requirement, so the request is sent statelessly\n // with the draft protocol version and the cross-cutting _meta/headers.\n let response;\n try {\n response = await sendStatelessRequest(serverUrl, 'resources/read', {\n uri: nonexistentUri\n });\n } catch (error) {\n checks.push({\n id: 'sep-2164-error-code',\n name: 'ResourcesNotFoundErrorCode',\n description:\n 'Server returns -32602 (Invalid Params) for non-existent resource',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `resources/read request failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences\n });\n return checks;\n }\n\n const result = response.body?.result as\n | { contents?: unknown[] }\n | undefined;\n const rpcError = response.body?.error;\n\n // Check 1: MUST NOT return an empty contents array\n const returnedEmptyContents =\n result !== undefined && (result.contents?.length ?? 0) === 0;\n checks.push({\n id: 'sep-2164-no-empty-contents',\n name: 'ResourcesNotFoundNoEmptyContents',\n description:\n 'Server does not return an empty contents array for a non-existent resource',\n status: returnedEmptyContents ? 'FAILURE' : 'SUCCESS',\n timestamp: new Date().toISOString(),\n errorMessage: returnedEmptyContents\n ? 'Server returned a result with an empty contents array. Servers MUST NOT return an empty contents array for non-existent resources.'\n : undefined,\n specReferences,\n details: {\n requestedUri: nonexistentUri,\n receivedResult: result !== undefined,\n contentsLength: result?.contents?.length\n }\n });\n\n // Check 2: SHOULD return JSON-RPC error with code -32602\n const errorCode = rpcError?.code;\n let errorCodeMessage: string | undefined;\n if (result !== undefined) {\n errorCodeMessage = `Server returned a result instead of an error (contents length: ${result.contents?.length ?? 'undefined'}). Servers SHOULD return a JSON-RPC error for non-existent resources.`;\n } else if (!rpcError) {\n errorCodeMessage = `Expected a JSON-RPC error, got HTTP ${response.status} with no JSON-RPC error in the body.`;\n } else if (errorCode !== -32602) {\n errorCodeMessage =\n `Expected error code -32602 (Invalid Params), got ${errorCode}. ` +\n (errorCode === -32002\n ? 'Code -32002 was used in earlier spec versions but SEP-2164 standardizes on -32602.'\n : '');\n }\n\n checks.push({\n id: 'sep-2164-error-code',\n name: 'ResourcesNotFoundErrorCode',\n description:\n 'Server returns -32602 (Invalid Params) for non-existent resource (SHOULD)',\n status: errorCodeMessage === undefined ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: errorCodeMessage,\n specReferences,\n details: {\n requestedUri: nonexistentUri,\n receivedErrorCode: errorCode,\n receivedResult: result !== undefined\n }\n });\n\n // Check 3: SHOULD include uri in error data field\n const errorData = rpcError?.data as { uri?: string } | undefined;\n const dataUriMatches = errorData?.uri === nonexistentUri;\n\n checks.push({\n id: 'sep-2164-data-uri',\n name: 'ResourcesNotFoundDataUri',\n description:\n 'Server includes the requested URI in the error data field (SHOULD)',\n status: rpcError ? (dataUriMatches ? 'SUCCESS' : 'WARNING') : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: rpcError\n ? dataUriMatches\n ? undefined\n : `Error data.uri is ${JSON.stringify(errorData?.uri)}, expected \"${nonexistentUri}\". This is a SHOULD requirement.`\n : 'No JSON-RPC error received; cannot evaluate data field.',\n specReferences,\n details: {\n requestedUri: nonexistentUri,\n receivedDataUri: errorData?.uri\n }\n });\n\n return checks;\n }\n}\n\nexport class ResourcesUnsubscribeScenario implements ClientScenario {\n name = 'resources-unsubscribe';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test unsubscribing from resource.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`resources/unsubscribe\\`\n\n**Requirements**:\n- Accept unsubscribe request with URI\n- Remove URI from subscriptions\n- Stop sending update notifications for that URI\n- Return empty object \\`{}\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n // First subscribe\n await connection.client.subscribeResource({\n uri: 'test://watched-resource'\n });\n\n // Then unsubscribe\n await connection.client.unsubscribeResource({\n uri: 'test://watched-resource'\n });\n\n checks.push({\n id: 'resources-unsubscribe',\n name: 'ResourcesUnsubscribe',\n description: 'Unsubscribe from resource successfully',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Resources-Subscribe',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/schema#unsubscriberequest'\n }\n ]\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'resources-unsubscribe',\n name: 'ResourcesUnsubscribe',\n description: 'Unsubscribe from resource successfully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Resources-Subscribe',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/resources#resource-subscriptions'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[141,254,272,314],"ba7caa16-5b64-11f1-bb92-ee650bb23af1","prompts.ts","ba7caade-5b64-11f1-bb92-ee650bb23af1",17,["D",1780062360842],"/**\n * Prompts test scenarios for MCP servers\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../types.ts';\nimport { connectToServer } from './client-helper.ts';\n\nexport class PromptsListScenario implements ClientScenario {\n name = 'prompts-list';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test listing available prompts.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`prompts/list\\`\n\n**Requirements**:\n- Return array of all available prompts\n- Each prompt MUST have:\n - \\`name\\` (string)\n - \\`description\\` (string)\n - \\`arguments\\` (array, optional) - list of required arguments`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.listPrompts();\n\n // Validate response structure\n const errors: string[] = [];\n if (!result.prompts) {\n errors.push('Missing prompts array');\n } else {\n if (!Array.isArray(result.prompts)) {\n errors.push('prompts is not an array');\n }\n\n result.prompts.forEach((prompt, index) => {\n if (!prompt.name) errors.push(`Prompt ${index}: missing name`);\n if (!prompt.description)\n errors.push(`Prompt ${index}: missing description`);\n });\n }\n\n checks.push({\n id: 'prompts-list',\n name: 'PromptsList',\n description: 'Server lists available prompts with valid structure',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Prompts-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#listing-prompts'\n }\n ],\n details: {\n promptCount: result.prompts?.length || 0,\n prompts: result.prompts?.map((p) => p.name)\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'prompts-list',\n name: 'PromptsList',\n description: 'Server lists available prompts with valid structure',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Prompts-List',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#listing-prompts'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class PromptsGetSimpleScenario implements ClientScenario {\n name = 'prompts-get-simple';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test getting a simple prompt without arguments.\n\n**Server Implementation Requirements:**\n\nImplement a prompt named \\`test_simple_prompt\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"text\",\n \"text\": \"This is a simple prompt for testing.\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.getPrompt({\n name: 'test_simple_prompt'\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.messages) errors.push('Missing messages array');\n if (!Array.isArray(result.messages))\n errors.push('messages is not an array');\n if (result.messages.length === 0) errors.push('messages array is empty');\n\n result.messages.forEach((message: any, index: number) => {\n if (!message.role) errors.push(`Message ${index}: missing role`);\n if (!message.content) errors.push(`Message ${index}: missing content`);\n });\n\n checks.push({\n id: 'prompts-get-simple',\n name: 'PromptsGetSimple',\n description: 'Get simple prompt successfully',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Prompts-Get',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#getting-prompts'\n }\n ],\n details: {\n messageCount: result.messages?.length || 0\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'prompts-get-simple',\n name: 'PromptsGetSimple',\n description: 'Get simple prompt successfully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Prompts-Get',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#getting-prompts'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class PromptsGetWithArgsScenario implements ClientScenario {\n name = 'prompts-get-with-args';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test parameterized prompt.\n\n**Server Implementation Requirements:**\n\nImplement a prompt named \\`test_prompt_with_arguments\\` with arguments:\n- \\`arg1\\` (string, required) - First test argument\n- \\`arg2\\` (string, required) - Second test argument\n\nReturns (with args \\`{arg1: \"hello\", arg2: \"world\"}\\`):\n\n\\`\\`\\`json\n{\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"text\",\n \"text\": \"Prompt with arguments: arg1='hello', arg2='world'\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.getPrompt({\n name: 'test_prompt_with_arguments',\n arguments: {\n arg1: 'testValue1',\n arg2: 'testValue2'\n }\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.messages) errors.push('Missing messages array');\n if (result.messages.length === 0) errors.push('messages array is empty');\n\n // Check if arguments were substituted\n const messageText = JSON.stringify(result.messages);\n if (!messageText.includes('testValue1')) {\n errors.push('arg1 not substituted in prompt');\n }\n if (!messageText.includes('testValue2')) {\n errors.push('arg2 not substituted in prompt');\n }\n\n checks.push({\n id: 'prompts-get-with-args',\n name: 'PromptsGetWithArgs',\n description: 'Get parameterized prompt with argument substitution',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Prompts-Get',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#getting-prompts'\n }\n ],\n details: {\n messageCount: result.messages?.length || 0,\n messages: result.messages\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'prompts-get-with-args',\n name: 'PromptsGetWithArgs',\n description: 'Get parameterized prompt with argument substitution',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Prompts-Get',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#getting-prompts'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class PromptsGetEmbeddedResourceScenario implements ClientScenario {\n name = 'prompts-get-embedded-resource';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test prompt with embedded resource content.\n\n**Server Implementation Requirements:**\n\nImplement a prompt named \\`test_prompt_with_embedded_resource\\` with argument:\n- \\`resourceUri\\` (string, required) - URI of the resource to embed\n\nReturns:\n\n\\`\\`\\`json\n{\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"resource\",\n \"resource\": {\n \"uri\": \"\",\n \"mimeType\": \"text/plain\",\n \"text\": \"Embedded resource content for testing.\"\n }\n }\n },\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"text\",\n \"text\": \"Please process the embedded resource above.\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.getPrompt({\n name: 'test_prompt_with_embedded_resource',\n arguments: {\n resourceUri: 'test://example-resource'\n }\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.messages) errors.push('Missing messages array');\n\n // Look for resource content\n const hasResourceContent = result.messages.some(\n (msg: any) =>\n msg.content?.type === 'resource' ||\n msg.content?.resource !== undefined\n );\n\n if (!hasResourceContent) {\n errors.push('No embedded resource found in prompt');\n }\n\n checks.push({\n id: 'prompts-get-embedded-resource',\n name: 'PromptsGetEmbeddedResource',\n description: 'Get prompt with embedded resource',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Prompts-Embedded-Resources',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#embedded-resources'\n }\n ],\n details: {\n messageCount: result.messages?.length || 0,\n messages: result.messages\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'prompts-get-embedded-resource',\n name: 'PromptsGetEmbeddedResource',\n description: 'Get prompt with embedded resource',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Prompts-Embedded-Resources',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#embedded-resources'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n\nexport class PromptsGetWithImageScenario implements ClientScenario {\n name = 'prompts-get-with-image';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test prompt with image content.\n\n**Server Implementation Requirements:**\n\nImplement a prompt named \\`test_prompt_with_image\\` with no arguments that returns:\n\n\\`\\`\\`json\n{\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"image\",\n \"data\": \"\",\n \"mimeType\": \"image/png\"\n }\n },\n {\n \"role\": \"user\",\n \"content\": {\n \"type\": \"text\",\n \"text\": \"Please analyze the image above.\"\n }\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n const result = await connection.client.getPrompt({\n name: 'test_prompt_with_image'\n });\n\n // Validate response\n const errors: string[] = [];\n if (!result.messages) errors.push('Missing messages array');\n\n // Look for image content\n const hasImageContent = result.messages.some(\n (msg: any) =>\n msg.content?.type === 'image' &&\n msg.content?.data &&\n msg.content?.mimeType\n );\n\n if (!hasImageContent) {\n errors.push('No image content found in prompt');\n }\n\n checks.push({\n id: 'prompts-get-with-image',\n name: 'PromptsGetWithImage',\n description: 'Get prompt with image content',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [\n {\n id: 'MCP-Prompts-Image',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#image-content'\n }\n ],\n details: {\n messageCount: result.messages?.length || 0\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'prompts-get-with-image',\n name: 'PromptsGetWithImage',\n description: 'Get prompt with image content',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Prompts-Image',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/prompts#image-content'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[141,254,272,322],"bcedad5e-5b64-11f1-bb30-ee650bb23af1","lifecycle.ts","bcedae58-5b64-11f1-bb30-ee650bb23af1",27,["D",1780062364884],"/**\n * Lifecycle test scenarios for MCP servers\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../types.ts';\nimport { connectToServer } from './client-helper.ts';\n\nconst VISIBLE_ASCII_REGEX = /^[\\x21-\\x7E]+$/;\n\nconst SESSION_SPEC_REFERENCES = [\n {\n id: 'MCP-Session-Management',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#session-management'\n }\n];\n\nexport class ServerInitializeScenario implements ClientScenario {\n name = 'server-initialize';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = `Test basic server initialization handshake.\n\n**Server Implementation Requirements:**\n\n**Endpoint**: \\`initialize\\`\n\n**Requirements**:\n- Accept \\`initialize\\` request with client info and capabilities\n- Return valid initialize response with server info, protocol version, and capabilities\n- Accept \\`initialized\\` notification from client after handshake\n- If a session ID is assigned, it MUST only contain visible ASCII characters (0x21 to 0x7E)\n\nThis test verifies the server can complete the two-phase initialization handshake successfully,\nand validates session ID format if one is assigned.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n // The connection process already does initialization\n // Check that we have a connected client\n checks.push({\n id: 'server-initialize',\n name: 'ServerInitialize',\n description:\n 'Server responds to initialize request with valid structure',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Initialize',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle#initialization'\n }\n ],\n details: {\n serverUrl,\n connected: true\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'server-initialize',\n name: 'ServerInitialize',\n description:\n 'Server responds to initialize request with valid structure',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to initialize: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'MCP-Initialize',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle#initialization'\n }\n ]\n });\n return checks;\n }\n\n // Check: Session ID visible ASCII validation\n // Use a raw fetch to inspect the MCP-Session-Id response header,\n // since the SDK client transport does not expose it.\n try {\n const response = await fetch(serverUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Accept: 'application/json, text/event-stream',\n 'mcp-protocol-version': '2025-11-25'\n },\n body: JSON.stringify({\n jsonrpc: '2.0',\n id: 1,\n method: 'initialize',\n params: {\n protocolVersion: '2025-11-25',\n capabilities: {},\n clientInfo: {\n name: 'conformance-session-id-test',\n version: '1.0.0'\n }\n }\n })\n });\n\n const sessionId = response.headers.get('mcp-session-id');\n\n if (!sessionId) {\n checks.push({\n id: 'server-session-id-visible-ascii',\n name: 'ServerSessionIdVisibleAscii',\n description:\n 'Server-provided session ID uses only visible ASCII characters',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: SESSION_SPEC_REFERENCES,\n details: {\n message:\n 'Server did not provide an MCP-Session-Id header (session ID is optional)'\n }\n });\n } else if (VISIBLE_ASCII_REGEX.test(sessionId)) {\n checks.push({\n id: 'server-session-id-visible-ascii',\n name: 'ServerSessionIdVisibleAscii',\n description:\n 'Server-provided session ID uses only visible ASCII characters',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: SESSION_SPEC_REFERENCES,\n details: {\n sessionId\n }\n });\n } else {\n checks.push({\n id: 'server-session-id-visible-ascii',\n name: 'ServerSessionIdVisibleAscii',\n description:\n 'Server-provided session ID uses only visible ASCII characters',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Session ID contains characters outside visible ASCII range (0x21-0x7E)',\n specReferences: SESSION_SPEC_REFERENCES,\n details: {\n sessionId\n }\n });\n }\n } catch (error) {\n checks.push({\n id: 'server-session-id-visible-ascii',\n name: 'ServerSessionIdVisibleAscii',\n description:\n 'Server-provided session ID uses only visible ASCII characters',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to send initialize request for session ID check: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: SESSION_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n",[],[141,254,272,330],"bbb74904-5b64-11f1-bb30-ee650bb23af1","json-schema-2020-12.ts","bbb749e0-5b64-11f1-bb30-ee650bb23af1",23,["D",1780062362933],"/**\n * JSON Schema 2020-12 conformance test scenario (SEP-1613, SEP-2106)\n *\n * Validates that MCP servers correctly preserve JSON Schema 2020-12 keywords\n * in tool definitions, ensuring implementations don't strip $schema, $defs,\n * or additionalProperties fields (SEP-1613).\n *\n * SEP-2106 broadened inputSchema to permit the full JSON Schema 2020-12\n * vocabulary alongside the required root `type: \"object\"`. This scenario also\n * verifies that composition (allOf/anyOf), conditional (if/then/else), and\n * reference ($anchor) keywords survive tools/list rather than being stripped.\n */\n\nimport {\n CheckStatus,\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport { connectToServer } from './client-helper.ts';\n\nconst EXPECTED_TOOL_NAME = 'json_schema_2020_12_tool';\nconst EXPECTED_SCHEMA_DIALECT = 'https://json-schema.org/draft/2020-12/schema';\n\n/**\n * Soft version gate for the SEP-2106 keyword-preservation checks.\n *\n * Preserving the broader JSON Schema 2020-12 vocabulary is good behavior at\n * any protocol version, so a server that preserves the keywords gets SUCCESS\n * regardless of what it negotiated. Stripping them is only a conformance\n * FAILURE once the server claims a protocol version that includes SEP-2106\n * (the draft); a server that only negotiated an earlier dated version is not\n * yet subject to the requirement, so the check is SKIPPED rather than failed.\n */\nexport function sep2106KeywordCheckStatus(\n preserved: boolean,\n negotiatedProtocolVersion: string | undefined\n): CheckStatus {\n if (preserved) {\n return 'SUCCESS';\n }\n return negotiatedProtocolVersion === DRAFT_PROTOCOL_VERSION\n ? 'FAILURE'\n : 'SKIPPED';\n}\n\nexport class JsonSchema2020_12Scenario implements ClientScenario {\n name = 'json-schema-2020-12';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description = `Validates JSON Schema 2020-12 keyword preservation (SEP-1613, SEP-2106).\n\n**Server Implementation Requirements:**\n\nImplement tool \\`${EXPECTED_TOOL_NAME}\\` with inputSchema containing JSON Schema 2020-12 features, including the broader vocabulary permitted by SEP-2106 (an \\`$anchor\\` inside \\`$defs\\`, composition keywords \\`allOf\\`/\\`anyOf\\`, and conditional keywords \\`if\\`/\\`then\\`/\\`else\\`):\n\n\\`\\`\\`json\n{\n \"name\": \"${EXPECTED_TOOL_NAME}\",\n \"description\": \"Tool with JSON Schema 2020-12 features\",\n \"inputSchema\": {\n \"$schema\": \"${EXPECTED_SCHEMA_DIALECT}\",\n \"type\": \"object\",\n \"$defs\": {\n \"address\": {\n \"$anchor\": \"addressDef\",\n \"type\": \"object\",\n \"properties\": {\n \"street\": { \"type\": \"string\" },\n \"city\": { \"type\": \"string\" }\n }\n }\n },\n \"properties\": {\n \"name\": { \"type\": \"string\" },\n \"address\": { \"$ref\": \"#/$defs/address\" },\n \"contactMethod\": { \"type\": \"string\", \"enum\": [\"phone\", \"email\"] },\n \"phone\": { \"type\": \"string\" },\n \"email\": { \"type\": \"string\" }\n },\n \"allOf\": [\n { \"anyOf\": [{ \"required\": [\"phone\"] }, { \"required\": [\"email\"] }] }\n ],\n \"if\": {\n \"properties\": { \"contactMethod\": { \"const\": \"phone\" } },\n \"required\": [\"contactMethod\"]\n },\n \"then\": { \"required\": [\"phone\"] },\n \"else\": { \"required\": [\"email\"] },\n \"additionalProperties\": false\n }\n}\n\\`\\`\\`\n\n**Verification**: The test verifies that \\`$schema\\`, \\`$defs\\`, and \\`additionalProperties\\` are preserved (SEP-1613), and that the composition (\\`allOf\\`/\\`anyOf\\`), conditional (\\`if\\`/\\`then\\`/\\`else\\`), and \\`$anchor\\` keywords are preserved (SEP-2106), in the tool listing response.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n const specReferences = [\n {\n id: 'SEP-1613',\n url: 'https://github.com/modelcontextprotocol/specification/pull/655'\n }\n ];\n const sep2106References = [\n {\n id: 'SEP-2106',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2106'\n }\n ];\n\n try {\n const connection = await connectToServer(serverUrl);\n // Negotiated wire protocolVersion from the initialize handshake; used to\n // soft-gate the SEP-2106 checks below.\n const negotiatedVersion = (\n connection.client.transport as { protocolVersion?: string } | undefined\n )?.protocolVersion;\n const result = await connection.client.listTools();\n\n // Find the test tool\n const tool = result.tools?.find((t) => t.name === EXPECTED_TOOL_NAME);\n\n // Check 1: Tool exists\n checks.push({\n id: 'json-schema-2020-12-tool-found',\n name: 'JsonSchema2020_12ToolFound',\n description: `Server advertises tool '${EXPECTED_TOOL_NAME}'`,\n status: tool ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: tool\n ? undefined\n : `Tool '${EXPECTED_TOOL_NAME}' not found. Available tools: ${result.tools?.map((t) => t.name).join(', ') || 'none'}`,\n specReferences,\n details: {\n toolFound: !!tool,\n availableTools: result.tools?.map((t) => t.name) || []\n }\n });\n\n if (!tool) {\n await connection.close();\n return checks;\n }\n\n const inputSchema = tool.inputSchema as Record;\n\n // Check 2: $schema field preserved\n const hasSchema = '$schema' in inputSchema;\n const schemaValue = inputSchema['$schema'];\n const schemaCorrect = schemaValue === EXPECTED_SCHEMA_DIALECT;\n\n checks.push({\n id: 'json-schema-2020-12-$schema',\n name: 'JsonSchema2020_12$Schema',\n description: `inputSchema.$schema field preserved with value '${EXPECTED_SCHEMA_DIALECT}'`,\n status: hasSchema && schemaCorrect ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: !hasSchema\n ? '$schema field missing from inputSchema - field was likely stripped'\n : !schemaCorrect\n ? `$schema has unexpected value: ${JSON.stringify(schemaValue)}`\n : undefined,\n specReferences,\n details: {\n hasSchema,\n schemaValue,\n expected: EXPECTED_SCHEMA_DIALECT\n }\n });\n\n // Check 3: $defs field preserved\n const hasDefs = '$defs' in inputSchema;\n const defsValue = inputSchema['$defs'] as\n | Record\n | undefined;\n const defsHasAddress = defsValue && 'address' in defsValue;\n\n checks.push({\n id: 'json-schema-2020-12-$defs',\n name: 'JsonSchema2020_12$Defs',\n description:\n 'inputSchema.$defs field preserved with expected structure',\n status: hasDefs && defsHasAddress ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: !hasDefs\n ? '$defs field missing from inputSchema - field was likely stripped'\n : !defsHasAddress\n ? '$defs exists but missing expected \"address\" definition'\n : undefined,\n specReferences,\n details: {\n hasDefs,\n defsKeys: defsValue ? Object.keys(defsValue) : [],\n defsValue\n }\n });\n\n // Check 4: additionalProperties field preserved\n const hasAdditionalProps = 'additionalProperties' in inputSchema;\n const additionalPropsValue = inputSchema['additionalProperties'];\n const additionalPropsCorrect = additionalPropsValue === false;\n\n checks.push({\n id: 'json-schema-2020-12-additionalProperties',\n name: 'JsonSchema2020_12AdditionalProperties',\n description: 'inputSchema.additionalProperties field preserved',\n status:\n hasAdditionalProps && additionalPropsCorrect ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: !hasAdditionalProps\n ? 'additionalProperties field missing from inputSchema - field was likely stripped'\n : !additionalPropsCorrect\n ? `additionalProperties has unexpected value: ${JSON.stringify(additionalPropsValue)}, expected: false`\n : undefined,\n specReferences,\n details: {\n hasAdditionalProps,\n additionalPropsValue,\n expected: false\n }\n });\n\n // SEP-2106: the full JSON Schema 2020-12 vocabulary is permitted in\n // inputSchema and must survive tools/list rather than being stripped to\n // properties/required. These checks are soft-gated on the negotiated\n // protocol version (see sep2106KeywordCheckStatus): stripping the\n // keywords is only a FAILURE for servers that negotiated the draft\n // protocol version, and SKIPPED otherwise.\n const skippedSuffix = ` (server negotiated protocol version ${negotiatedVersion ?? 'unknown'}; SEP-2106 applies from ${DRAFT_PROTOCOL_VERSION})`;\n\n // Check 5: composition keywords (allOf / anyOf) preserved\n const allOf = inputSchema['allOf'];\n const hasAllOf = Array.isArray(allOf) && allOf.length > 0;\n const hasNestedAnyOf =\n Array.isArray(allOf) &&\n allOf.some(\n (sub) =>\n typeof sub === 'object' &&\n sub !== null &&\n Array.isArray((sub as Record)['anyOf'])\n );\n const compositionPreserved = hasAllOf && hasNestedAnyOf;\n const compositionStatus = sep2106KeywordCheckStatus(\n compositionPreserved,\n negotiatedVersion\n );\n\n checks.push({\n id: 'sep-2106-composition-keywords-preserved',\n name: 'JsonSchema2020_12CompositionKeywords',\n description:\n 'inputSchema composition keywords (allOf/anyOf) preserved (SEP-2106)',\n status: compositionStatus,\n timestamp: new Date().toISOString(),\n errorMessage: compositionPreserved\n ? undefined\n : (!hasAllOf\n ? 'allOf keyword missing from inputSchema - composition keyword was likely stripped'\n : 'nested anyOf missing from allOf - composition keyword was likely stripped') +\n (compositionStatus === 'SKIPPED' ? skippedSuffix : ''),\n specReferences: sep2106References,\n details: {\n hasAllOf,\n hasNestedAnyOf,\n negotiatedProtocolVersion: negotiatedVersion\n }\n });\n\n // Check 6: conditional keywords (if / then / else) preserved\n const hasIf = 'if' in inputSchema;\n const hasThen = 'then' in inputSchema;\n const hasElse = 'else' in inputSchema;\n const conditionalPreserved = hasIf && hasThen && hasElse;\n const conditionalStatus = sep2106KeywordCheckStatus(\n conditionalPreserved,\n negotiatedVersion\n );\n\n checks.push({\n id: 'sep-2106-conditional-keywords-preserved',\n name: 'JsonSchema2020_12ConditionalKeywords',\n description:\n 'inputSchema conditional keywords (if/then/else) preserved (SEP-2106)',\n status: conditionalStatus,\n timestamp: new Date().toISOString(),\n errorMessage: conditionalPreserved\n ? undefined\n : `Conditional keywords missing (if=${hasIf}, then=${hasThen}, else=${hasElse}) - likely stripped` +\n (conditionalStatus === 'SKIPPED' ? skippedSuffix : ''),\n specReferences: sep2106References,\n details: {\n hasIf,\n hasThen,\n hasElse,\n negotiatedProtocolVersion: negotiatedVersion\n }\n });\n\n // Check 7: reference keyword ($anchor) preserved within $defs.address\n const addressDef = defsValue?.['address'] as\n | Record\n | undefined;\n const hasAnchor = !!addressDef && '$anchor' in addressDef;\n const anchorStatus = sep2106KeywordCheckStatus(\n hasAnchor,\n negotiatedVersion\n );\n\n checks.push({\n id: 'sep-2106-anchor-keyword-preserved',\n name: 'JsonSchema2020_12AnchorKeyword',\n description:\n 'inputSchema reference keyword ($anchor) preserved in $defs (SEP-2106)',\n status: anchorStatus,\n timestamp: new Date().toISOString(),\n errorMessage: hasAnchor\n ? undefined\n : '$anchor missing from $defs.address - reference keyword was likely stripped' +\n (anchorStatus === 'SKIPPED' ? skippedSuffix : ''),\n specReferences: sep2106References,\n details: {\n hasAnchor,\n anchorValue: addressDef?.['$anchor']\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'json-schema-2020-12-error',\n name: 'JsonSchema2020_12Error',\n description: 'JSON Schema 2020-12 conformance test',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences\n });\n }\n\n return checks;\n }\n}\n",[],[141,254,272,338],"b9d2f5e8-5b64-11f1-9c4b-ee650bb23af1","input-required-result.ts","b9d2f6c4-5b64-11f1-9c4b-ee650bb23af1",14,["D",1780062359756],"/**\n * SEP-2322: InputRequiredResult - Ephemeral Workflow Tests\n *\n * Tests the ephemeral (stateless) workflow where servers respond with\n * InputRequiredResult containing inputRequests and/or requestState, and\n * clients retry with inputResponses and echoed requestState.\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION,\n SpecVersion\n} from '../../types.ts';\nimport {\n sendRpc,\n isInputRequiredResult,\n isCompleteResult,\n mockElicitResponse,\n mockSamplingResponse,\n mockListRootsResponse,\n MRTR_SPEC_REFERENCES\n} from './input-required-result-helpers.ts';\n\n// ─── A1: Basic Elicitation ────────────────────────────────────────────────────\n\nexport class InputRequiredResultBasicElicitationScenario implements ClientScenario {\n name = 'input-required-result-basic-elicitation';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test basic ephemeral InputRequiredResult flow with a single elicitation input request (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_elicitation\\` (no arguments required).\n\n**Behavior (Round 1):** When called without \\`inputResponses\\`, return an \\`InputRequiredResult\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"user_name\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"What is your name?\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": {\n \"name\": { \"type\": \"string\" }\n },\n \"required\": [\"name\"]\n }\n }\n }\n }\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` containing the key \\`\"user_name\"\\`, return a complete result:\n\n\\`\\`\\`json\n{\n \"content\": [{ \"type\": \"text\", \"text\": \"Hello, !\" }]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1: Initial call — expect InputRequiredResult\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result) {\n r1Errors.push('No result in response');\n } else if (!isInputRequiredResult(r1Result)) {\n r1Errors.push(\n 'Expected InputRequiredResult but got a complete result. ' +\n 'Server should return resultType: \"input_required\" with inputRequests.'\n );\n } else {\n if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n } else if (!r1Result.inputRequests['user_name']) {\n r1Errors.push('inputRequests missing expected key \"user_name\"');\n } else {\n const req = r1Result.inputRequests['user_name'];\n if (req.method !== 'elicitation/create') {\n r1Errors.push(\n `Expected method \"elicitation/create\", got \"${req.method}\"`\n );\n }\n }\n }\n\n checks.push({\n id: 'sep-2322-elicitation-incomplete',\n name: 'InputRequiredResultElicitationIncomplete',\n description:\n 'Server returns InputRequiredResult with elicitation inputRequest',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Retry with inputResponses — expect complete result\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {},\n inputResponses: {\n user_name: mockElicitResponse({ name: 'Alice' })\n },\n ...(r1Result.requestState !== undefined\n ? { requestState: r1Result.requestState }\n : {})\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push(\n 'Expected complete result after retry with inputResponses'\n );\n } else {\n const content = r2Result.content as\n | Array<{ type: string; text?: string }>\n | undefined;\n if (!content || !Array.isArray(content) || content.length === 0) {\n r2Errors.push('Complete result missing content array');\n }\n }\n\n checks.push({\n id: 'sep-2322-elicitation-complete',\n name: 'InputRequiredResultElicitationComplete',\n description:\n 'Server returns complete result after retry with inputResponses',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-elicitation-incomplete',\n name: 'InputRequiredResultElicitationIncomplete',\n description:\n 'Server returns InputRequiredResult with elicitation inputRequest',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A2: Basic Sampling ──────────────────────────────────────────────────────\n\nexport class InputRequiredResultBasicSamplingScenario implements ClientScenario {\n name = 'input-required-result-basic-sampling';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test basic ephemeral InputRequiredResult flow with a single sampling input request (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_sampling\\` (no arguments required).\n\n**Behavior (Round 1):** When called without \\`inputResponses\\`, return an \\`InputRequiredResult\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"capital_question\": {\n \"method\": \"sampling/createMessage\",\n \"params\": {\n \"messages\": [{\n \"role\": \"user\",\n \"content\": { \"type\": \"text\", \"text\": \"What is the capital of France?\" }\n }],\n \"maxTokens\": 100\n }\n }\n }\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` containing the key \\`\"capital_question\"\\`, return a complete result with the sampling response text.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1: Initial call\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_sampling',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result) {\n r1Errors.push('No result in response');\n } else if (!isInputRequiredResult(r1Result)) {\n r1Errors.push(\n 'Expected InputRequiredResult with sampling inputRequest'\n );\n } else {\n if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n } else {\n const key = Object.keys(r1Result.inputRequests)[0];\n if (!key) {\n r1Errors.push('inputRequests map is empty');\n } else {\n const req = r1Result.inputRequests[key];\n if (req.method !== 'sampling/createMessage') {\n r1Errors.push(\n `Expected method \"sampling/createMessage\", got \"${req.method}\"`\n );\n }\n }\n }\n }\n\n checks.push({\n id: 'sep-2322-sampling-incomplete',\n name: 'InputRequiredResultSamplingIncomplete',\n description:\n 'Server returns InputRequiredResult with sampling inputRequest',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Retry with inputResponses\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const inputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_sampling',\n arguments: {},\n inputResponses: {\n [inputKey]: mockSamplingResponse('The capital of France is Paris.')\n },\n ...(r1Result.requestState !== undefined\n ? { requestState: r1Result.requestState }\n : {})\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push(\n 'Expected complete result after retry with sampling response'\n );\n }\n\n checks.push({\n id: 'sep-2322-sampling-complete',\n name: 'InputRequiredResultSamplingComplete',\n description:\n 'Server returns complete result after retry with sampling response',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-sampling-incomplete',\n name: 'InputRequiredResultSamplingIncomplete',\n description:\n 'Server returns InputRequiredResult with sampling inputRequest',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A3: Basic ListRoots ─────────────────────────────────────────────────────\n\nexport class InputRequiredResultBasicListRootsScenario implements ClientScenario {\n name = 'input-required-result-basic-list-roots';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test basic ephemeral InputRequiredResult flow with a single roots/list input request (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_list_roots\\` (no arguments required).\n\n**Behavior (Round 1):** When called without \\`inputResponses\\`, return an \\`InputRequiredResult\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"client_roots\": {\n \"method\": \"roots/list\",\n \"params\": {}\n }\n }\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` containing the key \\`\"client_roots\"\\` (a ListRootsResult with a \\`roots\\` array), return a complete result that references the provided roots.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1: Initial call\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_list_roots',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result) {\n r1Errors.push('No result in response');\n } else if (!isInputRequiredResult(r1Result)) {\n r1Errors.push(\n 'Expected InputRequiredResult with roots/list inputRequest'\n );\n } else {\n if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n } else {\n const key = Object.keys(r1Result.inputRequests)[0];\n if (!key) {\n r1Errors.push('inputRequests map is empty');\n } else {\n const req = r1Result.inputRequests[key];\n if (req.method !== 'roots/list') {\n r1Errors.push(\n `Expected method \"roots/list\", got \"${req.method}\"`\n );\n }\n }\n }\n }\n\n checks.push({\n id: 'sep-2322-list-roots-incomplete',\n name: 'InputRequiredResultListRootsIncomplete',\n description:\n 'Server returns InputRequiredResult with roots/list inputRequest',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Retry with inputResponses\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const inputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_list_roots',\n arguments: {},\n inputResponses: {\n [inputKey]: mockListRootsResponse()\n },\n ...(r1Result.requestState !== undefined\n ? { requestState: r1Result.requestState }\n : {})\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push(\n 'Expected complete result after retry with roots response'\n );\n }\n\n checks.push({\n id: 'sep-2322-list-roots-complete',\n name: 'InputRequiredResultListRootsComplete',\n description:\n 'Server returns complete result after retry with roots response',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-list-roots-incomplete',\n name: 'InputRequiredResultListRootsIncomplete',\n description:\n 'Server returns InputRequiredResult with roots/list inputRequest',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A4: Request State ──────────────────────────────────────────────────────\n\nexport class InputRequiredResultRequestStateScenario implements ClientScenario {\n name = 'input-required-result-request-state';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that requestState is correctly round-tripped in ephemeral InputRequiredResult flow (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_request_state\\` (no arguments required).\n\n**Behavior (Round 1):** Return an \\`InputRequiredResult\\` with both \\`inputRequests\\` and \\`requestState\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"confirm\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"Please confirm\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": { \"ok\": { \"type\": \"boolean\" } },\n \"required\": [\"ok\"]\n }\n }\n }\n },\n \"requestState\": \"\"\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` AND the echoed \\`requestState\\`, validate the state and return a complete result. The text content MUST include the word \"state-ok\" to confirm the server received and validated the requestState.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_request_state',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result || !isInputRequiredResult(r1Result)) {\n r1Errors.push('Expected InputRequiredResult');\n } else {\n if (!r1Result.requestState) {\n r1Errors.push('InputRequiredResult missing requestState');\n }\n if (typeof r1Result.requestState !== 'string') {\n r1Errors.push('requestState must be a string');\n }\n if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n }\n }\n\n checks.push({\n id: 'sep-2322-request-state-incomplete',\n name: 'InputRequiredResultRequestStateIncomplete',\n description:\n 'Server returns InputRequiredResult with both inputRequests and requestState',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Retry with inputResponses + requestState\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const inputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_request_state',\n arguments: {},\n inputResponses: {\n [inputKey]: mockElicitResponse({ ok: true })\n },\n requestState: r1Result.requestState\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push(\n 'Expected complete result after retry with requestState'\n );\n }\n\n checks.push({\n id: 'sep-2322-request-state-complete',\n name: 'InputRequiredResultRequestStateComplete',\n description:\n 'Server validates echoed requestState and returns complete result',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-request-state-incomplete',\n name: 'InputRequiredResultRequestStateIncomplete',\n description:\n 'Server returns InputRequiredResult with both inputRequests and requestState',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A5: Multiple Input Requests ─────────────────────────────────────────────\n\nexport class InputRequiredResultMultipleInputRequestsScenario implements ClientScenario {\n name = 'input-required-result-multiple-input-requests';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test multiple input requests in a single InputRequiredResult (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_multiple_inputs\\` (no arguments required).\n\n**Behavior (Round 1):** Return an \\`InputRequiredResult\\` with multiple \\`inputRequests\\` — elicitation, sampling, and roots/list — plus \\`requestState\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"user_name\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"What is your name?\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": { \"name\": { \"type\": \"string\" } },\n \"required\": [\"name\"]\n }\n }\n },\n \"greeting\": {\n \"method\": \"sampling/createMessage\",\n \"params\": {\n \"messages\": [{ \"role\": \"user\", \"content\": { \"type\": \"text\", \"text\": \"Generate a greeting\" } }],\n \"maxTokens\": 50\n }\n },\n \"client_roots\": {\n \"method\": \"roots/list\",\n \"params\": {}\n }\n },\n \"requestState\": \"\"\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` containing ALL keys and the echoed \\`requestState\\`, return a complete result.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_multiple_inputs',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result || !isInputRequiredResult(r1Result)) {\n r1Errors.push('Expected InputRequiredResult');\n } else if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n } else {\n if (!r1Result.requestState) {\n r1Errors.push('InputRequiredResult missing requestState');\n }\n\n const keys = Object.keys(r1Result.inputRequests);\n if (keys.length < 3) {\n r1Errors.push(\n `Expected at least 3 inputRequests, got ${keys.length}`\n );\n }\n\n // Check that required method types are present\n const methods = new Set(\n keys.map((k) => r1Result.inputRequests![k].method)\n );\n if (!methods.has('elicitation/create')) {\n r1Errors.push('Expected an elicitation/create inputRequest');\n }\n if (!methods.has('sampling/createMessage')) {\n r1Errors.push('Expected a sampling/createMessage inputRequest');\n }\n if (!methods.has('roots/list')) {\n r1Errors.push('Expected a roots/list inputRequest');\n }\n if (methods.size < 3) {\n r1Errors.push(\n 'Expected inputRequests with different method types (elicitation + sampling + roots/list)'\n );\n }\n }\n\n checks.push({\n id: 'sep-2322-multiple-inputs-incomplete',\n name: 'InputRequiredResultMultipleInputsIncomplete',\n description:\n 'Server returns InputRequiredResult with multiple inputRequests of different types',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Respond to all input requests\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const inputResponses: Record = {};\n for (const [key, req] of Object.entries(r1Result.inputRequests!)) {\n if (req.method === 'elicitation/create') {\n inputResponses[key] = mockElicitResponse({ name: 'Alice' });\n } else if (req.method === 'sampling/createMessage') {\n inputResponses[key] = mockSamplingResponse('Hello there!');\n } else if (req.method === 'roots/list') {\n inputResponses[key] = mockListRootsResponse();\n }\n }\n\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_multiple_inputs',\n arguments: {},\n inputResponses,\n ...(r1Result.requestState !== undefined\n ? { requestState: r1Result.requestState }\n : {})\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push(\n 'Expected complete result after providing all inputResponses'\n );\n }\n\n checks.push({\n id: 'sep-2322-multiple-inputs-complete',\n name: 'InputRequiredResultMultipleInputsComplete',\n description:\n 'Server returns complete result after all inputResponses are provided',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-multiple-inputs-incomplete',\n name: 'InputRequiredResultMultipleInputsIncomplete',\n description:\n 'Server returns InputRequiredResult with multiple inputRequests of different types',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A6: Multi-Round ─────────────────────────────────────────────────────────\n\nexport class InputRequiredResultMultiRoundScenario implements ClientScenario {\n name = 'input-required-result-multi-round';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test multi-round ephemeral InputRequiredResult flow with evolving requestState (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_multi_round\\` (no arguments required).\n\n**Behavior (Round 1):** Return an \\`InputRequiredResult\\` with an elicitation request and \\`requestState\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"step1\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"Step 1: What is your name?\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": { \"name\": { \"type\": \"string\" } },\n \"required\": [\"name\"]\n }\n }\n }\n },\n \"requestState\": \"\"\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\` for step1 + requestState, return ANOTHER \\`InputRequiredResult\\` with a new elicitation and updated requestState:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"step2\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"Step 2: What is your favorite color?\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": { \"color\": { \"type\": \"string\" } },\n \"required\": [\"color\"]\n }\n }\n }\n },\n \"requestState\": \"\"\n}\n\\`\\`\\`\n\n**Behavior (Round 3):** When called with \\`inputResponses\\` for step2 + updated requestState, return a complete result.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_multi_round',\n arguments: {}\n });\n\n const r1Result = r1.result;\n let round1Complete = false;\n\n if (\n !r1.error &&\n r1Result &&\n isInputRequiredResult(r1Result) &&\n r1Result.inputRequests &&\n r1Result.requestState\n ) {\n round1Complete = true;\n }\n\n checks.push({\n id: 'sep-2322-multi-round-r1',\n name: 'InputRequiredResultMultiRoundR1',\n description:\n 'Round 1: Server returns InputRequiredResult with requestState',\n status: round1Complete ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: round1Complete\n ? undefined\n : 'Expected InputRequiredResult with inputRequests and requestState',\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n if (!round1Complete || !isInputRequiredResult(r1Result)) return checks;\n\n // Round 2: Retry — expect another InputRequiredResult\n const r1InputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_multi_round',\n arguments: {},\n inputResponses: {\n [r1InputKey]: mockElicitResponse({ name: 'Alice' })\n },\n requestState: r1Result.requestState\n });\n\n const r2Result = r2.result;\n let round2Complete = false;\n\n if (\n !r2.error &&\n r2Result &&\n isInputRequiredResult(r2Result) &&\n r2Result.inputRequests &&\n r2Result.requestState\n ) {\n // requestState should have changed\n if (r2Result.requestState !== r1Result.requestState) {\n round2Complete = true;\n }\n }\n\n checks.push({\n id: 'sep-2322-multi-round-r2',\n name: 'InputRequiredResultMultiRoundR2',\n description:\n 'Round 2: Server returns another InputRequiredResult with updated requestState',\n status: round2Complete ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: round2Complete\n ? undefined\n : 'Expected new InputRequiredResult with different requestState',\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n\n if (!round2Complete || !isInputRequiredResult(r2Result)) return checks;\n\n // Round 3: Final retry — expect complete result\n const r2InputKey = Object.keys(r2Result.inputRequests!)[0];\n const r3 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_multi_round',\n arguments: {},\n inputResponses: {\n [r2InputKey]: mockElicitResponse({ color: 'blue' })\n },\n requestState: r2Result.requestState\n });\n\n const r3Result = r3.result;\n const round3Complete =\n !r3.error && r3Result != null && isCompleteResult(r3Result);\n\n checks.push({\n id: 'sep-2322-multi-round-r3',\n name: 'InputRequiredResultMultiRoundR3',\n description: 'Round 3: Server returns complete result',\n status: round3Complete ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: round3Complete\n ? undefined\n : 'Expected complete result after final retry',\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r3Result }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-multi-round-r1',\n name: 'InputRequiredResultMultiRoundR1',\n description:\n 'Round 1: Server returns InputRequiredResult with requestState',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A7: Missing Input Response ──────────────────────────────────────────────\n\nexport class InputRequiredResultMissingInputResponseScenario implements ClientScenario {\n name = 'input-required-result-missing-input-response';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test error handling when client sends wrong/missing inputResponses (SEP-2322).\n\n**Server Implementation Requirements:**\n\nUse the same tool as A1: \\`test_input_required_result_elicitation\\`.\n\n**Behavior:** When the client retries with \\`inputResponses\\` that are missing required keys or contain wrong keys, the server SHOULD respond with a new \\`InputRequiredResult\\` re-requesting the missing information (NOT a JSON-RPC error).`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1: Send wrong inputResponses (wrong key)\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {},\n inputResponses: {\n wrong_key: mockElicitResponse({ data: 'wrong' })\n }\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n // A JSON-RPC error is acceptable but the SEP prefers re-requesting\n r1Errors.push(\n 'Server returned JSON-RPC error instead of re-requesting via InputRequiredResult. ' +\n 'SEP-2322 recommends servers re-request missing information.'\n );\n } else if (!r1Result) {\n r1Errors.push('No result in response');\n } else if (!isInputRequiredResult(r1Result)) {\n r1Errors.push(\n 'Expected InputRequiredResult re-requesting missing information, ' +\n 'but got a complete result'\n );\n }\n\n checks.push({\n id: 'sep-2322-missing-response-rerequests',\n name: 'InputRequiredResultMissingResponseRerequests',\n description:\n 'Server re-requests missing inputResponses via new InputRequiredResult',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-missing-response-rerequests',\n name: 'InputRequiredResultMissingResponseRerequests',\n description:\n 'Server re-requests missing inputResponses via new InputRequiredResult',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A9: Non-Tool Request (prompts/get) ──────────────────────────────────────\n\nexport class InputRequiredResultNonToolRequestScenario implements ClientScenario {\n name = 'input-required-result-non-tool-request';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test InputRequiredResult on a non-tool request (prompts/get) to verify InputRequiredResult is universal (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a prompt named \\`test_input_required_result_prompt\\` that requires elicitation input.\n\n**Behavior (Round 1):** When \\`prompts/get\\` is called for \\`test_input_required_result_prompt\\` without \\`inputResponses\\`, return an \\`InputRequiredResult\\`:\n\n\\`\\`\\`json\n{\n \"resultType\": \"input_required\",\n \"inputRequests\": {\n \"user_context\": {\n \"method\": \"elicitation/create\",\n \"params\": {\n \"message\": \"What context should the prompt use?\",\n \"requestedSchema\": {\n \"type\": \"object\",\n \"properties\": { \"context\": { \"type\": \"string\" } },\n \"required\": [\"context\"]\n }\n }\n }\n }\n}\n\\`\\`\\`\n\n**Behavior (Round 2):** When called with \\`inputResponses\\`, return a complete \\`GetPromptResult\\`.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1\n const r1 = await sendRpc(serverUrl, 'prompts/get', {\n name: 'test_input_required_result_prompt'\n });\n\n const r1Result = r1.result;\n const r1Errors: string[] = [];\n\n if (r1.error) {\n r1Errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result || !isInputRequiredResult(r1Result)) {\n r1Errors.push('Expected InputRequiredResult from prompts/get');\n } else if (!r1Result.inputRequests) {\n r1Errors.push('InputRequiredResult missing inputRequests');\n }\n\n checks.push({\n id: 'sep-2322-non-tool-incomplete',\n name: 'InputRequiredResultNonToolIncomplete',\n description:\n 'prompts/get returns InputRequiredResult with inputRequests',\n status: r1Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r1Errors.length > 0 ? r1Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n\n // Round 2: Retry with inputResponses\n if (r1Errors.length === 0 && isInputRequiredResult(r1Result)) {\n const inputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'prompts/get', {\n name: 'test_input_required_result_prompt',\n inputResponses: {\n [inputKey]: mockElicitResponse({ context: 'test context' })\n },\n ...(r1Result.requestState !== undefined\n ? { requestState: r1Result.requestState }\n : {})\n });\n\n const r2Result = r2.result;\n const r2Errors: string[] = [];\n\n if (r2.error) {\n r2Errors.push(`JSON-RPC error: ${r2.error.message}`);\n } else if (!r2Result) {\n r2Errors.push('No result in response');\n } else if (!isCompleteResult(r2Result)) {\n r2Errors.push('Expected complete GetPromptResult after retry');\n } else if (!r2Result.messages) {\n r2Errors.push(\n 'Complete result missing messages (expected GetPromptResult)'\n );\n }\n\n checks.push({\n id: 'sep-2322-non-tool-complete',\n name: 'InputRequiredResultNonToolComplete',\n description:\n 'prompts/get returns complete GetPromptResult after retry with inputResponses',\n status: r2Errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: r2Errors.length > 0 ? r2Errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r2Result }\n });\n }\n } catch (error) {\n checks.push({\n id: 'sep-2322-non-tool-incomplete',\n name: 'InputRequiredResultNonToolIncomplete',\n description:\n 'prompts/get returns InputRequiredResult with inputRequests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A10: ResultType Included ────────────────────────────────────────────────\n\nexport class InputRequiredResultResultTypeScenario implements ClientScenario {\n name = 'input-required-result-result-type';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server explicitly includes resultType field in InputRequiredResult responses (SEP-2322).\n\n**Server Implementation Requirements:**\n\nUses the same tool as A1: \\`test_input_required_result_elicitation\\`.\n\nThis scenario verifies that the resultType field is explicitly present in the response (not just inferred).`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {}\n });\n\n const r1Result = r1.result;\n const errors: string[] = [];\n\n if (r1.error) {\n errors.push(`JSON-RPC error: ${r1.error.message}`);\n } else if (!r1Result) {\n errors.push('No result in response');\n } else if (!('resultType' in r1Result)) {\n errors.push(\n 'resultType field is missing from response. Servers MUST include resultType to indicate the type of the result.'\n );\n } else if (r1Result.resultType !== 'input_required') {\n errors.push(\n `Expected resultType \"input_required\", got \"${r1Result.resultType}\"`\n );\n }\n\n checks.push({\n id: 'sep-2322-result-type-included',\n name: 'ResultTypeIncluded',\n description:\n 'Server includes resultType field in InputRequiredResult response',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: r1Result }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-result-type-included',\n name: 'ResultTypeIncluded',\n description:\n 'Server includes resultType field in InputRequiredResult response',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A11: Unsupported Methods ────────────────────────────────────────────────\n\nexport class InputRequiredResultUnsupportedMethodsScenario implements ClientScenario {\n name = 'input-required-result-unsupported-methods';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server does NOT return InputRequiredResult on unsupported methods (SEP-2322).\n\nServers MUST NOT send InputRequiredResult responses on any client requests other than the supported ones (prompts/get, resources/read, tools/call, tasks/result).`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n const errors: string[] = [];\n\n const unsupportedMethods = ['tools/list', 'prompts/list'];\n\n try {\n for (const method of unsupportedMethods) {\n const resp = await sendRpc(serverUrl, method, {});\n if (\n resp.result &&\n (resp.result as Record).resultType ===\n 'input_required'\n ) {\n errors.push(\n `${method} returned InputRequiredResult, but it is not a supported method for MRTR`\n );\n }\n }\n\n checks.push({\n id: 'sep-2322-not-on-unsupported-requests',\n name: 'NotOnUnsupportedRequests',\n description:\n 'Server does not return InputRequiredResult on unsupported methods',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-not-on-unsupported-requests',\n name: 'NotOnUnsupportedRequests',\n description:\n 'Server does not return InputRequiredResult on unsupported methods',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A12: Tampered State Rejection ───────────────────────────────────────────\n\nexport class InputRequiredResultTamperedStateScenario implements ClientScenario {\n name = 'input-required-result-tampered-state';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server rejects tampered requestState (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_tampered_state\\` (no arguments required).\n\n**Behavior (Round 1):** When called without inputResponses, return an InputRequiredResult with\nintegrity-protected requestState (e.g. HMAC-signed).\n\n**Behavior (Round 2 - tampered):** When called with a modified/tampered requestState, return a\nJSON-RPC error (code -32602 or similar) indicating integrity check failure.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Round 1: Get valid InputRequiredResult with signed requestState\n const r1 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_tampered_state',\n arguments: {}\n });\n\n const r1Result = r1.result;\n if (r1.error || !r1Result || !isInputRequiredResult(r1Result)) {\n checks.push({\n id: 'sep-2322-reject-tampered-state',\n name: 'RejectTamperedState',\n description: 'Server rejects tampered requestState with error',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Prerequisite failed: could not get initial InputRequiredResult with requestState',\n specReferences: MRTR_SPEC_REFERENCES\n });\n return checks;\n }\n\n if (!r1Result.requestState) {\n checks.push({\n id: 'sep-2322-reject-tampered-state',\n name: 'RejectTamperedState',\n description: 'Server rejects tampered requestState with error',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Server did not include requestState in InputRequiredResult',\n specReferences: MRTR_SPEC_REFERENCES\n });\n return checks;\n }\n\n // Round 2: Tamper with the requestState and retry\n const tamperedState = r1Result.requestState + '-TAMPERED';\n const inputKey = Object.keys(r1Result.inputRequests!)[0];\n const r2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_tampered_state',\n arguments: {},\n inputResponses: {\n [inputKey]: mockElicitResponse({ ok: true })\n },\n requestState: tamperedState\n });\n\n const errors: string[] = [];\n\n if (!r2.error) {\n // The only acceptable response to tampered state is a JSON-RPC error.\n // Returning a complete result OR re-prompting (InputRequiredResult) both\n // indicate the server did not reject the tampered state.\n if (r2.result && isCompleteResult(r2.result)) {\n errors.push(\n 'Server accepted tampered requestState and returned complete result. ' +\n 'Servers MUST reject state that fails integrity verification.'\n );\n } else {\n errors.push(\n 'Server did not return a JSON-RPC error for tampered requestState. ' +\n 'Servers MUST reject state that fails integrity verification.'\n );\n }\n }\n\n checks.push({\n id: 'sep-2322-reject-tampered-state',\n name: 'RejectTamperedState',\n description: 'Server rejects tampered requestState with error',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { tamperedResponse: r2.result ?? r2.error }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-reject-tampered-state',\n name: 'RejectTamperedState',\n description: 'Server rejects tampered requestState with error',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A13: Respect Client Capabilities ────────────────────────────────────────\n\nexport class InputRequiredResultCapabilityCheckScenario implements ClientScenario {\n name = 'input-required-result-capability-check';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server only sends inputRequests for capabilities the client declared (SEP-2322).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_input_required_result_capabilities\\` (no arguments required).\n\n**Behavior:** Read client capabilities from \\`_meta['io.modelcontextprotocol/clientCapabilities']\\`.\nOnly include inputRequests for methods the client supports. For example, if the client declares\n\\`sampling: {}\\` but NOT \\`elicitation\\`, only include \\`sampling/createMessage\\` inputRequests.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Send request with only sampling capability (no elicitation)\n const resp = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_capabilities',\n arguments: {},\n _meta: {\n 'io.modelcontextprotocol/clientCapabilities': {\n sampling: {}\n // deliberately omitting elicitation\n }\n }\n });\n\n const result = resp.result;\n const errors: string[] = [];\n\n if (resp.error) {\n errors.push(`JSON-RPC error: ${resp.error.message}`);\n } else if (!result) {\n errors.push('No result in response');\n } else if (isInputRequiredResult(result) && result.inputRequests) {\n // Check that no elicitation requests are included (client didn't declare it)\n for (const [key, req] of Object.entries(result.inputRequests)) {\n if (req.method === 'elicitation/create') {\n errors.push(\n `Server included elicitation/create inputRequest (key: \"${key}\") ` +\n 'but client did not declare elicitation capability'\n );\n }\n }\n } else if (isCompleteResult(result)) {\n errors.push(\n 'Server returned complete result; expected InputRequiredResult with sampling-only inputRequests'\n );\n }\n\n checks.push({\n id: 'sep-2322-respect-client-capabilities',\n name: 'RespectClientCapabilities',\n description:\n 'Server only includes inputRequests for declared client capabilities',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-respect-client-capabilities',\n name: 'RespectClientCapabilities',\n description:\n 'Server only includes inputRequests for declared client capabilities',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A14: Ignore Unexpected Params ───────────────────────────────────────────\n\nexport class InputRequiredResultIgnoreExtraParamsScenario implements ClientScenario {\n name = 'input-required-result-ignore-extra-params';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server ignores unexpected extra parameters in InputResponses (SEP-2322).\n\n**Server Implementation Requirements:**\n\nUses the same tool as A1: \\`test_input_required_result_elicitation\\`.\n\nThis scenario sends correct inputResponses PLUS extra unrecognized keys. The server SHOULD ignore\nthe extra keys and complete normally.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Send retry with correct inputResponses + extra unknown keys\n const resp = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {},\n inputResponses: {\n user_name: mockElicitResponse({ name: 'Alice' }),\n unknown_extra_key: { action: 'accept', content: { foo: 'bar' } },\n another_unexpected: { action: 'accept', content: { baz: 123 } }\n }\n });\n\n const result = resp.result;\n const errors: string[] = [];\n\n if (resp.error) {\n errors.push(\n `Server returned JSON-RPC error when extra params were included: ${resp.error.message}. ` +\n 'Servers SHOULD ignore unrecognized information.'\n );\n } else if (!result) {\n errors.push('No result in response');\n } else if (!isCompleteResult(result)) {\n errors.push(\n 'Server did not return complete result when valid inputResponses were provided alongside extra keys. ' +\n 'Servers SHOULD ignore information they do not recognize.'\n );\n }\n\n checks.push({\n id: 'sep-2322-ignore-unexpected-params',\n name: 'IgnoreUnexpectedParams',\n description: 'Server ignores extra unrecognized keys in inputResponses',\n status: errors.length === 0 ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-ignore-unexpected-params',\n name: 'IgnoreUnexpectedParams',\n description: 'Server ignores extra unrecognized keys in inputResponses',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n\n// ─── A15: Validate InputResponses ────────────────────────────────────────────\n\nexport class InputRequiredResultValidateInputScenario implements ClientScenario {\n name = 'input-required-result-validate-input';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n specVersions: SpecVersion[] = [DRAFT_PROTOCOL_VERSION];\n description = `Test that server validates InputResponses and returns appropriate errors (SEP-2322).\n\n**Server Implementation Requirements:**\n\nUses the same tool as A1: \\`test_input_required_result_elicitation\\`.\n\nThis scenario sends completely invalid inputResponses structures. The server SHOULD validate them\nand return a JSON-RPC error or a new InputRequiredResult.`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Send inputResponses with invalid structure (number instead of object for the response)\n const resp = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {},\n inputResponses: {\n user_name: 12345 as unknown as Record\n }\n });\n\n const validateErrors: string[] = [];\n\n // Server should either error or re-request — NOT return a complete result\n // with the invalid data silently accepted\n if (!resp.error && resp.result && isCompleteResult(resp.result)) {\n validateErrors.push(\n 'Server accepted invalid inputResponses (number instead of object) and returned complete result. ' +\n 'Servers SHOULD validate InputResponses data.'\n );\n }\n\n checks.push({\n id: 'sep-2322-validate-input-responses',\n name: 'ValidateInputResponses',\n description: 'Server validates InputResponses structure',\n status: validateErrors.length === 0 ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage:\n validateErrors.length > 0 ? validateErrors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: resp.result, error: resp.error }\n });\n\n // Also test: send completely malformed inputResponses (null)\n const resp2 = await sendRpc(serverUrl, 'tools/call', {\n name: 'test_input_required_result_elicitation',\n arguments: {},\n inputResponses: null as unknown as Record\n });\n\n const protocolErrors: string[] = [];\n\n if (!resp2.error && resp2.result && isCompleteResult(resp2.result)) {\n protocolErrors.push(\n 'Server accepted null inputResponses and returned complete result. ' +\n 'Protocol errors SHOULD return a JSON-RPC error response.'\n );\n }\n\n checks.push({\n id: 'sep-2322-error-on-protocol-error',\n name: 'ErrorOnProtocolError',\n description:\n 'Server returns JSON-RPC error for protocol-level input errors',\n status: protocolErrors.length === 0 ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage:\n protocolErrors.length > 0 ? protocolErrors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: { result: resp2.result, error: resp2.error }\n });\n } catch (error) {\n checks.push({\n id: 'sep-2322-validate-input-responses',\n name: 'ValidateInputResponses',\n description: 'Server validates InputResponses structure',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n\n return checks;\n }\n}\n",[],[141,254,272,346],"c272c94e-5b64-11f1-b520-ee650bb23af1","input-required-result-helpers.ts","c272ca02-5b64-11f1-b520-ee650bb23af1",50,["D",1780062374226],"/**\n * Helpers for SEP-2322 conformance tests.\n *\n * Provides InputRequiredResult-specific type guards, mock response builders,\n * and a stateless JSON-RPC transport helper.\n */\n\n// ─── JSON-RPC Types ──────────────────────────────────────────────────────────\n\nexport type { JsonRpcResponse } from './stateless-client.ts';\n\n// ─── Stateless RPC Helper ────────────────────────────────────────────────────\n\nimport { sendStatelessRequest, JsonRpcResponse } from './stateless-client.ts';\n\n/**\n * Send a stateless JSON-RPC request (SEP-2575 pattern).\n * The shared stateless helper injects the cross-cutting requirements: _meta\n * (protocolVersion, clientInfo, clientCapabilities) and the standard\n * MCP-Protocol-Version / Mcp-Method / Mcp-Name headers (SEP-2243).\n */\nexport async function sendRpc(\n serverUrl: string,\n method: string,\n params?: Record\n): Promise {\n const response = await sendStatelessRequest(serverUrl, method, params);\n if (!response.body) {\n throw new Error(\n `Expected a JSON-RPC response for ${method}, got HTTP ${response.status} (${response.contentType ?? 'no content-type'})`\n );\n }\n return response.body as JsonRpcResponse;\n}\n\n// ─── InputRequiredResult Types ───────────────────────────────────────────────\n\nexport interface InputRequiredResultData {\n resultType?: 'input_required';\n inputRequests?: Record;\n requestState?: string;\n _meta?: Record;\n [key: string]: unknown;\n}\n\nexport interface InputRequestObject {\n method: string;\n params?: Record;\n}\n\n// ─── Type Guards ─────────────────────────────────────────────────────────────\n\n/**\n * Check if a JSON-RPC result is an InputRequiredResult.\n */\nexport function isInputRequiredResult(\n result: Record | undefined\n): result is InputRequiredResultData {\n if (!result) return false;\n if (result.resultType === 'input_required') return true;\n return false;\n}\n\n/**\n * Check if a JSON-RPC result is a complete result (not input_required).\n * complete is the default so if resultType is missing we assume it's complete.\n */\nexport function isCompleteResult(\n result: Record | undefined\n): boolean {\n if (!result) return false;\n if (result.resultType === 'input_required') return false;\n return true;\n}\n\n/**\n * Extract inputRequests from an InputRequiredResult.\n */\nexport function getInputRequests(\n result: InputRequiredResultData\n): Record | undefined {\n return result.inputRequests;\n}\n\n// ─── Mock Response Builders ──────────────────────────────────────────────────\n\n/**\n * Build a mock elicitation response (ElicitResult).\n */\nexport function mockElicitResponse(\n content: Record\n): Record {\n return {\n action: 'accept',\n content\n };\n}\n\n/**\n * Build a mock sampling response (CreateMessageResult).\n */\nexport function mockSamplingResponse(text: string): Record {\n return {\n role: 'assistant',\n content: {\n type: 'text',\n text\n },\n model: 'test-model',\n stopReason: 'endTurn'\n };\n}\n\n/**\n * Build a mock list roots response (ListRootsResult).\n */\nexport function mockListRootsResponse(): Record {\n return {\n roots: [\n {\n uri: 'file:///test/root',\n name: 'Test Root'\n }\n ]\n };\n}\n\n// ─── Spec References ─────────────────────────────────────────────────────────\n\n/**\n * SEP reference for InputRequiredResult / MRTR tests.\n */\nexport const MRTR_SPEC_REFERENCES = [\n {\n id: 'SEP-2322',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/utilities/mrtr'\n }\n];\n",[],[141,254,272,354],"b98c6646-5b64-11f1-97f0-ee650bb23af1","http-standard-headers.ts","b98c66fa-5b64-11f1-97f0-ee650bb23af1",13,["D",1780062359293],"/**\n * HTTP Standard Headers server validation test scenarios (SEP-2243)\n *\n * Tests that servers properly validate the standard MCP request headers:\n * - Reject requests where Mcp-Method header doesn't match the body\n * - Reject requests where Mcp-Name header doesn't match the body\n * - Accept case variations of header names (case-insensitive)\n * - Reject case variations of header values (case-sensitive)\n * - Handle whitespace trimming per HTTP spec\n * - Validate Base64-encoded custom header values\n * - Return 400 Bad Request with error code -32001 (HeaderMismatch)\n *\n * This is a ClientScenario (connects to a server under test and validates\n * its behavior).\n */\n\nimport http from 'node:http';\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport { withRequestMeta, sendStatelessRequest } from './stateless-client.ts';\n\nconst SPEC_REFERENCE = {\n id: 'SEP-2243-Server-Validation',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#server-validation'\n};\n\nconst SPEC_REFERENCE_CASE = {\n id: 'SEP-2243-Case-Sensitivity',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#case-sensitivity'\n};\n\n// OWS handling is an RFC 9110 §5.5 MUST (\"a field parsing implementation MUST\n// exclude such whitespace prior to evaluating the field value\"), not a\n// SEP-2243 requirement. Kept as a check because a server stack that fails it\n// has a real HTTP-layer bug that will manifest as header-mismatch rejections.\nconst SPEC_REFERENCE_RFC9110_OWS = {\n id: 'RFC-9110-5.5-Field-Values',\n url: 'https://www.rfc-editor.org/rfc/rfc9110#section-5.5'\n};\n\nconst SPEC_REFERENCE_BASE64 = {\n id: 'SEP-2243-Value-Encoding',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#value-encoding'\n};\n\nconst SPEC_REFERENCE_CUSTOM = {\n id: 'SEP-2243-Custom-Headers',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#server-behavior-for-custom-headers'\n};\n\nconst HEADER_MISMATCH_ERROR_CODE = -32001;\n\n// Coarse, requirement-level check IDs (SEP-2243) for STANDARD-header\n// rejections. Every standard-header rejection case emits this same pair of IDs;\n// the per-case name/description carry the detail of which case was exercised,\n// matching the repo's \"same id, vary status/message\" convention.\nconst REJECT_STATUS_CHECK_ID = 'sep-2243-server-reject-invalid-headers';\nconst REJECT_ERROR_CODE_CHECK_ID = 'sep-2243-server-reject-error-code';\n\n// CUSTOM-header (Mcp-Param-*) rejections map to the param-validation\n// requirements instead. The -32001 error-code half of every custom-header\n// rejection is the \"reject with 400 + JSON-RPC error code -32001 if any\n// validation fails\" requirement.\nconst PARAM_REJECT_ERROR_CODE_CHECK_ID =\n 'sep-2243-server-reject-param-mismatch';\n\n/**\n * Every requirement-level check ID HttpCustomHeaderServerValidationScenario\n * can emit (SEP-2243). When the server under test exposes no x-mcp-header\n * tool the scenario cannot exercise these, but it still emits one SKIPPED row\n * per ID so the traceability manifest sees that a scenario exists for each\n * requirement (the manifest joins on emitted IDs regardless of status).\n */\nexport const CUSTOM_HEADER_SERVER_DECLARED_CHECK_IDS = [\n 'sep-2243-server-decode-base64',\n 'sep-2243-server-validate-param-match',\n 'sep-2243-server-reject-invalid-param-chars',\n 'sep-2243-server-reject-param-mismatch'\n] as const;\n\n/**\n * Helper to send a raw HTTP POST request with custom headers.\n * Uses Node.js http.request to preserve exact header casing and values,\n * avoiding normalization that fetch()/Headers may apply.\n */\nasync function sendRawRequest(\n serverUrl: string,\n body: object,\n headers: Record = {}\n): Promise<{ status: number; body: any; headers: http.IncomingHttpHeaders }> {\n const url = new URL(serverUrl);\n const bodyStr = JSON.stringify(body);\n\n return new Promise((resolve, reject) => {\n const req = http.request(\n {\n hostname: url.hostname,\n port: url.port,\n path: url.pathname,\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Accept: 'application/json, text/event-stream',\n 'Content-Length': Buffer.byteLength(bodyStr),\n ...headers\n }\n },\n (res) => {\n res.setEncoding('utf8');\n let data = '';\n res.on('data', (chunk) => {\n data += chunk;\n });\n res.on('end', () => {\n let responseBody: any;\n const contentType = res.headers['content-type'];\n if (contentType?.includes('application/json')) {\n try {\n responseBody = JSON.parse(data);\n } catch {\n responseBody = data;\n }\n } else {\n responseBody = data;\n }\n resolve({\n status: res.statusCode || 0,\n body: responseBody,\n headers: res.headers\n });\n });\n }\n );\n\n req.on('error', reject);\n req.write(bodyStr);\n req.end();\n });\n}\n\n/**\n * Builds two checks for a rejection case: one for the HTTP 400 status, one for\n * the -32001 JSON-RPC error code. Per SEP-2243 §Server Validation, 400 is MUST\n * but -32001 is SHOULD for *standard* headers (and MUST for *custom* headers,\n * §Server Behavior for Custom Headers) — so a server returning 400 with a\n * different error code is compliant for standard headers and must not FAIL.\n *\n * The two emitted check IDs are supplied explicitly by the caller: standard-\n * header callers pass the coarse REJECT_STATUS_CHECK_ID/REJECT_ERROR_CODE_CHECK_ID\n * pair, while custom-header/Base64 callers pass the param-validation\n * requirement that case exercises plus PARAM_REJECT_ERROR_CODE_CHECK_ID. The\n * per-case `name`/`description` distinguish which rejection case was\n * exercised.\n */\nfunction createRejectionChecks(\n statusId: string,\n errorCodeId: string,\n name: string,\n description: string,\n response: { status: number; body: any },\n specRef: { id: string; url: string },\n details: Record,\n opts: { errorCodeSeverity: 'FAILURE' | 'WARNING' }\n): ConformanceCheck[] {\n const fullDetails = {\n ...details,\n responseStatus: response.status,\n responseBody: response.body\n };\n const ts = new Date().toISOString();\n\n const statusOk = response.status === 400;\n const codeOk = response.body?.error?.code === HEADER_MISMATCH_ERROR_CODE;\n\n return [\n {\n id: statusId,\n name,\n description,\n status: statusOk ? 'SUCCESS' : 'FAILURE',\n timestamp: ts,\n errorMessage: statusOk\n ? undefined\n : `Expected HTTP 400, got ${response.status}. Server MUST reject with 400 Bad Request.`,\n specReferences: [specRef],\n details: fullDetails\n },\n {\n id: errorCodeId,\n name: `${name}ErrorCode`,\n description: `${description} — uses JSON-RPC error code -32001 (HeaderMismatch)`,\n status: codeOk ? 'SUCCESS' : opts.errorCodeSeverity,\n timestamp: ts,\n errorMessage: codeOk\n ? undefined\n : `Expected JSON-RPC error code ${HEADER_MISMATCH_ERROR_CODE} (HeaderMismatch), got ${response.body?.error?.code ?? '(missing)'}.`,\n specReferences: [specRef],\n details: fullDetails\n }\n ];\n}\n\nfunction createAcceptanceCheck(\n id: string,\n name: string,\n description: string,\n response: { status: number; body: any },\n specRef: { id: string; url: string },\n details: Record\n): ConformanceCheck {\n const errors: string[] = [];\n if (response.status >= 400) {\n errors.push(\n `Expected successful response, got HTTP ${response.status}. Server MUST accept this request.`\n );\n }\n // A server can return HTTP 200 with a JSON-RPC error in the body. Without\n // this assertion that case would pass as \"accepted\".\n if (\n response.body &&\n typeof response.body === 'object' &&\n 'error' in response.body\n ) {\n errors.push(\n `Expected successful response, but body contains JSON-RPC error ${JSON.stringify(response.body.error)}.`\n );\n }\n return {\n id,\n name,\n description,\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [specRef],\n details: {\n ...details,\n responseStatus: response.status,\n responseBody: response.body\n }\n };\n}\n\nexport class HttpHeaderValidationScenario implements ClientScenario {\n name = 'http-header-validation';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test server validation of standard MCP request headers (SEP-2243).\n\n**Server Implementation Requirements:**\n\n**Endpoint**: Streamable HTTP\n\n**Requirements**:\n- Server MUST reject requests where Mcp-Method header doesn't match the body method\n- Server MUST reject requests where Mcp-Name header doesn't match the body params.name/uri\n- Server MUST accept header names case-insensitively\n- Server MUST reject case-mismatched header values (method values are case-sensitive)\n- Server MUST accept extra whitespace around header values (per HTTP spec)\n- Server MUST return HTTP 400 Bad Request for validation failures\n- Server MUST return JSON-RPC error with code -32001 (HeaderMismatch)`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Discover the server's tools with a fully-conformant stateless request\n // (SEP-2575) — that wire protocol has no initialize handshake or sessions.\n const toolsResponse = await sendStatelessRequest(serverUrl, 'tools/list');\n if (!toolsResponse.body?.result) {\n // The server under test could not even answer a conformant tools/list:\n // report a single explicit setup failure instead of misleading\n // per-case results against a broken server.\n const rpcError = toolsResponse.body?.error;\n checks.push({\n id: 'sep-2243-server-standard-setup',\n name: 'HttpHeaderValidationSetup',\n description: 'Setup for header validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n `tools/list discovery failed: HTTP ${toolsResponse.status}` +\n (rpcError\n ? `, JSON-RPC error ${rpcError.code}: ${rpcError.message}`\n : ', no result in response body'),\n specReferences: [SPEC_REFERENCE],\n details: { httpStatus: toolsResponse.status, error: rpcError }\n });\n return checks;\n }\n const toolsResult = toolsResponse.body.result as {\n tools?: Array<{ name: string; inputSchema?: unknown }>;\n };\n\n const baseHeaders: Record = {\n 'MCP-Protocol-Version': DRAFT_PROTOCOL_VERSION\n };\n\n let idCounter = 100;\n const nextId = () => idCounter++;\n\n // --- Header/Body Mismatch Tests ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMismatchedMethodHeader',\n 'Server rejects requests where Mcp-Method header does not match body method',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'Mcp-Method': 'prompts/list' },\n SPEC_REFERENCE,\n { requestBodyMethod: 'tools/list', mcpMethodHeader: 'prompts/list' }\n );\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMissingMethodHeader',\n 'Server rejects requests with missing Mcp-Method header',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n {},\n SPEC_REFERENCE,\n { requestBodyMethod: 'tools/list', mcpMethodHeader: '(missing)' }\n );\n\n if (toolsResult.tools && toolsResult.tools.length > 0) {\n const toolName = toolsResult.tools[0].name;\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMismatchedNameHeader',\n 'Server rejects tools/call where Mcp-Name does not match body params.name',\n {\n jsonrpc: '2.0',\n id: 0,\n method: 'tools/call',\n params: { name: toolName, arguments: {} }\n },\n { 'Mcp-Method': 'tools/call', 'Mcp-Name': 'wrong_tool_name' },\n SPEC_REFERENCE,\n { requestBodyName: toolName, mcpNameHeader: 'wrong_tool_name' }\n );\n\n // --- Whitespace Test ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-accepts-whitespace-header-value',\n 'ServerAcceptsWhitespaceHeaderValue',\n 'Server MUST accept leading/trailing whitespace in Mcp-Name value (RFC 9110 §5.5: field parsing MUST exclude OWS before evaluating)',\n {\n jsonrpc: '2.0',\n id: 0,\n method: 'tools/call',\n params: { name: toolName, arguments: {} }\n },\n {\n 'Mcp-Method': 'tools/call',\n 'Mcp-Name': ` ${toolName} `\n },\n SPEC_REFERENCE_RFC9110_OWS,\n {\n headerValue: ` ${toolName} `,\n bodyValue: toolName,\n reason: 'HTTP spec requires trimming OWS around field values'\n }\n );\n\n // --- Missing Standard Header with Value in Body (Case 47) ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsMissingNameHeader',\n 'Server MUST reject tools/call with missing Mcp-Name header when body has params.name',\n {\n jsonrpc: '2.0',\n id: 0,\n method: 'tools/call',\n params: { name: toolName, arguments: {} }\n },\n { 'Mcp-Method': 'tools/call' },\n SPEC_REFERENCE,\n {\n requestBodyName: toolName,\n mcpNameHeader: '(missing)',\n reason:\n 'Standard header omitted but value present in body → MUST reject'\n }\n );\n }\n\n // --- Case Sensitivity Tests ---\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-header-name-case-insensitive',\n 'ServerAcceptsLowercaseHeaderName',\n 'Server MUST accept lowercase header name (mcp-method)',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'mcp-method': 'tools/list' },\n SPEC_REFERENCE_CASE,\n { headerNameUsed: 'mcp-method' }\n );\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-header-name-case-insensitive',\n 'ServerAcceptsUppercaseHeaderName',\n 'Server MUST accept uppercase header name (MCP-METHOD)',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'MCP-METHOD': 'tools/list' },\n SPEC_REFERENCE_CASE,\n { headerNameUsed: 'MCP-METHOD' }\n );\n\n await this.testCase(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n REJECT_STATUS_CHECK_ID,\n 'ServerRejectsCaseMismatchValue',\n 'Server MUST reject uppercase method value (TOOLS/LIST) since values are case-sensitive',\n { jsonrpc: '2.0', id: 0, method: 'tools/list' },\n { 'Mcp-Method': 'TOOLS/LIST' },\n SPEC_REFERENCE_CASE,\n { headerValue: 'TOOLS/LIST', bodyValue: 'tools/list' }\n );\n } catch (error) {\n checks.push({\n id: 'sep-2243-server-standard-setup',\n name: 'HttpHeaderValidationSetup',\n description: 'Setup for header validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed to set up tests: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE]\n });\n }\n\n return checks;\n }\n\n private async testCase(\n checks: ConformanceCheck[],\n serverUrl: string,\n baseHeaders: Record,\n nextId: () => number,\n expectation: 'accept' | 'reject',\n checkId: string,\n checkName: string,\n description: string,\n body: any,\n extraHeaders: Record,\n specRef: { id: string; url: string },\n details: Record\n ): Promise {\n try {\n // Issue #311: every raw request carries the SEP-2575 _meta fields — the\n // header-validation cases only mangle headers, never the body metadata.\n const requestBody = {\n ...body,\n id: body.id === 0 ? nextId() : body.id,\n params: withRequestMeta(body.params)\n };\n const response = await sendRawRequest(serverUrl, requestBody, {\n ...baseHeaders,\n ...extraHeaders\n });\n if (expectation === 'reject') {\n // Standard-header rejection: 400 is MUST, -32001 is SHOULD. All\n // standard-header rejection cases collapse onto the coarse requirement\n // ids; checkId/checkName still distinguish the case via name/details.\n checks.push(\n ...createRejectionChecks(\n REJECT_STATUS_CHECK_ID,\n REJECT_ERROR_CODE_CHECK_ID,\n checkName,\n description,\n response,\n specRef,\n details,\n { errorCodeSeverity: 'WARNING' }\n )\n );\n } else {\n checks.push(\n createAcceptanceCheck(\n checkId,\n checkName,\n description,\n response,\n specRef,\n details\n )\n );\n }\n } catch (error) {\n checks.push({\n id: checkId,\n name: checkName,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [specRef]\n });\n }\n }\n}\n\nexport class HttpCustomHeaderServerValidationScenario implements ClientScenario {\n name = 'http-custom-header-server-validation';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test server validation of custom Mcp-Param headers and Base64 encoding (SEP-2243).\n\n**Server Implementation Requirements:**\n\n**Endpoint**: Streamable HTTP with at least one tool using \\`x-mcp-header\\`\n\n**Requirements**:\n- Server MUST validate Base64-encoded header values\n- Server MUST reject requests with invalid Base64 padding or characters\n- Server MUST treat values without =?base64?...?= wrapper as literal\n- Server MUST reject requests where custom header is omitted but value is in body`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n // Discover the server's tools with a fully-conformant stateless request\n // (SEP-2575) — that wire protocol has no initialize handshake or sessions.\n const toolsResponse = await sendStatelessRequest(serverUrl, 'tools/list');\n if (!toolsResponse.body?.result) {\n // The server under test could not even answer a conformant tools/list:\n // report a single explicit setup failure (and backfill the declared\n // checks, mirroring the catch path) instead of pretending the\n // requirements are not applicable to a broken server.\n const rpcError = toolsResponse.body?.error;\n checks.push({\n id: 'sep-2243-server-custom-setup',\n name: 'HttpCustomHeaderServerValidationSetup',\n description: 'Setup for custom header server validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n `tools/list discovery failed: HTTP ${toolsResponse.status}` +\n (rpcError\n ? `, JSON-RPC error ${rpcError.code}: ${rpcError.message}`\n : ', no result in response body'),\n specReferences: [SPEC_REFERENCE_CUSTOM],\n details: { httpStatus: toolsResponse.status, error: rpcError }\n });\n this.failDeclaredChecks(checks);\n return checks;\n }\n const toolsResult = toolsResponse.body.result as {\n tools?: Array<{ name: string; inputSchema?: unknown }>;\n };\n\n // Find a tool with x-mcp-header annotations\n const xMcpTool = toolsResult.tools?.find((tool) => {\n const schema = tool.inputSchema as any;\n if (!schema?.properties) return false;\n return Object.values(schema.properties).some(\n (prop: any) => prop['x-mcp-header'] !== undefined\n );\n });\n\n if (!xMcpTool) {\n checks.push({\n id: 'sep-2243-server-no-xmcp-tool',\n name: 'HttpCustomHeaderServerNoTool',\n description:\n 'Server has no tools with x-mcp-header annotations to test',\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_REFERENCE_CUSTOM],\n details: {\n reason:\n 'No tools with x-mcp-header found. These tests require at least one tool with x-mcp-header annotations.'\n }\n });\n this.skipDeclaredChecks(\n checks,\n 'Server exposes no tool with x-mcp-header annotations.'\n );\n return checks;\n }\n\n const baseHeaders: Record = {\n 'MCP-Protocol-Version': DRAFT_PROTOCOL_VERSION\n };\n\n // Find the first x-mcp-header annotated STRING property\n // that is callable with minimal arguments to avoid schema validation failures\n const schema = xMcpTool.inputSchema as any;\n const annotatedEntry = Object.entries(schema.properties).find(\n ([, def]: [string, any]) =>\n def['x-mcp-header'] !== undefined && (def as any).type === 'string'\n );\n if (!annotatedEntry) {\n checks.push({\n id: 'sep-2243-server-no-string-param',\n name: 'HttpCustomHeaderServerNoStringParam',\n description:\n 'Server has no string-typed x-mcp-header parameter to test',\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n this.skipDeclaredChecks(\n checks,\n 'Server exposes no string-typed x-mcp-header parameter.'\n );\n return checks;\n }\n const [paramName, paramDef] = annotatedEntry as [string, any];\n const headerSuffix = paramDef['x-mcp-header'];\n\n // Build default arguments for all required params to avoid schema validation errors.\n // These go in the JSON body, so number/boolean must be the real types —\n // sending '0' or 'false' as strings makes the server reject on JSON-schema\n // grounds and the header-validation checks below would false-pass on that 400.\n const requiredParams: string[] = schema.required || [];\n const defaultArgs: Record = {};\n const defaultHeaders: Record = {};\n for (const rp of requiredParams) {\n if (rp !== paramName) {\n const rpDef = schema.properties[rp];\n const rpType = rpDef?.type || 'string';\n if (rpType === 'number' || rpType === 'integer') {\n defaultArgs[rp] = 0;\n } else if (rpType === 'boolean') {\n defaultArgs[rp] = false;\n } else {\n defaultArgs[rp] = 'test-default';\n }\n // If this required param also has x-mcp-header, include its header too\n if (rpDef?.['x-mcp-header']) {\n defaultHeaders[`Mcp-Param-${rpDef['x-mcp-header']}`] = String(\n defaultArgs[rp]\n );\n }\n }\n }\n\n let idCounter = 200;\n const nextId = () => idCounter++;\n\n // --- Base64 Decoding Tests ---\n\n const validBase64Value = Buffer.from('Hello').toString('base64');\n\n // Valid Base64 - server decodes and validates\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-decode-base64',\n 'ServerAcceptsValidBase64',\n 'Server decodes valid Base64 header value and validates against body',\n xMcpTool.name,\n paramName,\n 'Hello',\n headerSuffix,\n `=?base64?${validBase64Value}?=`,\n defaultArgs,\n defaultHeaders\n );\n\n // Invalid Base64 padding — FAILURE per the SEP-2243 conformance-test-case\n // table, which is the approved source of truth for these cases. The spec\n // body says only \"MUST decode them accordingly\", but the table specifies\n // strict rejection. SDKs whose stdlib decoders are lenient (Node\n // Buffer.from, browser atob) will need to validate before decoding; if\n // that proves burdensome we'll revisit.\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n 'sep-2243-server-reject-invalid-param-chars',\n 'ServerRejectsInvalidBase64Padding',\n 'Server MUST reject Mcp-Param header with invalid Base64 padding (per SEP-2243 test-case table)',\n xMcpTool.name,\n paramName,\n 'Hello',\n headerSuffix,\n '=?base64?SGVsbG8?=',\n defaultArgs,\n defaultHeaders\n );\n\n // Invalid Base64 characters — FAILURE for the same reason as padding.\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'reject',\n 'sep-2243-server-reject-invalid-param-chars',\n 'ServerRejectsInvalidBase64Chars',\n 'Server MUST reject Mcp-Param header with non-alphabet Base64 characters (per SEP-2243 test-case table)',\n xMcpTool.name,\n paramName,\n 'Hello',\n headerSuffix,\n '=?base64?SGVs!!!bG8=?=',\n defaultArgs,\n defaultHeaders\n );\n\n // Missing prefix - server treats as literal value\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-validate-param-match',\n 'ServerLiteralMissingBase64Prefix',\n 'Server treats value without =?base64? prefix as literal (not Base64)',\n xMcpTool.name,\n paramName,\n validBase64Value,\n headerSuffix,\n validBase64Value,\n defaultArgs,\n defaultHeaders\n );\n\n // Missing suffix - server treats as literal value\n await this.testBase64Case(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n 'accept',\n 'sep-2243-server-validate-param-match',\n 'ServerLiteralMissingBase64Suffix',\n 'Server treats value without ?= suffix as literal (not Base64)',\n xMcpTool.name,\n paramName,\n `=?base64?${validBase64Value}`,\n headerSuffix,\n `=?base64?${validBase64Value}`,\n defaultArgs,\n defaultHeaders\n );\n\n // --- Missing Custom Header with Value in Body ---\n\n await this.testMissingCustomHeader(\n checks,\n serverUrl,\n baseHeaders,\n nextId,\n xMcpTool.name,\n paramName,\n headerSuffix,\n defaultArgs,\n defaultHeaders\n );\n } catch (error) {\n checks.push({\n id: 'sep-2243-server-custom-setup',\n name: 'HttpCustomHeaderServerValidationSetup',\n description: 'Setup for custom header server validation tests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n\n // Declared-but-unemitted -> FAILURE. Reached only when setup threw partway\n // through (the gate-out paths emit SKIPPED rows and the happy path emits\n // every declared ID).\n this.failDeclaredChecks(checks);\n\n return checks;\n }\n\n /**\n * Backfill every declared-but-unemitted check ID as FAILURE when setup\n * failed before the cases could run, keeping the emitted ID set stable.\n */\n private failDeclaredChecks(checks: ConformanceCheck[]): void {\n for (const id of CUSTOM_HEADER_SERVER_DECLARED_CHECK_IDS) {\n if (checks.some((c) => c.id === id)) continue;\n checks.push({\n id,\n name: 'NotObserved',\n description: `Declared check ${id} was never emitted`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Check was not observed: custom-header validation setup failed before this case ran.',\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n }\n\n /**\n * Emit one SKIPPED row per declared requirement check when the scenario\n * cannot run against this server (no x-mcp-header tool). The IDs must still\n * reach checks.json so the traceability manifest records that a scenario\n * exists for each requirement.\n */\n private skipDeclaredChecks(checks: ConformanceCheck[], reason: string): void {\n for (const id of CUSTOM_HEADER_SERVER_DECLARED_CHECK_IDS) {\n if (checks.some((c) => c.id === id)) continue;\n checks.push({\n id,\n name: 'NotApplicable',\n description: `Declared check ${id} is not testable against this server`,\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_REFERENCE_CUSTOM],\n details: { reason }\n });\n }\n }\n\n private async testBase64Case(\n checks: ConformanceCheck[],\n serverUrl: string,\n baseHeaders: Record,\n nextId: () => number,\n expectation: 'accept' | 'reject',\n checkId: string,\n checkName: string,\n description: string,\n toolName: string,\n paramName: string,\n bodyValue: string,\n headerSuffix: string,\n headerValue: string,\n defaultArgs: Record,\n defaultHeaders: Record\n ): Promise {\n try {\n const response = await sendRawRequest(\n serverUrl,\n {\n jsonrpc: '2.0',\n id: nextId(),\n method: 'tools/call',\n // Issue #311: the body always carries the SEP-2575 _meta fields —\n // these cases only vary the Mcp-Param header value.\n params: withRequestMeta({\n name: toolName,\n arguments: { ...defaultArgs, [paramName]: bodyValue }\n })\n },\n {\n ...baseHeaders,\n ...defaultHeaders,\n 'Mcp-Method': 'tools/call',\n 'Mcp-Name': toolName,\n [`Mcp-Param-${headerSuffix}`]: headerValue\n }\n );\n\n const details = {\n toolName,\n paramName,\n bodyValue,\n headerSuffix,\n headerValue\n };\n\n if (expectation === 'accept') {\n checks.push(\n createAcceptanceCheck(\n checkId,\n checkName,\n description,\n response,\n SPEC_REFERENCE_BASE64,\n details\n )\n );\n } else {\n // Custom-header rejection: both 400 and -32001 are MUST per\n // §Server Behavior for Custom Headers. The status half maps to the\n // param-validation requirement this case exercises (checkId); the\n // error-code half is the \"400 + -32001 if any validation fails\"\n // requirement.\n checks.push(\n ...createRejectionChecks(\n checkId,\n PARAM_REJECT_ERROR_CODE_CHECK_ID,\n checkName,\n description,\n response,\n SPEC_REFERENCE_BASE64,\n details,\n { errorCodeSeverity: 'FAILURE' }\n )\n );\n }\n } catch (error) {\n checks.push({\n id: checkId,\n name: checkName,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE_BASE64]\n });\n }\n }\n\n private async testMissingCustomHeader(\n checks: ConformanceCheck[],\n serverUrl: string,\n baseHeaders: Record,\n nextId: () => number,\n toolName: string,\n paramName: string,\n headerSuffix: string,\n defaultArgs: Record,\n defaultHeaders: Record\n ): Promise {\n try {\n // Send tools/call with value in body but NO Mcp-Param header\n const response = await sendRawRequest(\n serverUrl,\n {\n jsonrpc: '2.0',\n id: nextId(),\n method: 'tools/call',\n // Issue #311: the body always carries the SEP-2575 _meta fields —\n // this case only omits the Mcp-Param header.\n params: withRequestMeta({\n name: toolName,\n arguments: { ...defaultArgs, [paramName]: 'test-value' }\n })\n },\n {\n ...baseHeaders,\n ...defaultHeaders,\n 'Mcp-Method': 'tools/call',\n 'Mcp-Name': toolName\n // Deliberately omit Mcp-Param-{headerSuffix} header\n }\n );\n\n // Custom-header rejection: both 400 and -32001 are MUST. A header\n // omitted while the body carries a value is a header/body mismatch, so\n // the status half maps to the validate-param-match requirement.\n checks.push(\n ...createRejectionChecks(\n 'sep-2243-server-validate-param-match',\n PARAM_REJECT_ERROR_CODE_CHECK_ID,\n 'ServerRejectsMissingCustomHeader',\n 'Server MUST reject request where custom header is omitted but value is present in body',\n response,\n SPEC_REFERENCE_CUSTOM,\n {\n toolName,\n paramName,\n bodyValue: 'test-value',\n expectedHeader: `Mcp-Param-${headerSuffix}`,\n mcpParamHeader: '(missing)'\n },\n { errorCodeSeverity: 'FAILURE' }\n )\n );\n } catch (error) {\n checks.push({\n id: 'sep-2243-server-validate-param-match',\n name: 'ServerRejectsMissingCustomHeader',\n description:\n 'Server MUST reject request where custom header is omitted but value is present in body',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n }\n}\n",[],[141,254,272,362],"bb559f74-5b64-11f1-8713-ee650bb23af1","elicitation-enums.ts","bb55a014-5b64-11f1-8713-ee650bb23af1",21,["D",1780062362292],"/**\n * SEP-1330: Elicitation enum schema improvements test scenarios for MCP servers\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../types.ts';\nimport { connectToServer } from './client-helper.ts';\nimport { ElicitRequestSchema } from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\n\nexport class ElicitationEnumsScenario implements ClientScenario {\n name = 'elicitation-sep1330-enums';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description = `Test elicitation with enum schema improvements (SEP-1330).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_elicitation_sep1330_enums\\` (no arguments) that requests \\`elicitation/create\\` from the client with a schema containing all 5 enum variants:\n\n1. **Untitled single-select**: \\`{ type: \"string\", enum: [\"option1\", \"option2\", \"option3\"] }\\`\n2. **Titled single-select**: \\`{ type: \"string\", oneOf: [{ const: \"value1\", title: \"First Option\" }, ...] }\\`\n3. **Legacy titled (deprecated)**: \\`{ type: \"string\", enum: [\"opt1\", \"opt2\", \"opt3\"], enumNames: [\"Option One\", \"Option Two\", \"Option Three\"] }\\`\n4. **Untitled multi-select**: \\`{ type: \"array\", items: { type: \"string\", enum: [\"option1\", \"option2\", \"option3\"] } }\\`\n5. **Titled multi-select**: \\`{ type: \"array\", items: { anyOf: [{ const: \"value1\", title: \"First Choice\" }, ...] } }\\`\n\n**Returns**: Text content with the elicitation result\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"Elicitation completed: action=, content={...}\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n let capturedRequest: any = null;\n connection.client.setRequestHandler(\n ElicitRequestSchema,\n async (request) => {\n capturedRequest = request;\n // Return mock data for all enum types\n return {\n action: 'accept',\n content: {\n untitledSingle: 'option1',\n titledSingle: 'value1',\n legacyEnum: 'opt1',\n untitledMulti: ['option1', 'option2'],\n titledMulti: ['value1', 'value2']\n }\n };\n }\n );\n\n await connection.client.callTool({\n name: 'test_elicitation_sep1330_enums',\n arguments: {}\n });\n\n // Validate that elicitation was requested\n if (!capturedRequest) {\n checks.push({\n id: 'elicitation-sep1330-general',\n name: 'ElicitationSEP1330General',\n description: 'Server requests elicitation with enum schemas',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'Server did not request elicitation from client',\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ]\n });\n await connection.close();\n return checks;\n }\n\n const schema = capturedRequest.params?.requestedSchema;\n const properties = schema?.properties;\n\n // Validate untitled single-select enum\n const untitledSingleErrors: string[] = [];\n if (!properties?.untitledSingle) {\n untitledSingleErrors.push(\n 'Missing untitled single-select enum field \"untitledSingle\"'\n );\n } else {\n if (properties.untitledSingle.type !== 'string') {\n untitledSingleErrors.push(\n `Expected type \"string\", got \"${properties.untitledSingle.type}\"`\n );\n }\n if (\n !properties.untitledSingle.enum ||\n !Array.isArray(properties.untitledSingle.enum)\n ) {\n untitledSingleErrors.push('Missing or invalid enum array');\n }\n if (properties.untitledSingle.oneOf) {\n untitledSingleErrors.push(\n 'Untitled enum should not have oneOf property'\n );\n }\n if (properties.untitledSingle.enumNames) {\n untitledSingleErrors.push(\n 'Untitled enum should not have enumNames property'\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1330-untitled-single',\n name: 'ElicitationSEP1330UntitledSingle',\n description: 'Untitled single-select enum schema uses enum array',\n status: untitledSingleErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n untitledSingleErrors.length > 0\n ? untitledSingleErrors.join('; ')\n : undefined,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ],\n details: {\n field: 'untitledSingle',\n schema: properties?.untitledSingle\n }\n });\n\n // Validate titled single-select enum (using oneOf with const/title)\n const titledSingleErrors: string[] = [];\n if (!properties?.titledSingle) {\n titledSingleErrors.push(\n 'Missing titled single-select enum field \"titledSingle\"'\n );\n } else {\n if (properties.titledSingle.type !== 'string') {\n titledSingleErrors.push(\n `Expected type \"string\", got \"${properties.titledSingle.type}\"`\n );\n }\n if (\n !properties.titledSingle.oneOf ||\n !Array.isArray(properties.titledSingle.oneOf)\n ) {\n titledSingleErrors.push(\n 'Missing or invalid oneOf array for titled enum'\n );\n } else {\n // Validate oneOf structure has const/title pairs\n const invalidItems = properties.titledSingle.oneOf.filter(\n (item: any) =>\n typeof item.const !== 'string' || typeof item.title !== 'string'\n );\n if (invalidItems.length > 0) {\n titledSingleErrors.push(\n `oneOf items must have \"const\" (string) and \"title\" (string) properties`\n );\n }\n }\n if (properties.titledSingle.enum) {\n titledSingleErrors.push(\n 'Titled enum should use oneOf instead of enum array'\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1330-titled-single',\n name: 'ElicitationSEP1330TitledSingle',\n description:\n 'Titled single-select enum schema uses oneOf with const/title',\n status: titledSingleErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n titledSingleErrors.length > 0\n ? titledSingleErrors.join('; ')\n : undefined,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ],\n details: {\n field: 'titledSingle',\n schema: properties?.titledSingle\n }\n });\n\n // Validate legacy titled enum (using enumNames - deprecated)\n const legacyEnumErrors: string[] = [];\n if (!properties?.legacyEnum) {\n legacyEnumErrors.push('Missing legacy titled enum field \"legacyEnum\"');\n } else {\n if (properties.legacyEnum.type !== 'string') {\n legacyEnumErrors.push(\n `Expected type \"string\", got \"${properties.legacyEnum.type}\"`\n );\n }\n if (\n !properties.legacyEnum.enum ||\n !Array.isArray(properties.legacyEnum.enum)\n ) {\n legacyEnumErrors.push('Missing or invalid enum array');\n }\n if (\n !properties.legacyEnum.enumNames ||\n !Array.isArray(properties.legacyEnum.enumNames)\n ) {\n legacyEnumErrors.push(\n 'Missing or invalid enumNames array for legacy titled enum'\n );\n } else if (\n properties.legacyEnum.enum &&\n properties.legacyEnum.enumNames.length !==\n properties.legacyEnum.enum.length\n ) {\n legacyEnumErrors.push(\n `enumNames length (${properties.legacyEnum.enumNames.length}) must match enum length (${properties.legacyEnum.enum.length})`\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1330-legacy-enumnames',\n name: 'ElicitationSEP1330LegacyEnumNames',\n description: 'Legacy titled enum schema uses enumNames (deprecated)',\n status: legacyEnumErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n legacyEnumErrors.length > 0 ? legacyEnumErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ],\n details: {\n field: 'legacyEnum',\n schema: properties?.legacyEnum\n }\n });\n\n // Validate untitled multi-select enum\n const untitledMultiErrors: string[] = [];\n if (!properties?.untitledMulti) {\n untitledMultiErrors.push(\n 'Missing untitled multi-select enum field \"untitledMulti\"'\n );\n } else {\n if (properties.untitledMulti.type !== 'array') {\n untitledMultiErrors.push(\n `Expected type \"array\", got \"${properties.untitledMulti.type}\"`\n );\n }\n if (!properties.untitledMulti.items) {\n untitledMultiErrors.push('Missing items property for array type');\n } else {\n if (properties.untitledMulti.items.type !== 'string') {\n untitledMultiErrors.push(\n `Expected items.type \"string\", got \"${properties.untitledMulti.items.type}\"`\n );\n }\n if (\n !properties.untitledMulti.items.enum ||\n !Array.isArray(properties.untitledMulti.items.enum)\n ) {\n untitledMultiErrors.push('Missing or invalid items.enum array');\n }\n if (properties.untitledMulti.items.anyOf) {\n untitledMultiErrors.push(\n 'Untitled multi-select should use items.enum, not items.anyOf'\n );\n }\n }\n }\n\n checks.push({\n id: 'elicitation-sep1330-untitled-multi',\n name: 'ElicitationSEP1330UntitledMulti',\n description:\n 'Untitled multi-select enum schema uses array with items.enum',\n status: untitledMultiErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n untitledMultiErrors.length > 0\n ? untitledMultiErrors.join('; ')\n : undefined,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ],\n details: {\n field: 'untitledMulti',\n schema: properties?.untitledMulti\n }\n });\n\n // Validate titled multi-select enum (using items.anyOf with const/title)\n const titledMultiErrors: string[] = [];\n if (!properties?.titledMulti) {\n titledMultiErrors.push(\n 'Missing titled multi-select enum field \"titledMulti\"'\n );\n } else {\n if (properties.titledMulti.type !== 'array') {\n titledMultiErrors.push(\n `Expected type \"array\", got \"${properties.titledMulti.type}\"`\n );\n }\n if (!properties.titledMulti.items) {\n titledMultiErrors.push('Missing items property for array type');\n } else {\n if (\n !properties.titledMulti.items.anyOf ||\n !Array.isArray(properties.titledMulti.items.anyOf)\n ) {\n titledMultiErrors.push(\n 'Missing or invalid items.anyOf array for titled multi-select'\n );\n } else {\n // Validate anyOf structure has const/title pairs\n const invalidItems = properties.titledMulti.items.anyOf.filter(\n (item: any) =>\n typeof item.const !== 'string' || typeof item.title !== 'string'\n );\n if (invalidItems.length > 0) {\n titledMultiErrors.push(\n `items.anyOf entries must have \"const\" (string) and \"title\" (string) properties`\n );\n }\n }\n if (properties.titledMulti.items.enum) {\n titledMultiErrors.push(\n 'Titled multi-select should use items.anyOf, not items.enum'\n );\n }\n }\n }\n\n checks.push({\n id: 'elicitation-sep1330-titled-multi',\n name: 'ElicitationSEP1330TitledMulti',\n description:\n 'Titled multi-select enum schema uses array with items.anyOf',\n status: titledMultiErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n titledMultiErrors.length > 0\n ? titledMultiErrors.join('; ')\n : undefined,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ],\n details: {\n field: 'titledMulti',\n schema: properties?.titledMulti\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'elicitation-sep1330-general',\n name: 'ElicitationSEP1330General',\n description: 'Server requests elicitation with enum schemas',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'SEP-1330',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1330'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[141,254,272,370],"bb83054a-5b64-11f1-b618-ee650bb23af1","elicitation-defaults.ts","bb830680-5b64-11f1-b618-ee650bb23af1",22,["D",1780062362588],"/**\n * SEP-1034: Elicitation default values test scenarios for MCP servers\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../types.ts';\nimport { connectToServer } from './client-helper.ts';\nimport { ElicitRequestSchema } from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\n\nexport class ElicitationDefaultsScenario implements ClientScenario {\n name = 'elicitation-sep1034-defaults';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description = `Test elicitation with default values for all primitive types (SEP-1034).\n\n**Server Implementation Requirements:**\n\nImplement a tool named \\`test_elicitation_sep1034_defaults\\` (no arguments) that requests \\`elicitation/create\\` from the client with a schema containing default values for all primitive types:\n- \\`name\\` (string): default \"John Doe\"\n- \\`age\\` (integer): default 30\n- \\`score\\` (number): default 95.5\n- \\`status\\` (string enum: [\"active\", \"inactive\", \"pending\"]): default \"active\"\n- \\`verified\\` (boolean): default true\n\n**Returns**: Text content with the elicitation result\n\n\\`\\`\\`json\n{\n \"content\": [\n {\n \"type\": \"text\",\n \"text\": \"Elicitation completed: action=, content={...}\"\n }\n ]\n}\n\\`\\`\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n\n try {\n const connection = await connectToServer(serverUrl);\n\n let capturedRequest: any = null;\n connection.client.setRequestHandler(\n ElicitRequestSchema,\n async (request) => {\n capturedRequest = request;\n return {\n action: 'accept',\n content: {\n name: 'Jane Smith',\n age: 25,\n score: 88.0,\n status: 'inactive',\n verified: false\n }\n };\n }\n );\n\n await connection.client.callTool({\n name: 'test_elicitation_sep1034_defaults',\n arguments: {}\n });\n\n // Validate that elicitation was requested\n if (!capturedRequest) {\n checks.push({\n id: 'elicitation-sep1034-general',\n name: 'ElicitationSEP1034General',\n description: 'Server requests elicitation with default values',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'Server did not request elicitation from client',\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ]\n });\n await connection.close();\n return checks;\n }\n\n const schema = capturedRequest.params?.requestedSchema;\n const properties = schema?.properties;\n\n // Validate string default\n const stringErrors: string[] = [];\n if (!properties?.name) {\n stringErrors.push('Missing string field \"name\"');\n } else {\n if (properties.name.type !== 'string') {\n stringErrors.push(\n `Expected type \"string\", got \"${properties.name.type}\"`\n );\n }\n if (!('default' in properties.name)) {\n stringErrors.push('Missing default field');\n } else if (properties.name.default !== 'John Doe') {\n stringErrors.push(\n `Expected default \"John Doe\", got \"${properties.name.default}\"`\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1034-string-default',\n name: 'ElicitationSEP1034StringDefault',\n description: 'String schema includes default value',\n status: stringErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n stringErrors.length > 0 ? stringErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'name',\n schema: properties?.name\n }\n });\n\n // Validate integer default\n const integerErrors: string[] = [];\n if (!properties?.age) {\n integerErrors.push('Missing integer field \"age\"');\n } else {\n if (properties.age.type !== 'integer') {\n integerErrors.push(\n `Expected type \"integer\", got \"${properties.age.type}\"`\n );\n }\n if (!('default' in properties.age)) {\n integerErrors.push('Missing default field');\n } else if (properties.age.default !== 30) {\n integerErrors.push(\n `Expected default 30, got ${properties.age.default}`\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1034-integer-default',\n name: 'ElicitationSEP1034IntegerDefault',\n description: 'Integer schema includes default value',\n status: integerErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n integerErrors.length > 0 ? integerErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'age',\n schema: properties?.age\n }\n });\n\n // Validate number default\n const numberErrors: string[] = [];\n if (!properties?.score) {\n numberErrors.push('Missing number field \"score\"');\n } else {\n if (properties.score.type !== 'number') {\n numberErrors.push(\n `Expected type \"number\", got \"${properties.score.type}\"`\n );\n }\n if (!('default' in properties.score)) {\n numberErrors.push('Missing default field');\n } else if (properties.score.default !== 95.5) {\n numberErrors.push(\n `Expected default 95.5, got ${properties.score.default}`\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1034-number-default',\n name: 'ElicitationSEP1034NumberDefault',\n description: 'Number schema includes default value',\n status: numberErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n numberErrors.length > 0 ? numberErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'score',\n schema: properties?.score\n }\n });\n\n // Validate enum default\n const enumErrors: string[] = [];\n if (!properties?.status) {\n enumErrors.push('Missing enum field \"status\"');\n } else {\n if (properties.status.type !== 'string') {\n enumErrors.push(\n `Expected type \"string\", got \"${properties.status.type}\"`\n );\n }\n if (!properties.status.enum || !Array.isArray(properties.status.enum)) {\n enumErrors.push('Missing or invalid enum array');\n }\n if (!('default' in properties.status)) {\n enumErrors.push('Missing default field');\n } else {\n if (properties.status.default !== 'active') {\n enumErrors.push(\n `Expected default \"active\", got \"${properties.status.default}\"`\n );\n }\n if (\n properties.status.enum &&\n !properties.status.enum.includes(properties.status.default)\n ) {\n enumErrors.push(\n `Default value \"${properties.status.default}\" is not a valid enum member`\n );\n }\n }\n }\n\n checks.push({\n id: 'elicitation-sep1034-enum-default',\n name: 'ElicitationSEP1034EnumDefault',\n description: 'Enum schema includes valid default value',\n status: enumErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: enumErrors.length > 0 ? enumErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'status',\n schema: properties?.status\n }\n });\n\n // Validate boolean default (regression test - already supported)\n const booleanErrors: string[] = [];\n if (!properties?.verified) {\n booleanErrors.push('Missing boolean field \"verified\"');\n } else {\n if (properties.verified.type !== 'boolean') {\n booleanErrors.push(\n `Expected type \"boolean\", got \"${properties.verified.type}\"`\n );\n }\n if (!('default' in properties.verified)) {\n booleanErrors.push('Missing default field');\n } else if (properties.verified.default !== true) {\n booleanErrors.push(\n `Expected default true, got ${properties.verified.default}`\n );\n }\n }\n\n checks.push({\n id: 'elicitation-sep1034-boolean-default',\n name: 'ElicitationSEP1034BooleanDefault',\n description: 'Boolean schema includes default value',\n status: booleanErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n booleanErrors.length > 0 ? booleanErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'verified',\n schema: properties?.verified\n }\n });\n\n await connection.close();\n } catch (error) {\n checks.push({\n id: 'elicitation-sep1034-general',\n name: 'ElicitationSEP1034General',\n description: 'Server requests elicitation with default values',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ]\n });\n }\n\n return checks;\n }\n}\n",[],[141,254,272,378],"ba4312f6-5b64-11f1-a2b2-ee650bb23af1","dns-rebinding.ts","ba4313e6-5b64-11f1-a2b2-ee650bb23af1",16,["D",1780062360491],"/**\n * DNS Rebinding Protection test scenarios for MCP servers\n *\n * Tests that localhost MCP servers properly validate Host or Origin headers\n * to prevent DNS rebinding attacks. See GHSA-w48q-cv73-mx4w for details.\n */\n\nimport { ClientScenario, ConformanceCheck } from '../../types.ts';\nimport { request } from 'npm:undici@^7.25.0';\n\nconst SPEC_REFERENCES = [\n {\n id: 'MCP-DNS-Rebinding-Protection',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/security_best_practices#local-mcp-server-compromise'\n },\n {\n id: 'MCP-Transport-Security',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#security-warning'\n }\n];\n\n/**\n * Check if URL is a localhost URL\n */\nfunction isLocalhostUrl(serverUrl: string): boolean {\n const url = new URL(serverUrl);\n const hostname = url.hostname.toLowerCase();\n return (\n hostname === 'localhost' ||\n hostname === '127.0.0.1' ||\n hostname === '[::1]' ||\n hostname === '::1'\n );\n}\n\n/**\n * Get the host header value from a URL (hostname:port)\n */\nfunction getHostFromUrl(serverUrl: string): string {\n const url = new URL(serverUrl);\n return url.host; // includes port if present\n}\n\n/**\n * Send an MCP initialize request with custom Host and Origin headers.\n * Both headers are set to the same value so that servers checking either\n * Host or Origin will properly detect the rebinding attempt.\n */\nasync function sendRequestWithHostAndOrigin(\n serverUrl: string,\n hostOrOrigin: string\n): Promise<{ statusCode: number; body: unknown }> {\n const response = await request(serverUrl, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/json',\n Host: hostOrOrigin,\n Origin: `http://${hostOrOrigin}`,\n Accept: 'application/json, text/event-stream'\n },\n body: JSON.stringify({\n jsonrpc: '2.0',\n id: 1,\n method: 'initialize',\n params: {\n protocolVersion: '2025-11-25',\n capabilities: {},\n clientInfo: { name: 'conformance-dns-rebinding-test', version: '1.0.0' }\n }\n })\n });\n\n let body: unknown;\n try {\n body = await response.body.json();\n } catch {\n body = null;\n }\n\n return {\n statusCode: response.statusCode,\n body\n };\n}\n\nexport class DNSRebindingProtectionScenario implements ClientScenario {\n name = 'dns-rebinding-protection';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description = `Test DNS rebinding protection for localhost servers.\n\n**Scope:** This test applies to localhost MCP servers running without HTTPS and without\nauthentication. These servers are vulnerable to DNS rebinding attacks where a malicious\nwebsite tricks a user's browser into making requests to the local server.\n\n**Attack scenario:**\n1. User visits malicious website (e.g., evil.com)\n2. evil.com's DNS is configured to resolve to 127.0.0.1\n3. Browser makes request to evil.com which actually goes to localhost\n4. Without Host/Origin header validation, the local MCP server processes the request\n\n**Requirements:**\n- Server **MUST** validate the Host or Origin header on incoming requests\n- Server **MUST** reject requests with non-localhost Host/Origin headers (HTTP 4xx)\n- Server **MUST** accept requests with valid localhost Host/Origin headers\n\n**Valid localhost values:** \\`localhost\\`, \\`127.0.0.1\\`, \\`[::1]\\` (with optional port)\n\n**Note:** This test requires a localhost server URL. Non-localhost URLs will fail.\n\nSee: https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-w48q-cv73-mx4w`;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n const timestamp = new Date().toISOString();\n\n // Common check properties\n const rejectedCheckBase = {\n id: 'localhost-host-rebinding-rejected',\n name: 'DNSRebindingRejected',\n description:\n 'Server rejects requests with non-localhost Host/Origin headers',\n timestamp,\n specReferences: SPEC_REFERENCES\n };\n\n const acceptedCheckBase = {\n id: 'localhost-host-valid-accepted',\n name: 'LocalhostHostAccepted',\n description:\n 'Server accepts requests with valid localhost Host/Origin headers',\n timestamp,\n specReferences: SPEC_REFERENCES\n };\n\n // First check: Is this a localhost URL?\n if (!isLocalhostUrl(serverUrl)) {\n const errorMessage =\n 'DNS rebinding tests require a localhost server URL (localhost, 127.0.0.1, or [::1])';\n const details = { serverUrl, reason: 'non-localhost-url' };\n\n checks.push({\n ...rejectedCheckBase,\n status: 'FAILURE',\n errorMessage,\n details\n });\n checks.push({\n ...acceptedCheckBase,\n status: 'FAILURE',\n errorMessage,\n details\n });\n return checks;\n }\n\n const validHost = getHostFromUrl(serverUrl);\n const attackerHost = 'evil.example.com';\n\n // Check 1: Invalid Host/Origin headers should be rejected with a 4xx error\n try {\n const response = await sendRequestWithHostAndOrigin(\n serverUrl,\n attackerHost\n );\n const isRejected =\n response.statusCode >= 400 && response.statusCode < 500;\n\n const details = {\n hostHeader: attackerHost,\n originHeader: `http://${attackerHost}`,\n statusCode: response.statusCode,\n body: response.body\n };\n\n if (isRejected) {\n checks.push({\n ...rejectedCheckBase,\n status: 'SUCCESS',\n details\n });\n } else {\n checks.push({\n ...rejectedCheckBase,\n status: 'FAILURE',\n errorMessage: `Expected HTTP 4xx for invalid Host/Origin headers, got ${response.statusCode}`,\n details\n });\n }\n } catch (error) {\n checks.push({\n ...rejectedCheckBase,\n status: 'FAILURE',\n errorMessage: `Request failed: ${error instanceof Error ? error.message : String(error)}`,\n details: {\n hostHeader: attackerHost,\n originHeader: `http://${attackerHost}`\n }\n });\n }\n\n // Check 2: Valid localhost Host/Origin headers should be accepted (2xx response)\n try {\n const response = await sendRequestWithHostAndOrigin(serverUrl, validHost);\n const isAccepted =\n response.statusCode >= 200 && response.statusCode < 300;\n\n const details = {\n hostHeader: validHost,\n originHeader: `http://${validHost}`,\n statusCode: response.statusCode,\n body: response.body\n };\n\n if (isAccepted) {\n checks.push({\n ...acceptedCheckBase,\n status: 'SUCCESS',\n details\n });\n } else {\n checks.push({\n ...acceptedCheckBase,\n status: 'FAILURE',\n errorMessage: `Expected HTTP 2xx for valid localhost Host/Origin headers, got ${response.statusCode}`,\n details\n });\n }\n } catch (error) {\n checks.push({\n ...acceptedCheckBase,\n status: 'FAILURE',\n errorMessage: `Request failed: ${error instanceof Error ? error.message : String(error)}`,\n details: { hostHeader: validHost, originHeader: `http://${validHost}` }\n });\n }\n\n return checks;\n }\n}\n",[],[141,254,272,386],"c2a208da-5b64-11f1-9f3f-ee650bb23af1","client-helper.ts","c2a209b6-5b64-11f1-9f3f-ee650bb23af1",51,["D",1780062374538],"/**\n * Helper utilities for creating MCP clients to test servers\n */\n\nimport { Client } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/index.js';\nimport { StreamableHTTPClientTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/client/streamableHttp.js';\nimport {\n LoggingMessageNotificationSchema,\n ProgressNotificationSchema\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\n\nexport interface MCPClientConnection {\n client: Client;\n close: () => Promise;\n}\n\n/**\n * Create and connect an MCP client to a server\n */\nexport async function connectToServer(\n serverUrl: string\n): Promise {\n const client = new Client(\n {\n name: 'conformance-test-client',\n version: '1.0.0'\n },\n {\n capabilities: {\n // Client capabilities\n sampling: {},\n elicitation: {}\n }\n }\n );\n\n const transport = new StreamableHTTPClientTransport(new URL(serverUrl));\n\n await client.connect(transport);\n\n return {\n client,\n close: async () => {\n await client.close();\n }\n };\n}\n\n/**\n * Helper to collect notifications (logging and progress)\n */\nexport class NotificationCollector {\n private loggingNotifications: any[] = [];\n private progressNotifications: any[] = [];\n\n constructor(client: Client) {\n // Set up notification handler for logging messages\n client.setNotificationHandler(\n LoggingMessageNotificationSchema,\n (notification) => {\n this.loggingNotifications.push(notification);\n }\n );\n\n // Set up notification handler for progress notifications\n client.setNotificationHandler(\n ProgressNotificationSchema,\n (notification) => {\n this.progressNotifications.push(notification);\n }\n );\n }\n\n /**\n * Get all collected logging notifications\n */\n getLoggingNotifications(): any[] {\n return this.loggingNotifications;\n }\n\n /**\n * Get all collected progress notifications\n */\n getProgressNotifications(): any[] {\n return this.progressNotifications;\n }\n\n /**\n * Get all notifications (for backward compatibility)\n */\n getNotifications(): any[] {\n return this.loggingNotifications;\n }\n}\n",[],[141,254,272,394],"ba0b5960-5b64-11f1-9de2-ee650bb23af1","caching.ts","ba0b5a5a-5b64-11f1-9de2-ee650bb23af1",15,["D",1780062360121],"/**\n * Caching (SEP-2549) test scenario for MCP servers\n *\n * Tests that servers include ttlMs and cacheScope on cacheable results:\n * tools/list, prompts/list, resources/list, resources/templates/list, resources/read\n */\n\nimport {\n ClientScenario,\n ConformanceCheck,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\nimport { sendStatelessRequest } from './stateless-client.ts';\n\nconst SPEC_REFS = [\n {\n id: 'MCP-Caching',\n url: 'https://modelcontextprotocol.io/specification/draft/server/utilities/caching'\n },\n {\n id: 'SEP-2549',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2549'\n }\n];\n\ninterface CachingFields {\n ttlMs: unknown;\n cacheScope: unknown;\n hasTtlMs: boolean;\n hasCacheScope: boolean;\n}\n\nfunction extractCachingFields(result: Record): CachingFields {\n const hasTtlMs = 'ttlMs' in result;\n const hasCacheScope = 'cacheScope' in result;\n return {\n ttlMs: hasTtlMs ? result.ttlMs : undefined,\n cacheScope: hasCacheScope ? result.cacheScope : undefined,\n hasTtlMs,\n hasCacheScope\n };\n}\n\nfunction buildPresenceCheck(\n id: string,\n name: string,\n endpoint: string,\n fields: CachingFields\n): ConformanceCheck {\n const errors: string[] = [];\n\n if (!fields.hasTtlMs) {\n errors.push(`${endpoint} response missing ttlMs`);\n }\n if (!fields.hasCacheScope) {\n errors.push(`${endpoint} response missing cacheScope`);\n }\n\n return {\n id,\n name,\n description: `${endpoint} response includes ttlMs and cacheScope caching hints`,\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: SPEC_REFS,\n details: {\n ttlMs: fields.ttlMs,\n cacheScope: fields.cacheScope,\n hasTtlMs: fields.hasTtlMs,\n hasCacheScope: fields.hasCacheScope\n }\n };\n}\n\nexport class CachingScenario implements ClientScenario {\n name = 'caching';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Test that servers include caching hints (ttlMs and cacheScope) on cacheable results (SEP-2549).\n\n**Server Implementation Requirements:**\n\nServers MUST include \\`ttlMs\\` (integer >= 0) and \\`cacheScope\\` (\"public\" or \"private\") on results from:\n- \\`tools/list\\`\n- \\`prompts/list\\`\n- \\`resources/list\\`\n- \\`resources/templates/list\\`\n- \\`resources/read\\``;\n\n async run(serverUrl: string): Promise {\n const checks: ConformanceCheck[] = [];\n const allFields: Array<{ endpoint: string; fields: CachingFields }> = [];\n\n // SEP-2549 only exists in the draft spec, so each cacheable endpoint is\n // queried over the stateless path (SEP-2575): protocolVersion DRAFT-2026-v1\n // plus the cross-cutting _meta and standard headers (issue #315).\n const queryEndpoint = async (\n checkId: string,\n checkName: string,\n endpoint: string,\n params?: Record\n ): Promise | undefined> => {\n const description = `${endpoint} response includes ttlMs and cacheScope caching hints`;\n try {\n const response = await sendStatelessRequest(\n serverUrl,\n endpoint,\n params\n );\n const result = response.body?.result;\n if (!result) {\n const error = response.body?.error;\n checks.push({\n id: checkId,\n name: checkName,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: error\n ? `${endpoint} returned JSON-RPC error ${error.code}: ${error.message}`\n : `${endpoint} returned HTTP ${response.status} with no result`,\n specReferences: SPEC_REFS,\n details: { httpStatus: response.status, error }\n });\n return undefined;\n }\n const fields = extractCachingFields(result);\n allFields.push({ endpoint, fields });\n checks.push(buildPresenceCheck(checkId, checkName, endpoint, fields));\n return result;\n } catch (error) {\n checks.push({\n id: checkId,\n name: checkName,\n description,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `${endpoint} request failed: ${error instanceof Error ? error.message : String(error)}`,\n specReferences: SPEC_REFS\n });\n return undefined;\n }\n };\n\n // 1. tools/list\n await queryEndpoint(\n 'sep-2549-tools-list-caching-hints',\n 'ToolsListCachingHints',\n 'tools/list'\n );\n\n // 2. prompts/list\n await queryEndpoint(\n 'sep-2549-prompts-list-caching-hints',\n 'PromptsListCachingHints',\n 'prompts/list'\n );\n\n // 3. resources/list\n const resourcesResult = await queryEndpoint(\n 'sep-2549-resources-list-caching-hints',\n 'ResourcesListCachingHints',\n 'resources/list'\n );\n\n // 4. resources/templates/list\n await queryEndpoint(\n 'sep-2549-resources-templates-list-caching-hints',\n 'ResourcesTemplatesListCachingHints',\n 'resources/templates/list'\n );\n\n // 5. resources/read — use first resource from resources/list\n const resources = resourcesResult?.resources as\n | Array<{ uri?: string }>\n | undefined;\n const firstResourceUri = resources?.[0]?.uri;\n if (firstResourceUri) {\n await queryEndpoint(\n 'sep-2549-resources-read-caching-hints',\n 'ResourcesReadCachingHints',\n 'resources/read',\n { uri: firstResourceUri }\n );\n } else {\n // Keep the emitted check-ID set stable even when there is nothing to\n // read (resources/list failed or the server exposes no resources).\n checks.push({\n id: 'sep-2549-resources-read-caching-hints',\n name: 'ResourcesReadCachingHints',\n description:\n 'resources/read response includes ttlMs and cacheScope caching hints',\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'resources/read was not exercised: resources/list failed or returned no resources.',\n specReferences: SPEC_REFS\n });\n }\n\n // 6. Aggregate: ttlMs must be a non-negative integer\n const ttlErrors: string[] = [];\n const endpointsWithTtl = allFields.filter((f) => f.fields.hasTtlMs);\n if (endpointsWithTtl.length === 0) {\n ttlErrors.push('no endpoints returned ttlMs');\n } else {\n for (const { endpoint, fields } of endpointsWithTtl) {\n const val = fields.ttlMs;\n if (typeof val !== 'number') {\n ttlErrors.push(\n `${endpoint}: ttlMs is ${typeof val}, expected number`\n );\n } else if (!Number.isInteger(val)) {\n ttlErrors.push(`${endpoint}: ttlMs is ${val}, expected integer`);\n } else if (val < 0) {\n ttlErrors.push(`${endpoint}: ttlMs is ${val}, must be >= 0`);\n }\n }\n }\n\n checks.push({\n id: 'sep-2549-ttl-non-negative',\n name: 'TtlNonNegative',\n description: 'All ttlMs values are non-negative integers',\n status: ttlErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: ttlErrors.length > 0 ? ttlErrors.join('; ') : undefined,\n specReferences: SPEC_REFS,\n details: {\n endpoints: allFields.map((f) => ({\n endpoint: f.endpoint,\n ttlMs: f.fields.ttlMs\n }))\n }\n });\n\n // 7. Aggregate: cacheScope must be \"public\" or \"private\"\n const scopeErrors: string[] = [];\n const endpointsWithScope = allFields.filter((f) => f.fields.hasCacheScope);\n if (endpointsWithScope.length === 0) {\n scopeErrors.push('no endpoints returned cacheScope');\n } else {\n for (const { endpoint, fields } of endpointsWithScope) {\n const val = fields.cacheScope;\n if (val !== 'public' && val !== 'private') {\n scopeErrors.push(\n `${endpoint}: cacheScope is ${JSON.stringify(val)}, expected \"public\" or \"private\"`\n );\n }\n }\n }\n\n checks.push({\n id: 'sep-2549-cache-scope-valid',\n name: 'CacheScopeValid',\n description: 'All cacheScope values are \"public\" or \"private\"',\n status: scopeErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: scopeErrors.length > 0 ? scopeErrors.join('; ') : undefined,\n specReferences: SPEC_REFS,\n details: {\n endpoints: allFields.map((f) => ({\n endpoint: f.endpoint,\n cacheScope: f.fields.cacheScope\n }))\n }\n });\n\n return checks;\n }\n}\n",[],[141,254,272,402],"b98d1758-5b64-11f1-97f0-ee650bb23af1",["D",1780062359293],[210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227],[141,254,272],"fd757570-5f4a-11f1-b55f-1607ee4eb77e","tools_call.ts","be60801c-5b64-11f1-ae75-ee650bb23af1","ec297e4a-593f-4895-bcc9-83abd226436a",94,["D",1780491110710],"import { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport type { ConformanceCheck, RequestListener } from '../../types.ts';\nimport { HandlerScenario } from '../../types.ts';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { createRequestLogger } from '../request-logger.ts';\n\nfunction createMcpServer(checks: ConformanceCheck[]): Server {\n const server = new Server(\n {\n name: 'add-numbers-server',\n version: '1.0.0'\n },\n {\n capabilities: {\n tools: {}\n }\n }\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => {\n return {\n tools: [\n {\n name: 'add_numbers',\n description: 'Add two numbers together',\n inputSchema: {\n type: 'object',\n properties: {\n a: {\n type: 'number',\n description: 'First number'\n },\n b: {\n type: 'number',\n description: 'Second number'\n }\n },\n required: ['a', 'b']\n }\n }\n ]\n };\n });\n\n server.setRequestHandler(CallToolRequestSchema, async (request) => {\n if (request.params.name === 'add_numbers') {\n const { a, b } = request.params.arguments as { a: number; b: number };\n const result = a + b;\n\n checks.push({\n id: 'tool-add-numbers',\n name: 'ToolAddNumbers',\n description: 'Validates that the add_numbers tool works correctly',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Tools',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ],\n details: {\n a,\n b,\n result\n }\n });\n\n return {\n content: [\n {\n type: 'text',\n text: `The sum of ${a} and ${b} is ${result}`\n }\n ]\n };\n }\n\n throw new Error(`Unknown tool: ${request.params.name}`);\n });\n\n return server;\n}\n\nfunction createServerApp(checks: ConformanceCheck[]): express.Application {\n const app = express();\n app.use(express.json());\n\n app.use(\n createRequestLogger(checks, {\n incomingId: 'incoming-request',\n outgoingId: 'outgoing-response',\n mcpRoute: '/mcp'\n })\n );\n\n app.post('/mcp', async (req: Request, res: Response) => {\n // Stateless: create a fresh server and transport per request\n const server = createMcpServer(checks);\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n\n await transport.handleRequest(req, res, req.body);\n });\n\n return app;\n}\n\nexport class ToolsCallScenario extends HandlerScenario {\n name = 'tools_call';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = 'Tests calling tools with various parameter types';\n mcpPath = '/mcp';\n private checks: ConformanceCheck[] = [];\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n return createServerApp(this.checks);\n }\n\n getChecks(): ConformanceCheck[] {\n const expectedSlugs = ['tool-add-numbers'];\n // add a failure if not in there already\n for (const slug of expectedSlugs) {\n if (!this.checks.find((c) => c.id === slug)) {\n // TODO: this is duplicated from above, refactor\n this.checks.push({\n id: slug,\n name: `ToolAddNumbers`,\n description: `Validates that the add_numbers tool works correctly`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n details: { message: 'Tool was not called by client' },\n specReferences: [\n {\n id: 'MCP-Tools',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n }\n ]\n });\n }\n }\n return this.checks;\n }\n}\n",[],[141,254,422,414],"client","02cd4e26-09c8-459f-9b26-4e326ed9d1f3","stateless-gauntlet.ts","fd176548-5f4a-11f1-89cc-1607ee4eb77e",102,["D",1780655292566],4,"/**\n * Stateless conformance gauntlet — one MCP server, many validating tools.\n *\n * Unlike the per-aspect scenarios, this is a single stateless server a client\n * connects to once. Every tool validates some aspect of the request that\n * carried it; transport-level obligations (Accept header, content type,\n * MCP-Protocol-Version) are validated on every POST before dispatch. The\n * conformance contract is self-evident:\n *\n * list tools, call each one with valid arguments — if nothing errors,\n * the client passed everything this server can observe per-request.\n *\n * There is intentionally NO cross-request state: each request is judged on\n * its own content, so the server can run on serverless hosts (val.town)\n * where consecutive requests may land on different isolates, and no run-id\n * or results polling is needed. Checks are still recorded for the runner /\n * hosted results view, but a misbehaving client finds out immediately\n * because its own request fails with an explanation.\n */\n\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport type { ConformanceCheck } from '../../types.ts';\nimport { HandlerScenario, DRAFT_PROTOCOL_VERSION } from '../../types.ts';\n\nconst SPEC_HTTP = {\n id: 'MCP-Streamable-HTTP',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#streamable-http'\n};\nconst SPEC_TOOLS = {\n id: 'MCP-Tools',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/server/tools#calling-tools'\n};\n\n/**\n * The draft wire string and its planned release date are treated as the same\n * version: clients built against the dated release string must pass against\n * a server that predates the rename (and vice versa).\n */\nconst DRAFT_VERSION_ALIASES = [DRAFT_PROTOCOL_VERSION, '2026-07-28'];\n\nconst CLASSIC_PROTOCOL_VERSIONS = ['2025-03-26', '2025-06-18', '2025-11-25'];\n\nconst KNOWN_PROTOCOL_VERSIONS = [\n ...CLASSIC_PROTOCOL_VERSIONS,\n ...DRAFT_VERSION_ALIASES\n];\n\nfunction isDraftVersion(v: unknown): boolean {\n return DRAFT_VERSION_ALIASES.includes(String(v));\n}\n\n/** Versions compare equal across the draft/release-date alias. */\nfunction sameVersion(a: unknown, b: unknown): boolean {\n return (\n String(a) === String(b) || (isDraftVersion(a) && isDraftVersion(b))\n );\n}\n\nconst META_NS = 'io.modelcontextprotocol/';\n\n// ---------------------------------------------------------------------------\n// MRTR (SEP-2322) — multi-round-trip tool, draft mode only.\n//\n// Listed only for clients whose per-request `_meta` clientCapabilities\n// declare elicitation support: a client that can't answer elicitation\n// requests simply never sees the tool, so \"call every listed tool\" stays the\n// whole contract. The requestState is self-contained (no server memory), so\n// the retry can land on any isolate.\n// ---------------------------------------------------------------------------\n\nconst MRTR_TOOL = {\n name: 'mrtr_confirm',\n description:\n 'Multi-round-trip tool (SEP-2322): the first call returns an ' +\n 'input_required result with an elicitation request and a requestState. ' +\n 'Re-call this tool with inputResponses.confirm set to the elicitation ' +\n 'result and requestState echoed back unchanged.',\n inputSchema: { type: 'object', properties: {} }\n};\n\n/**\n * Listed in place of mrtr_confirm when the client does NOT declare the\n * elicitation capability — so the absence is discoverable instead of silent.\n * Calling it is not an error (not implementing elicitation is conformant);\n * the result explains what declaring the capability unlocks.\n */\nconst ELICITATION_MISSING_TOOL = {\n name: 'elicitation_missing',\n description:\n 'You are seeing this tool because your client did not declare the ' +\n \"'elicitation' capability in _meta \" +\n `${META_NS}clientCapabilities. Clients that declare it ` +\n '({\"elicitation\": {}}) see the full tool list, including the ' +\n 'multi-round-trip (MRTR, SEP-2322) tool mrtr_confirm. Calling this ' +\n 'tool is not an error — it returns this explanation.',\n inputSchema: { type: 'object', properties: {} }\n};\n\nfunction declaresElicitation(meta: Record): boolean {\n const caps = meta[`${META_NS}clientCapabilities`];\n return (\n typeof caps === 'object' &&\n caps !== null &&\n (caps as Record).elicitation !== undefined\n );\n}\n\nfunction encodeMrtrState(): string {\n return Buffer.from(\n JSON.stringify({ tool: MRTR_TOOL.name, nonce: 'gauntlet-mrtr-v1' })\n ).toString('base64url');\n}\n\nfunction decodeMrtrState(state: string): boolean {\n try {\n const parsed = JSON.parse(Buffer.from(state, 'base64url').toString());\n return parsed.tool === MRTR_TOOL.name && parsed.nonce === 'gauntlet-mrtr-v1';\n } catch {\n return false;\n }\n}\n\ninterface ToolOutcome {\n ok: boolean;\n /** What was validated (on success) or what the client got wrong. */\n detail: string;\n}\n\n/**\n * Tool registry. Transport conformance (headers, _meta, version) is enforced\n * on every request before any tool runs, so tools only need to cover what a\n * request body can get wrong: constructing arguments that honor the\n * inputSchema. One tool with a string, a number, and a same-document $ref\n * field covers every argument kind in a single call; failures itemize\n * per-field problems so nothing diagnostic is lost by the consolidation.\n */\nconst GAUNTLET_TOOLS: {\n name: string;\n description: string;\n inputSchema: Record;\n validate: (args: Record, req: Request) => ToolOutcome;\n}[] = [\n {\n name: 'validate_arguments',\n description:\n 'Echoes back its arguments. Validates that the client constructs ' +\n 'arguments honoring the inputSchema: a required string, a required ' +\n 'JSON number (not a stringified number), and a field defined via a ' +\n 'same-document $ref (#/$defs/payload) — local refs are safe to ' +\n 'resolve (SEP-2106). Failures list every non-conforming field.',\n inputSchema: {\n type: 'object',\n properties: {\n message: { type: 'string', description: 'Any string to echo' },\n count: { type: 'number', description: 'Any JSON number' },\n payload: { $ref: '#/$defs/payload' }\n },\n required: ['message', 'count', 'payload'],\n $defs: {\n payload: {\n type: 'object',\n properties: { kind: { type: 'string', enum: ['solid', 'liquid'] } },\n required: ['kind']\n }\n }\n },\n validate: (args) => {\n const problems: string[] = [];\n if (typeof args.message !== 'string') {\n problems.push(\n `'message' must be a string; got ${JSON.stringify(args.message)} (${typeof args.message})`\n );\n }\n if (typeof args.count !== 'number') {\n problems.push(\n `'count' must be a JSON number, not a stringified number; got ${JSON.stringify(args.count)} (${typeof args.count})`\n );\n }\n const payload = args.payload as { kind?: unknown } | undefined;\n if (\n !payload ||\n typeof payload !== 'object' ||\n (payload.kind !== 'solid' && payload.kind !== 'liquid')\n ) {\n problems.push(\n `'payload' must match #/$defs/payload ({kind: \"solid\"|\"liquid\"}); got ${JSON.stringify(args.payload)}`\n );\n }\n if (problems.length > 0) {\n return { ok: false, detail: problems.join('; ') };\n }\n return {\n ok: true,\n detail: `message=${args.message}, count=${String(args.count)}, payload.kind=${String(payload?.kind)}`\n };\n }\n }\n];\n\n/** Transport-level problems with the request, empty when conformant. */\nfunction headerProblems(req: Request): string[] {\n const problems: string[] = [];\n const accept = String(req.headers.accept ?? '');\n if (\n !accept.includes('application/json') ||\n !accept.includes('text/event-stream')\n ) {\n problems.push(\n `Accept header MUST list both application/json and text/event-stream; got '${accept || '(missing)'}'`\n );\n }\n const contentType = String(req.headers['content-type'] ?? '');\n if (!contentType.includes('application/json')) {\n problems.push(\n `Content-Type MUST be application/json; got '${contentType || '(missing)'}'`\n );\n }\n return problems;\n}\n\n/**\n * Draft-2026 (SEP-2575/SEP-2243) per-request obligations. There is no\n * initialization in the stateless draft protocol, so everything a classic\n * handshake established must be carried by every request: the version header,\n * the io.modelcontextprotocol/* `_meta` fields, and the Mcp-Method/Mcp-Name\n * routing headers.\n */\nfunction draftProblems(\n req: Request,\n body: { method?: string; params?: Record }\n): string[] {\n const problems: string[] = [];\n const headerVersion = req.headers['mcp-protocol-version'];\n const meta = (body.params?._meta ?? {}) as Record;\n const metaVersion = meta[`${META_NS}protocolVersion`];\n\n if (!headerVersion) {\n problems.push(\n 'MCP-Protocol-Version header MUST be sent on every request (SEP-2575; there is no initialize handshake to negotiate it)'\n );\n } else if (!KNOWN_PROTOCOL_VERSIONS.includes(String(headerVersion))) {\n problems.push(\n `MCP-Protocol-Version '${String(headerVersion)}' is not a known protocol version (${KNOWN_PROTOCOL_VERSIONS.join(', ')})`\n );\n }\n for (const field of ['protocolVersion', 'clientInfo', 'clientCapabilities']) {\n if (meta[`${META_NS}${field}`] === undefined) {\n problems.push(\n `_meta MUST carry ${META_NS}${field} on every request (SEP-2575)`\n );\n }\n }\n if (\n headerVersion !== undefined &&\n metaVersion !== undefined &&\n !sameVersion(headerVersion, metaVersion)\n ) {\n problems.push(\n `MCP-Protocol-Version header ('${String(headerVersion)}') MUST match _meta ${META_NS}protocolVersion ('${String(metaVersion)}')`\n );\n }\n const mcpMethod = req.headers['mcp-method'];\n if (!mcpMethod) {\n problems.push(\n 'Mcp-Method header MUST mirror the JSON-RPC method on every POST (SEP-2243)'\n );\n } else if (body.method && String(mcpMethod) !== body.method) {\n problems.push(\n `Mcp-Method header ('${String(mcpMethod)}') MUST equal the body method ('${body.method}') (SEP-2243)`\n );\n }\n if (body.method === 'tools/call') {\n const mcpName = req.headers['mcp-name'];\n const toolName = (body.params as { name?: string } | undefined)?.name;\n if (!mcpName) {\n problems.push(\n 'Mcp-Name header MUST mirror params.name on tools/call (SEP-2243)'\n );\n } else if (toolName && String(mcpName) !== toolName) {\n problems.push(\n `Mcp-Name header ('${String(mcpName)}') MUST equal params.name ('${toolName}') (SEP-2243)`\n );\n }\n }\n return problems;\n}\n\nfunction check(\n checks: ConformanceCheck[],\n id: string,\n name: string,\n ok: boolean,\n description: string,\n details?: Record\n): void {\n checks.push({\n id,\n name,\n description,\n status: ok ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_HTTP],\n details\n });\n}\n\ninterface ToolCallResult {\n content: { type: 'text'; text: string }[];\n isError?: boolean;\n}\n\n/** Execute a gauntlet tool call. */\nfunction runTool(\n checks: ConformanceCheck[],\n name: string,\n args: Record,\n req: Request\n): ToolCallResult {\n const tool = GAUNTLET_TOOLS.find((t) => t.name === name);\n if (!tool) {\n return {\n content: [\n {\n type: 'text',\n text:\n `CONFORMANCE FAIL: unknown tool '${name}'. ` +\n `Available: ${GAUNTLET_TOOLS.map((t) => t.name).join(', ')}`\n }\n ],\n isError: true\n };\n }\n const outcome = tool.validate(args, req);\n check(\n checks,\n `gauntlet-${tool.name}`,\n `Gauntlet: ${tool.name}`,\n outcome.ok,\n outcome.ok\n ? `Client called ${tool.name} conformantly`\n : `Client call to ${tool.name} was not conformant`,\n { detail: outcome.detail }\n );\n if (!outcome.ok) {\n return {\n content: [\n {\n type: 'text',\n text: `CONFORMANCE FAIL [${tool.name}]: ${outcome.detail}`\n }\n ],\n isError: true\n };\n }\n return {\n content: [\n { type: 'text', text: `CONFORMANCE OK [${tool.name}]: ${outcome.detail}` }\n ]\n };\n}\n\nexport class StatelessGauntletScenario extends HandlerScenario {\n name = 'stateless-gauntlet';\n description =\n 'Single stateless MCP server with validating tools, draft protocol ' +\n '(SEP-2575) ONLY. List tools, call each once with valid arguments; any ' +\n 'error response tells you what the client got wrong. No run-id and no ' +\n 'results polling — every request is judged on its own content. Clients ' +\n 'that fall back to a classic version (initialize, or a 2025-* version ' +\n 'header) fail with an itemized list of what a draft request carries ' +\n 'that theirs did not.';\n readonly source = { introducedIn: '2025-06-18' } as const;\n mcpPath = '';\n\n private checks: ConformanceCheck[] = [];\n\n handler(): express.Application {\n const app = express();\n app.use(express.json());\n\n app.post('/', async (req: Request, res: Response) => {\n const body =\n req.body && !Array.isArray(req.body)\n ? (req.body as {\n method?: string;\n id?: unknown;\n params?: Record;\n })\n : {};\n const headerVersion = req.headers['mcp-protocol-version'];\n\n // This gauntlet tests the stateless draft protocol ONLY. A client\n // that falls back to a classic version (an `initialize` request or a\n // 2025-* version header) fails — but with a full inventory of what a\n // draft request must carry that this one didn't, so the failure is\n // also the upgrade guide. A request carrying draft `_meta` fields is\n // judged as draft no matter what its header claims (the disagreement\n // is reported, not routed around).\n const meta = (body.params?._meta ?? {}) as Record;\n const hasDraftMeta = Object.keys(meta).some((k) =>\n k.startsWith(META_NS)\n );\n const isClassicFallback =\n !hasDraftMeta &&\n ((body.method === 'initialize' && !isDraftVersion(headerVersion)) ||\n (headerVersion !== undefined &&\n CLASSIC_PROTOCOL_VERSIONS.includes(String(headerVersion))));\n\n const problems = headerProblems(req);\n if (isClassicFallback) {\n problems.unshift(\n body.method === 'initialize'\n ? 'This gauntlet tests the stateless draft protocol (2026-07-28): there is NO initialize handshake. Do not negotiate up front — send server/discover (or any request) directly, carrying the version and client identity on every request.'\n : `Request declared classic protocol version '${String(headerVersion)}'. This gauntlet tests the stateless draft protocol only — declare 2026-07-28 (or DRAFT-2026-v1) in both the MCP-Protocol-Version header and _meta.`\n );\n }\n // Draft obligations are evaluated for EVERY request — for a classic\n // fallback this doubles as the itemized list of what was missing.\n problems.push(...draftProblems(req, body));\n\n check(\n this.checks,\n 'gauntlet-transport-headers',\n 'Gauntlet: transport headers',\n problems.length === 0,\n problems.length === 0\n ? 'Request carried conformant draft transport headers'\n : isClassicFallback\n ? 'Client fell back to a classic protocol version'\n : 'Request transport headers were not conformant',\n {\n method: body.method,\n mode: isClassicFallback ? 'classic-fallback-rejected' : 'draft',\n ...(problems.length ? { problems } : {})\n }\n );\n if (problems.length > 0) {\n res.status(400).json({\n error: 'conformance failure',\n mode: isClassicFallback ? 'classic-fallback-rejected' : 'draft',\n problems,\n hint: isClassicFallback\n ? 'Each listed problem is one thing a stateless draft request carries that this request did not.'\n : 'Fix the listed transport problems and retry.'\n });\n return;\n }\n\n this.handleDraft(req, res, body);\n });\n\n // Stateless servers have nothing to GET/DELETE.\n app.get('/', (_req, res) => {\n res.status(405).json({\n error: 'stateless server: POST JSON-RPC to this URL'\n });\n });\n\n return app;\n }\n\n /**\n * Draft-2026 dispatch: no lifecycle, plain JSON responses, every request\n * self-contained. Transport/draft obligations were already enforced.\n */\n private handleDraft(\n req: Request,\n res: Response,\n body: { method?: string; id?: unknown; params?: Record }\n ): void {\n const reply = (result: object) => {\n res.json({ jsonrpc: '2.0', id: body.id ?? null, result });\n };\n\n switch (body.method) {\n case 'server/discover':\n reply({\n supportedVersions: DRAFT_VERSION_ALIASES,\n capabilities: { tools: {} },\n serverInfo: { name: 'conformance-gauntlet', version: '1.0.0' },\n instructions:\n 'Call every tool once with valid arguments. Each tool validates ' +\n 'the request that carried it; any error explains what your ' +\n 'client got wrong.'\n });\n return;\n\n case 'tools/list': {\n const meta = (body.params?._meta ?? {}) as Record;\n const tools = GAUNTLET_TOOLS.map(\n ({ name, description, inputSchema }) => ({\n name,\n description,\n inputSchema\n })\n );\n // MRTR is only part of the contract for clients that can answer\n // elicitation requests — gate the listing on the declared capability\n // each request carries. Clients without it get a placeholder that\n // makes the gap (and how to close it) discoverable.\n tools.push(\n declaresElicitation(meta) ? MRTR_TOOL : ELICITATION_MISSING_TOOL\n );\n reply({ tools });\n return;\n }\n\n case 'tools/call': {\n const params = (body.params ?? {}) as {\n name?: string;\n arguments?: Record;\n inputResponses?: Record;\n requestState?: string;\n _meta?: Record;\n };\n\n if (params.name === MRTR_TOOL.name) {\n reply(this.runMrtr(params));\n return;\n }\n\n if (params.name === ELICITATION_MISSING_TOOL.name) {\n const declared = declaresElicitation(\n (params._meta ?? {}) as Record\n );\n this.checks.push({\n id: 'gauntlet-elicitation-missing',\n name: 'Gauntlet: elicitation capability not declared',\n description:\n 'Client called the elicitation_missing placeholder tool',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [SPEC_TOOLS],\n details: { declared }\n });\n reply({\n content: [\n {\n type: 'text',\n text: declared\n ? 'CONFORMANCE NOTE [elicitation_missing]: this request DOES declare the elicitation capability — list tools again and you will see mrtr_confirm instead of this placeholder.'\n : 'CONFORMANCE NOTE [elicitation_missing]: your client has not declared the elicitation capability, so the MRTR (SEP-2322) tool mrtr_confirm is hidden. This is conformant — elicitation is optional — but to exercise the full gauntlet, implement elicitation and declare it in _meta ' +\n `${META_NS}clientCapabilities as {\"elicitation\": {}}; the full tool list will then appear.`\n }\n ]\n });\n return;\n }\n\n // MRTR plumbing must not leak onto unrelated calls (SEP-2322).\n if (\n params.inputResponses !== undefined ||\n params.requestState !== undefined\n ) {\n const detail =\n 'inputResponses/requestState MUST only be sent when retrying the ' +\n 'tool that returned input_required; they leaked onto ' +\n `'${params.name ?? '(none)'}'`;\n check(\n this.checks,\n 'gauntlet-mrtr-leak',\n 'Gauntlet: MRTR state leak',\n false,\n 'MRTR retry fields leaked onto an unrelated tool call',\n { detail }\n );\n reply({\n content: [\n { type: 'text', text: `CONFORMANCE FAIL [${params.name}]: ${detail}` }\n ],\n isError: true\n });\n return;\n }\n\n reply(\n runTool(this.checks, params.name ?? '', params.arguments ?? {}, req)\n );\n return;\n }\n\n case 'initialize':\n case 'ping':\n case 'logging/setLevel':\n // Removed from the stateless draft protocol entirely.\n res.status(404).json({\n jsonrpc: '2.0',\n id: body.id ?? null,\n error: {\n code: -32601,\n message: `Method not found: '${body.method}' does not exist in the stateless draft protocol (use server/discover, not initialize)`\n }\n });\n return;\n\n default:\n res.status(404).json({\n jsonrpc: '2.0',\n id: body.id ?? null,\n error: {\n code: -32601,\n message: `Method not found: '${body.method ?? '(none)'}'. Supported: server/discover, tools/list, tools/call`\n }\n });\n }\n }\n\n /**\n * Two-phase MRTR tool. First call → input_required with a self-contained\n * requestState. Retry → validate the echoed state and the elicitation\n * response shape, then complete.\n */\n private runMrtr(params: {\n inputResponses?: Record;\n requestState?: string;\n }): object {\n if (params.inputResponses === undefined) {\n // Round 1: ask for confirmation via elicitation.\n return {\n resultType: 'input_required',\n inputRequests: {\n confirm: {\n method: 'elicitation/create',\n params: {\n message: 'Confirm the MRTR round-trip by answering this.',\n requestedSchema: {\n type: 'object',\n properties: { confirmed: { type: 'boolean' } },\n required: ['confirmed']\n }\n }\n }\n },\n requestState: encodeMrtrState()\n };\n }\n\n // Round 2: judge the retry on its own content.\n const problems: string[] = [];\n if (params.requestState === undefined) {\n problems.push(\n 'requestState MUST be echoed back unchanged on the retry (SEP-2322)'\n );\n } else if (!decodeMrtrState(params.requestState)) {\n problems.push(\n `requestState was altered — it MUST be echoed back byte-exact; got '${params.requestState.slice(0, 60)}'`\n );\n }\n const confirm = params.inputResponses.confirm as\n | { action?: unknown; content?: { confirmed?: unknown } }\n | undefined;\n if (!confirm || typeof confirm !== 'object') {\n problems.push(\n \"inputResponses MUST be keyed by the inputRequests key ('confirm')\"\n );\n } else {\n if (confirm.action !== 'accept' && confirm.action !== 'decline' && confirm.action !== 'cancel') {\n problems.push(\n `elicitation response action MUST be accept/decline/cancel; got ${JSON.stringify(confirm.action)}`\n );\n }\n if (\n confirm.action === 'accept' &&\n typeof confirm.content?.confirmed !== 'boolean'\n ) {\n problems.push(\n `accepted elicitation content MUST match requestedSchema ({confirmed: boolean}); got ${JSON.stringify(confirm.content)}`\n );\n }\n }\n\n const ok = problems.length === 0;\n const detail = ok\n ? `requestState echoed intact; elicitation response valid (action=${String((params.inputResponses.confirm as { action?: unknown })?.action)})`\n : problems.join('; ');\n check(\n this.checks,\n 'gauntlet-mrtr_confirm',\n 'Gauntlet: mrtr_confirm',\n ok,\n ok\n ? 'Client completed the MRTR round-trip conformantly'\n : 'Client MRTR retry was not conformant',\n { detail }\n );\n if (!ok) {\n return {\n content: [\n { type: 'text', text: `CONFORMANCE FAIL [mrtr_confirm]: ${detail}` }\n ],\n isError: true\n };\n }\n return {\n content: [\n { type: 'text', text: `CONFORMANCE OK [mrtr_confirm]: ${detail}` }\n ]\n };\n }\n\n getChecks(): ConformanceCheck[] {\n return this.checks;\n }\n}\n",[],[141,254,422,424],"bdbfba74-5b64-11f1-a277-ee650bb23af1","sse-retry.ts","bdbfbb50-5b64-11f1-a277-ee650bb23af1",30,["D",1780062366222],"/**\n * SSE Retry conformance test scenarios for MCP clients (SEP-1699)\n *\n * Tests that clients properly respect the SSE retry field by:\n * - Waiting the specified milliseconds before reconnecting\n * - Sending Last-Event-ID header on reconnection\n * - Treating graceful stream closure as reconnectable\n */\n\nimport http from 'node:http';\nimport {\n Scenario,\n ScenarioUrls,\n ConformanceCheck,\n RequestListener\n} from '../../types.ts';\n\nexport class SSERetryScenario implements Scenario {\n name = 'sse-retry';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests that client respects SSE retry field timing and reconnects properly (SEP-1699)';\n\n private server: http.Server | null = null;\n private checks: ConformanceCheck[] = [];\n private port: number = 0;\n\n // Timing tracking\n private toolStreamCloseTime: number | null = null;\n private getReconnectionTime: number | null = null;\n private getConnectionCount: number = 0;\n private lastEventIds: (string | undefined)[] = [];\n private retryValue: number = 500; // 500ms\n private eventIdCounter: number = 0;\n private sessionId: string = `session-${Date.now()}`;\n\n // Pending tool call to respond to after reconnection\n private pendingToolCallId: number | string | null = null;\n private getResponseStream: http.ServerResponse | null = null;\n\n // Tolerances for timing validation\n private readonly EARLY_TOLERANCE = 50; // Allow 50ms early for scheduler variance\n private readonly LATE_TOLERANCE = 200; // Allow 200ms late for network/event loop\n private readonly VERY_LATE_MULTIPLIER = 2; // If >2x retry value, client is likely ignoring it\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n this.toolStreamCloseTime = null;\n this.getReconnectionTime = null;\n this.getConnectionCount = 0;\n this.lastEventIds = [];\n this.eventIdCounter = 0;\n this.sessionId = `session-${Date.now()}`;\n this.pendingToolCallId = null;\n this.getResponseStream = null;\n return (req, res) => this.handleRequest(req, res);\n }\n\n async start(): Promise {\n const listener = this.handler(() => `http://localhost:${this.port}`);\n return new Promise((resolve, reject) => {\n this.server = http.createServer(listener);\n this.server.on('error', reject);\n this.server.listen(0, () => {\n const address = this.server!.address();\n if (address && typeof address === 'object') {\n this.port = address.port;\n resolve({\n serverUrl: `http://localhost:${this.port}`\n });\n } else {\n reject(new Error('Failed to get server address'));\n }\n });\n });\n }\n\n async stop(): Promise {\n return new Promise((resolve, reject) => {\n if (this.server) {\n this.server.close((err) => {\n if (err) {\n reject(err);\n } else {\n this.server = null;\n resolve();\n }\n });\n } else {\n resolve();\n }\n });\n }\n\n getChecks(): ConformanceCheck[] {\n // Generate checks based on observed behavior\n this.generateChecks();\n return this.checks;\n }\n\n private handleRequest(\n req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n if (req.method === 'GET') {\n // Track GET reconnection timing and Last-Event-ID\n this.getConnectionCount++;\n this.getReconnectionTime = performance.now();\n\n const lastEventId = req.headers['last-event-id'] as string | undefined;\n const description = lastEventId\n ? `Received GET request for ${req.url} (Last-Event-ID: ${lastEventId})`\n : `Received GET request for ${req.url}`;\n this.checks.push({\n id: 'incoming-request',\n name: 'IncomingRequest',\n description,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n method: 'GET',\n url: req.url,\n headers: req.headers,\n connectionCount: this.getConnectionCount\n }\n });\n\n if (lastEventId) {\n this.lastEventIds.push(lastEventId);\n }\n\n // Handle GET SSE stream request (reconnection)\n this.handleGetSSEStream(req, res);\n } else if (req.method === 'POST') {\n // Handle POST JSON-RPC requests\n this.handlePostRequest(req, res);\n } else {\n res.writeHead(405);\n res.end('Method Not Allowed');\n }\n }\n\n private handleGetSSEStream(\n _req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n // Set SSE headers\n res.writeHead(200, {\n 'Content-Type': 'text/event-stream',\n 'Cache-Control': 'no-cache',\n Connection: 'keep-alive',\n 'mcp-session-id': this.sessionId\n });\n\n // Generate event ID\n this.eventIdCounter++;\n const eventId = `event-${this.eventIdCounter}`;\n\n // Send priming event with ID and retry field\n const primingContent = `id: ${eventId}\\nretry: ${this.retryValue}\\ndata: \\n\\n`;\n res.write(primingContent);\n\n this.checks.push({\n id: 'outgoing-sse-event',\n name: 'OutgoingSseEvent',\n description: `Sent SSE priming event on GET stream (id: ${eventId}, retry: ${this.retryValue}ms)`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId,\n retryMs: this.retryValue,\n eventType: 'priming',\n raw: primingContent\n }\n });\n\n // Store the GET stream to send pending tool response\n this.getResponseStream = res;\n\n // If we have a pending tool call, send the response now\n if (this.pendingToolCallId !== null) {\n const toolResponse = {\n jsonrpc: '2.0',\n id: this.pendingToolCallId,\n result: {\n content: [\n {\n type: 'text',\n text: 'Reconnection test completed successfully'\n }\n ]\n }\n };\n\n const responseEventId = `event-${++this.eventIdCounter}`;\n const responseContent = `event: message\\nid: ${responseEventId}\\ndata: ${JSON.stringify(toolResponse)}\\n\\n`;\n res.write(responseContent);\n\n this.checks.push({\n id: 'outgoing-sse-event',\n name: 'OutgoingSseEvent',\n description: `Sent tool response on GET stream after reconnection (id: ${responseEventId})`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId: responseEventId,\n eventType: 'message',\n jsonrpcId: this.pendingToolCallId,\n body: toolResponse,\n raw: responseContent\n }\n });\n\n this.pendingToolCallId = null;\n }\n }\n\n private handlePostRequest(\n req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n let body = '';\n\n req.on('data', (chunk) => {\n body += chunk.toString();\n });\n\n req.on('end', () => {\n try {\n const request = JSON.parse(body);\n\n this.checks.push({\n id: 'incoming-request',\n name: 'IncomingRequest',\n description: `Received POST request for ${req.url} (method: ${request.method})`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n method: 'POST',\n url: req.url,\n jsonrpcMethod: request.method,\n jsonrpcId: request.id\n }\n });\n\n if (request.method === 'initialize') {\n this.handleInitialize(req, res, request);\n } else if (request.method === 'tools/list') {\n this.handleToolsList(res, request);\n } else if (request.method === 'tools/call') {\n this.handleToolsCall(res, request);\n } else if (request.id === undefined) {\n // Notifications (no id) - return 202 Accepted\n res.writeHead(202);\n res.end();\n } else {\n // For other requests, send a simple JSON response\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {}\n })\n );\n }\n } catch (error) {\n res.writeHead(400, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n error: {\n code: -32700,\n message: `Parse error: ${error}`\n }\n })\n );\n }\n });\n }\n\n private handleInitialize(\n _req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n const response = {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n protocolVersion: '2025-03-26',\n serverInfo: {\n name: 'sse-retry-test-server',\n version: '1.0.0'\n },\n capabilities: {\n tools: {}\n }\n }\n };\n\n res.end(JSON.stringify(response));\n\n this.checks.push({\n id: 'outgoing-response',\n name: 'OutgoingResponse',\n description: `Sent initialize response`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n jsonrpcId: request.id,\n body: response\n }\n });\n }\n\n private handleToolsList(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n const response = {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n tools: [\n {\n name: 'test_reconnection',\n description:\n 'A tool that triggers SSE stream closure to test client reconnection behavior',\n inputSchema: {\n type: 'object',\n properties: {},\n required: []\n }\n }\n ]\n }\n };\n\n res.end(JSON.stringify(response));\n\n this.checks.push({\n id: 'outgoing-response',\n name: 'OutgoingResponse',\n description: `Sent tools/list response`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n jsonrpcId: request.id,\n body: response\n }\n });\n }\n\n private handleToolsCall(res: http.ServerResponse, request: any): void {\n // Store the request ID so we can respond after reconnection\n this.pendingToolCallId = request.id;\n\n // Start SSE stream\n res.writeHead(200, {\n 'Content-Type': 'text/event-stream',\n 'Cache-Control': 'no-cache',\n Connection: 'keep-alive',\n 'mcp-session-id': this.sessionId\n });\n\n // Send priming event with retry field\n this.eventIdCounter++;\n const primingEventId = `event-${this.eventIdCounter}`;\n const primingContent = `id: ${primingEventId}\\nretry: ${this.retryValue}\\ndata: \\n\\n`;\n res.write(primingContent);\n\n this.checks.push({\n id: 'outgoing-sse-event',\n name: 'OutgoingSseEvent',\n description: `Sent SSE priming event for tools/call (id: ${primingEventId}, retry: ${this.retryValue}ms)`,\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n eventId: primingEventId,\n retryMs: this.retryValue,\n eventType: 'priming',\n raw: primingContent\n }\n });\n\n // Close the stream after a short delay to trigger reconnection\n setTimeout(() => {\n this.toolStreamCloseTime = performance.now();\n this.checks.push({\n id: 'outgoing-stream-close',\n name: 'OutgoingStreamClose',\n description:\n 'Closed tools/call SSE stream to trigger client reconnection',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n details: {\n retryMs: this.retryValue,\n pendingToolCallId: this.pendingToolCallId\n }\n });\n res.end();\n }, 50);\n }\n\n private generateChecks(): void {\n // Check 1: Client should have reconnected via GET after tool call stream close\n if (this.getConnectionCount < 1) {\n this.checks.push({\n id: 'client-sse-graceful-reconnect',\n name: 'ClientGracefulReconnect',\n description:\n 'Client reconnects via GET after SSE stream is closed gracefully',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Client did not attempt GET reconnection after stream closure. Client should treat graceful stream close as reconnectable.`,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n getConnectionCount: this.getConnectionCount,\n toolStreamCloseTime: this.toolStreamCloseTime,\n retryValue: this.retryValue\n }\n });\n return;\n }\n\n // Client did reconnect - SUCCESS for graceful reconnection\n this.checks.push({\n id: 'client-sse-graceful-reconnect',\n name: 'ClientGracefulReconnect',\n description:\n 'Client reconnects via GET after SSE stream is closed gracefully',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n getConnectionCount: this.getConnectionCount\n }\n });\n\n // Check 2: Client MUST respect retry field timing\n if (\n this.toolStreamCloseTime !== null &&\n this.getReconnectionTime !== null\n ) {\n const actualDelay = this.getReconnectionTime - this.toolStreamCloseTime;\n const minExpected = this.retryValue - this.EARLY_TOLERANCE;\n const maxExpected = this.retryValue + this.LATE_TOLERANCE;\n\n const tooEarly = actualDelay < minExpected;\n const slightlyLate = actualDelay > maxExpected;\n const veryLate =\n actualDelay > this.retryValue * this.VERY_LATE_MULTIPLIER;\n const withinTolerance = !tooEarly && !slightlyLate;\n\n let status: 'SUCCESS' | 'FAILURE' | 'WARNING' = 'SUCCESS';\n let errorMessage: string | undefined;\n\n if (tooEarly) {\n // Client reconnected too soon - MUST violation\n status = 'FAILURE';\n errorMessage = `Client reconnected too early (${actualDelay.toFixed(0)}ms instead of ${this.retryValue}ms). Client MUST respect the retry field and wait the specified time.`;\n } else if (veryLate) {\n // Client reconnected way too late - likely ignoring retry field entirely\n status = 'FAILURE';\n errorMessage = `Client reconnected very late (${actualDelay.toFixed(0)}ms instead of ${this.retryValue}ms). Client appears to be ignoring the retry field and using its own backoff strategy.`;\n } else if (slightlyLate) {\n // Client reconnected slightly late - not a spec violation but suspicious\n status = 'WARNING';\n errorMessage = `Client reconnected slightly late (${actualDelay.toFixed(0)}ms instead of ${this.retryValue}ms). This is acceptable but may indicate network delays.`;\n }\n\n this.checks.push({\n id: 'client-sse-retry-timing',\n name: 'ClientRespectsRetryField',\n description:\n 'Client MUST respect the retry field, waiting the given number of milliseconds before attempting to reconnect',\n status,\n timestamp: new Date().toISOString(),\n errorMessage,\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n expectedRetryMs: this.retryValue,\n actualDelayMs: Math.round(actualDelay),\n minAcceptableMs: minExpected,\n maxAcceptableMs: maxExpected,\n veryLateThresholdMs: this.retryValue * this.VERY_LATE_MULTIPLIER,\n earlyToleranceMs: this.EARLY_TOLERANCE,\n lateToleranceMs: this.LATE_TOLERANCE,\n withinTolerance,\n tooEarly,\n slightlyLate,\n veryLate,\n getConnectionCount: this.getConnectionCount\n }\n });\n } else {\n this.checks.push({\n id: 'client-sse-retry-timing',\n name: 'ClientRespectsRetryField',\n description: 'Client MUST respect the retry field timing',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Could not measure timing - tool stream close time or GET reconnection time not recorded',\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n toolStreamCloseTime: this.toolStreamCloseTime,\n getReconnectionTime: this.getReconnectionTime\n }\n });\n }\n\n // Check 3: Client SHOULD send Last-Event-ID header on reconnection\n const hasLastEventId =\n this.lastEventIds.length > 0 && this.lastEventIds[0] !== undefined;\n\n this.checks.push({\n id: 'client-sse-last-event-id',\n name: 'ClientSendsLastEventId',\n description:\n 'Client SHOULD send Last-Event-ID header on reconnection for resumability',\n status: hasLastEventId ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-1699',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1699'\n }\n ],\n details: {\n hasLastEventId,\n lastEventIds: this.lastEventIds,\n getConnectionCount: this.getConnectionCount\n },\n errorMessage: !hasLastEventId\n ? 'Client did not send Last-Event-ID header on reconnection. This is a SHOULD requirement for resumability.'\n : undefined\n });\n }\n}\n",[],[141,254,422,433],"fc94f752-5f4a-11f1-80a9-1607ee4eb77e","request-metadata.ts","bd5c3f4e-5b64-11f1-a593-ee650bb23af1",91,["D",1780491109479],"import http from 'node:http';\nimport {\n HandlerScenario,\n RequestListener,\n ConformanceCheck,\n CheckStatus,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\n\n/**\n * Severity ranking used to latch per-id check results: a single\n * non-conformant request is a violation even if later requests are\n * conformant, so a later better status must never overwrite a worse one.\n */\nconst STATUS_SEVERITY: Record = {\n FAILURE: 3,\n WARNING: 2,\n SUCCESS: 1,\n INFO: 1,\n SKIPPED: 0\n};\n\n/**\n * Every check ID this scenario can emit. Declared-but-unemitted checks are\n * backfilled as FAILURE by getChecks(), so the emitted ID set is the same for\n * every client. The positive-path test asserts this list is exact.\n */\nexport const DECLARED_CHECK_IDS = [\n 'sep-2575-http-client-sends-version-header',\n 'sep-2575-client-populates-meta',\n 'sep-2575-http-version-header-matches-meta',\n 'sep-2575-client-declares-roots-capability',\n 'sep-2575-client-declares-sampling-capability',\n 'sep-2575-client-declares-elicitation-capability',\n 'sep-2575-client-retry-supported-version'\n] as const;\n\nexport class RequestMetadataScenario extends HandlerScenario {\n name = 'request-metadata';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Per-request _meta and MCP-Protocol-Version header obligations (SEP-2575)';\n\n private checks: ConformanceCheck[] = [];\n private hasSimulatedRejection = false;\n private requestsObserved = 0;\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.hasSimulatedRejection = false;\n this.checks = [];\n this.requestsObserved = 0;\n return (req, res) => this.handleRequest(req, res);\n }\n\n getChecks(): ConformanceCheck[] {\n // Declared but never emitted -> FAILURE. A check that is legitimately not\n // applicable must be emitted as SKIPPED explicitly to avoid this.\n for (const id of DECLARED_CHECK_IDS) {\n if (!this.checks.some((c) => c.id === id)) {\n this.checks.push({\n id,\n name: 'NotObserved',\n description: `Declared check ${id} was never emitted`,\n status: 'FAILURE',\n errorMessage:\n this.requestsObserved === 0\n ? 'Check was not observed: the client never sent a request to the scenario server (no handler registered for this scenario?)'\n : 'Check was not observed: no request exercised it',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/index#meta'\n }\n ],\n details: { observed: false, requestsObserved: this.requestsObserved }\n });\n }\n }\n return this.checks;\n }\n\n private addOrUpdateCheck(check: ConformanceCheck): void {\n const index = this.checks.findIndex((c) => c.id === check.id);\n if (index === -1) {\n this.checks.push(check);\n return;\n }\n // Keep the worst status observed for this id (FAILURE > WARNING > SUCCESS\n // > SKIPPED): an equal-or-worse result replaces the stored check (so its\n // details stay fresh), but a better result must not erase a violation\n // recorded from an earlier request.\n const existing = this.checks[index];\n if (STATUS_SEVERITY[check.status] >= STATUS_SEVERITY[existing.status]) {\n this.checks[index] = check;\n }\n }\n\n private handleRequest(\n req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n let body = '';\n req.on('data', (chunk) => {\n body += chunk.toString();\n });\n req.on('end', () => {\n const request = JSON.parse(body);\n this.requestsObserved++;\n\n // Extract version and headers\n const meta = request.params?._meta;\n const metaVersion = meta?.['io.modelcontextprotocol/protocolVersion'];\n const headerVersion = req.headers['mcp-protocol-version'];\n\n // 1. \"Every POST request to the MCP endpoint MUST include an\n // MCP-Protocol-Version header.\" — unconditional, so this fires for\n // server/discover too.\n this.addOrUpdateCheck({\n id: 'sep-2575-http-client-sends-version-header',\n name: 'ClientSendsVersionHeader',\n description: 'Client sends MCP-Protocol-Version header on every POST',\n status: headerVersion !== undefined ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#protocol-version-header'\n }\n ],\n details: { method: request.method, headerVersion }\n });\n\n // 2. \"Every client request MUST include the following\n // io.modelcontextprotocol/* fields in _meta: protocolVersion,\n // clientInfo, clientCapabilities.\"\n const hasClientInfo = meta?.['io.modelcontextprotocol/clientInfo'];\n const hasCapabilities =\n meta?.['io.modelcontextprotocol/clientCapabilities'];\n const metaIsValid = metaVersion && hasClientInfo && hasCapabilities;\n\n this.addOrUpdateCheck({\n id: 'sep-2575-client-populates-meta',\n name: 'ClientPopulatesMeta',\n description:\n 'Client populates _meta on every request with all three required fields',\n status: metaIsValid ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/index#meta'\n }\n ],\n details: { method: request.method, meta }\n });\n\n // 3. \"The header value MUST match the io.modelcontextprotocol/protocolVersion\n // field carried in the request body's _meta.\" Only comparable when both\n // are present; absence is already covered by the two checks above, so\n // emit SKIPPED rather than falling through to the declared-check failure.\n const bothVersionsPresent =\n headerVersion !== undefined && metaVersion !== undefined;\n this.addOrUpdateCheck({\n id: 'sep-2575-http-version-header-matches-meta',\n name: 'ClientVersionHeaderMatchesMeta',\n description:\n 'MCP-Protocol-Version header matches _meta.protocolVersion',\n status: !bothVersionsPresent\n ? 'SKIPPED'\n : headerVersion === metaVersion\n ? 'SUCCESS'\n : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#protocol-version-header'\n }\n ],\n details: { headerVersion, metaVersion }\n });\n\n // 4. Optional client capabilities conditional verification\n const capabilities = meta?.['io.modelcontextprotocol/clientCapabilities'];\n const checkOptionalCapability = (\n capabilityName: string,\n checkId: string,\n checkName: string\n ) => {\n let status: 'SUCCESS' | 'FAILURE' | 'SKIPPED' = 'SKIPPED';\n if (capabilities && capabilityName in capabilities) {\n const val = capabilities[capabilityName];\n const isValidObject =\n typeof val === 'object' && val !== null && !Array.isArray(val);\n status = isValidObject ? 'SUCCESS' : 'FAILURE';\n }\n this.addOrUpdateCheck({\n id: checkId,\n name: checkName,\n description: `Client declares valid ${capabilityName} capability if present`,\n status,\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/index#capabilities'\n }\n ],\n details: { capabilityValue: capabilities?.[capabilityName] }\n });\n };\n\n checkOptionalCapability(\n 'roots',\n 'sep-2575-client-declares-roots-capability',\n 'ClientDeclaresRootsCapability'\n );\n checkOptionalCapability(\n 'sampling',\n 'sep-2575-client-declares-sampling-capability',\n 'ClientDeclaresSamplingCapability'\n );\n checkOptionalCapability(\n 'elicitation',\n 'sep-2575-client-declares-elicitation-capability',\n 'ClientDeclaresElicitationCapability'\n );\n\n // 5. Simulated Version Negotiation Retry Check\n if (!this.hasSimulatedRejection) {\n this.hasSimulatedRejection = true;\n\n this.addOrUpdateCheck({\n id: 'sep-2575-client-retry-supported-version',\n name: 'ClientRetrySupportedVersion',\n description:\n 'Client retries with a supported version when first choice is rejected',\n status: 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'SEP-2575',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#protocol-version-header'\n }\n ],\n details: { headerVersion }\n });\n\n res.writeHead(400, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id ?? null,\n error: {\n // UnsupportedProtocolVersionError per the draft schema.\n code: -32004,\n message: 'Unsupported protocol version',\n data: {\n supported: [DRAFT_PROTOCOL_VERSION]\n }\n }\n })\n );\n return;\n }\n\n const retryCheck = this.checks.find(\n (c) => c.id === 'sep-2575-client-retry-supported-version'\n );\n if (retryCheck) {\n if (\n headerVersion === DRAFT_PROTOCOL_VERSION &&\n metaVersion === DRAFT_PROTOCOL_VERSION\n ) {\n retryCheck.status = 'SUCCESS';\n } else {\n retryCheck.status = 'WARNING';\n }\n retryCheck.details = {\n ...retryCheck.details,\n retryHeaderVersion: headerVersion,\n retryMetaVersion: metaVersion\n };\n }\n\n // server/discover is optional for clients (spec: \"Clients MAY call it\"),\n // so no check is emitted; we still respond so a client that does call it\n // proceeds normally and exercises the per-request _meta/header checks above.\n if (request.method === 'server/discover') {\n res.writeHead(200, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n supportedVersions: [DRAFT_PROTOCOL_VERSION],\n capabilities: {},\n serverInfo: { name: 'test', version: '1.0' }\n }\n })\n );\n return;\n }\n\n // Return generic response to unblock client\n let result: object = {};\n if (request.method === 'tools/list') {\n result = { tools: [] };\n } else if (request.method === 'tools/call') {\n result = { content: [] };\n }\n res.writeHead(200, { 'Content-Type': 'application/json' });\n res.end(JSON.stringify({ jsonrpc: '2.0', id: request.id, result }));\n });\n }\n}\n",[],[141,254,422,441],"fc725b3e-5f4a-11f1-8b96-1607ee4eb77e","mrtr-client.ts","bd25421e-5b64-11f1-8a62-ee650bb23af1",90,["D",1780491109248],"/**\n * SEP-2322: MRTR Client Conformance Tests\n *\n * Tests that clients correctly handle the MRTR (Multi-Round Tool Resolution) flow:\n * - Echo requestState back unchanged when retrying\n * - Don't include requestState when server didn't send one\n * - Use a different JSON-RPC id on retry\n *\n * The server exposes two tools. The client calls each tool, gets InputRequiredResult,\n * fulfills the elicitation, and retries. The server verifies correct client behavior.\n */\n\nimport type { ConformanceCheck, RequestListener } from '../../types.ts';\nimport { HandlerScenario, DRAFT_PROTOCOL_VERSION } from '../../types.ts';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { randomUUID } from 'node:crypto';\n\nconst MRTR_SPEC_REFERENCES = [\n {\n id: 'SEP-2322-MRTR',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/utilities/mrtr'\n }\n];\n\nconst TOOLS = [\n {\n name: 'test_mrtr_echo_state',\n description:\n 'Test tool: triggers MRTR flow with requestState. Client must echo state back unchanged.',\n inputSchema: {\n type: 'object' as const,\n properties: {},\n required: [] as string[]\n }\n },\n {\n name: 'test_mrtr_no_state',\n description:\n 'Test tool: triggers MRTR flow WITHOUT requestState. Client must NOT include requestState in retry.',\n inputSchema: {\n type: 'object' as const,\n properties: {},\n required: [] as string[]\n }\n },\n {\n name: 'test_mrtr_unrelated',\n description:\n 'Test tool: simple tool called between MRTR rounds. Must NOT carry inputResponses or requestState from another tool.',\n inputSchema: {\n type: 'object' as const,\n properties: {},\n required: [] as string[]\n }\n },\n {\n name: 'test_mrtr_no_result_type',\n description:\n 'Test tool: returns a result without resultType. Client must treat it as complete (default).',\n inputSchema: {\n type: 'object' as const,\n properties: {},\n required: [] as string[]\n }\n }\n];\n\ninterface JsonRpcRequest {\n jsonrpc: '2.0';\n id: string | number;\n method: string;\n params?: Record;\n}\n\nfunction createMRTRServer(checks: ConformanceCheck[]): express.Application {\n const app = express();\n app.use(express.json());\n\n // Track original JSON-RPC ids per tool to verify they change on retry\n const originalIds = new Map();\n // Track the exact requestState string sent, to verify byte-exact echo on retry\n const sentStates = new Map();\n\n app.post('/mcp', (req: Request, res: Response) => {\n const body = req.body as JsonRpcRequest;\n const { id, method, params } = body;\n\n switch (method) {\n case 'notifications/initialized': {\n res.status(204).end();\n return;\n }\n\n case 'tools/list': {\n res.json({\n jsonrpc: '2.0',\n id,\n result: { tools: TOOLS }\n });\n return;\n }\n\n case 'tools/call': {\n const toolName = (params as Record)?.name as string;\n const inputResponses = (params as Record)\n ?.inputResponses as Record | undefined;\n const requestState = (params as Record)\n ?.requestState as string | undefined;\n\n if (toolName === 'test_mrtr_echo_state') {\n handleEchoState(id, inputResponses, requestState, checks, res);\n return;\n }\n\n if (toolName === 'test_mrtr_no_state') {\n handleNoState(id, inputResponses, requestState, checks, res);\n return;\n }\n\n if (toolName === 'test_mrtr_unrelated') {\n handleUnrelated(inputResponses, requestState, checks, res, id);\n return;\n }\n\n if (toolName === 'test_mrtr_no_result_type') {\n handleNoResultType(id, inputResponses, checks, res);\n return;\n }\n\n res.json({\n jsonrpc: '2.0',\n id,\n error: { code: -32601, message: `Unknown tool: ${toolName}` }\n });\n return;\n }\n\n case 'elicitation/create': {\n // Client is fulfilling our ElicitRequest — accept it\n res.json({\n jsonrpc: '2.0',\n id,\n result: { action: 'accept', content: { confirmed: true } }\n });\n return;\n }\n\n default: {\n res.json({\n jsonrpc: '2.0',\n id,\n error: { code: -32601, message: `Method not found: ${method}` }\n });\n return;\n }\n }\n });\n\n function handleEchoState(\n id: string | number,\n inputResponses: Record | undefined,\n requestState: string | undefined,\n checks: ConformanceCheck[],\n res: Response\n ) {\n if (!inputResponses) {\n // Initial call — store original id, return InputRequiredResult with requestState\n originalIds.set('echo_state', id);\n const state = JSON.stringify({\n nonce: randomUUID(),\n originalId: id\n });\n sentStates.set('echo_state', state);\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n resultType: 'input_required',\n inputRequests: {\n confirm: {\n method: 'elicitation/create',\n params: {\n message: 'Please confirm to continue',\n requestedSchema: {\n type: 'object',\n properties: {\n confirmed: { type: 'boolean', description: 'Confirm?' }\n }\n }\n }\n }\n },\n requestState: state\n }\n });\n return;\n }\n\n // Retry — verify requestState was echoed back correctly\n const originalId = originalIds.get('echo_state');\n const sentState = sentStates.get('echo_state');\n\n // Check 1: requestState must be present and byte-for-byte identical to\n // what the server sent. The spec requires the client to echo back the\n // *exact value* without inspecting, parsing, or modifying it — so a\n // semantically-equal but re-serialized string is still a failure.\n const stateErrors: string[] = [];\n if (!requestState) {\n stateErrors.push('Client did not include requestState in retry');\n } else if (requestState !== sentState) {\n stateErrors.push(\n 'requestState was not echoed back exactly — clients MUST NOT inspect, parse, or modify it'\n );\n }\n\n checks.push({\n id: 'sep-2322-client-request-state-echoed',\n name: 'MRTRClientRequestStateEchoed',\n description:\n 'Client MUST echo back the exact value of requestState when retrying',\n status: stateErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: stateErrors.length > 0 ? stateErrors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: {\n requestStateSent: sentState,\n requestStateReceived: requestState,\n originalId\n }\n });\n\n // Check 2: JSON-RPC id must differ from original\n const idErrors: string[] = [];\n if (id === originalId) {\n idErrors.push(\n `JSON-RPC id is the same on retry (${id}) — MUST be different`\n );\n }\n\n checks.push({\n id: 'sep-2322-client-jsonrpc-id-different',\n name: 'MRTRClientJsonRpcIdDifferent',\n description:\n 'The JSON-RPC id MUST be different between the initial request and the retry',\n status: idErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: idErrors.length > 0 ? idErrors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: {\n originalId,\n retryId: id\n }\n });\n\n // Return complete result\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n content: [{ type: 'text', text: 'echo-state-ok' }]\n }\n });\n }\n\n function handleNoState(\n id: string | number,\n inputResponses: Record | undefined,\n requestState: string | undefined,\n checks: ConformanceCheck[],\n res: Response\n ) {\n if (!inputResponses) {\n // Initial call — return InputRequiredResult WITHOUT requestState\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n resultType: 'input_required',\n inputRequests: {\n confirm: {\n method: 'elicitation/create',\n params: {\n message: 'Please confirm to continue (no state test)',\n requestedSchema: {\n type: 'object',\n properties: {\n confirmed: { type: 'boolean', description: 'Confirm?' }\n }\n }\n }\n }\n }\n // No requestState field!\n }\n });\n return;\n }\n\n // Retry — verify client did NOT include requestState\n const errors: string[] = [];\n if (requestState !== undefined) {\n errors.push(\n `Client included requestState (\"${requestState}\") but server did not send one — MUST NOT include it`\n );\n }\n\n checks.push({\n id: 'sep-2322-client-no-state-omitted',\n name: 'MRTRClientNoStateOmitted',\n description:\n 'If InputRequiredResult does not contain requestState, client MUST NOT include one in the retry',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: {\n requestStateReceived: requestState\n }\n });\n\n // Return complete result\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n content: [{ type: 'text', text: 'no-state-ok' }]\n }\n });\n }\n\n function handleUnrelated(\n inputResponses: Record | undefined,\n requestState: string | undefined,\n checks: ConformanceCheck[],\n res: Response,\n id: string | number\n ) {\n // This tool should NEVER receive inputResponses or requestState —\n // those belong to a different tool's MRTR flow\n const errors: string[] = [];\n if (inputResponses !== undefined) {\n errors.push(\n `Unrelated tool call included inputResponses from another tool's MRTR flow`\n );\n }\n if (requestState !== undefined) {\n errors.push(\n `Unrelated tool call included requestState from another tool's MRTR flow`\n );\n }\n\n checks.push({\n id: 'sep-2322-client-parallel-isolation',\n name: 'MRTRClientParallelIsolation',\n description:\n 'inputRequests and requestState MUST NOT be used for any other request the client may be sending',\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: MRTR_SPEC_REFERENCES,\n details: {\n inputResponsesReceived: inputResponses,\n requestStateReceived: requestState\n }\n });\n\n // Return a normal complete result\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n content: [{ type: 'text', text: 'unrelated-ok' }]\n }\n });\n }\n\n function handleNoResultType(\n id: string | number,\n inputResponses: Record | undefined,\n checks: ConformanceCheck[],\n res: Response\n ) {\n const checkId = 'sep-2322-default-result-type-complete';\n\n // If the client retries this tool, it means it did NOT treat the result as complete\n if (inputResponses) {\n // Remove any prior SUCCESS for this check (emitted when we first sent the response)\n const existingIdx = checks.findIndex((c) => c.id === checkId);\n if (existingIdx !== -1) checks.splice(existingIdx, 1);\n\n checks.push({\n id: checkId,\n name: 'DefaultResultTypeComplete',\n description:\n 'Client MUST assume resultType \"complete\" when not specified',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n 'Client retried with inputResponses even though the result had no resultType (should default to complete)',\n specReferences: MRTR_SPEC_REFERENCES\n });\n res.json({\n jsonrpc: '2.0',\n id,\n result: { content: [{ type: 'text', text: 'unexpected-retry' }] }\n });\n return;\n }\n\n // Return a result WITHOUT resultType — client should treat as complete\n checks.push({\n id: checkId,\n name: 'DefaultResultTypeComplete',\n description:\n 'Client MUST assume resultType \"complete\" when not specified',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: MRTR_SPEC_REFERENCES\n });\n\n res.json({\n jsonrpc: '2.0',\n id,\n result: {\n // Deliberately NO resultType field\n content: [{ type: 'text', text: 'no-result-type-test-ok' }]\n }\n });\n }\n\n return app;\n}\n\nexport class MRTRClientScenario extends HandlerScenario {\n name = 'sep-2322-client-request-state';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests client MRTR behavior: requestState echo, no-state omission, and JSON-RPC id uniqueness (SEP-2322)';\n mcpPath = '/mcp';\n private checks: ConformanceCheck[] = [];\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n return createMRTRServer(this.checks);\n }\n\n getChecks(): ConformanceCheck[] {\n const expectedSlugs = [\n 'sep-2322-client-request-state-echoed',\n 'sep-2322-client-jsonrpc-id-different',\n 'sep-2322-client-no-state-omitted',\n 'sep-2322-client-parallel-isolation',\n 'sep-2322-default-result-type-complete'\n ];\n\n for (const slug of expectedSlugs) {\n if (!this.checks.find((c) => c.id === slug)) {\n this.checks.push({\n id: slug,\n name: slug,\n description: `MRTR client check: ${slug}`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n details: {\n message: 'Tool was not called by client or MRTR flow not completed'\n },\n specReferences: MRTR_SPEC_REFERENCES\n });\n }\n }\n return this.checks;\n }\n}\n",[],[141,254,422,449],"f942af36-5f4a-11f1-a8ce-1607ee4eb77e","json-schema-ref-deref.ts","b83f4f42-5b64-11f1-9ce4-ee650bb23af1",86,["D",1780491103912],"import { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport { ListToolsRequestSchema } from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport type { ConformanceCheck, RequestListener } from '../../types.ts';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { HandlerScenario, DRAFT_PROTOCOL_VERSION } from '../../types.ts';\n\n/**\n * Scenario: JSON Schema network $ref dereferencing (SEP-2106)\n *\n * SEP-2106 permits the full JSON Schema 2020-12 vocabulary in tool schemas,\n * including `$ref`. A `$ref` that resolves to a network URI is an SSRF /\n * fetch-DoS vector: a malicious tool definition could point at internal\n * infrastructure and have the *client* fetch it during schema processing.\n *\n * Per SEP-2106, implementations MUST NOT automatically dereference `$ref`\n * values that resolve to a network URI (anything that is not a same-document\n * JSON Pointer such as `#/$defs/Foo` or an internal `$anchor`).\n *\n * This scenario advertises a tool whose inputSchema contains both a\n * same-document `$ref` and a `$ref` to a canary URL hosted by the scenario\n * itself. If the client fetches the canary URL at any point before the\n * scenario stops, the check fails.\n */\n\nconst TOOL_NAME = 'lookup_user';\nconst CANARY_PATH = '/canary/profile-schema.json';\nconst CHECK_ID = 'sep-2106-no-network-ref-deref';\n\nconst SPEC_REFERENCES = [\n {\n id: 'SEP-2106',\n url: 'https://modelcontextprotocol.io/seps/2106-json-schema-2020-12#security-implications'\n }\n];\n\nfunction createMcpServer(canaryUrl: string, onToolsListed: () => void): Server {\n const server = new Server(\n { name: 'json-schema-ref-deref-server', version: '1.0.0' },\n { capabilities: { tools: {} } }\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => {\n onToolsListed();\n return {\n tools: [\n {\n name: TOOL_NAME,\n description: 'Look up a user profile by id',\n inputSchema: {\n $schema: 'https://json-schema.org/draft/2020-12/schema',\n type: 'object',\n $defs: {\n userId: { type: 'string', pattern: '^[a-z0-9-]+$' }\n },\n properties: {\n // Same-document $ref: safe, expected to be resolvable locally.\n id: { $ref: '#/$defs/userId' },\n // Network $ref: the canary. Implementations MUST NOT fetch this\n // automatically while processing the schema.\n profile: { $ref: canaryUrl }\n },\n required: ['id']\n }\n }\n ]\n };\n });\n\n return server;\n}\n\nexport class JsonSchemaRefDerefScenario extends HandlerScenario {\n name = 'json-schema-ref-no-deref';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description = `Tests that a client does not automatically dereference a network-URI \\`$ref\\` in a tool's inputSchema (SEP-2106).\n\nThe scenario advertises a tool whose inputSchema contains a \\`$ref\\` pointing at a canary URL. The client should list tools (and may otherwise process the schema), but must not fetch the canary URL. Same-document refs (\\`#/$defs/...\\`) remain safe to resolve.`;\n mcpPath = '/mcp';\n\n private canaryRequests: Array<{ method: string; userAgent?: string }> = [];\n private toolsListed = false;\n\n handler(getBaseUrl: () => string): RequestListener {\n this.canaryRequests = [];\n this.toolsListed = false;\n\n const app = express();\n app.use(express.json());\n\n // Canary endpoint: any request here means the client dereferenced the\n // network $ref. Return a valid schema so a dereferencing client gets a\n // realistic response rather than an error it might silently swallow.\n app.all(CANARY_PATH, (req: Request, res: Response) => {\n this.canaryRequests.push({\n method: req.method,\n userAgent: req.headers['user-agent']\n });\n res.json({\n $schema: 'https://json-schema.org/draft/2020-12/schema',\n type: 'object',\n properties: { displayName: { type: 'string' } }\n });\n });\n\n app.post('/mcp', async (req: Request, res: Response) => {\n try {\n // Stateless: fresh server and transport per request\n const canaryUrl = `${getBaseUrl()}${CANARY_PATH}`;\n const server = createMcpServer(canaryUrl, () => {\n this.toolsListed = true;\n });\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n await server.connect(transport);\n await transport.handleRequest(req, res, req.body);\n } catch (error) {\n if (!res.headersSent) {\n res.status(500).json({\n jsonrpc: '2.0',\n error: {\n code: -32603,\n message: `Internal error: ${error instanceof Error ? error.message : String(error)}`\n },\n id: null\n });\n }\n }\n });\n\n return app;\n }\n\n getChecks(): ConformanceCheck[] {\n // Built fresh on every call so getChecks() is idempotent — the runner may\n // call it more than once and we must not accumulate duplicates.\n const timestamp = new Date().toISOString();\n const fetched = this.canaryRequests.length > 0;\n\n if (!this.toolsListed) {\n return [\n {\n id: CHECK_ID,\n name: 'NoNetworkRefDereference',\n description:\n 'Client never requested tools/list, so $ref handling could not be evaluated',\n status: 'FAILURE',\n timestamp,\n errorMessage:\n 'Client did not call tools/list against a server advertising a tool with a network $ref',\n specReferences: SPEC_REFERENCES,\n details: { toolsListed: false }\n }\n ];\n }\n\n return [\n {\n id: CHECK_ID,\n name: 'NoNetworkRefDereference',\n description: fetched\n ? 'Client automatically dereferenced a network-URI $ref in a tool inputSchema. Implementations MUST NOT automatically dereference $ref values that resolve to a network URI (SEP-2106).'\n : 'Client did not dereference the network-URI $ref in the tool inputSchema',\n status: fetched ? 'FAILURE' : 'SUCCESS',\n timestamp,\n errorMessage: fetched\n ? `Canary URL ${CANARY_PATH} was fetched ${this.canaryRequests.length} time(s)`\n : undefined,\n specReferences: SPEC_REFERENCES,\n details: {\n toolsListed: true,\n canaryRequestCount: this.canaryRequests.length,\n canaryRequests: this.canaryRequests\n }\n }\n ];\n }\n}\n",[],[141,254,422,457],"fdfeb7cc-5f4a-11f1-b5e7-1607ee4eb77e","initialize.ts","be962d2a-5b64-11f1-ad2f-ee650bb23af1",95,["D",1780491111606],"import http from 'node:http';\nimport {\n HandlerScenario,\n RequestListener,\n ConformanceCheck,\n LATEST_SPEC_VERSION,\n NEGOTIABLE_PROTOCOL_VERSIONS\n} from '../../types.ts';\nimport { clientChecks } from '../../checks/index.ts';\n\nexport class InitializeScenario extends HandlerScenario {\n name = 'initialize';\n readonly source = { introducedIn: '2025-06-18' } as const;\n description = 'Tests MCP client initialization handshake';\n\n private checks: ConformanceCheck[] = [];\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n return (req, res) => this.handleRequest(req, res);\n }\n\n getChecks(): ConformanceCheck[] {\n return this.checks;\n }\n\n private handleRequest(\n req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n let body = '';\n\n req.on('data', (chunk) => {\n body += chunk.toString();\n });\n\n req.on('end', () => {\n try {\n const request = JSON.parse(body);\n\n if (request.method === 'initialize') {\n this.handleInitialize(request, res);\n } else if (request.method === 'tools/list') {\n this.handleToolsList(request, res);\n } else {\n res.writeHead(200, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {}\n })\n );\n }\n } catch (error) {\n res.writeHead(400, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n error: {\n code: -32700,\n message: `Parse error ${error}`\n }\n })\n );\n }\n });\n }\n\n private handleInitialize(request: any, res: http.ServerResponse): void {\n const initializeRequest = request.params;\n\n const check =\n clientChecks.createClientInitializationCheck(initializeRequest);\n this.checks.push(check);\n\n const serverInfo = {\n name: 'test-server',\n version: '1.0.0'\n };\n\n this.checks.push(clientChecks.createServerInfoCheck(serverInfo));\n\n // Echo back client's version if valid, otherwise use latest\n const clientVersion = initializeRequest?.protocolVersion;\n const responseVersion = NEGOTIABLE_PROTOCOL_VERSIONS.includes(clientVersion)\n ? clientVersion\n : LATEST_SPEC_VERSION;\n\n const response = {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n protocolVersion: responseVersion,\n serverInfo,\n capabilities: {}\n }\n };\n\n res.writeHead(200, { 'Content-Type': 'application/json' });\n res.end(JSON.stringify(response));\n }\n\n private handleToolsList(request: any, res: http.ServerResponse): void {\n const response = {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n tools: []\n }\n };\n\n res.writeHead(200, { 'Content-Type': 'application/json' });\n res.end(JSON.stringify(response));\n }\n}\n",[],[141,254,422,465],"f9cd7a58-5f4a-11f1-a3ec-1607ee4eb77e","b8b6f7d6-5b64-11f1-bb30-ee650bb23af1",88,["D",1780491104718],"/**\n * HTTP Standard Headers conformance test scenario for MCP clients (SEP-2243)\n *\n * Tests that clients include the required standard MCP request headers on\n * Streamable HTTP POST requests:\n * - `Mcp-Method`: mirrors the `method` field from the JSON-RPC request body\n * - `Mcp-Name`: mirrors `params.name` or `params.uri` for tools/call,\n * resources/read, and prompts/get requests\n *\n * This is a Scenario (acts as a test server that inspects incoming requests\n * from the client under test).\n */\n\nimport http from 'node:http';\nimport { ConformanceCheck } from '../../types.ts';\nimport { BaseHttpScenario } from './http-base.ts';\n\nconst SPEC_REFERENCE = {\n id: 'SEP-2243-Standard-Headers',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#standard-mcp-request-headers'\n};\n\nexport class HttpStandardHeadersScenario extends BaseHttpScenario {\n name = 'http-standard-headers';\n description =\n 'Tests that client includes Mcp-Method and Mcp-Name headers on HTTP POST requests (SEP-2243)';\n\n // Track which header checks have been recorded\n private methodHeaderChecks = new Map();\n // Track which Mcp-Name checks have been recorded\n private nameHeaderChecks = new Map();\n\n getChecks(): ConformanceCheck[] {\n // Build a fresh array each call so getChecks() is idempotent — the runner\n // may call it more than once and we must not accumulate duplicates.\n const result = [...this.checks];\n\n // SEP-2243 requires Mcp-Method on \"all requests and notifications\". A\n // client that never sent prompts/list isn't violating SEP-2243 — it just\n // didn't exercise that path. Emit SKIPPED (not FAILURE) so a prompts-less\n // client doesn't show red, but the gap is still visible in the report.\n const expectedMethods = [\n 'initialize',\n 'notifications/initialized',\n 'tools/list',\n 'tools/call',\n 'resources/list',\n 'resources/read',\n 'prompts/list',\n 'prompts/get'\n ];\n\n for (const method of expectedMethods) {\n if (!this.methodHeaderChecks.has(method)) {\n result.push({\n id: 'sep-2243-client-includes-standard-headers',\n name: `ClientMcpMethodHeader_${method.replace(/\\//g, '_')}`,\n description: `Client sends correct Mcp-Method header on ${method} request`,\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n errorMessage: `Client did not send a ${method} request; Mcp-Method header was not exercised for this method.`,\n specReferences: [SPEC_REFERENCE]\n });\n }\n }\n\n const expectedNameMethods = ['tools/call', 'resources/read', 'prompts/get'];\n for (const method of expectedNameMethods) {\n if (!this.nameHeaderChecks.has(method)) {\n result.push({\n id: 'sep-2243-client-includes-standard-headers',\n name: `ClientMcpNameHeader_${method.replace(/\\//g, '_')}`,\n description: `Client sends correct Mcp-Name header on ${method} request`,\n status: 'SKIPPED',\n timestamp: new Date().toISOString(),\n errorMessage: `Client did not send a ${method} request; Mcp-Name header was not exercised for this method.`,\n specReferences: [SPEC_REFERENCE]\n });\n }\n }\n\n return result;\n }\n\n protected handlePost(\n req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n // Check Mcp-Method header for every request\n this.checkMcpMethodHeader(req, request);\n\n // Route to handlers\n if (request.method === 'initialize') {\n this.handleInitialize(res, request);\n } else if (request.method === 'tools/list') {\n this.handleToolsList(res, request);\n } else if (request.method === 'tools/call') {\n this.checkMcpNameHeader(req, request, 'params.name');\n this.handleToolsCall(res, request);\n } else if (request.method === 'resources/list') {\n this.handleResourcesList(res, request);\n } else if (request.method === 'resources/read') {\n this.checkMcpNameHeader(req, request, 'params.uri');\n this.handleResourcesRead(res, request);\n } else if (request.method === 'prompts/list') {\n this.handlePromptsList(res, request);\n } else if (request.method === 'prompts/get') {\n this.checkMcpNameHeader(req, request, 'params.name');\n this.handlePromptsGet(res, request);\n } else if (request.id === undefined) {\n // Notifications - return 202 (Mcp-Method already checked above)\n this.sendNotificationAck(res);\n } else {\n this.sendGenericResult(res, request);\n }\n }\n\n private checkMcpMethodHeader(req: http.IncomingMessage, request: any): void {\n const method = request.method;\n if (!method) return;\n\n // Already recorded a check for this method\n if (this.methodHeaderChecks.has(method)) return;\n\n // Header names are lowercased by Node.js http parser\n const mcpMethodHeader = req.headers['mcp-method'] as string | undefined;\n\n const errors: string[] = [];\n if (!mcpMethodHeader) {\n errors.push(\n `Missing Mcp-Method header on ${method} request. Clients MUST include the Mcp-Method header on all POST requests.`\n );\n } else if (mcpMethodHeader !== method) {\n // Header values are case-sensitive\n errors.push(\n `Mcp-Method header value '${mcpMethodHeader}' does not match body method '${method}'. Header values are case-sensitive.`\n );\n }\n\n this.methodHeaderChecks.set(method, errors.length === 0);\n\n this.checks.push({\n id: 'sep-2243-client-includes-standard-headers',\n name: `ClientMcpMethodHeader_${method.replace(/\\//g, '_')}`,\n description: `Client sends correct Mcp-Method header on ${method} request`,\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [SPEC_REFERENCE],\n details: {\n expectedMethod: method,\n actualHeader: mcpMethodHeader\n }\n });\n }\n\n private checkMcpNameHeader(\n req: http.IncomingMessage,\n request: any,\n sourceField: string\n ): void {\n const method = request.method;\n\n // Same de-dup guard as checkMcpMethodHeader: the harness advertises two\n // tools and two resources, so a client that calls both would otherwise\n // produce duplicate check rows for the same id.\n if (this.nameHeaderChecks.has(method)) return;\n\n const expectedValue =\n sourceField === 'params.uri' ? request.params?.uri : request.params?.name;\n\n const mcpNameHeader = req.headers['mcp-name'] as string | undefined;\n\n const errors: string[] = [];\n if (!mcpNameHeader) {\n errors.push(\n `Missing Mcp-Name header on ${method} request. Clients MUST include the Mcp-Name header for ${method} requests.`\n );\n } else if (mcpNameHeader !== expectedValue) {\n errors.push(\n `Mcp-Name header value '${mcpNameHeader}' does not match body ${sourceField} '${expectedValue}'.`\n );\n }\n\n this.nameHeaderChecks.set(method, errors.length === 0);\n\n this.checks.push({\n id: 'sep-2243-client-includes-standard-headers',\n name: `ClientMcpNameHeader_${method.replace(/\\//g, '_')}`,\n description: `Client sends correct Mcp-Name header on ${method} request`,\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [SPEC_REFERENCE],\n details: {\n method,\n sourceField,\n expectedValue,\n actualHeader: mcpNameHeader\n }\n });\n }\n\n private handleInitialize(res: http.ServerResponse, request: any): void {\n this.sendInitialize(res, request, {\n tools: {},\n resources: {},\n prompts: {}\n });\n }\n\n private handleToolsList(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n tools: [\n {\n name: 'test_headers',\n description:\n 'A simple tool used to test that HTTP headers are sent correctly',\n inputSchema: {\n type: 'object',\n properties: {},\n required: []\n }\n },\n {\n name: 'my-hyphenated-tool',\n description:\n 'Tool with hyphen in name to test special chars in Mcp-Name header',\n inputSchema: {\n type: 'object',\n properties: {},\n required: []\n }\n }\n ]\n }\n })\n );\n }\n\n private handleToolsCall(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n content: [\n {\n type: 'text',\n text: 'Headers test completed'\n }\n ]\n }\n })\n );\n }\n\n private handleResourcesList(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n resources: [\n {\n uri: 'file:///path/to/file%20name.txt',\n name: 'File with spaces',\n description: 'Resource URI with percent-encoded spaces'\n },\n {\n uri: 'https://example.com/resource?id=123',\n name: 'Resource with query string',\n description: 'Resource URI with query string'\n }\n ]\n }\n })\n );\n }\n\n private handleResourcesRead(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n contents: []\n }\n })\n );\n }\n\n private handlePromptsList(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n prompts: [\n {\n name: 'test_prompt',\n description: 'A simple prompt for header testing'\n }\n ]\n }\n })\n );\n }\n\n private handlePromptsGet(res: http.ServerResponse, request: any): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n id: request.id,\n result: {\n messages: []\n }\n })\n );\n }\n}\n",[],[141,254,422,362],"f987cf9e-5f4a-11f1-84e9-1607ee4eb77e","http-custom-headers.ts","b879c514-5b64-11f1-aa1a-ee650bb23af1",87,["D",1780491104355],"/**\n * HTTP Custom Headers conformance test scenario for MCP clients (SEP-2243)\n *\n * Tests that clients correctly handle the `x-mcp-header` extension property:\n * 1. Mirror annotated tool parameter values into `Mcp-Param-{Name}` headers\n * 2. Apply correct value encoding (plain ASCII, Base64 for non-ASCII)\n * 3. Reject tool definitions with invalid `x-mcp-header` annotations\n *\n * This is a Scenario (acts as a test server that inspects incoming requests\n * from the client under test).\n */\n\nimport http from 'node:http';\nimport { ScenarioUrls, ConformanceCheck } from '../../types.ts';\nimport { BaseHttpScenario } from './http-base.ts';\n\nconst SPEC_REFERENCE_CUSTOM = {\n id: 'SEP-2243-Custom-Headers',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#custom-headers-from-tool-parameters'\n};\n\nconst SPEC_REFERENCE_ENCODING = {\n id: 'SEP-2243-Value-Encoding',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/transports#value-encoding'\n};\n\nconst SPEC_REFERENCE_TOOL_DEF = {\n id: 'SEP-2243-x-mcp-header',\n url: 'https://modelcontextprotocol.io/specification/draft/server/tools#x-mcp-header'\n};\n\n/**\n * Every requirement-level check ID HttpCustomHeadersScenario can emit\n * (SEP-2243). Declared-but-unemitted checks are backfilled as FAILURE by\n * getChecks() — same pattern as request-metadata.ts — so the emitted ID set\n * is stable for traceability even when the client never exercises the\n * feature.\n */\nexport const CUSTOM_HEADERS_DECLARED_CHECK_IDS = [\n 'sep-2243-client-supports-custom-headers',\n 'sep-2243-client-mirrors-designated-params',\n 'sep-2243-client-encode-values',\n 'sep-2243-client-base64-unsafe',\n 'sep-2243-client-omit-null'\n] as const;\n\n/**\n * Every requirement-level check ID HttpInvalidToolHeadersScenario can emit\n * (SEP-2243).\n */\nexport const INVALID_TOOL_DECLARED_CHECK_IDS = [\n 'sep-2243-client-reject-invalid-tool',\n 'sep-2243-x-mcp-header-not-empty',\n 'sep-2243-x-mcp-header-charset',\n 'sep-2243-x-mcp-header-unique',\n 'sep-2243-x-mcp-header-primitive-only'\n] as const;\n\n/**\n * Invalid tool definitions served by HttpInvalidToolHeadersScenario, keyed by\n * tool name, mapped to the SEP-2243 x-mcp-header constraint each one\n * violates. The check for \"client did not call this tool\" is emitted under\n * the constraint's requirement ID so each constraint traces to a check.\n */\nconst INVALID_TOOL_CONSTRAINT_IDS: Record = {\n invalid_empty_header: 'sep-2243-x-mcp-header-not-empty',\n invalid_object_header: 'sep-2243-x-mcp-header-primitive-only',\n invalid_array_header: 'sep-2243-x-mcp-header-primitive-only',\n invalid_null_header: 'sep-2243-x-mcp-header-primitive-only',\n invalid_duplicate_same_case: 'sep-2243-x-mcp-header-unique',\n invalid_duplicate_diff_case: 'sep-2243-x-mcp-header-unique',\n invalid_space_in_name: 'sep-2243-x-mcp-header-charset',\n invalid_colon_in_name: 'sep-2243-x-mcp-header-charset',\n invalid_non_ascii_name: 'sep-2243-x-mcp-header-charset',\n invalid_control_char_name: 'sep-2243-x-mcp-header-charset'\n};\n\n/**\n * Decodes a header value that may be Base64-encoded.\n * Base64-encoded values use the format: =?base64?{Base64EncodedValue}?=\n */\nfunction decodeHeaderValue(value: string): string {\n const base64Match = value.match(/^=\\?base64\\?(.*)\\?=$/);\n if (base64Match) {\n return Buffer.from(base64Match[1], 'base64').toString('utf-8');\n }\n return value;\n}\n\n/**\n * Check if a value needs Base64 encoding per the spec:\n * - Non-ASCII characters\n * - Control characters\n * - Leading/trailing whitespace\n */\nfunction needsBase64Encoding(value: string): boolean {\n // Check for non-ASCII or control characters\n for (let i = 0; i < value.length; i++) {\n const code = value.charCodeAt(i);\n if (code < 0x20 || code > 0x7e) {\n // Allow space (0x20) and tab (0x09) only inside values, not at edges\n if (code === 0x09) return true; // tab always needs encoding\n if (code < 0x20) return true; // other control chars\n if (code > 0x7e) return true; // non-ASCII\n }\n }\n // Check for leading/trailing whitespace\n if (value !== value.trim()) return true;\n return false;\n}\n\n/**\n * Checks if a raw header value is properly encoded for a body value that\n * needs Base64 encoding. Returns null if valid, error string if invalid.\n */\nfunction validateEncodedHeader(\n rawHeader: string,\n bodyValue: string,\n valueType?: string\n): string | null {\n if (needsBase64Encoding(bodyValue)) {\n // Value requires Base64 encoding\n const base64Match = rawHeader.match(/^=\\?base64\\?(.*)\\?=$/);\n\n if (!base64Match) {\n return `Value '${bodyValue}' requires Base64 encoding but header was sent as plain: '${rawHeader}'`;\n }\n const decoded = Buffer.from(base64Match[1], 'base64').toString('utf-8');\n if (valueType === 'number') {\n return compareNumericValues(decoded, bodyValue);\n }\n if (decoded !== bodyValue) {\n return `Base64-decoded header value '${decoded}' does not match body value '${bodyValue}'`;\n }\n return null;\n }\n // Plain ASCII - compare directly (after decoding if Base64 was used)\n const decoded = decodeHeaderValue(rawHeader);\n if (valueType === 'number') {\n return compareNumericValues(decoded, bodyValue);\n }\n if (decoded !== bodyValue) {\n return `Header value '${decoded}' (raw: '${rawHeader}') does not match body value '${bodyValue}'`;\n }\n return null;\n}\n\n/**\n * Compare two string representations of numbers numerically.\n * For integers, requires exact match. For decimals, allows\n * a tolerance of 1e-9 to account for cross-SDK floating point\n * representation differences.\n */\nfunction compareNumericValues(\n headerValue: string,\n bodyValue: string\n): string | null {\n const headerNum = Number(headerValue);\n const bodyNum = Number(bodyValue);\n if (isNaN(headerNum) || isNaN(bodyNum)) {\n return `Non-numeric value in number comparison: header='${headerValue}', body='${bodyValue}'`;\n }\n if (Number.isInteger(bodyNum)) {\n // Integer: require exact numeric match (e.g. 42 === 42.0)\n if (headerNum !== bodyNum) {\n return `Numeric header value ${headerNum} does not match body value ${bodyNum}`;\n }\n } else {\n // Decimal: allow tolerance of 1e-9\n if (Math.abs(headerNum - bodyNum) > 1e-9) {\n return `Numeric header value ${headerNum} does not match body value ${bodyNum} (difference ${Math.abs(headerNum - bodyNum)} exceeds tolerance 1e-9)`;\n }\n }\n return null;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// HttpCustomHeadersScenario - tests that clients mirror x-mcp-header params\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport class HttpCustomHeadersScenario extends BaseHttpScenario {\n name = 'http-custom-headers';\n description =\n 'Tests that client mirrors x-mcp-header tool parameters into Mcp-Param headers with correct encoding (SEP-2243)';\n\n private toolCallReceived: boolean = false;\n private nullToolCallReceived: boolean = false;\n\n async start(): Promise {\n const urls = await super.start();\n // Pass test values via context for encoding edge cases.\n // The conformance client should use these values when calling test_custom_headers.\n urls.context = {\n toolCalls: [\n {\n name: 'test_custom_headers',\n arguments: {\n region: 'us-west1',\n priority: 42,\n verbose: false,\n debug: true,\n empty_val: '',\n method_val: 'test-method',\n float_val: 3.14159,\n non_ascii_val: 'Hello, 世界',\n whitespace_val: ' padded ',\n leading_space_val: ' us-west1',\n trailing_space_val: 'us-west1 ',\n internal_space_val: 'us west 1',\n control_char_val: 'line1\\nline2',\n crlf_val: 'line1\\r\\nline2',\n tab_val: '\\tindented',\n query: 'SELECT * FROM users'\n }\n },\n {\n name: 'test_custom_headers_null',\n arguments: {\n region: 'us-east1',\n priority: 1,\n verbose: null,\n query: 'SELECT 1'\n }\n }\n ]\n };\n return urls;\n }\n\n getChecks(): ConformanceCheck[] {\n // Declared-but-unemitted -> FAILURE (request-metadata.ts pattern). Keeps\n // the emitted ID set stable for traceability even when the client never\n // calls the annotated tools. The `some()` guard makes this idempotent.\n for (const id of CUSTOM_HEADERS_DECLARED_CHECK_IDS) {\n if (this.checks.some((c) => c.id === id)) continue;\n const missingNullCall =\n id === 'sep-2243-client-omit-null' && !this.nullToolCallReceived;\n this.checks.push({\n id,\n name: 'NotObserved',\n description: `Declared check ${id} was never emitted`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: missingNullCall\n ? 'Client did not send a tools/call request for test_custom_headers_null to test null/omitted parameter handling.'\n : this.toolCallReceived\n ? 'Check was not observed: no tool call exercised it.'\n : 'Client did not send a tools/call request for test_custom_headers.',\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n return this.checks;\n }\n\n protected handlePost(\n req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n if (request.method === 'initialize') {\n this.sendInitialize(res, request);\n } else if (request.method === 'tools/list') {\n this.handleToolsList(res, request);\n } else if (request.method === 'tools/call') {\n this.handleToolsCall(req, res, request);\n } else if (request.id === undefined) {\n this.sendNotificationAck(res);\n } else {\n this.sendGenericResult(res, request);\n }\n }\n\n private handleToolsList(res: http.ServerResponse, request: any): void {\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n tools: [\n {\n name: 'test_custom_headers',\n description:\n 'A tool with x-mcp-header annotations to test custom header mirroring and encoding',\n inputSchema: {\n type: 'object',\n properties: {\n region: {\n type: 'string',\n description: 'Plain ASCII string value',\n 'x-mcp-header': 'Region'\n },\n priority: {\n type: 'number',\n description: 'Integer numeric value',\n 'x-mcp-header': 'Priority'\n },\n verbose: {\n type: 'boolean',\n description: 'Boolean value',\n 'x-mcp-header': 'Verbose'\n },\n debug: {\n type: 'boolean',\n description: 'Boolean true value',\n 'x-mcp-header': 'Debug'\n },\n empty_val: {\n type: 'string',\n description: 'Empty string value',\n 'x-mcp-header': 'EmptyVal'\n },\n method_val: {\n type: 'string',\n description:\n 'Value for header named \"Method\" — tests that x-mcp-header \"Method\" produces Mcp-Param-Method (not Mcp-Method)',\n 'x-mcp-header': 'Method'\n },\n float_val: {\n type: 'number',\n description: 'Floating point numeric value',\n 'x-mcp-header': 'FloatVal'\n },\n non_ascii_val: {\n type: 'string',\n description:\n 'Non-ASCII string value — requires Base64 encoding',\n 'x-mcp-header': 'NonAscii'\n },\n whitespace_val: {\n type: 'string',\n description:\n 'String with leading/trailing whitespace — requires Base64 encoding',\n 'x-mcp-header': 'Whitespace'\n },\n leading_space_val: {\n type: 'string',\n description:\n 'String with leading space only — requires Base64 encoding',\n 'x-mcp-header': 'LeadingSpace'\n },\n trailing_space_val: {\n type: 'string',\n description:\n 'String with trailing space only — requires Base64 encoding',\n 'x-mcp-header': 'TrailingSpace'\n },\n internal_space_val: {\n type: 'string',\n description:\n 'String with internal spaces only — plain ASCII, no Base64',\n 'x-mcp-header': 'InternalSpace'\n },\n control_char_val: {\n type: 'string',\n description:\n 'String with control characters — requires Base64 encoding',\n 'x-mcp-header': 'ControlChar'\n },\n crlf_val: {\n type: 'string',\n description:\n 'String with carriage return and line feed — requires Base64 encoding',\n 'x-mcp-header': 'CrLf'\n },\n tab_val: {\n type: 'string',\n description:\n 'String with leading tab — requires Base64 encoding',\n 'x-mcp-header': 'Tab'\n },\n query: {\n type: 'string',\n description:\n 'No x-mcp-header annotation - should not be mirrored'\n }\n },\n required: ['region', 'priority', 'query']\n }\n },\n {\n name: 'test_custom_headers_null',\n description:\n 'A tool for testing null/omitted x-mcp-header parameter handling',\n inputSchema: {\n type: 'object',\n properties: {\n region: {\n type: 'string',\n description: 'Plain ASCII string value',\n 'x-mcp-header': 'Region'\n },\n priority: {\n type: 'number',\n description: 'Integer numeric value',\n 'x-mcp-header': 'Priority'\n },\n verbose: {\n type: 'boolean',\n description: 'Boolean value — will be null to test omission',\n 'x-mcp-header': 'Verbose'\n },\n query: {\n type: 'string',\n description: 'No x-mcp-header annotation'\n }\n },\n required: ['region', 'priority', 'query']\n }\n }\n ]\n }\n });\n }\n\n private handleToolsCall(\n req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n const toolName = request.params?.name;\n const args = request.params?.arguments || {};\n\n if (toolName === 'test_custom_headers') {\n this.toolCallReceived = true;\n\n // SEP-2243 \"MCP clients MUST support this feature\": observable as the\n // client calling the annotated tool with at least one mirrored\n // Mcp-Param-* header. The per-parameter checks below then validate each\n // mirrored value individually.\n const hasAnyParamHeader = Object.keys(req.headers).some((h) =>\n h.startsWith('mcp-param-')\n );\n this.checks.push({\n id: 'sep-2243-client-supports-custom-headers',\n name: 'ClientSupportsCustomHeaders',\n description:\n 'Client supports custom headers: calls the x-mcp-header annotated tool and mirrors at least one parameter',\n status: hasAnyParamHeader ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: hasAnyParamHeader\n ? undefined\n : 'Client called test_custom_headers but sent no Mcp-Param-* headers.',\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n\n // Check Mcp-Param-Region header (plain ASCII string)\n this.checkParamHeader(req, 'Region', args.region, 'string');\n\n // Check Mcp-Param-Priority header (integer number)\n this.checkParamHeader(req, 'Priority', args.priority, 'number');\n\n // Check Mcp-Param-Verbose header (boolean value)\n // checkParamHeader already FAILs on missing header, so this also covers\n // \"optional parameter present → client MUST include header\" without a\n // separate check id.\n if (args.verbose !== undefined && args.verbose !== null) {\n this.checkParamHeader(req, 'Verbose', args.verbose, 'boolean');\n }\n\n // Check Mcp-Param-Debug header (boolean true value)\n if (args.debug !== undefined && args.debug !== null) {\n this.checkParamHeader(req, 'Debug', args.debug, 'boolean');\n }\n\n // Check Mcp-Param-EmptyVal header (empty string → empty header value)\n if (args.empty_val !== undefined && args.empty_val !== null) {\n this.checkParamHeader(req, 'EmptyVal', args.empty_val, 'string');\n }\n\n // Check Mcp-Param-Method header (x-mcp-header \"Method\" → Mcp-Param-Method, NOT Mcp-Method)\n if (args.method_val !== undefined && args.method_val !== null) {\n this.checkParamHeader(req, 'Method', args.method_val, 'string');\n }\n\n // Check Mcp-Param-FloatVal header (floating point number)\n if (args.float_val !== undefined && args.float_val !== null) {\n this.checkParamHeader(req, 'FloatVal', args.float_val, 'number');\n }\n\n // Check Mcp-Param-NonAscii header (requires Base64 encoding)\n if (args.non_ascii_val !== undefined && args.non_ascii_val !== null) {\n this.checkParamHeader(req, 'NonAscii', args.non_ascii_val, 'string');\n }\n\n // Check Mcp-Param-Whitespace header (leading/trailing whitespace → Base64)\n if (args.whitespace_val !== undefined && args.whitespace_val !== null) {\n this.checkParamHeader(req, 'Whitespace', args.whitespace_val, 'string');\n }\n\n // Check Mcp-Param-LeadingSpace header (leading space only → Base64)\n if (\n args.leading_space_val !== undefined &&\n args.leading_space_val !== null\n ) {\n this.checkParamHeader(\n req,\n 'LeadingSpace',\n args.leading_space_val,\n 'string'\n );\n }\n\n // Check Mcp-Param-TrailingSpace header (trailing space only → Base64)\n if (\n args.trailing_space_val !== undefined &&\n args.trailing_space_val !== null\n ) {\n this.checkParamHeader(\n req,\n 'TrailingSpace',\n args.trailing_space_val,\n 'string'\n );\n }\n\n // Check Mcp-Param-InternalSpace header (internal spaces only → plain ASCII, no Base64)\n if (\n args.internal_space_val !== undefined &&\n args.internal_space_val !== null\n ) {\n this.checkParamHeader(\n req,\n 'InternalSpace',\n args.internal_space_val,\n 'string'\n );\n }\n\n // Check Mcp-Param-ControlChar header (control characters → Base64)\n if (\n args.control_char_val !== undefined &&\n args.control_char_val !== null\n ) {\n this.checkParamHeader(\n req,\n 'ControlChar',\n args.control_char_val,\n 'string'\n );\n }\n\n // Check Mcp-Param-CrLf header (carriage return + line feed → Base64)\n if (args.crlf_val !== undefined && args.crlf_val !== null) {\n this.checkParamHeader(req, 'CrLf', args.crlf_val, 'string');\n }\n\n // Check Mcp-Param-Tab header (leading tab → Base64)\n if (args.tab_val !== undefined && args.tab_val !== null) {\n this.checkParamHeader(req, 'Tab', args.tab_val, 'string');\n }\n\n // Check that 'query' (no x-mcp-header) is NOT mirrored — the negative\n // half of \"mirror the *designated* parameter values\".\n const queryHeader = req.headers['mcp-param-query'] as string | undefined;\n this.checks.push({\n id: 'sep-2243-client-mirrors-designated-params',\n name: 'ClientCustomHeaderNoMirrorUnannotated',\n description:\n 'Client MUST NOT add Mcp-Param headers for parameters without x-mcp-header',\n status: queryHeader === undefined ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n queryHeader !== undefined\n ? `Found unexpected Mcp-Param-Query header '${queryHeader}' for unannotated parameter`\n : undefined,\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n } else if (toolName === 'test_custom_headers_null') {\n this.nullToolCallReceived = true;\n\n // When value is null or not provided, client MUST omit the header\n const verboseHeader = req.headers['mcp-param-verbose'] as\n | string\n | undefined;\n this.checks.push({\n id: 'sep-2243-client-omit-null',\n name: 'ClientCustomHeaderOmitNull',\n description:\n 'Client MUST omit Mcp-Param header when parameter value is null or not provided',\n status: verboseHeader === undefined ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n verboseHeader !== undefined\n ? `Mcp-Param-Verbose should be omitted when null/undefined, but got '${verboseHeader}'`\n : undefined,\n specReferences: [SPEC_REFERENCE_CUSTOM]\n });\n }\n\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n content: [{ type: 'text', text: 'Custom headers test completed' }]\n }\n });\n }\n\n private checkParamHeader(\n req: http.IncomingMessage,\n headerName: string,\n bodyValue: any,\n valueType: string\n ): void {\n const headerKey = `mcp-param-${headerName.toLowerCase()}`;\n const rawHeaderValue = req.headers[headerKey] as string | undefined;\n\n if (bodyValue === undefined || bodyValue === null) return;\n\n const errors: string[] = [];\n\n if (rawHeaderValue === undefined) {\n errors.push(\n `Missing Mcp-Param-${headerName} header. Client MUST include headers for x-mcp-header parameters.`\n );\n } else {\n // Convert body value to expected string representation\n let expectedString: string;\n switch (valueType) {\n case 'number':\n expectedString = String(bodyValue);\n break;\n case 'boolean':\n expectedString = bodyValue ? 'true' : 'false';\n break;\n default:\n expectedString = String(bodyValue);\n }\n\n // For numbers, compare numerically to allow for cross-SDK\n // floating point representation differences (e.g., \"42\" vs \"42.0\").\n // See SEP-2243 discussion on number precision.\n const validationError = validateEncodedHeader(\n rawHeaderValue,\n expectedString,\n valueType\n );\n if (validationError) {\n errors.push(validationError);\n }\n }\n\n // One check ID per SEP-2243 requirement, picked by what this parameter\n // actually exercises: Base64 wrapping for unsafe values, primitive\n // (number/boolean) string encoding, or plain mirroring. The per-parameter\n // detail lives in `name`/`details`.\n const needsBase64 =\n typeof bodyValue === 'string' && needsBase64Encoding(String(bodyValue));\n const checkId = needsBase64\n ? 'sep-2243-client-base64-unsafe'\n : valueType === 'number' || valueType === 'boolean'\n ? 'sep-2243-client-encode-values'\n : 'sep-2243-client-mirrors-designated-params';\n\n this.checks.push({\n id: checkId,\n name: `ClientCustomHeader_${headerName}`,\n description: `Client sends correct Mcp-Param-${headerName} header (${valueType} value)`,\n status: errors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n specReferences: [SPEC_REFERENCE_ENCODING],\n details: {\n headerName: `Mcp-Param-${headerName}`,\n rawHeaderValue,\n bodyValue,\n valueType,\n needsBase64\n }\n });\n }\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// HttpInvalidToolHeadersScenario - tests that clients reject invalid tools\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport class HttpInvalidToolHeadersScenario extends BaseHttpScenario {\n name = 'http-invalid-tool-headers';\n description =\n 'Tests that client rejects tools with invalid x-mcp-header annotations (SEP-2243)';\n allowClientError = true;\n\n private calledTools: Set = new Set();\n private toolsListSent = false;\n\n getChecks(): ConformanceCheck[] {\n if (!this.toolsListSent) {\n this.checks.push({\n id: 'sep-2243-invalid-tool-tools-list-gate',\n name: 'ClientInvalidToolHeadersToolsList',\n description: 'Client requests tools/list',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: 'Client did not send a tools/list request.',\n specReferences: [SPEC_REFERENCE_TOOL_DEF]\n });\n }\n\n // Check that valid_tool WAS called — proves client kept valid tools\n const validToolCalled = this.calledTools.has('valid_tool');\n this.checks.push({\n id: 'sep-2243-client-reject-invalid-tool',\n name: 'ClientKeepsValidTool',\n description: 'Client MUST keep valid tools while excluding invalid ones',\n status: validToolCalled ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: validToolCalled\n ? undefined\n : \"Client did not call 'valid_tool'. A single malformed tool definition must not prevent other valid tools from being used.\",\n specReferences: [SPEC_REFERENCE_TOOL_DEF]\n });\n\n // Check that the client did NOT call any of the invalid tools. Each\n // invalid tool violates one specific x-mcp-header constraint, so the\n // check is emitted under that constraint's requirement ID — the client\n // rejecting the tool is how the constraint is enforced on the wire.\n for (const [toolName, constraintId] of Object.entries(\n INVALID_TOOL_CONSTRAINT_IDS\n )) {\n const called = this.calledTools.has(toolName);\n this.checks.push({\n id: constraintId,\n name: `ClientRejectsInvalidTool_${toolName}`,\n description: `Client MUST NOT call tool '${toolName}' with invalid x-mcp-header`,\n status: called ? 'FAILURE' : 'SUCCESS',\n timestamp: new Date().toISOString(),\n errorMessage: called\n ? `Client called '${toolName}' which has an invalid x-mcp-header. Clients MUST reject (exclude) such tools.`\n : undefined,\n specReferences: [SPEC_REFERENCE_TOOL_DEF]\n });\n }\n\n return this.checks;\n }\n\n protected handlePost(\n _req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void {\n if (request.method === 'initialize') {\n this.sendInitialize(res, request);\n } else if (request.method === 'tools/list') {\n this.handleToolsList(res, request);\n } else if (request.method === 'tools/call') {\n this.handleToolsCall(res, request);\n } else if (request.id === undefined) {\n this.sendNotificationAck(res);\n } else {\n this.sendGenericResult(res, request);\n }\n }\n\n private handleToolsList(res: http.ServerResponse, request: any): void {\n this.toolsListSent = true;\n\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n tools: [\n // ── Valid tool (should be kept by client) ──\n {\n name: 'valid_tool',\n description: 'A valid tool with correct x-mcp-header',\n inputSchema: {\n type: 'object',\n properties: {\n region: {\n type: 'string',\n 'x-mcp-header': 'Region'\n }\n },\n required: ['region']\n }\n },\n\n // ── Invalid: empty x-mcp-header value ──\n {\n name: 'invalid_empty_header',\n description:\n 'x-mcp-header MUST NOT be empty (MUST be rejected by client)',\n inputSchema: {\n type: 'object',\n properties: {\n value: { type: 'string', 'x-mcp-header': '' }\n },\n required: ['value']\n }\n },\n\n // ── Invalid: x-mcp-header on object type ──\n {\n name: 'invalid_object_header',\n description:\n 'x-mcp-header MUST only be on primitive types (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n data: { type: 'object', 'x-mcp-header': 'Data' }\n },\n required: ['data']\n }\n },\n\n // ── Invalid: x-mcp-header on array type ──\n {\n name: 'invalid_array_header',\n description:\n 'x-mcp-header MUST only be on primitive types (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n items: {\n type: 'array',\n items: { type: 'string' },\n 'x-mcp-header': 'Items'\n }\n },\n required: ['items']\n }\n },\n\n // ── Invalid: x-mcp-header on null type ──\n {\n name: 'invalid_null_header',\n description:\n 'x-mcp-header MUST only be on primitive types (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n nil: { type: 'null', 'x-mcp-header': 'Nil' }\n },\n required: ['nil']\n }\n },\n\n // ── Invalid: duplicate same-case x-mcp-header values ──\n {\n name: 'invalid_duplicate_same_case',\n description:\n 'Duplicate x-mcp-header \"Region\" on two properties (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n field1: { type: 'string', 'x-mcp-header': 'Region' },\n field2: { type: 'string', 'x-mcp-header': 'Region' }\n },\n required: ['field1', 'field2']\n }\n },\n\n // ── Invalid: duplicate case-insensitive x-mcp-header values ──\n {\n name: 'invalid_duplicate_diff_case',\n description:\n 'Duplicate case-insensitive x-mcp-header \"MyField\"/\"myfield\" (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n field1: { type: 'string', 'x-mcp-header': 'MyField' },\n field2: { type: 'string', 'x-mcp-header': 'myfield' }\n },\n required: ['field1', 'field2']\n }\n },\n\n // ── Invalid: space in x-mcp-header name ──\n {\n name: 'invalid_space_in_name',\n description:\n 'x-mcp-header MUST NOT contain space (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n value: { type: 'string', 'x-mcp-header': 'My Region' }\n },\n required: ['value']\n }\n },\n\n // ── Invalid: colon in x-mcp-header name ──\n {\n name: 'invalid_colon_in_name',\n description:\n 'x-mcp-header MUST NOT contain colon (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n value: {\n type: 'string',\n 'x-mcp-header': 'Region:Primary'\n }\n },\n required: ['value']\n }\n },\n\n // ── Invalid: non-ASCII in x-mcp-header name ──\n {\n name: 'invalid_non_ascii_name',\n description:\n 'x-mcp-header MUST contain only ASCII chars (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n value: { type: 'string', 'x-mcp-header': 'Région' }\n },\n required: ['value']\n }\n },\n\n // ── Invalid: control character in x-mcp-header name ──\n {\n name: 'invalid_control_char_name',\n description:\n 'x-mcp-header MUST NOT contain control chars (MUST be rejected)',\n inputSchema: {\n type: 'object',\n properties: {\n value: { type: 'string', 'x-mcp-header': 'Region\\t1' }\n },\n required: ['value']\n }\n }\n ]\n }\n });\n }\n\n private handleToolsCall(res: http.ServerResponse, request: any): void {\n const toolName = request.params?.name;\n if (toolName) this.calledTools.add(toolName);\n\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n content: [{ type: 'text', text: 'Tool call received' }]\n }\n });\n }\n}\n",[],[141,254,422,480],"becb9eba-5b64-11f1-a025-ee650bb23af1","http-base.ts","becba07c-5b64-11f1-a025-ee650bb23af1",34,["D",1780062368098],"/**\n * Shared HTTP test-server scaffold for client-under-test SEP-2243 scenarios.\n *\n * A scenario that needs to act as a Streamable-HTTP MCP server, inspect\n * incoming client requests, and emit ConformanceChecks should extend this\n * class and implement handlePost() + getChecks(). start()/stop() and the\n * GET/DELETE/body-parse boilerplate are handled here.\n */\n\nimport http from 'node:http';\nimport {\n HandlerScenario,\n RequestListener,\n ConformanceCheck,\n ScenarioSource,\n DRAFT_PROTOCOL_VERSION\n} from '../../types.ts';\n\nexport abstract class BaseHttpScenario extends HandlerScenario {\n abstract name: string;\n abstract description: string;\n readonly source: ScenarioSource = { introducedIn: DRAFT_PROTOCOL_VERSION };\n\n protected checks: ConformanceCheck[] = [];\n protected sessionId: string = `session-${Date.now()}`;\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n this.sessionId = `session-${Date.now()}`;\n return (req, res) => this.handleRequest(req, res);\n }\n\n abstract getChecks(): ConformanceCheck[];\n\n protected handleRequest(\n req: http.IncomingMessage,\n res: http.ServerResponse\n ): void {\n if (req.method === 'GET') {\n res.writeHead(200, {\n 'Content-Type': 'text/event-stream',\n 'Cache-Control': 'no-cache',\n Connection: 'keep-alive',\n 'mcp-session-id': this.sessionId\n });\n res.write('data: \\n\\n');\n return;\n }\n if (req.method === 'DELETE') {\n res.writeHead(200);\n res.end();\n return;\n }\n if (req.method !== 'POST') {\n res.writeHead(405);\n res.end('Method Not Allowed');\n return;\n }\n\n // Decode the stream as UTF-8 so multi-byte characters that straddle a\n // chunk boundary aren't corrupted by per-chunk Buffer.toString().\n req.setEncoding('utf8');\n let body = '';\n req.on('data', (chunk) => {\n body += chunk;\n });\n req.on('end', () => {\n try {\n const request = JSON.parse(body);\n this.handlePost(req, res, request);\n } catch (error) {\n res.writeHead(400, { 'Content-Type': 'application/json' });\n res.end(\n JSON.stringify({\n jsonrpc: '2.0',\n error: { code: -32700, message: `Parse error: ${error}` }\n })\n );\n }\n });\n }\n\n protected abstract handlePost(\n req: http.IncomingMessage,\n res: http.ServerResponse,\n request: any\n ): void;\n\n protected sendJson(res: http.ServerResponse, body: object): void {\n res.writeHead(200, {\n 'Content-Type': 'application/json',\n 'mcp-session-id': this.sessionId\n });\n res.end(JSON.stringify(body));\n }\n\n protected sendInitialize(\n res: http.ServerResponse,\n request: any,\n capabilities: object = { tools: {} }\n ): void {\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: {\n protocolVersion: DRAFT_PROTOCOL_VERSION,\n serverInfo: { name: this.name + '-server', version: '1.0.0' },\n capabilities\n }\n });\n }\n\n protected sendNotificationAck(res: http.ServerResponse): void {\n res.writeHead(202);\n res.end();\n }\n\n protected sendGenericResult(res: http.ServerResponse, request: any): void {\n this.sendJson(res, {\n jsonrpc: '2.0',\n id: request.id,\n result: {}\n });\n }\n}\n",[],[141,254,422,488],"fccba310-5f4a-11f1-b758-1607ee4eb77e","be29333c-5b64-11f1-85ad-ee650bb23af1",92,["D",1780491109844],"/**\n * SEP-1034: Elicitation defaults test\n * Validates that clients properly apply default values for omitted fields\n * in elicitation responses before sending them to the server\n */\n\nimport { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n ListToolsRequestSchema,\n ElicitResultSchema\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport type { ConformanceCheck, RequestListener } from '../../types.ts';\nimport { HandlerScenario } from '../../types.ts';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { createRequestLogger } from '../request-logger.ts';\nimport { randomUUID } from 'node:crypto';\n\nfunction isInitializeRequest(body: unknown): boolean {\n if (\n typeof body === 'object' &&\n body !== null &&\n 'method' in body &&\n (body as { method: string }).method === 'initialize'\n ) {\n return true;\n }\n return false;\n}\n\nfunction createServer(checks: ConformanceCheck[]): {\n app: express.Application;\n cleanup: () => void;\n} {\n // Session management\n const transports: { [sessionId: string]: StreamableHTTPServerTransport } = {};\n const servers: { [sessionId: string]: Server } = {};\n\n const createMcpServer = () => {\n const server = new Server(\n {\n name: 'elicitation-defaults-test-server',\n version: '1.0.0'\n },\n {\n capabilities: {\n tools: {}\n }\n }\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => {\n return {\n tools: [\n {\n name: 'test_client_elicitation_defaults',\n description:\n 'Tests that client applies defaults for omitted elicitation fields',\n inputSchema: {\n type: 'object',\n properties: {},\n required: []\n }\n }\n ]\n };\n });\n\n server.setRequestHandler(CallToolRequestSchema, async (request) => {\n if (request.params.name === 'test_client_elicitation_defaults') {\n try {\n // Request elicitation with all optional fields having defaults\n // Using raw server.request() to verify client applies defaults before sending response\n const elicitResult = await server.request(\n {\n method: 'elicitation/create',\n params: {\n message:\n 'Test client default value handling - please accept with defaults',\n requestedSchema: {\n type: 'object',\n properties: {\n name: {\n type: 'string',\n description: 'User name',\n default: 'John Doe'\n },\n age: {\n type: 'integer',\n description: 'User age',\n default: 30\n },\n score: {\n type: 'number',\n description: 'User score',\n default: 95.5\n },\n status: {\n type: 'string',\n description: 'User status',\n enum: ['active', 'inactive', 'pending'],\n default: 'active'\n },\n verified: {\n type: 'boolean',\n description: 'Verification status',\n default: true\n }\n },\n required: [] // All fields optional, so defaults should apply\n }\n }\n },\n ElicitResultSchema\n );\n\n // Check if elicitation was accepted\n if (elicitResult.action !== 'accept') {\n checks.push({\n id: 'client-elicitation-sep1034-general',\n name: 'ClientElicitationSEP1034General',\n description: 'Client accepts elicitation request',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Expected action 'accept', got '${elicitResult.action}'`,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ]\n });\n return {\n content: [{ type: 'text', text: 'Elicitation was not accepted' }]\n };\n }\n\n const content = elicitResult.content || {};\n\n // Validate string default was applied\n const stringErrors: string[] = [];\n if (!('name' in content)) {\n stringErrors.push(\n 'Field \"name\" missing - should have default \"John Doe\"'\n );\n } else if (typeof content.name !== 'string') {\n stringErrors.push(\n `Expected string for \"name\", got ${typeof content.name}`\n );\n }\n\n checks.push({\n id: 'client-elicitation-sep1034-string-default',\n name: 'ClientElicitationSEP1034StringDefault',\n description: 'Client applies string default value for elicitation',\n status: stringErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n stringErrors.length > 0 ? stringErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'name',\n expectedDefault: 'John Doe',\n receivedValue: content.name\n }\n });\n\n // Validate integer default was applied\n const integerErrors: string[] = [];\n if (!('age' in content)) {\n integerErrors.push('Field \"age\" missing - should have default 30');\n } else if (typeof content.age !== 'number') {\n integerErrors.push(\n `Expected number for \"age\", got ${typeof content.age}`\n );\n }\n\n checks.push({\n id: 'client-elicitation-sep1034-integer-default',\n name: 'ClientElicitationSEP1034IntegerDefault',\n description: 'Client applies integer default value for elicitation',\n status: integerErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n integerErrors.length > 0 ? integerErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'age',\n expectedDefault: 30,\n receivedValue: content.age\n }\n });\n\n // Validate number default was applied\n const numberErrors: string[] = [];\n if (!('score' in content)) {\n numberErrors.push(\n 'Field \"score\" missing - should have default 95.5'\n );\n } else if (typeof content.score !== 'number') {\n numberErrors.push(\n `Expected number for \"score\", got ${typeof content.score}`\n );\n }\n\n checks.push({\n id: 'client-elicitation-sep1034-number-default',\n name: 'ClientElicitationSEP1034NumberDefault',\n description: 'Client applies number default value for elicitation',\n status: numberErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n numberErrors.length > 0 ? numberErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'score',\n expectedDefault: 95.5,\n receivedValue: content.score\n }\n });\n\n // Validate enum default was applied\n const enumErrors: string[] = [];\n if (!('status' in content)) {\n enumErrors.push(\n 'Field \"status\" missing - should have default \"active\"'\n );\n } else if (typeof content.status !== 'string') {\n enumErrors.push(\n `Expected string for \"status\", got ${typeof content.status}`\n );\n } else if (\n !['active', 'inactive', 'pending'].includes(content.status)\n ) {\n enumErrors.push(\n `Value \"${content.status}\" is not a valid enum member`\n );\n }\n\n checks.push({\n id: 'client-elicitation-sep1034-enum-default',\n name: 'ClientElicitationSEP1034EnumDefault',\n description: 'Client applies enum default value for elicitation',\n status: enumErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n enumErrors.length > 0 ? enumErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'status',\n expectedDefault: 'active',\n receivedValue: content.status\n }\n });\n\n // Validate boolean default was applied\n const booleanErrors: string[] = [];\n if (!('verified' in content)) {\n booleanErrors.push(\n 'Field \"verified\" missing - should have default true'\n );\n } else if (typeof content.verified !== 'boolean') {\n booleanErrors.push(\n `Expected boolean for \"verified\", got ${typeof content.verified}`\n );\n }\n\n checks.push({\n id: 'client-elicitation-sep1034-boolean-default',\n name: 'ClientElicitationSEP1034BooleanDefault',\n description: 'Client applies boolean default value for elicitation',\n status: booleanErrors.length === 0 ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage:\n booleanErrors.length > 0 ? booleanErrors.join('; ') : undefined,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ],\n details: {\n field: 'verified',\n expectedDefault: true,\n receivedValue: content.verified\n }\n });\n\n return {\n content: [\n {\n type: 'text',\n text: `Elicitation completed: ${JSON.stringify(content)}`\n }\n ]\n };\n } catch (error: any) {\n checks.push({\n id: 'client-elicitation-sep1034-general',\n name: 'ClientElicitationSEP1034General',\n description: 'Client handles elicitation with defaults',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n errorMessage: `Elicitation failed: ${error.message}`,\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ]\n });\n\n return {\n content: [\n {\n type: 'text',\n text: `Elicitation error: ${error.message}`\n }\n ]\n };\n }\n }\n\n throw new Error(`Unknown tool: ${request.params.name}`);\n });\n\n return server;\n };\n\n const app = express();\n app.use(express.json());\n\n app.use(\n createRequestLogger(checks, {\n incomingId: 'incoming-request',\n outgoingId: 'outgoing-response',\n mcpRoute: '/mcp'\n })\n );\n\n // Handle POST requests - stateful mode\n app.post('/mcp', async (req: Request, res: Response) => {\n const sessionId = req.headers['mcp-session-id'] as string | undefined;\n\n try {\n let transport: StreamableHTTPServerTransport;\n\n if (sessionId && transports[sessionId]) {\n // Reuse existing transport for established sessions\n transport = transports[sessionId];\n } else if (!sessionId && isInitializeRequest(req.body)) {\n // Create new transport for initialization requests\n const mcpServer = createMcpServer();\n\n transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: () => randomUUID(),\n onsessioninitialized: (newSessionId) => {\n transports[newSessionId] = transport;\n servers[newSessionId] = mcpServer;\n }\n });\n\n transport.onclose = () => {\n const sid = transport.sessionId;\n if (sid && transports[sid]) {\n delete transports[sid];\n if (servers[sid]) {\n servers[sid].close();\n delete servers[sid];\n }\n }\n };\n\n await mcpServer.connect(transport);\n await transport.handleRequest(req, res, req.body);\n return;\n } else {\n res.status(400).json({\n jsonrpc: '2.0',\n error: {\n code: -32000,\n message: 'Invalid or missing session ID'\n },\n id: null\n });\n return;\n }\n\n await transport.handleRequest(req, res, req.body);\n } catch {\n if (!res.headersSent) {\n res.status(500).json({\n jsonrpc: '2.0',\n error: {\n code: -32603,\n message: 'Internal server error'\n },\n id: null\n });\n }\n }\n });\n\n // Handle GET requests - SSE streams for sessions\n app.get('/mcp', async (req: Request, res: Response) => {\n const sessionId = req.headers['mcp-session-id'] as string | undefined;\n\n if (!sessionId || !transports[sessionId]) {\n res.status(400).send('Invalid or missing session ID');\n return;\n }\n\n try {\n const transport = transports[sessionId];\n await transport.handleRequest(req, res);\n } catch {\n if (!res.headersSent) {\n res.status(500).send('Error establishing SSE stream');\n }\n }\n });\n\n // Handle DELETE requests - session termination\n app.delete('/mcp', async (req: Request, res: Response) => {\n const sessionId = req.headers['mcp-session-id'] as string | undefined;\n\n if (!sessionId || !transports[sessionId]) {\n res.status(400).send('Invalid or missing session ID');\n return;\n }\n\n try {\n const transport = transports[sessionId];\n await transport.handleRequest(req, res);\n } catch {\n if (!res.headersSent) {\n res.status(500).send('Error handling termination');\n }\n }\n });\n\n const cleanup = () => {\n // Clean up all sessions\n for (const sessionId of Object.keys(transports)) {\n if (servers[sessionId]) {\n servers[sessionId].close();\n }\n }\n };\n\n return { app, cleanup };\n}\n\nexport class ElicitationClientDefaultsScenario extends HandlerScenario {\n name = 'elicitation-sep1034-client-defaults';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests client applies default values for omitted elicitation fields (SEP-1034)';\n mcpPath = '/mcp';\n private checks: ConformanceCheck[] = [];\n private cleanup: (() => void) | null = null;\n\n handler(_getBaseUrl: () => string): RequestListener {\n this.checks = [];\n const { app, cleanup } = createServer(this.checks);\n this.cleanup = cleanup;\n return app;\n }\n\n async stop() {\n this.cleanup?.();\n this.cleanup = null;\n await super.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const expectedSlugs = [\n 'client-elicitation-sep1034-string-default',\n 'client-elicitation-sep1034-integer-default',\n 'client-elicitation-sep1034-number-default',\n 'client-elicitation-sep1034-enum-default',\n 'client-elicitation-sep1034-boolean-default'\n ];\n\n // Add failures for any checks that weren't triggered (tool not called)\n for (const slug of expectedSlugs) {\n if (!this.checks.find((c) => c.id === slug)) {\n this.checks.push({\n id: slug,\n name: slug.replace(/-/g, ''),\n description: `Server applies ${slug.split('-')[4]} default for elicitation`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n details: { message: 'Tool was not called by client' },\n specReferences: [\n {\n id: 'SEP-1034',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1034'\n }\n ]\n });\n }\n }\n return this.checks;\n }\n}\n",[],[141,254,422,378],"c1547f62-5b64-11f1-aa1a-ee650bb23af1","token-endpoint-auth.ts","c154802a-5b64-11f1-aa1a-ee650bb23af1","8ee88a56-dbb1-42be-8649-f2f17a02c562",45,["D",1780062372346],"import type { Scenario, ConformanceCheck } from '../../../types.ts';\nimport { ScenarioUrls } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\n\ntype AuthMethod = 'client_secret_basic' | 'client_secret_post' | 'none';\n\nfunction detectAuthMethod(\n authorizationHeader?: string,\n bodyClientSecret?: string\n): AuthMethod {\n if (authorizationHeader?.startsWith('Basic ')) {\n return 'client_secret_basic';\n }\n if (bodyClientSecret) {\n return 'client_secret_post';\n }\n return 'none';\n}\n\nfunction validateBasicAuthFormat(authorizationHeader: string): {\n valid: boolean;\n error?: string;\n} {\n const encoded = authorizationHeader.substring('Basic '.length);\n try {\n const decoded = Buffer.from(encoded, 'base64').toString('utf-8');\n if (!decoded.includes(':')) {\n return { valid: false, error: 'missing colon separator' };\n }\n return { valid: true };\n } catch {\n return { valid: false, error: 'base64 decoding failed' };\n }\n}\n\nconst AUTH_METHOD_NAMES: Record = {\n client_secret_basic: 'HTTP Basic authentication (client_secret_basic)',\n client_secret_post: 'client_secret_post',\n none: 'no authentication (public client)'\n};\n\nclass TokenEndpointAuthScenario implements Scenario {\n name: string;\n readonly source = { introducedIn: '2025-06-18' } as const;\n description: string;\n private expectedAuthMethod: AuthMethod;\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n // Track resource parameters for RFC 8707 validation\n private authorizationResource?: string;\n private tokenResource?: string;\n\n constructor(expectedAuthMethod: AuthMethod) {\n this.expectedAuthMethod = expectedAuthMethod;\n this.name = `auth/token-endpoint-auth-${expectedAuthMethod === 'client_secret_basic' ? 'basic' : expectedAuthMethod === 'client_secret_post' ? 'post' : 'none'}`;\n this.description = `Tests that client uses ${AUTH_METHOD_NAMES[expectedAuthMethod]} when server only supports ${expectedAuthMethod}`;\n }\n\n async start(): Promise {\n this.checks = [];\n this.authorizationResource = undefined;\n this.tokenResource = undefined;\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n tokenEndpointAuthMethodsSupported: [this.expectedAuthMethod],\n onAuthorizationRequest: ({ resource }) => {\n this.authorizationResource = resource;\n },\n onTokenRequest: ({ authorizationHeader, body, timestamp }) => {\n // Track resource from token request for RFC 8707 validation\n this.tokenResource = body.resource;\n const bodyClientSecret = body.client_secret;\n const actualMethod = detectAuthMethod(\n authorizationHeader,\n bodyClientSecret\n );\n const isCorrect = actualMethod === this.expectedAuthMethod;\n\n // For basic auth, also validate the format\n let formatError: string | undefined;\n if (actualMethod === 'client_secret_basic' && authorizationHeader) {\n const validation = validateBasicAuthFormat(authorizationHeader);\n if (!validation.valid) {\n formatError = validation.error;\n }\n }\n\n const status = isCorrect && !formatError ? 'SUCCESS' : 'FAILURE';\n let description: string;\n\n if (formatError) {\n description = `Client sent Basic auth header but ${formatError}`;\n } else if (isCorrect) {\n description = `Client correctly used ${AUTH_METHOD_NAMES[this.expectedAuthMethod]} for token endpoint`;\n } else {\n description = `Client used ${actualMethod} but server only supports ${this.expectedAuthMethod}`;\n }\n\n this.checks.push({\n id: 'token-endpoint-auth-method',\n name: 'Token endpoint authentication method',\n description,\n status,\n timestamp,\n specReferences: [SpecReferences.OAUTH_2_1_TOKEN],\n details: {\n expectedAuthMethod: this.expectedAuthMethod,\n actualAuthMethod: actualMethod,\n hasAuthorizationHeader: !!authorizationHeader,\n hasBodyClientSecret: !!bodyClientSecret,\n ...(formatError && { formatError })\n }\n });\n\n return {\n token: `test-token-${Date.now()}`,\n scopes: []\n };\n },\n onRegistrationRequest: () => ({\n clientId: `test-client-${Date.now()}`,\n clientSecret:\n this.expectedAuthMethod === 'none'\n ? undefined\n : `test-secret-${Date.now()}`,\n tokenEndpointAuthMethod: this.expectedAuthMethod\n })\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [],\n tokenVerifier\n }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const timestamp = new Date().toISOString();\n\n if (!this.checks.some((c) => c.id === 'token-endpoint-auth-method')) {\n this.checks.push({\n id: 'token-endpoint-auth-method',\n name: 'Token endpoint authentication method',\n description: 'Client did not make a token request',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.OAUTH_2_1_TOKEN]\n });\n }\n\n // RFC 8707 Resource Parameter Validation Checks\n this.addResourceParameterChecks(timestamp);\n\n return this.checks;\n }\n\n private addResourceParameterChecks(timestamp: string): void {\n const specRefs = [\n SpecReferences.RFC_8707_RESOURCE_INDICATORS,\n SpecReferences.MCP_RESOURCE_PARAMETER\n ];\n\n // Check 1: Resource parameter in authorization request\n if (\n !this.checks.some((c) => c.id === 'resource-parameter-in-authorization')\n ) {\n const hasResource = !!this.authorizationResource;\n this.checks.push({\n id: 'resource-parameter-in-authorization',\n name: 'Resource parameter in authorization request',\n description: hasResource\n ? 'Client included resource parameter in authorization request'\n : 'Client MUST include resource parameter in authorization request per RFC 8707',\n status: hasResource ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n resource: this.authorizationResource || 'not provided'\n }\n });\n }\n\n // Check 2: Resource parameter in token request\n if (!this.checks.some((c) => c.id === 'resource-parameter-in-token')) {\n const hasResource = !!this.tokenResource;\n this.checks.push({\n id: 'resource-parameter-in-token',\n name: 'Resource parameter in token request',\n description: hasResource\n ? 'Client included resource parameter in token request'\n : 'Client MUST include resource parameter in token request per RFC 8707',\n status: hasResource ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n resource: this.tokenResource || 'not provided'\n }\n });\n }\n\n // Check 3: Resource parameter is valid canonical URI\n if (!this.checks.some((c) => c.id === 'resource-parameter-valid-uri')) {\n const resourceToValidate =\n this.authorizationResource || this.tokenResource;\n if (resourceToValidate) {\n const validation = this.validateCanonicalUri(resourceToValidate);\n this.checks.push({\n id: 'resource-parameter-valid-uri',\n name: 'Resource parameter is valid canonical URI',\n description: validation.valid\n ? 'Resource parameter is a valid canonical URI (has scheme, no fragment)'\n : `Resource parameter is invalid: ${validation.error}`,\n status: validation.valid ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n resource: resourceToValidate,\n ...(validation.error && { error: validation.error })\n }\n });\n }\n }\n\n // Check 4: Resource parameter consistency between requests\n if (!this.checks.some((c) => c.id === 'resource-parameter-consistency')) {\n if (this.authorizationResource && this.tokenResource) {\n const consistent = this.authorizationResource === this.tokenResource;\n this.checks.push({\n id: 'resource-parameter-consistency',\n name: 'Resource parameter consistency',\n description: consistent\n ? 'Resource parameter is consistent between authorization and token requests'\n : 'Resource parameter MUST be consistent between authorization and token requests',\n status: consistent ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n authorizationResource: this.authorizationResource,\n tokenResource: this.tokenResource\n }\n });\n }\n }\n }\n\n private validateCanonicalUri(uri: string): {\n valid: boolean;\n error?: string;\n } {\n try {\n const parsed = new URL(uri);\n // Check for fragment (RFC 8707: MUST NOT include fragment)\n if (parsed.hash) {\n return {\n valid: false,\n error: 'contains fragment (not allowed per RFC 8707)'\n };\n }\n return { valid: true };\n } catch {\n return { valid: false, error: 'invalid URI format' };\n }\n }\n}\n\nexport class ClientSecretBasicAuthScenario extends TokenEndpointAuthScenario {\n constructor() {\n super('client_secret_basic');\n }\n}\n\nexport class ClientSecretPostAuthScenario extends TokenEndpointAuthScenario {\n constructor() {\n super('client_secret_post');\n }\n}\n\nexport class PublicClientAuthScenario extends TokenEndpointAuthScenario {\n constructor() {\n super('none');\n }\n}\n",[],[141,254,422,511,503],"auth","befc35fc-5b64-11f1-85ad-ee650bb23af1","spec-references.ts","befc36b0-5b64-11f1-85ad-ee650bb23af1",35,["D",1780062368418],"import { SpecReference } from '../../../types.ts';\n\nexport const SpecReferences: { [key: string]: SpecReference } = {\n RFC_PRM_DISCOVERY: {\n id: 'RFC-9728',\n url: 'https://www.rfc-editor.org/rfc/rfc9728.html#section-3.1'\n },\n RFC_AUTH_SERVER_METADATA_REQUEST: {\n id: 'RFC-8414-metadata-request',\n url: 'https://www.rfc-editor.org/rfc/rfc8414.html#section-3.1'\n },\n LEGACY_2025_03_26_AUTH_DISCOVERY: {\n id: 'MCP-2025-03-26-Authorization-metadata-discovery',\n url: 'https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization#server-metadata-discovery'\n },\n LEGACY_2025_03_26_AUTH_URL_FALLBACK: {\n id: 'MCP-2025-03-26-Authorization-metadata-url-fallback',\n url: 'https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization#fallbacks-for-servers-without-metadata-discovery'\n },\n MCP_PRM_DISCOVERY: {\n id: 'MCP-2025-06-18-PRM-discovery',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#protected-resource-metadata-discovery-requirements'\n },\n MCP_AUTH_DISCOVERY: {\n id: 'MCP-Authorization-metadata-discovery',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#authorization-server-metadata-discovery'\n },\n MCP_DCR: {\n id: 'MCP-Dynamic-client-registration',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/client#dynamic-client-registration'\n },\n OAUTH_2_1_AUTHORIZATION_ENDPOINT: {\n id: 'OAUTH-2.1-authorization-endpoint',\n url: 'https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-13.html#name-authorization-endpoint'\n },\n OAUTH_2_1_TOKEN: {\n id: 'OAUTH-2.1-token-request',\n url: 'https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-13.html#name-token-request'\n },\n MCP_ACCESS_TOKEN_USAGE: {\n id: 'MCP-Access-token-usage',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#access-token-usage'\n },\n MCP_SCOPE_SELECTION_STRATEGY: {\n id: 'MCP-Scope-selection-strategy',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#scope-selection-strategy'\n },\n MCP_SCOPE_CHALLENGE_HANDLING: {\n id: 'MCP-Scope-challenge-handling',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#scope-challenge-handling'\n },\n MCP_AUTH_ERROR_HANDLING: {\n id: 'MCP-Auth-error-handling',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#error-handling'\n },\n MCP_CLIENT_ID_METADATA_DOCUMENTS: {\n id: 'MCP-Client-ID-Metadata-Documents',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#client-id-metadata-documents'\n },\n IETF_CIMD: {\n id: 'IETF-OAuth-Client-ID-Metadata-Document',\n url: 'https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00'\n },\n RFC_JWT_CLIENT_AUTH: {\n id: 'RFC-7523-JWT-Client-Auth',\n url: 'https://datatracker.ietf.org/doc/html/rfc7523#section-2.2'\n },\n OAUTH_2_1_CLIENT_CREDENTIALS: {\n id: 'OAUTH-2.1-client-credentials-grant',\n url: 'https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-13.html#section-4.2'\n },\n SEP_1046_CLIENT_CREDENTIALS: {\n id: 'SEP-1046-Client-Credentials',\n url: 'https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/oauth-client-credentials.mdx'\n },\n RFC_8707_RESOURCE_INDICATORS: {\n id: 'RFC-8707-Resource-Indicators',\n url: 'https://www.rfc-editor.org/rfc/rfc8707.html'\n },\n MCP_RESOURCE_PARAMETER: {\n id: 'MCP-Resource-Parameter-Implementation',\n url: 'https://modelcontextprotocol.io/specification/draft/basic/authorization#resource-parameter-implementation'\n },\n MCP_PREREGISTRATION: {\n id: 'MCP-Preregistration',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#preregistration'\n },\n MCP_PKCE: {\n id: 'MCP-PKCE-requirement',\n url: 'https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization#authorization-code-protection'\n },\n // TODO: Update to MCP spec URL once SEP-2468 (modelcontextprotocol/modelcontextprotocol#2468) is merged\n RFC_9207_ISS_PARAMETER: {\n id: 'RFC-9207-iss-parameter',\n url: 'https://www.rfc-editor.org/rfc/rfc9207.html#section-2'\n },\n RFC_8693_TOKEN_EXCHANGE: {\n id: 'RFC-8693-Token-Exchange',\n url: 'https://datatracker.ietf.org/doc/html/rfc8693'\n },\n RFC_7523_JWT_BEARER: {\n id: 'RFC-7523-JWT-Bearer-Grant',\n url: 'https://datatracker.ietf.org/doc/html/rfc7523'\n },\n SEP_990_ENTERPRISE_OAUTH: {\n id: 'SEP-990-Enterprise-Managed-OAuth',\n url: 'https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/draft/enterprise-managed-authorization.mdx'\n },\n SEP_2207_REFRESH_TOKEN_GUIDANCE: {\n id: 'SEP-2207-Refresh-Token-Guidance',\n url: 'https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2207'\n }\n};\n",[],[141,254,422,511,513],"c188a76a-5b64-11f1-b520-ee650bb23af1","scope-handling.ts","c188a83c-5b64-11f1-b520-ee650bb23af1",46,["D",1780062372688],"import type { Scenario, ConformanceCheck } from '../../../types.ts';\nimport { ScenarioUrls } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\nimport type { Request, Response, NextFunction } from 'npm:express@^5.1.0';\n\n/**\n * Scenario 1: Client uses scope from WWW-Authenticate header\n *\n * Tests that clients SHOULD follow the scope parameter from the initial\n * WWW-Authenticate header in the 401 response, per the scope selection strategy.\n */\nexport class ScopeFromWwwAuthenticateScenario implements Scenario {\n name = 'auth/scope-from-www-authenticate';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests that client uses scope parameter from WWW-Authenticate header when provided';\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(): Promise {\n this.checks = [];\n\n const expectedScope = 'mcp:basic';\n const tokenVerifier = new MockTokenVerifier(this.checks, [expectedScope]);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n onAuthorizationRequest: (data) => {\n // Check if client used the scope from WWW-Authenticate header\n const requestedScopes = data.scope ? data.scope.split(' ') : [];\n const usedCorrectScope = requestedScopes.includes(expectedScope);\n this.checks.push({\n id: 'scope-from-www-authenticate',\n name: 'Client scope selection from WWW-Authenticate header',\n description: usedCorrectScope\n ? 'Client correctly used the scope parameter from the WWW-Authenticate header'\n : 'Client SHOULD use the scope parameter from the WWW-Authenticate header when provided',\n status: usedCorrectScope ? 'SUCCESS' : 'WARNING',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY],\n details: {\n expectedScope,\n requestedScope: data.scope || 'none'\n }\n });\n }\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [expectedScope],\n includeScopeInWwwAuth: true,\n tokenVerifier\n }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n // Emit failure check if expected scope check didn't run\n const hasScopeCheck = this.checks.some(\n (c) => c.id === 'scope-from-www-authenticate'\n );\n if (!hasScopeCheck) {\n this.checks.push({\n id: 'scope-from-www-authenticate',\n name: 'Client scope selection from WWW-Authenticate header',\n description:\n 'Client did not complete authorization flow - scope check could not be performed',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY]\n });\n }\n return this.checks;\n }\n}\n\n/**\n * Scenario 2: Client falls back to scopes_supported when scope not in WWW-Authenticate\n *\n * Tests that clients SHOULD use all scopes from scopes_supported in the PRM\n * when the scope parameter is not available in the WWW-Authenticate header.\n */\nexport class ScopeFromScopesSupportedScenario implements Scenario {\n name = 'auth/scope-from-scopes-supported';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests that client uses all scopes from scopes_supported when scope not in WWW-Authenticate header';\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(): Promise {\n this.checks = [];\n\n const scopesSupported = ['mcp:basic', 'mcp:read', 'mcp:write'];\n const tokenVerifier = new MockTokenVerifier(this.checks, scopesSupported);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n onAuthorizationRequest: (data) => {\n // Check if client requested all scopes from scopes_supported\n const requestedScopes = data.scope ? data.scope.split(' ') : [];\n const hasAllScopes = scopesSupported.every((scope) =>\n requestedScopes.includes(scope)\n );\n this.checks.push({\n id: 'scope-from-scopes-supported',\n name: 'Client scope selection from scopes_supported',\n description: hasAllScopes\n ? 'Client correctly used all scopes from scopes_supported in PRM when scope not in WWW-Authenticate'\n : 'Client SHOULD use all scopes from scopes_supported when scope not available in WWW-Authenticate header',\n status: hasAllScopes ? 'SUCCESS' : 'WARNING',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY],\n details: {\n scopesSupported: scopesSupported.join(' '),\n requestedScope: data.scope || 'none',\n ...(hasAllScopes\n ? {}\n : {\n missingScopes: scopesSupported\n .filter((s) => !requestedScopes.includes(s))\n .join(' ')\n })\n }\n });\n }\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: scopesSupported,\n scopesSupported: scopesSupported,\n includeScopeInWwwAuth: false,\n tokenVerifier\n }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n // Emit failure check if expected scope check didn't run\n const hasScopeCheck = this.checks.some(\n (c) => c.id === 'scope-from-scopes-supported'\n );\n if (!hasScopeCheck) {\n this.checks.push({\n id: 'scope-from-scopes-supported',\n name: 'Client scope selection from scopes_supported',\n description:\n 'Client did not complete authorization flow - scope check could not be performed',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY]\n });\n }\n return this.checks;\n }\n}\n\n/**\n * Scenario 3: Client omits scope when scopes_supported is undefined\n *\n * Tests that clients SHOULD omit the scope parameter when scopes_supported\n * is not available in the PRM and scope is not in WWW-Authenticate header.\n */\nexport class ScopeOmittedWhenUndefinedScenario implements Scenario {\n name = 'auth/scope-omitted-when-undefined';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests that client omits scope parameter when scopes_supported is undefined';\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(): Promise {\n this.checks = [];\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n onAuthorizationRequest: (data) => {\n // Check if client omitted scope parameter\n const scopeOmitted = !data.scope || data.scope.trim() === '';\n this.checks.push({\n id: 'scope-omitted-when-undefined',\n name: 'Client scope omission when scopes_supported undefined',\n description: scopeOmitted\n ? 'Client correctly omitted scope parameter when scopes_supported is undefined'\n : 'Client SHOULD omit scope parameter when scopes_supported is undefined and scope not in WWW-Authenticate',\n status: scopeOmitted ? 'SUCCESS' : 'WARNING',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY],\n details: {\n scopeParameter: scopeOmitted ? 'omitted' : data.scope\n }\n });\n }\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [],\n scopesSupported: undefined,\n includeScopeInWwwAuth: false,\n tokenVerifier\n }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n // Emit failure check if expected scope check didn't run\n const hasScopeCheck = this.checks.some(\n (c) => c.id === 'scope-omitted-when-undefined'\n );\n if (!hasScopeCheck) {\n this.checks.push({\n id: 'scope-omitted-when-undefined',\n name: 'Client scope omission when scopes_supported undefined',\n description:\n 'Client did not complete authorization flow - scope check could not be performed',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY]\n });\n }\n return this.checks;\n }\n}\n\n/**\n * Scenario 4: Client performs step-up authentication\n *\n * Tests that clients handle step-up authentication where:\n * - initialize/notifications do not require auth\n * - listTools requires mcp:basic scope (401 if missing)\n * - tools/call requires mcp:basic + mcp:write scopes (403 if insufficient)\n * Client must handle both 401 and 403 responses with different scope requirements\n */\nexport class ScopeStepUpAuthScenario implements Scenario {\n name = 'auth/scope-step-up';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests that client handles step-up authentication with different scope requirements per operation';\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(): Promise {\n this.checks = [];\n\n const initialScope = 'mcp:basic';\n // tools/call gates on mcp:write only (not the union) so the scenario can\n // complete even for clients that don't accumulate; the SEP-2350 check then\n // observes whether the previously-granted mcp:basic was retained.\n const stepUpScope = 'mcp:write';\n const escalatedScopes = [initialScope, stepUpScope];\n const tokenVerifier = new MockTokenVerifier(this.checks, escalatedScopes);\n let authRequestCount = 0;\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n onAuthorizationRequest: (data) => {\n authRequestCount++;\n const requestedScopes = data.scope ? data.scope.split(' ') : [];\n\n if (authRequestCount === 1) {\n // First auth request - should request mcp:basic from WWW-Authenticate\n const usedCorrectScope = requestedScopes.includes(initialScope);\n this.checks.push({\n id: 'scope-step-up-initial',\n name: 'Client initial scope selection for step-up auth',\n description: usedCorrectScope\n ? 'Client correctly used scope from WWW-Authenticate header for initial auth'\n : 'Client SHOULD use the scope parameter from the WWW-Authenticate header',\n status: usedCorrectScope ? 'SUCCESS' : 'WARNING',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY],\n details: {\n expectedScope: initialScope,\n requestedScope: data.scope || 'none'\n }\n });\n } else if (authRequestCount === 2) {\n // Second auth request after a 403 challenge that listed only the\n // *missing* scope (mcp:write). Two distinct assertions:\n // - escalation: client included the challenged scope at all\n // - SEP-2350 union: client *also* kept the previously-granted scope\n // that was NOT in the challenge (i.e., computed prior ∪ challenge)\n const includesChallenged = requestedScopes.includes(stepUpScope);\n this.checks.push({\n id: 'scope-step-up-escalation',\n name: 'Client scope escalation for step-up auth',\n description: includesChallenged\n ? 'Client correctly requested the challenged scope for step-up authentication'\n : 'Client SHOULD request additional scopes when receiving 403 with new scope requirements',\n status: includesChallenged ? 'SUCCESS' : 'WARNING',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY],\n details: {\n challengedScope: stepUpScope,\n requestedScope: data.scope || 'none'\n }\n });\n\n const retainedPrior = requestedScopes.includes(initialScope);\n this.checks.push({\n id: 'sep-2350-scope-union-on-reauth',\n name: 'Client accumulates previously-granted scopes on re-authorization',\n description: retainedPrior\n ? 'Client included previously-granted scopes alongside the newly challenged scope when re-authorizing'\n : 'Client SHOULD compute the union of previously requested scopes and newly challenged scopes when initiating re-authorization (SEP-2350); previously-granted scope was dropped',\n status: retainedPrior ? 'SUCCESS' : 'WARNING',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING],\n details: {\n previouslyGranted: initialScope,\n challengedScope: stepUpScope,\n requestedScope: data.scope || 'none'\n }\n });\n }\n }\n });\n await this.authServer.start(authApp);\n\n // Inline step-up auth middleware\n const resourceMetadataUrl = () =>\n `${this.server.getUrl()}/.well-known/oauth-protected-resource/mcp`;\n\n const stepUpMiddleware = async (\n req: Request,\n res: Response,\n next: NextFunction\n ) => {\n // Parse body to check method\n let body = req.body;\n if (typeof body === 'string') {\n body = JSON.parse(body);\n }\n const method = body?.method;\n\n // Allow initialize and notifications without auth\n if (method === 'initialize' || method?.startsWith('notifications/')) {\n return next();\n }\n\n const authHeader = req.headers.authorization;\n if (!authHeader || !authHeader.startsWith('Bearer ')) {\n // No auth - return 401 with initial scope\n return res\n .status(401)\n .set(\n 'WWW-Authenticate',\n `Bearer scope=\"${initialScope}\", resource_metadata=\"${resourceMetadataUrl()}\"`\n )\n .json({\n error: 'invalid_token',\n error_description: 'Missing Authorization header'\n });\n }\n\n const token = authHeader.substring('Bearer '.length);\n const authInfo = await tokenVerifier.verifyAccessToken(token);\n const tokenScopes = authInfo.scopes || [];\n\n // Determine required scopes based on method\n const isToolCall = method === 'tools/call';\n const requiredScopes = isToolCall ? [stepUpScope] : [initialScope];\n\n const hasRequiredScopes = requiredScopes.every((s) =>\n tokenScopes.includes(s)\n );\n\n if (!hasRequiredScopes) {\n // Has token but insufficient scopes - return 403. Challenge with only\n // the step-up scope so SEP-2350 union accumulation is observable: a\n // client that just echoes the challenge would drop mcp:basic.\n return res\n .status(403)\n .set(\n 'WWW-Authenticate',\n `Bearer scope=\"${stepUpScope}\", resource_metadata=\"${resourceMetadataUrl()}\", error=\"insufficient_scope\"`\n )\n .json({\n error: 'insufficient_scope',\n error_description: 'Token has insufficient scope'\n });\n }\n\n next();\n };\n\n const baseApp = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: escalatedScopes,\n // Deliberately disjoint from initialScope/stepUpScope so the SEP-2350\n // union check can't be satisfied by a client that unions\n // scopes_supported ∪ challenge instead of prior-grant ∪ challenge.\n // The spec allows this: clients MUST NOT assume any set relationship\n // between challenged scopes and scopes_supported.\n scopesSupported: ['mcp:profile'],\n includeScopeInWwwAuth: true,\n authMiddleware: stepUpMiddleware,\n tokenVerifier\n }\n );\n\n await this.server.start(baseApp);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n // Emit failure checks if expected auth requests didn't happen\n const hasInitialCheck = this.checks.some(\n (c) => c.id === 'scope-step-up-initial'\n );\n const hasEscalationCheck = this.checks.some(\n (c) => c.id === 'scope-step-up-escalation'\n );\n\n if (!hasInitialCheck) {\n this.checks.push({\n id: 'scope-step-up-initial',\n name: 'Client initial scope selection for step-up auth',\n description: 'Client did not make an initial authorization request',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY]\n });\n }\n\n if (!hasEscalationCheck) {\n this.checks.push({\n id: 'scope-step-up-escalation',\n name: 'Client scope escalation for step-up auth',\n description:\n 'Client did not make a second authorization request for scope escalation',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_SELECTION_STRATEGY]\n });\n this.checks.push({\n id: 'sep-2350-scope-union-on-reauth',\n name: 'Client accumulates previously-granted scopes on re-authorization',\n description:\n 'Client did not make a second authorization request - scope union check could not be performed',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING]\n });\n }\n\n return this.checks;\n }\n}\n\n/**\n * Scenario 5: Client implements retry limits for scope escalation\n *\n * Tests that clients SHOULD implement retry limits to avoid infinite\n * authorization loops when receiving repeated 403 insufficient_scope errors.\n * The server always returns 403 with the same scope requirement, and clients\n * should stop retrying after a reasonable number of attempts (3 or fewer).\n */\nexport class ScopeRetryLimitScenario implements Scenario {\n name = 'auth/scope-retry-limit';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests that client implements retry limits to prevent infinite authorization loops on repeated 403 responses';\n allowClientError = true;\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(): Promise {\n this.checks = [];\n\n const requiredScope = 'mcp:admin';\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n let authRequestCount = 0;\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n onAuthorizationRequest: (data) => {\n authRequestCount++;\n this.checks.push({\n id: 'scope-retry-auth-attempt',\n name: `Authorization attempt ${authRequestCount}`,\n description: `Client made authorization request attempt ${authRequestCount}`,\n status: 'INFO',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING],\n details: {\n attemptNumber: authRequestCount,\n requestedScope: data.scope || 'none'\n }\n });\n }\n });\n await this.authServer.start(authApp);\n\n const resourceMetadataUrl = () =>\n `${this.server.getUrl()}/.well-known/oauth-protected-resource/mcp`;\n\n const maxAttempts = 3;\n let mcpRequestWithTokenCount = 0;\n\n const alwaysDeny403Middleware = async (\n req: Request,\n res: Response,\n next: NextFunction\n ) => {\n let body = req.body;\n if (typeof body === 'string') {\n body = JSON.parse(body);\n }\n const method = body?.method;\n\n if (method === 'initialize' || method?.startsWith('notifications/')) {\n return next();\n }\n\n const authHeader = req.headers.authorization;\n if (!authHeader || !authHeader.startsWith('Bearer ')) {\n return res\n .status(401)\n .set(\n 'WWW-Authenticate',\n `Bearer scope=\"${requiredScope}\", resource_metadata=\"${resourceMetadataUrl()}\"`\n )\n .json({\n error: 'invalid_token',\n error_description: 'Missing Authorization header'\n });\n }\n\n mcpRequestWithTokenCount++;\n\n if (mcpRequestWithTokenCount > maxAttempts) {\n return res.status(410).json({\n error: 'test_complete',\n error_description:\n 'Test is over - client exceeded maximum retry attempts'\n });\n }\n\n return res\n .status(403)\n .set(\n 'WWW-Authenticate',\n `Bearer error=\"insufficient_scope\", scope=\"${requiredScope}\", resource_metadata=\"${resourceMetadataUrl()}\", error_description=\"Scope upgrade will never succeed\"`\n )\n .json({\n error: 'insufficient_scope',\n error_description: 'Scope upgrade will never succeed'\n });\n };\n\n const baseApp = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [requiredScope],\n scopesSupported: [requiredScope],\n includeScopeInWwwAuth: true,\n authMiddleware: alwaysDeny403Middleware,\n tokenVerifier\n }\n );\n\n await this.server.start(baseApp);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const authAttempts = this.checks.filter(\n (c) => c.id === 'scope-retry-auth-attempt'\n ).length;\n\n if (authAttempts === 0) {\n this.checks.push({\n id: 'scope-retry-limit',\n name: 'Client retry limit for scope escalation',\n description: 'Client did not make any authorization requests',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING]\n });\n } else if (authAttempts <= 3) {\n this.checks.push({\n id: 'scope-retry-limit',\n name: 'Client retry limit for scope escalation',\n description: `Client correctly limited retry attempts to ${authAttempts} (3 or fewer)`,\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING],\n details: {\n authorizationAttempts: authAttempts,\n maxAllowed: 3\n }\n });\n } else {\n this.checks.push({\n id: 'scope-retry-limit',\n name: 'Client retry limit for scope escalation',\n description: `Client made ${authAttempts} authorization attempts (more than 3). Clients SHOULD implement retry limits to avoid infinite loops.`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_SCOPE_CHALLENGE_HANDLING],\n details: {\n authorizationAttempts: authAttempts,\n maxAllowed: 3\n }\n });\n }\n\n return this.checks;\n }\n}\n",[],[141,254,422,511,521],"c0eac0d6-5b64-11f1-aa1a-ee650bb23af1","resource-mismatch.ts","c0eac176-5b64-11f1-aa1a-ee650bb23af1",43,["D",1780062371651],"import type { Scenario, ConformanceCheck } from '../../../types.ts';\nimport { ScenarioUrls, DRAFT_PROTOCOL_VERSION } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\n\n/**\n * Scenario: Resource Mismatch Detection\n *\n * Tests that clients correctly detect and reject when the Protected Resource\n * Metadata returns a `resource` field that doesn't match the server URL\n * the client is trying to access.\n *\n * Per RFC 8707 and MCP spec, clients MUST validate that the resource from\n * PRM matches the expected server before proceeding with authorization.\n *\n * Setup:\n * - Server returns PRM with resource: \"https://evil.example.com/mcp\" (different origin)\n * - Client is trying to access the actual server at localhost:/mcp\n *\n * Expected behavior:\n * - Client should NOT proceed with authorization\n * - Client should abort due to resource mismatch\n * - Test passes if client does NOT complete the auth flow (no authorization request)\n */\nexport class ResourceMismatchScenario implements Scenario {\n name = 'auth/resource-mismatch';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client rejects when PRM resource does not match server URL';\n allowClientError = true;\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private authorizationRequestMade = false;\n\n async start(): Promise {\n this.checks = [];\n this.authorizationRequestMade = false;\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n tokenEndpointAuthMethodsSupported: ['none'],\n onAuthorizationRequest: () => {\n // If we get here, the client incorrectly proceeded with auth\n this.authorizationRequestMade = true;\n },\n onRegistrationRequest: () => ({\n clientId: `test-client-${Date.now()}`,\n clientSecret: undefined,\n tokenEndpointAuthMethod: 'none'\n })\n });\n await this.authServer.start(authApp);\n\n // Create server that returns a mismatched resource in PRM\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [],\n tokenVerifier,\n // Return a different origin in PRM - this should be rejected by the client\n prmResourceOverride: 'https://evil.example.com/mcp'\n }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const timestamp = new Date().toISOString();\n const specRefs = [\n SpecReferences.RFC_8707_RESOURCE_INDICATORS,\n SpecReferences.MCP_RESOURCE_PARAMETER\n ];\n\n // The test passes if the client did NOT make an authorization request\n // (meaning it correctly rejected the mismatched resource)\n if (!this.checks.some((c) => c.id === 'resource-mismatch-rejected')) {\n const correctlyRejected = !this.authorizationRequestMade;\n this.checks.push({\n id: 'resource-mismatch-rejected',\n name: 'Client rejects mismatched resource',\n description: correctlyRejected\n ? 'Client correctly rejected authorization when PRM resource does not match server URL'\n : 'Client MUST validate that PRM resource matches the server URL before proceeding with authorization',\n status: correctlyRejected ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n prmResource: 'https://evil.example.com/mcp',\n expectedBehavior: 'Client should NOT proceed with authorization',\n authorizationRequestMade: this.authorizationRequestMade\n }\n });\n }\n\n return this.checks;\n }\n}\n",[],[141,254,422,511,529],"ff390c50-5f4a-11f1-84e9-1607ee4eb77e","pre-registration.ts","c09426cc-5b64-11f1-b83c-ee650bb23af1",97,["D",1780491113921],"import {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n ConformanceCheck\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\n\nconst PRE_REGISTERED_CLIENT_ID = 'pre-registered-client';\nconst PRE_REGISTERED_CLIENT_SECRET = 'pre-registered-secret';\n\n/**\n * Scenario: Pre-registration (static client credentials)\n *\n * Tests OAuth flow where the server does NOT support Dynamic Client Registration.\n * Clients must use pre-registered credentials passed via context.\n *\n * This tests the pre-registration approach described in the MCP spec:\n * https://modelcontextprotocol.io/specification/draft/basic/authorization#preregistration\n */\nexport class PreRegistrationScenario extends AuthHandlerScenario {\n name = 'auth/pre-registration';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests OAuth flow with pre-registered client credentials. Server does not support DCR.';\n\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(this.checks, getAsUrl, {\n tokenVerifier,\n disableDynamicRegistration: true,\n tokenEndpointAuthMethodsSupported: ['client_secret_basic'],\n onTokenRequest: ({ authorizationHeader, timestamp }) => {\n // Verify client used pre-registered credentials via Basic auth\n if (!authorizationHeader?.startsWith('Basic ')) {\n this.checks.push({\n id: 'pre-registration-auth',\n name: 'Pre-registration authentication',\n description:\n 'Client did not use Basic authentication with pre-registered credentials',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PREREGISTRATION]\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Missing or invalid Authorization header',\n statusCode: 401\n };\n }\n\n const base64Credentials = authorizationHeader.slice(6);\n const credentials = Buffer.from(base64Credentials, 'base64').toString(\n 'utf-8'\n );\n const [clientId, clientSecret] = credentials.split(':');\n\n if (\n clientId !== PRE_REGISTERED_CLIENT_ID ||\n clientSecret !== PRE_REGISTERED_CLIENT_SECRET\n ) {\n this.checks.push({\n id: 'pre-registration-auth',\n name: 'Pre-registration authentication',\n description: `Client used incorrect pre-registered credentials. Expected client_id '${PRE_REGISTERED_CLIENT_ID}', got '${clientId}'`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PREREGISTRATION],\n details: {\n expectedClientId: PRE_REGISTERED_CLIENT_ID,\n actualClientId: clientId\n }\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Invalid pre-registered credentials',\n statusCode: 401\n };\n }\n\n // Success - client used correct pre-registered credentials\n this.checks.push({\n id: 'pre-registration-auth',\n name: 'Pre-registration authentication',\n description:\n 'Client correctly used pre-registered credentials when server does not support DCR',\n status: 'SUCCESS',\n timestamp,\n specReferences: [SpecReferences.MCP_PREREGISTRATION],\n details: { clientId }\n });\n\n return {\n token: `test-token-prereg-${Date.now()}`,\n scopes: []\n };\n }\n });\n\n const rsApp = createServer(this.checks, ctx.getRsBaseUrl, getAsUrl, {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: [],\n tokenVerifier\n });\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n protected scenarioContext() {\n return {\n client_id: PRE_REGISTERED_CLIENT_ID,\n client_secret: PRE_REGISTERED_CLIENT_SECRET\n };\n }\n\n getChecks(): ConformanceCheck[] {\n // Ensure we have the pre-registration check\n const hasPreRegCheck = this.checks.some(\n (c) => c.id === 'pre-registration-auth'\n );\n if (!hasPreRegCheck) {\n this.checks.push({\n id: 'pre-registration-auth',\n name: 'Pre-registration authentication',\n description: 'Client did not make a token request',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_PREREGISTRATION]\n });\n }\n\n return this.checks;\n }\n}\n",[],[141,254,422,511,537],"c022969c-5b64-11f1-a5db-ee650bb23af1","offline-access.ts","c0229750-5b64-11f1-a5db-ee650bb23af1",40,["D",1780062370348],"import type { Scenario, ConformanceCheck } from '../../../types.ts';\nimport { ScenarioUrls, DRAFT_PROTOCOL_VERSION } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\n\n/**\n * Scenario: Offline Access Scope (SEP-2207)\n *\n * Tests client behavior when the Authorization Server metadata lists\n * `offline_access` in `scopes_supported`:\n *\n * 1. Client SHOULD include `refresh_token` in `grant_types` client metadata\n * (checked via DCR body or CIMD document, whichever the client uses)\n * 2. Client MAY include `offline_access` in authorization request scope\n *\n * Setup:\n * - AS metadata: scopes_supported includes 'offline_access'\n * - PRM: scopes_supported does NOT include 'offline_access' (per SEP-2207 server guidance)\n * - Both CIMD and DCR paths available\n */\nexport class OfflineAccessScopeScenario implements Scenario {\n name = 'auth/offline-access-scope';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that a client that wants a refresh token handles offline_access scope and refresh_token grant type when AS supports them (SEP-2207)';\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private grantTypesChecked = false;\n private capturedCimdUrl: string | undefined;\n\n async start(): Promise {\n this.checks = [];\n this.grantTypesChecked = false;\n this.capturedCimdUrl = undefined;\n\n const tokenVerifier = new MockTokenVerifier(this.checks, ['mcp:basic']);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n scopesSupported: ['mcp:basic', 'offline_access'],\n clientIdMetadataDocumentSupported: true,\n onRegistrationRequest: (req) => {\n // DCR path: inspect grant_types in registration body\n const grantTypes: string[] = req.body.grant_types || [];\n const hasRefreshToken = grantTypes.includes('refresh_token');\n this.grantTypesChecked = true;\n this.checks.push({\n id: 'sep-2207-client-metadata-grant-types',\n name: 'Client metadata includes refresh_token grant type (DCR)',\n description: hasRefreshToken\n ? 'Client correctly included refresh_token in grant_types during dynamic client registration'\n : 'Client SHOULD include refresh_token in grant_types client metadata (SEP-2207)',\n status: hasRefreshToken ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n registrationMethod: 'DCR',\n grantTypes: grantTypes.length > 0 ? grantTypes.join(' ') : 'none'\n }\n });\n\n const clientId = `test-client-${Date.now()}`;\n return {\n clientId,\n clientSecret: undefined,\n tokenEndpointAuthMethod: 'none'\n };\n },\n onAuthorizationRequest: (data) => {\n // Capture CIMD URL if client used URL-based client_id\n if (data.clientId && data.clientId.startsWith('http')) {\n this.capturedCimdUrl = data.clientId;\n }\n\n // Check if client included offline_access in scope\n const requestedScopes = data.scope ? data.scope.split(' ') : [];\n const hasOfflineAccess = requestedScopes.includes('offline_access');\n this.checks.push({\n id: 'sep-2207-offline-access-requested',\n name: 'Client requests offline_access scope',\n description: hasOfflineAccess\n ? 'Client included offline_access in authorization request scope when AS lists it in scopes_supported'\n : 'Client MAY include offline_access in scope when AS metadata lists it in scopes_supported (SEP-2207). Client chose not to request it.',\n status: hasOfflineAccess ? 'SUCCESS' : 'INFO',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n asScopesSupported: 'mcp:basic offline_access',\n requestedScope: data.scope || 'none'\n }\n });\n }\n });\n await this.authServer.start(authApp);\n\n // PRM does NOT include offline_access (per SEP-2207 server guidance:\n // servers SHOULD NOT include offline_access in PRM scopes_supported)\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: ['mcp:basic'],\n scopesSupported: ['mcp:basic'],\n tokenVerifier\n }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n // If client used CIMD and we haven't checked grant_types yet,\n // attempt to fetch the CIMD URL to inspect the metadata document\n if (this.capturedCimdUrl && !this.grantTypesChecked) {\n try {\n const controller = new AbortController();\n const timeout = setTimeout(() => controller.abort(), 3000);\n const response = await fetch(this.capturedCimdUrl, {\n signal: controller.signal\n });\n clearTimeout(timeout);\n\n if (response.ok) {\n const metadata = await response.json();\n const grantTypes: string[] = metadata.grant_types || [];\n const hasRefreshToken = grantTypes.includes('refresh_token');\n this.grantTypesChecked = true;\n this.checks.push({\n id: 'sep-2207-client-metadata-grant-types',\n name: 'Client metadata includes refresh_token grant type (CIMD)',\n description: hasRefreshToken\n ? 'Client metadata document includes refresh_token in grant_types'\n : 'Client SHOULD include refresh_token in grant_types client metadata (SEP-2207)',\n status: hasRefreshToken ? 'SUCCESS' : 'WARNING',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n registrationMethod: 'CIMD',\n cimdUrl: this.capturedCimdUrl,\n grantTypes: grantTypes.length > 0 ? grantTypes.join(' ') : 'none'\n }\n });\n }\n } catch {\n // CIMD URL didn't resolve - emit info check\n this.grantTypesChecked = true;\n this.checks.push({\n id: 'sep-2207-client-metadata-grant-types',\n name: 'Client metadata includes refresh_token grant type (CIMD)',\n description:\n 'Client used CIMD but metadata URL could not be fetched to verify grant_types',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n registrationMethod: 'CIMD',\n cimdUrl: this.capturedCimdUrl,\n fetchFailed: true\n }\n });\n }\n }\n\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const timestamp = new Date().toISOString();\n\n // If grant_types was never checked (no DCR, no CIMD, possibly pre-registered)\n if (!this.grantTypesChecked) {\n this.checks.push({\n id: 'sep-2207-client-metadata-grant-types',\n name: 'Client metadata includes refresh_token grant type',\n description:\n 'Client did not use DCR or fetchable CIMD — grant_types could not be inspected',\n status: 'INFO',\n timestamp,\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n registrationMethod: 'unknown'\n }\n });\n }\n\n // If offline_access check never ran, the authorization flow didn't complete\n if (\n !this.checks.some((c) => c.id === 'sep-2207-offline-access-requested')\n ) {\n this.checks.push({\n id: 'sep-2207-offline-access-requested',\n name: 'Client requests offline_access scope',\n description:\n 'Client did not complete authorization flow — offline_access scope check could not be performed',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE]\n });\n }\n\n return this.checks;\n }\n}\n\n/**\n * Scenario: Offline Access Not Supported (SEP-2207)\n *\n * Tests that clients do NOT include `offline_access` in the authorization\n * request scope when the AS metadata does NOT list it in `scopes_supported`.\n *\n * Per SEP-2207, clients MAY add offline_access only \"when the Authorization\n * Server's metadata lists it in scopes_supported\". If the AS doesn't support\n * it, requesting it is an error (requesting an unsupported scope).\n *\n * Setup:\n * - AS metadata: scopes_supported does NOT include 'offline_access'\n * - PRM: standard scopes\n */\nexport class OfflineAccessNotSupportedScenario implements Scenario {\n name = 'auth/offline-access-not-supported';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client does not request offline_access when AS does not list it in scopes_supported (SEP-2207)';\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(): Promise {\n this.checks = [];\n\n const tokenVerifier = new MockTokenVerifier(this.checks, [\n 'mcp:basic',\n 'mcp:read'\n ]);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n scopesSupported: ['mcp:basic', 'mcp:read'],\n onAuthorizationRequest: (data) => {\n const requestedScopes = data.scope ? data.scope.split(' ') : [];\n const hasOfflineAccess = requestedScopes.includes('offline_access');\n this.checks.push({\n id: 'sep-2207-offline-access-not-requested',\n name: 'Client does not request unsupported offline_access',\n description: hasOfflineAccess\n ? 'Client MUST NOT request offline_access when it is not listed in AS scopes_supported (SEP-2207)'\n : 'Client correctly did not request offline_access when AS does not list it in scopes_supported',\n status: hasOfflineAccess ? 'FAILURE' : 'SUCCESS',\n timestamp: data.timestamp,\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE],\n details: {\n asScopesSupported: 'mcp:basic mcp:read',\n requestedScope: data.scope || 'none'\n }\n });\n }\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: ['mcp:basic', 'mcp:read'],\n scopesSupported: ['mcp:basic', 'mcp:read'],\n tokenVerifier\n }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n if (\n !this.checks.some((c) => c.id === 'sep-2207-offline-access-not-requested')\n ) {\n this.checks.push({\n id: 'sep-2207-offline-access-not-requested',\n name: 'Client does not request unsupported offline_access',\n description:\n 'Client did not complete authorization flow — offline_access scope check could not be performed',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.SEP_2207_REFRESH_TOKEN_GUIDANCE]\n });\n }\n\n return this.checks;\n }\n}\n",[],[141,254,422,511,545],"c1db59ce-5b64-11f1-aa1a-ee650bb23af1","march-spec-backcompat.ts","c1db5aa0-5b64-11f1-aa1a-ee650bb23af1",47,["D",1780062373219],"import type { Scenario, ConformanceCheck } from '../../../types.ts';\nimport { ScenarioUrls } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport express, { Request, Response } from 'npm:express@^5.1.0';\nimport { SpecReferences } from './spec-references.ts';\n\nexport class Auth20250326OAuthMetadataBackcompatScenario implements Scenario {\n name = 'auth/2025-03-26-oauth-metadata-backcompat';\n readonly source = {\n introducedIn: '2025-03-26',\n removedIn: '2025-06-18'\n } as const;\n description =\n 'Tests 2025-03-26 spec OAuth flow: no PRM (Protected Resource Metadata), OAuth metadata at root location';\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(): Promise {\n this.checks = [];\n // Legacy server, so we create the auth server endpoints on the\n // same URL as the main server (rather than separating AS / RS).\n const authApp = createAuthServer(this.checks, this.server.getUrl, {\n // Disable logging since the main server will already have logging enabled\n loggingEnabled: false,\n // Add a prefix to auth endpoints to avoid being caught by auth fallbacks\n routePrefix: '/oauth'\n });\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.server.getUrl,\n // Explicitly set to null to indicate no PRM available\n { prmPath: null }\n );\n app.use(authApp);\n\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const expectedSlugs = [\n 'authorization-server-metadata',\n 'client-registration',\n 'authorization-request',\n 'token-request'\n ];\n\n for (const slug of expectedSlugs) {\n if (!this.checks.find((c) => c.id === slug)) {\n this.checks.push({\n id: slug,\n name: `Expected Check Missing: ${slug}`,\n description: `Expected Check Missing: ${slug}`,\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.LEGACY_2025_03_26_AUTH_DISCOVERY]\n });\n }\n }\n\n return this.checks;\n }\n}\n\nexport class Auth20250326OEndpointFallbackScenario implements Scenario {\n name = 'auth/2025-03-26-oauth-endpoint-fallback';\n readonly source = {\n introducedIn: '2025-03-26',\n removedIn: '2025-06-18'\n } as const;\n description =\n 'Tests OAuth flow with no metadata endpoints, relying on fallback to standard OAuth endpoints at server root (2025-03-26 spec behavior)';\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(): Promise {\n this.checks = [];\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.server.getUrl,\n { prmPath: null }\n );\n\n // needed for /token endpoint\n app.use(express.urlencoded({ extended: true }));\n\n app.get('/authorize', (req: Request, res: Response) => {\n this.checks.push({\n id: 'authorization-request',\n name: 'AuthorizationRequest',\n description: 'Client made authorization request to fallback endpoint',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.LEGACY_2025_03_26_AUTH_URL_FALLBACK],\n details: {\n response_type: req.query.response_type,\n client_id: req.query.client_id,\n redirect_uri: req.query.redirect_uri,\n state: req.query.state,\n code_challenge: req.query.code_challenge ? 'present' : 'missing',\n code_challenge_method: req.query.code_challenge_method\n }\n });\n\n const redirectUri = req.query.redirect_uri as string;\n const state = req.query.state as string;\n const redirectUrl = new URL(redirectUri);\n redirectUrl.searchParams.set('code', 'test-auth-code');\n if (state) {\n redirectUrl.searchParams.set('state', state);\n }\n\n res.redirect(redirectUrl.toString());\n });\n\n app.post('/token', (req: Request, res: Response) => {\n this.checks.push({\n id: 'token-request',\n name: 'TokenRequest',\n description: 'Client requested access token from fallback endpoint',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.LEGACY_2025_03_26_AUTH_URL_FALLBACK],\n details: {\n endpoint: '/token',\n grantType: req.body.grant_type\n }\n });\n\n res.json({\n access_token: 'test-token',\n token_type: 'Bearer',\n expires_in: 3600\n });\n });\n\n app.post('/register', (req: Request, res: Response) => {\n this.checks.push({\n id: 'client-registration',\n name: 'ClientRegistration',\n description:\n 'Client registered with authorization server at fallback endpoint',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.LEGACY_2025_03_26_AUTH_URL_FALLBACK],\n details: {\n endpoint: '/register',\n clientName: req.body.client_name\n }\n });\n\n res.status(201).json({\n client_id: 'test-client-id',\n client_secret: 'test-client-secret',\n client_name: req.body.client_name || 'test-client',\n redirect_uris: req.body.redirect_uris || []\n });\n });\n\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const expectedSlugs = [\n 'client-registration',\n 'authorization-request',\n 'token-request'\n ];\n\n for (const slug of expectedSlugs) {\n if (!this.checks.find((c) => c.id === slug)) {\n this.checks.push({\n id: slug,\n name: `Expected Check Missing: ${slug}`,\n description: `Expected Check Missing: ${slug}`,\n status: 'FAILURE',\n timestamp: new Date().toISOString()\n });\n }\n }\n\n return this.checks;\n }\n}\n",[],[141,254,422,511,553],"bfb9c00e-5b64-11f1-8ff0-ee650bb23af1","issuer-parameter.ts","bfb9c0c2-5b64-11f1-8ff0-ee650bb23af1",38,["D",1780062369646],"import type { Scenario, ConformanceCheck } from '../../../types.ts';\nimport { ScenarioUrls, DRAFT_PROTOCOL_VERSION } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\n\nconst specRefs = [SpecReferences.RFC_9207_ISS_PARAMETER];\nconst metadataSpecRefs = [\n SpecReferences.RFC_AUTH_SERVER_METADATA_REQUEST,\n SpecReferences.MCP_AUTH_DISCOVERY\n];\n\n/**\n * Scenario: ISS Parameter Supported (positive)\n *\n * Server advertises authorization_response_iss_parameter_supported: true and\n * includes the correct iss value in the authorization redirect. A conformant\n * client should validate iss and proceed normally.\n */\nexport class IssParameterSupportedScenario implements Scenario {\n name = 'auth/iss-supported';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client accepts authorization response when server advertises and sends correct iss parameter';\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private tokenRequestMade = false;\n\n async start(): Promise {\n this.checks = [];\n this.tokenRequestMade = false;\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n issParameterSupported: true,\n issInRedirect: 'correct',\n onTokenRequest: () => {\n this.tokenRequestMade = true;\n return { token: `test-token-${Date.now()}`, scopes: [] };\n }\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n { requiredScopes: [], tokenVerifier }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const timestamp = new Date().toISOString();\n\n this.checks.push({\n id: 'sep-2468-client-compare-iss-supported',\n name: 'Client accepts matching iss when advertised',\n description: this.tokenRequestMade\n ? 'Client compared advertised iss against recorded issuer and proceeded to token exchange'\n : 'Client did not proceed to token exchange after receiving a correct iss from a server that advertised support',\n status: this.tokenRequestMade ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: { tokenRequestMade: this.tokenRequestMade }\n });\n\n return this.checks;\n }\n}\n\n/**\n * Scenario: ISS Parameter Not Advertised (positive)\n *\n * Server does not advertise authorization_response_iss_parameter_supported and\n * does not include iss in the redirect. A conformant client should proceed normally.\n */\nexport class IssParameterNotAdvertisedScenario implements Scenario {\n name = 'auth/iss-not-advertised';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client accepts authorization response when server does not advertise or send iss parameter';\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private tokenRequestMade = false;\n\n async start(): Promise {\n this.checks = [];\n this.tokenRequestMade = false;\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n issParameterSupported: null,\n issInRedirect: 'omit',\n onTokenRequest: () => {\n this.tokenRequestMade = true;\n return { token: `test-token-${Date.now()}`, scopes: [] };\n }\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n { requiredScopes: [], tokenVerifier }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const timestamp = new Date().toISOString();\n\n this.checks.push({\n id: 'sep-2468-client-proceed-no-iss',\n name: 'Client proceeds when iss absent and not advertised',\n description: this.tokenRequestMade\n ? 'Client proceeded to token exchange when neither metadata advertised iss support nor redirect contained iss'\n : 'Client did not proceed to token exchange — should proceed when iss is absent and not advertised',\n status: this.tokenRequestMade ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: { tokenRequestMade: this.tokenRequestMade }\n });\n\n return this.checks;\n }\n}\n\n/**\n * Scenario: ISS Parameter Advertised but Missing from Redirect (client must reject)\n *\n * Server advertises authorization_response_iss_parameter_supported: true but\n * omits iss from the redirect. A conformant client MUST reject this response.\n */\nexport class IssParameterSupportedMissingScenario implements Scenario {\n name = 'auth/iss-supported-missing';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client rejects authorization response when server advertised iss support but omitted iss from redirect';\n allowClientError = true;\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private authReached = false;\n private tokenRequestMade = false;\n\n async start(): Promise {\n this.checks = [];\n this.authReached = false;\n this.tokenRequestMade = false;\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n issParameterSupported: true,\n issInRedirect: 'omit', // advertise support but don't send iss\n onAuthorizationRequest: () => {\n this.authReached = true;\n },\n onTokenRequest: () => {\n this.tokenRequestMade = true;\n return { token: `test-token-${Date.now()}`, scopes: [] };\n }\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n { requiredScopes: [], tokenVerifier }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const timestamp = new Date().toISOString();\n\n if (\n !this.checks.some((c) => c.id === 'sep-2468-client-reject-missing-iss')\n ) {\n const correctlyRejected = this.authReached && !this.tokenRequestMade;\n this.checks.push({\n id: 'sep-2468-client-reject-missing-iss',\n name: 'Client rejects missing iss when required',\n description: correctlyRejected\n ? 'Client correctly rejected authorization response missing required iss parameter'\n : 'Client MUST reject authorization response when server advertised iss support but iss is absent from redirect',\n status: correctlyRejected ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n serverAdvertisedSupport: true,\n issSentInRedirect: false,\n authReached: this.authReached,\n tokenRequestMade: this.tokenRequestMade\n }\n });\n }\n\n return this.checks;\n }\n}\n\n/**\n * Scenario: ISS Parameter Has Wrong Value (client must reject)\n *\n * Server advertises authorization_response_iss_parameter_supported: true and\n * includes an iss value that does not match the server's actual issuer. A\n * conformant client MUST reject this response.\n */\nexport class IssParameterWrongIssuerScenario implements Scenario {\n name = 'auth/iss-wrong-issuer';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client rejects authorization response when iss does not match the authorization server issuer';\n allowClientError = true;\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private authReached = false;\n private tokenRequestMade = false;\n\n async start(): Promise {\n this.checks = [];\n this.authReached = false;\n this.tokenRequestMade = false;\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n issParameterSupported: true,\n issInRedirect: 'wrong', // send iss that doesn't match metadata issuer\n onAuthorizationRequest: () => {\n this.authReached = true;\n },\n onTokenRequest: () => {\n this.tokenRequestMade = true;\n return { token: `test-token-${Date.now()}`, scopes: [] };\n }\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n { requiredScopes: [], tokenVerifier }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const timestamp = new Date().toISOString();\n\n if (\n !this.checks.some((c) => c.id === 'sep-2468-client-compare-iss-supported')\n ) {\n const correctlyRejected = this.authReached && !this.tokenRequestMade;\n this.checks.push({\n id: 'sep-2468-client-compare-iss-supported',\n name: 'Client rejects mismatched iss',\n description: correctlyRejected\n ? 'Client correctly rejected authorization response with mismatched iss parameter'\n : 'Client MUST reject authorization response when iss does not match the authorization server issuer',\n status: correctlyRejected ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n serverAdvertisedSupport: true,\n issSentInRedirect: 'https://evil.example.com',\n authReached: this.authReached,\n tokenRequestMade: this.tokenRequestMade\n }\n });\n }\n\n return this.checks;\n }\n}\n\n/**\n * Scenario: ISS Parameter Sent but Not Advertised, Mismatched (client must reject)\n *\n * Server does not advertise authorization_response_iss_parameter_supported but\n * includes a mismatched iss value in the redirect. Per the SEP-2468 spec table\n * row 3, a conformant client MUST compare a present iss against the recorded\n * issuer regardless of metadata advertisement, and reject on mismatch.\n */\nexport class IssParameterUnexpectedScenario implements Scenario {\n name = 'auth/iss-unexpected';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client compares iss against recorded issuer even when not advertised, and rejects on mismatch';\n allowClientError = true;\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private authReached = false;\n private tokenRequestMade = false;\n\n async start(): Promise {\n this.checks = [];\n this.authReached = false;\n this.tokenRequestMade = false;\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n issParameterSupported: null,\n issInRedirect: 'wrong', // send mismatched iss without advertising support\n onAuthorizationRequest: () => {\n this.authReached = true;\n },\n onTokenRequest: () => {\n this.tokenRequestMade = true;\n return { token: `test-token-${Date.now()}`, scopes: [] };\n }\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n { requiredScopes: [], tokenVerifier }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const timestamp = new Date().toISOString();\n\n if (\n !this.checks.some(\n (c) => c.id === 'sep-2468-client-compare-iss-unadvertised'\n )\n ) {\n const correctlyRejected = this.authReached && !this.tokenRequestMade;\n this.checks.push({\n id: 'sep-2468-client-compare-iss-unadvertised',\n name: 'Client compares unadvertised iss and rejects mismatch',\n description: correctlyRejected\n ? 'Client correctly compared unadvertised iss against recorded issuer and rejected the mismatch'\n : 'Client MUST compare a present iss against the recorded issuer regardless of metadata advertisement, and reject on mismatch',\n status: correctlyRejected ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n serverAdvertisedSupport: false,\n issSentInRedirect: 'https://evil.example.com',\n authReached: this.authReached,\n tokenRequestMade: this.tokenRequestMade\n }\n });\n }\n\n return this.checks;\n }\n}\n\n/**\n * Scenario: ISS Parameter Is a Normalization-Equivalent Variant (client must reject)\n *\n * Server advertises authorization_response_iss_parameter_supported: true and\n * includes an iss value that differs from the recorded issuer only by RFC 3986\n * normalization (a trailing slash on an empty path — exactly what\n * `new URL(x).href` round-tripping produces). SEP-2468 requires simple string\n * comparison with no scheme/host case folding, default-port elision,\n * trailing-slash, or percent-encoding normalization, so a conformant client\n * MUST treat the variant as a mismatch and reject the response.\n */\nexport class IssParameterNormalizedVariantScenario implements Scenario {\n name = 'auth/iss-normalized';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client compares iss using simple string comparison without applying URL normalization';\n allowClientError = true;\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private authReached = false;\n private tokenRequestMade = false;\n\n async start(): Promise {\n this.checks = [];\n this.authReached = false;\n this.tokenRequestMade = false;\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n issParameterSupported: true,\n issInRedirect: 'normalized', // correct issuer + trailing slash\n onAuthorizationRequest: () => {\n this.authReached = true;\n },\n onTokenRequest: () => {\n this.tokenRequestMade = true;\n return { token: `test-token-${Date.now()}`, scopes: [] };\n }\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n { requiredScopes: [], tokenVerifier }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const timestamp = new Date().toISOString();\n\n if (!this.checks.some((c) => c.id === 'sep-2468-client-no-normalization')) {\n const correctlyRejected = this.authReached && !this.tokenRequestMade;\n this.checks.push({\n id: 'sep-2468-client-no-normalization',\n name: 'Client compares iss without URL normalization',\n description: correctlyRejected\n ? 'Client rejected an iss value that only matches the recorded issuer after URL normalization'\n : 'Client MUST NOT apply scheme/host case folding, default-port elision, trailing-slash, or percent-encoding normalization to iss before comparison; a trailing-slash variant of the issuer must be treated as a mismatch',\n status: correctlyRejected ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: specRefs,\n details: {\n recordedIssuer: this.authServer.getUrl(),\n issSentInRedirect: `${this.authServer.getUrl()}/`,\n authReached: this.authReached,\n tokenRequestMade: this.tokenRequestMade\n }\n });\n }\n\n return this.checks;\n }\n}\n\n/**\n * Scenario: AS Metadata Issuer Mismatch (client must not use the metadata)\n *\n * The authorization server metadata document declares an `issuer` that is not\n * identical to the issuer identifier used to construct the well-known URL.\n * Per RFC 8414 §3.3 / OpenID Connect Discovery §4.3 (incorporated by\n * SEP-2468), the client MUST validate the issuer and MUST NOT use the\n * metadata on mismatch. The endpoints in the poisoned document live under a\n * non-default route prefix, so any request that reaches them proves the\n * client used the metadata.\n */\nexport class MetadataIssuerMismatchScenario implements Scenario {\n name = 'auth/metadata-issuer-mismatch';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that client rejects authorization server metadata whose issuer does not match the issuer used to construct the well-known URL';\n allowClientError = true;\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private metadataEndpointsUsed = false;\n\n async start(): Promise {\n this.checks = [];\n this.metadataEndpointsUsed = false;\n\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n tokenVerifier,\n // The well-known URL is constructed from the AS URL advertised in PRM\n // (the bare origin), so the document's issuer must equal that origin.\n // Serve something else entirely.\n metadataIssuer: 'https://attacker.example.com',\n // Park the endpoints under a prefix only discoverable via the poisoned\n // metadata, so \"client used the metadata\" is observable as a request.\n routePrefix: '/mismatched-as',\n onRegistrationRequest: () => {\n this.metadataEndpointsUsed = true;\n return {\n clientId: 'test-client-id',\n clientSecret: 'test-client-secret'\n };\n },\n onAuthorizationRequest: () => {\n this.metadataEndpointsUsed = true;\n },\n onTokenRequest: () => {\n this.metadataEndpointsUsed = true;\n return { token: `test-token-${Date.now()}`, scopes: [] };\n }\n });\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl,\n { requiredScopes: [], tokenVerifier }\n );\n await this.server.start(app);\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const timestamp = new Date().toISOString();\n\n if (\n !this.checks.some(\n (c) => c.id === 'sep-2468-client-validate-metadata-issuer'\n )\n ) {\n const metadataRequested = this.checks.some(\n (c) => c.id === 'authorization-server-metadata'\n );\n const correctlyRejected =\n metadataRequested && !this.metadataEndpointsUsed;\n this.checks.push({\n id: 'sep-2468-client-validate-metadata-issuer',\n name: 'Client validates metadata issuer against well-known URL',\n description: correctlyRejected\n ? 'Client rejected authorization server metadata whose issuer does not match the issuer identifier used to construct the well-known URL'\n : metadataRequested\n ? 'Client MUST NOT use authorization server metadata whose issuer differs from the issuer identifier used to construct the well-known URL; client used endpoints from the mismatched metadata'\n : 'Client never retrieved the authorization server metadata document, so issuer validation could not be observed',\n status: correctlyRejected ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: metadataSpecRefs,\n details: {\n expectedIssuer: this.authServer.getUrl(),\n metadataIssuer: 'https://attacker.example.com',\n metadataRequested,\n metadataEndpointsUsed: this.metadataEndpointsUsed\n }\n });\n }\n\n return this.checks;\n }\n}\n",[],[141,254,422,511,561],"b9532106-5b64-11f1-a299-ee650bb23af1","b9532340-5b64-11f1-a299-ee650bb23af1",12,["D",1780062358922],"import { Scenario } from '../../../types.ts';\nimport { metadataScenarios } from './discovery-metadata.ts';\nimport { AuthBasicCIMDScenario } from './basic-cimd.ts';\nimport {\n Auth20250326OAuthMetadataBackcompatScenario,\n Auth20250326OEndpointFallbackScenario\n} from './march-spec-backcompat.ts';\nimport {\n ScopeFromWwwAuthenticateScenario,\n ScopeFromScopesSupportedScenario,\n ScopeOmittedWhenUndefinedScenario,\n ScopeStepUpAuthScenario,\n ScopeRetryLimitScenario\n} from './scope-handling.ts';\nimport {\n ClientSecretBasicAuthScenario,\n ClientSecretPostAuthScenario,\n PublicClientAuthScenario\n} from './token-endpoint-auth.ts';\nimport {\n ClientCredentialsJwtScenario,\n ClientCredentialsBasicScenario\n} from './client-credentials.ts';\nimport { ResourceMismatchScenario } from './resource-mismatch.ts';\nimport { PreRegistrationScenario } from './pre-registration.ts';\nimport { EnterpriseManagedAuthorizationScenario } from './enterprise-managed-authorization.ts';\nimport {\n OfflineAccessScopeScenario,\n OfflineAccessNotSupportedScenario\n} from './offline-access.ts';\nimport { AuthorizationServerMigrationScenario } from './authorization-server-migration.ts';\nimport {\n IssParameterSupportedScenario,\n IssParameterNotAdvertisedScenario,\n IssParameterSupportedMissingScenario,\n IssParameterWrongIssuerScenario,\n IssParameterUnexpectedScenario,\n IssParameterNormalizedVariantScenario,\n MetadataIssuerMismatchScenario\n} from './issuer-parameter.ts';\n\n// Auth scenarios (required for tier 1)\nexport const authScenariosList: Scenario[] = [\n ...metadataScenarios,\n new AuthBasicCIMDScenario(),\n new ScopeFromWwwAuthenticateScenario(),\n new ScopeFromScopesSupportedScenario(),\n new ScopeOmittedWhenUndefinedScenario(),\n new ScopeStepUpAuthScenario(),\n new ScopeRetryLimitScenario(),\n new ClientSecretBasicAuthScenario(),\n new ClientSecretPostAuthScenario(),\n new PublicClientAuthScenario(),\n new PreRegistrationScenario()\n];\n\n// Back-compat scenarios (optional - backward compatibility with older spec versions)\nexport const backcompatScenariosList: Scenario[] = [\n new Auth20250326OAuthMetadataBackcompatScenario(),\n new Auth20250326OEndpointFallbackScenario()\n];\n\n// Extension scenarios (optional for tier 1 - protocol extensions)\nexport const extensionScenariosList: Scenario[] = [\n new ClientCredentialsJwtScenario(),\n new ClientCredentialsBasicScenario(),\n new EnterpriseManagedAuthorizationScenario()\n];\n\n// Draft scenarios (informational - not scored for tier assessment)\nexport const draftScenariosList: Scenario[] = [\n new ResourceMismatchScenario(),\n new OfflineAccessScopeScenario(),\n new OfflineAccessNotSupportedScenario(),\n new AuthorizationServerMigrationScenario(),\n new IssParameterSupportedScenario(),\n new IssParameterNotAdvertisedScenario(),\n new IssParameterSupportedMissingScenario(),\n new IssParameterWrongIssuerScenario(),\n new IssParameterUnexpectedScenario(),\n new IssParameterNormalizedVariantScenario(),\n new MetadataIssuerMismatchScenario()\n];\n",[],[141,254,422,511,256],"c05f1432-5b64-11f1-bce3-ee650bb23af1","enterprise-managed-authorization.ts","c05f1504-5b64-11f1-bce3-ee650bb23af1",41,["D",1780062370726],"import * as jose from 'npm:jose@^6.1.2';\nimport type { CryptoKey } from 'npm:jose@^6.1.2';\nimport express, { type Request, type Response } from 'npm:express@^5.1.0';\nimport type { Scenario, ConformanceCheck, ScenarioUrls } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport { SpecReferences } from './spec-references.ts';\n\nconst CONFORMANCE_TEST_CLIENT_ID = 'conformance-test-xaa-client';\nconst CONFORMANCE_TEST_CLIENT_SECRET = 'conformance-test-xaa-secret';\nconst IDP_CLIENT_ID = 'conformance-test-idp-client';\nconst DEMO_USER_ID = 'demo-user@example.com';\n\n/**\n * Generate an EC P-256 keypair for IDP ID token signing.\n */\nasync function generateIdpKeypair(): Promise<{\n publicKey: CryptoKey;\n privateKey: CryptoKey;\n}> {\n const { publicKey, privateKey } = await jose.generateKeyPair('ES256', {\n extractable: true\n });\n return { publicKey, privateKey };\n}\n\n/**\n * Create a signed ID token from the IDP\n */\nasync function createIdpIdToken(\n privateKey: CryptoKey,\n idpIssuer: string,\n audience: string,\n userId: string = DEMO_USER_ID\n): Promise {\n return await new jose.SignJWT({\n sub: userId,\n email: userId,\n aud: audience\n })\n .setProtectedHeader({ alg: 'ES256' })\n .setIssuer(idpIssuer)\n .setIssuedAt()\n .setExpirationTime('1h')\n .sign(privateKey);\n}\n\n/**\n * Scenario: Enterprise-Managed Authorization (SEP-990)\n *\n * Tests the complete SEP-990 flow: IDP ID token -> authorization grant -> access token\n * This scenario combines both RFC 8693 token exchange and RFC 7523 JWT bearer grant.\n */\nexport class EnterpriseManagedAuthorizationScenario implements Scenario {\n name = 'auth/enterprise-managed-authorization';\n readonly source = {\n extensionId: 'io.modelcontextprotocol/enterprise-managed-authorization'\n } as const;\n description =\n 'Tests complete SEP-990 flow: token exchange + JWT bearer grant (Enterprise-Managed Authorization)';\n\n private idpServer = new ServerLifecycle();\n private authServer = new ServerLifecycle();\n private mcpServer = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n private idpPublicKey?: CryptoKey;\n private idpPrivateKey?: CryptoKey;\n private grantKeypairs: Map = new Map();\n\n async start(): Promise {\n this.checks = [];\n\n // Generate IDP keypair\n const { publicKey, privateKey } = await generateIdpKeypair();\n this.idpPublicKey = publicKey;\n this.idpPrivateKey = privateKey;\n\n // Shared token verifier ensures MCP server only accepts tokens\n // actually issued by the auth server\n const tokenVerifier = new MockTokenVerifier(this.checks, []);\n\n // Start IDP server\n await this.startIdpServer();\n\n // Start auth server with JWT bearer grant support only\n // Token exchange is handled by IdP\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n grantTypesSupported: ['urn:ietf:params:oauth:grant-type:jwt-bearer'],\n tokenEndpointAuthMethodsSupported: ['client_secret_basic'],\n tokenVerifier,\n onTokenRequest: async ({\n grantType,\n body,\n timestamp,\n authBaseUrl,\n authorizationHeader\n }) => {\n // Auth server only handles JWT bearer grant (ID-JAG -> access token)\n if (grantType === 'urn:ietf:params:oauth:grant-type:jwt-bearer') {\n const mcpResourceUrl = `${this.mcpServer.getUrl()}/mcp`;\n return await this.handleJwtBearerGrant(\n body,\n timestamp,\n authBaseUrl,\n authorizationHeader,\n mcpResourceUrl\n );\n }\n\n return {\n error: 'unsupported_grant_type',\n errorDescription: `Auth server only supports jwt-bearer grant, got ${grantType}`\n };\n }\n });\n\n await this.authServer.start(authApp);\n\n // Start MCP server with shared token verifier\n const mcpApp = createServer(\n this.checks,\n this.mcpServer.getUrl,\n this.authServer.getUrl,\n { tokenVerifier }\n );\n\n await this.mcpServer.start(mcpApp);\n\n // Generate IDP ID token for client\n const idpIdToken = await createIdpIdToken(\n this.idpPrivateKey!,\n this.idpServer.getUrl(),\n IDP_CLIENT_ID\n );\n\n return {\n serverUrl: `${this.mcpServer.getUrl()}/mcp`,\n context: {\n client_id: CONFORMANCE_TEST_CLIENT_ID,\n client_secret: CONFORMANCE_TEST_CLIENT_SECRET,\n idp_client_id: IDP_CLIENT_ID,\n idp_id_token: idpIdToken,\n idp_issuer: this.idpServer.getUrl(),\n idp_token_endpoint: `${this.idpServer.getUrl()}/token`\n }\n };\n }\n\n private async startIdpServer(): Promise {\n const app = express();\n app.use(express.json());\n app.use(express.urlencoded({ extended: true }));\n\n // IDP metadata endpoint\n app.get(\n '/.well-known/openid-configuration',\n (req: Request, res: Response) => {\n res.json({\n issuer: this.idpServer.getUrl(),\n authorization_endpoint: `${this.idpServer.getUrl()}/authorize`,\n token_endpoint: `${this.idpServer.getUrl()}/token`,\n jwks_uri: `${this.idpServer.getUrl()}/.well-known/jwks.json`,\n grant_types_supported: [\n 'urn:ietf:params:oauth:grant-type:token-exchange'\n ]\n });\n }\n );\n\n // IDP token endpoint - handles token exchange (IDP ID token -> ID-JAG)\n app.post('/token', async (req: Request, res: Response) => {\n const timestamp = new Date().toISOString();\n const grantType = req.body.grant_type;\n const subjectToken = req.body.subject_token;\n const subjectTokenType = req.body.subject_token_type;\n const requestedTokenType = req.body.requested_token_type;\n const audience = req.body.audience;\n const resource = req.body.resource;\n\n // Only handle token exchange at IdP\n if (grantType !== 'urn:ietf:params:oauth:grant-type:token-exchange') {\n this.checks.push({\n id: 'complete-flow-token-exchange',\n name: 'CompleteFlowTokenExchange',\n description: `IdP expected token-exchange grant, got ${grantType}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_8693_TOKEN_EXCHANGE]\n });\n res.status(400).json({\n error: 'unsupported_grant_type',\n error_description: 'IdP only supports token-exchange'\n });\n return;\n }\n\n // Verify all required token exchange parameters per SEP-990\n const missingParams: string[] = [];\n if (!subjectToken) missingParams.push('subject_token');\n if (subjectTokenType !== 'urn:ietf:params:oauth:token-type:id_token') {\n missingParams.push(\n `subject_token_type (expected urn:ietf:params:oauth:token-type:id_token, got ${subjectTokenType || 'missing'})`\n );\n }\n if (requestedTokenType !== 'urn:ietf:params:oauth:token-type:id-jag') {\n missingParams.push(\n `requested_token_type (expected urn:ietf:params:oauth:token-type:id-jag, got ${requestedTokenType || 'missing'})`\n );\n }\n if (!audience) missingParams.push('audience');\n if (!resource) missingParams.push('resource');\n\n if (missingParams.length > 0) {\n this.checks.push({\n id: 'complete-flow-token-exchange',\n name: 'CompleteFlowTokenExchange',\n description: `Token exchange missing or invalid required parameters: ${missingParams.join(', ')}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [\n SpecReferences.RFC_8693_TOKEN_EXCHANGE,\n SpecReferences.SEP_990_ENTERPRISE_OAUTH\n ]\n });\n res.status(400).json({\n error: 'invalid_request',\n error_description: `Missing or invalid required parameters: ${missingParams.join(', ')}`\n });\n return;\n }\n\n try {\n // Verify the IDP ID token\n const { payload } = await jose.jwtVerify(\n subjectToken,\n this.idpPublicKey!,\n {\n audience: IDP_CLIENT_ID,\n issuer: this.idpServer.getUrl()\n }\n );\n\n this.checks.push({\n id: 'complete-flow-token-exchange',\n name: 'CompleteFlowTokenExchange',\n description:\n 'Successfully exchanged IDP ID token for ID-JAG at IdP with all required parameters',\n status: 'SUCCESS',\n timestamp,\n specReferences: [\n SpecReferences.RFC_8693_TOKEN_EXCHANGE,\n SpecReferences.SEP_990_ENTERPRISE_OAUTH\n ]\n });\n\n // Create ID-JAG (ID-bound JSON Assertion Grant)\n // Include resource and client_id claims per SEP-990\n const userId = payload.sub as string;\n const { publicKey, privateKey } = await jose.generateKeyPair('ES256');\n this.grantKeypairs.set(userId, publicKey);\n\n // The IdP uses CONFORMANCE_TEST_CLIENT_ID (the MCP Client's client_id\n // at the AS), not the IdP client_id from the request body.\n // Per Section 6.1: \"the IdP will need to be aware of the MCP Client's\n // client_id that it normally uses with the MCP Server.\"\n const idJag = await new jose.SignJWT({\n sub: userId,\n resource: resource,\n client_id: CONFORMANCE_TEST_CLIENT_ID\n })\n .setProtectedHeader({ alg: 'ES256', typ: 'oauth-id-jag+jwt' })\n .setIssuer(this.idpServer.getUrl())\n .setAudience(audience)\n .setIssuedAt()\n .setExpirationTime('5m')\n .setJti(crypto.randomUUID())\n .sign(privateKey);\n\n res.json({\n access_token: idJag,\n issued_token_type: 'urn:ietf:params:oauth:token-type:id-jag',\n token_type: 'N_A'\n });\n } catch (e) {\n const errorMessage = e instanceof Error ? e.message : String(e);\n this.checks.push({\n id: 'complete-flow-token-exchange',\n name: 'CompleteFlowTokenExchange',\n description: `Token exchange failed: ${errorMessage}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_8693_TOKEN_EXCHANGE]\n });\n res.status(400).json({\n error: 'invalid_grant',\n error_description: 'Invalid ID token'\n });\n }\n });\n\n await this.idpServer.start(app);\n }\n\n private async handleJwtBearerGrant(\n body: Record,\n timestamp: string,\n authBaseUrl: string,\n authorizationHeader?: string,\n mcpResourceUrl?: string\n ): Promise {\n // 1. Verify client authentication (client_secret_basic)\n if (!authorizationHeader || !authorizationHeader.startsWith('Basic ')) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description:\n 'Missing or invalid Authorization header for client_secret_basic authentication',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH],\n details: {\n expected: 'Authorization: Basic ',\n received: authorizationHeader || 'missing'\n }\n });\n return {\n error: 'invalid_client',\n errorDescription:\n 'Client authentication required (client_secret_basic)',\n statusCode: 401\n };\n }\n\n const base64Credentials = authorizationHeader.slice('Basic '.length);\n const decoded = Buffer.from(base64Credentials, 'base64').toString('utf-8');\n const separatorIndex = decoded.indexOf(':');\n if (separatorIndex === -1) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: 'Malformed Basic auth header (no colon separator)',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH]\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Malformed Basic auth',\n statusCode: 401\n };\n }\n\n const authClientId = decodeURIComponent(decoded.slice(0, separatorIndex));\n const authClientSecret = decodeURIComponent(\n decoded.slice(separatorIndex + 1)\n );\n\n if (\n authClientId !== CONFORMANCE_TEST_CLIENT_ID ||\n authClientSecret !== CONFORMANCE_TEST_CLIENT_SECRET\n ) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: `Client authentication failed: invalid credentials (client_id: ${authClientId})`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH]\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Invalid client credentials',\n statusCode: 401\n };\n }\n\n // 2. Verify assertion is present\n const assertion = body.assertion;\n if (!assertion) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: 'Missing assertion in JWT bearer grant',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_7523_JWT_BEARER]\n });\n return {\n error: 'invalid_request',\n errorDescription: 'Missing assertion'\n };\n }\n\n try {\n // 3. Verify the ID-JAG header has the correct typ\n const header = jose.decodeProtectedHeader(assertion);\n if (header.typ !== 'oauth-id-jag+jwt') {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: `ID-JAG has wrong typ header: expected oauth-id-jag+jwt, got ${header.typ}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH]\n });\n return {\n error: 'invalid_grant',\n errorDescription: 'Invalid ID-JAG typ header'\n };\n }\n\n // 4. Decode and verify the ID-JAG\n const decoded = jose.decodeJwt(assertion);\n const userId = decoded.sub as string;\n const publicKey = this.grantKeypairs.get(userId);\n\n if (!publicKey) {\n throw new Error('Unknown authorization grant');\n }\n\n // Verify signature and audience\n const withoutSlash = authBaseUrl.replace(/\\/+$/, '');\n const withSlash = `${withoutSlash}/`;\n\n await jose.jwtVerify(assertion, publicKey, {\n audience: [withoutSlash, withSlash],\n clockTolerance: 30\n });\n\n // 5. Verify client_id in ID-JAG matches the authenticating client (Section 5.1)\n const jagClientId = decoded.client_id as string | undefined;\n if (jagClientId !== authClientId) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: `ID-JAG client_id (${jagClientId}) does not match authenticating client (${authClientId})`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH],\n details: {\n jagClientId,\n authClientId\n }\n });\n return {\n error: 'invalid_grant',\n errorDescription:\n 'ID-JAG client_id does not match authenticating client'\n };\n }\n\n // 6. Verify resource claim in ID-JAG matches the MCP server resource\n const jagResource = decoded.resource as string | undefined;\n if (mcpResourceUrl && jagResource !== mcpResourceUrl) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: `ID-JAG resource (${jagResource}) does not match MCP server resource (${mcpResourceUrl})`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_990_ENTERPRISE_OAUTH],\n details: {\n jagResource,\n expectedResource: mcpResourceUrl\n }\n });\n return {\n error: 'invalid_grant',\n errorDescription: 'ID-JAG resource does not match MCP server resource'\n };\n }\n\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description:\n 'Successfully verified client auth, ID-JAG claims, and exchanged for access token',\n status: 'SUCCESS',\n timestamp,\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_990_ENTERPRISE_OAUTH\n ]\n });\n\n const scopes = body.scope ? body.scope.split(' ') : [];\n return {\n token: `test-token-${Date.now()}`,\n scopes\n };\n } catch (e) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: `JWT bearer grant failed: ${e}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_7523_JWT_BEARER]\n });\n return {\n error: 'invalid_grant',\n errorDescription: 'Invalid authorization grant'\n };\n }\n }\n\n async stop() {\n await this.idpServer.stop();\n await this.authServer.stop();\n await this.mcpServer.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n const hasTokenExchangeCheck = this.checks.some(\n (c) => c.id === 'complete-flow-token-exchange'\n );\n const hasJwtBearerCheck = this.checks.some(\n (c) => c.id === 'complete-flow-jwt-bearer'\n );\n\n if (!hasTokenExchangeCheck) {\n this.checks.push({\n id: 'complete-flow-token-exchange',\n name: 'CompleteFlowTokenExchange',\n description: 'Client did not perform token exchange',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_8693_TOKEN_EXCHANGE,\n SpecReferences.SEP_990_ENTERPRISE_OAUTH\n ]\n });\n }\n\n if (!hasJwtBearerCheck) {\n this.checks.push({\n id: 'complete-flow-jwt-bearer',\n name: 'CompleteFlowJwtBearer',\n description: 'Client did not perform JWT bearer grant exchange',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_7523_JWT_BEARER,\n SpecReferences.SEP_990_ENTERPRISE_OAUTH\n ]\n });\n }\n\n return this.checks;\n }\n}\n",[],[141,254,422,511,576],"fa4d201e-5f4a-11f1-84e9-1607ee4eb77e","discovery-metadata.ts","b921845c-5b64-11f1-a593-ee650bb23af1",89,["D",1780491105663],"/**\n * OAuth Metadata Discovery Scenarios\n *\n * These scenarios test different combinations of PRM and OAuth metadata locations.\n * The configurations are defined in SCENARIO_CONFIGS below and scenarios are\n * generated from them.\n */\n\nimport {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n ConformanceCheck\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { SpecReferences } from './spec-references.ts';\nimport { Request, Response } from 'npm:express@^5.1.0';\n\n/**\n * Configuration for a metadata discovery scenario.\n */\ninterface MetadataScenarioConfig {\n name: string;\n prmLocation: string;\n inWwwAuth: boolean;\n oauthMetadataLocation: string;\n /** Route prefix for the auth server (e.g., '/tenant1') */\n authRoutePrefix?: string;\n /** If true, add a trap for root PRM requests */\n trapRootPrm?: boolean;\n}\n\n/**\n * Scenario configurations table:\n *\n * | Scenario | PRM Location | In WWW-Auth | OAuth Metadata Location |\n * |------------------|-------------------------------------------|-------------|------------------------------------------------|\n * | metadata-default | /.well-known/oauth-protected-resource/mcp | Yes | /.well-known/oauth-authorization-server |\n * | metadata-var1 | /.well-known/oauth-protected-resource/mcp | No | /.well-known/openid-configuration |\n * | metadata-var2 | /.well-known/oauth-protected-resource | No | /.well-known/oauth-authorization-server/tenant1|\n * | metadata-var3 | /custom/metadata/location.json | Yes | /tenant1/.well-known/openid-configuration |\n */\nconst SCENARIO_CONFIGS: MetadataScenarioConfig[] = [\n {\n name: 'metadata-default',\n prmLocation: '/.well-known/oauth-protected-resource/mcp',\n inWwwAuth: true,\n oauthMetadataLocation: '/.well-known/oauth-authorization-server',\n trapRootPrm: true\n },\n {\n name: 'metadata-var1',\n prmLocation: '/.well-known/oauth-protected-resource/mcp',\n inWwwAuth: false,\n oauthMetadataLocation: '/.well-known/openid-configuration'\n },\n {\n name: 'metadata-var2',\n prmLocation: '/.well-known/oauth-protected-resource',\n inWwwAuth: false,\n oauthMetadataLocation: '/.well-known/oauth-authorization-server/tenant1',\n authRoutePrefix: '/tenant1'\n },\n {\n name: 'metadata-var3',\n prmLocation: '/custom/metadata/location.json',\n inWwwAuth: true,\n oauthMetadataLocation: '/tenant1/.well-known/openid-configuration',\n authRoutePrefix: '/tenant1'\n }\n];\n\n/**\n * Base for the table-driven discovery scenarios. Each subclass binds a row\n * of SCENARIO_CONFIGS; we use real classes (not factory-returned literals)\n * so the hosted runner can do `new Ctor()` for a fresh instance per run.\n */\nabstract class MetadataDiscoveryScenario extends AuthHandlerScenario {\n protected abstract readonly config: MetadataScenarioConfig;\n readonly source = { introducedIn: '2025-11-25' } as const;\n private checks: ConformanceCheck[] = [];\n\n get name() {\n return `auth/${this.config.name}`;\n }\n get description() {\n return `Tests Basic OAuth metadata discovery flow.\n\n**PRM:** ${this.config.prmLocation}${this.config.inWwwAuth ? '' : ' (not in WWW-Authenticate)'}\n**OAuth metadata:** ${this.config.oauthMetadataLocation}\n`;\n }\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const config = this.config;\n const routePrefix = config.authRoutePrefix || '';\n const isOpenIdConfiguration = config.oauthMetadataLocation.includes(\n 'openid-configuration'\n );\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const authApp = createAuthServer(this.checks, getAsUrl, {\n metadataPath: config.oauthMetadataLocation,\n isOpenIdConfiguration,\n ...(routePrefix && { routePrefix })\n });\n\n // If path-based OAuth metadata, trap root requests\n if (routePrefix) {\n authApp.get('/.well-known/oauth-authorization-server', (req, res) => {\n this.checks.push({\n id: 'authorization-server-metadata-wrong-path',\n name: 'AuthorizationServerMetadataWrongPath',\n description:\n 'Client requested authorization server at the root path when the AS URL has a path-based location',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_AUTH_SERVER_METADATA_REQUEST,\n SpecReferences.MCP_AUTH_DISCOVERY\n ],\n details: {\n url: req.url\n }\n });\n res.status(404).send('Not Found');\n });\n }\n\n const getAuthServerUrl = routePrefix\n ? () => `${getAsUrl()}${routePrefix}`\n : getAsUrl;\n\n const rsApp = createServer(\n this.checks,\n ctx.getRsBaseUrl,\n getAuthServerUrl,\n {\n prmPath: config.prmLocation,\n includePrmInWwwAuth: config.inWwwAuth\n }\n );\n\n // Add trap for root PRM requests if configured\n if (config.trapRootPrm) {\n rsApp.get(\n '/.well-known/oauth-protected-resource',\n (req: Request, res: Response) => {\n this.checks.push({\n id: 'prm-priority-order',\n name: 'PRM Priority Order',\n description:\n 'Client requested PRM metadata at root location on a server with path-based PRM',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_PRM_DISCOVERY,\n SpecReferences.MCP_PRM_DISCOVERY\n ],\n details: {\n url: req.url,\n path: req.path\n }\n });\n\n res.status(404).json({\n error: 'not_found',\n error_description: 'PRM metadata not available at root location'\n });\n }\n );\n }\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n rawChecks(): ConformanceCheck[] {\n return this.checks;\n }\n\n getChecks(): ConformanceCheck[] {\n const isPathBasedPrm =\n this.config.prmLocation === '/.well-known/oauth-protected-resource/mcp';\n const expectedSlugs = [\n ...(isPathBasedPrm ? ['prm-pathbased-requested'] : []),\n 'authorization-server-metadata',\n 'client-registration',\n 'authorization-request',\n 'token-request'\n ];\n\n for (const slug of expectedSlugs) {\n if (!this.checks.find((c) => c.id === slug)) {\n this.checks.push({\n id: slug,\n name: `Expected Check Missing: ${slug}`,\n description: `Expected Check Missing: ${slug}`,\n status: 'FAILURE',\n timestamp: new Date().toISOString()\n });\n }\n }\n\n return this.checks;\n }\n}\n\nexport class AuthMetadataDefaultScenario extends MetadataDiscoveryScenario {\n protected readonly config = SCENARIO_CONFIGS[0];\n}\nexport class AuthMetadataVar1Scenario extends MetadataDiscoveryScenario {\n protected readonly config = SCENARIO_CONFIGS[1];\n}\nexport class AuthMetadataVar2Scenario extends MetadataDiscoveryScenario {\n protected readonly config = SCENARIO_CONFIGS[2];\n}\nexport class AuthMetadataVar3Scenario extends MetadataDiscoveryScenario {\n protected readonly config = SCENARIO_CONFIGS[3];\n}\n\n// Export all scenarios as an array for convenience\nexport const metadataScenarios = [\n new AuthMetadataDefaultScenario(),\n new AuthMetadataVar1Scenario(),\n new AuthMetadataVar2Scenario(),\n new AuthMetadataVar3Scenario()\n];\n\n// Export function to list metadata scenario names (for suite support)\nexport function listMetadataScenarios(): string[] {\n return metadataScenarios.map((s) => s.name);\n}\n",[],[141,254,422,511,584],"c120111e-5b64-11f1-ad2f-ee650bb23af1","client-credentials.ts","c12011fa-5b64-11f1-ad2f-ee650bb23af1",44,["D",1780062371988],"import * as jose from 'npm:jose@^6.1.2';\nimport type { CryptoKey } from 'npm:jose@^6.1.2';\nimport type { Scenario, ConformanceCheck, ScenarioUrls } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport { SpecReferences } from './spec-references.ts';\n\nconst CONFORMANCE_TEST_CLIENT_ID = 'conformance-test-client';\nconst CONFORMANCE_TEST_CLIENT_SECRET = 'conformance-test-secret';\n\n/**\n * Generate an EC P-256 keypair for JWT signing.\n * Returns both public key (for server verification) and private key PEM (for client signing).\n */\nasync function generateTestKeypair(): Promise<{\n publicKey: CryptoKey;\n privateKeyPem: string;\n}> {\n const { publicKey, privateKey } = await jose.generateKeyPair('ES256', {\n extractable: true\n });\n const privateKeyPem = await jose.exportPKCS8(privateKey);\n return { publicKey, privateKeyPem };\n}\n\n/**\n * Scenario: Client Credentials with JWT Authentication (SEP-1046)\n *\n * Tests OAuth client_credentials flow with private_key_jwt authentication.\n * Client authenticates using a JWT assertion signed with a dynamically generated keypair.\n */\nexport class ClientCredentialsJwtScenario implements Scenario {\n name = 'auth/client-credentials-jwt';\n readonly source = {\n extensionId: 'io.modelcontextprotocol/oauth-client-credentials'\n } as const;\n description =\n 'Tests OAuth client_credentials flow with private_key_jwt authentication (SEP-1046)';\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(): Promise {\n this.checks = [];\n\n // Generate a fresh keypair for this test run\n const { publicKey, privateKeyPem } = await generateTestKeypair();\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n grantTypesSupported: ['client_credentials'],\n tokenEndpointAuthMethodsSupported: ['private_key_jwt'],\n tokenEndpointAuthSigningAlgValuesSupported: ['ES256'],\n onTokenRequest: async ({ grantType, body, timestamp, authBaseUrl }) => {\n if (grantType !== 'client_credentials') {\n this.checks.push({\n id: 'client-credentials-grant-type',\n name: 'ClientCredentialsGrantType',\n description: `Expected grant_type=client_credentials, got ${grantType}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS\n ]\n });\n return {\n error: 'unsupported_grant_type',\n errorDescription: 'Only client_credentials grant is supported'\n };\n }\n\n const clientAssertion = body.client_assertion;\n const clientAssertionType = body.client_assertion_type;\n\n // Verify assertion type\n if (\n clientAssertionType !==\n 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'\n ) {\n this.checks.push({\n id: 'client-credentials-assertion-type',\n name: 'ClientCredentialsAssertionType',\n description: `Invalid client_assertion_type: ${clientAssertionType}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_JWT_CLIENT_AUTH]\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Invalid client_assertion_type',\n statusCode: 401\n };\n }\n\n // Verify JWT signature and claims using the generated public key\n try {\n // Per RFC 7523bis, audience MUST be the issuer identifier.\n // Per RFC 3986, URLs with and without trailing slash are equivalent,\n // so we accept both forms for interoperability (e.g. Pydantic normalizes\n // URLs by adding trailing slashes).\n // Strip any trailing slashes first, then accept both the bare form\n // and the form with exactly one trailing slash.\n const withoutSlash = authBaseUrl.replace(/\\/+$/, '');\n const withSlash = `${withoutSlash}/`;\n const { payload } = await jose.jwtVerify(clientAssertion, publicKey, {\n audience: [withoutSlash, withSlash],\n clockTolerance: 30\n });\n\n // Verify iss claim matches expected client_id\n if (payload.iss !== CONFORMANCE_TEST_CLIENT_ID) {\n this.checks.push({\n id: 'client-credentials-jwt-iss',\n name: 'ClientCredentialsJwtIss',\n description: `JWT iss claim '${payload.iss}' does not match expected client_id '${CONFORMANCE_TEST_CLIENT_ID}'`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_JWT_CLIENT_AUTH],\n details: {\n expected: CONFORMANCE_TEST_CLIENT_ID,\n actual: payload.iss\n }\n });\n return {\n error: 'invalid_client',\n errorDescription:\n 'JWT iss claim does not match expected client_id',\n statusCode: 401\n };\n }\n\n // Verify sub claim matches expected client_id\n if (payload.sub !== CONFORMANCE_TEST_CLIENT_ID) {\n this.checks.push({\n id: 'client-credentials-jwt-sub',\n name: 'ClientCredentialsJwtSub',\n description: `JWT sub claim '${payload.sub}' does not match expected client_id '${CONFORMANCE_TEST_CLIENT_ID}'`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_JWT_CLIENT_AUTH],\n details: {\n expected: CONFORMANCE_TEST_CLIENT_ID,\n actual: payload.sub\n }\n });\n return {\n error: 'invalid_client',\n errorDescription:\n 'JWT sub claim does not match expected client_id',\n statusCode: 401\n };\n }\n\n // Success!\n this.checks.push({\n id: 'client-credentials-jwt-verified',\n name: 'ClientCredentialsJwtVerified',\n description:\n 'Client successfully authenticated with signed JWT assertion',\n status: 'SUCCESS',\n timestamp,\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS,\n SpecReferences.RFC_JWT_CLIENT_AUTH\n ],\n details: {\n iss: payload.iss,\n sub: payload.sub,\n aud: payload.aud\n }\n });\n\n const scopes = body.scope ? body.scope.split(' ') : [];\n return {\n token: `cc-token-${Date.now()}`,\n scopes\n };\n } catch (e) {\n const errorMessage = e instanceof Error ? e.message : String(e);\n this.checks.push({\n id: 'client-credentials-jwt-verified',\n name: 'ClientCredentialsJwtVerified',\n description: `JWT verification failed: ${errorMessage}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.RFC_JWT_CLIENT_AUTH],\n details: { error: errorMessage }\n });\n return {\n error: 'invalid_client',\n errorDescription: `JWT verification failed: ${errorMessage}`,\n statusCode: 401\n };\n }\n }\n });\n\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl\n );\n\n await this.server.start(app);\n\n return {\n serverUrl: `${this.server.getUrl()}/mcp`,\n context: {\n client_id: CONFORMANCE_TEST_CLIENT_ID,\n private_key_pem: privateKeyPem,\n signing_algorithm: 'ES256'\n }\n };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n // Ensure we have the JWT verification check\n const hasJwtCheck = this.checks.some(\n (c) => c.id === 'client-credentials-jwt-verified'\n );\n if (!hasJwtCheck) {\n this.checks.push({\n id: 'client-credentials-jwt-verified',\n name: 'ClientCredentialsJwtVerified',\n description: 'Client did not make a client_credentials token request',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS\n ]\n });\n }\n\n return this.checks;\n }\n}\n\n/**\n * Scenario: Client Credentials with client_secret_basic Authentication\n *\n * Tests OAuth client_credentials flow with HTTP Basic authentication.\n */\nexport class ClientCredentialsBasicScenario implements Scenario {\n name = 'auth/client-credentials-basic';\n readonly source = {\n extensionId: 'io.modelcontextprotocol/oauth-client-credentials'\n } as const;\n description =\n 'Tests OAuth client_credentials flow with client_secret_basic authentication';\n\n private authServer = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(): Promise {\n this.checks = [];\n\n const authApp = createAuthServer(this.checks, this.authServer.getUrl, {\n grantTypesSupported: ['client_credentials'],\n tokenEndpointAuthMethodsSupported: ['client_secret_basic'],\n onTokenRequest: async ({\n grantType,\n body,\n timestamp,\n authorizationHeader\n }) => {\n if (grantType !== 'client_credentials') {\n this.checks.push({\n id: 'client-credentials-grant-type',\n name: 'ClientCredentialsGrantType',\n description: `Expected grant_type=client_credentials, got ${grantType}`,\n status: 'FAILURE',\n timestamp,\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS\n ]\n });\n return {\n error: 'unsupported_grant_type',\n errorDescription: 'Only client_credentials grant is supported'\n };\n }\n\n // Verify Basic auth header\n const authHeader = authorizationHeader;\n if (!authHeader || !authHeader.startsWith('Basic ')) {\n this.checks.push({\n id: 'client-credentials-basic-auth',\n name: 'ClientCredentialsBasicAuth',\n description:\n 'Missing or invalid Authorization header for Basic auth',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_1046_CLIENT_CREDENTIALS]\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Missing or invalid Authorization header',\n statusCode: 401\n };\n }\n\n const base64Credentials = authHeader.slice(6);\n const credentials = Buffer.from(base64Credentials, 'base64').toString(\n 'utf-8'\n );\n const [clientId, clientSecret] = credentials.split(':');\n\n if (\n clientId !== CONFORMANCE_TEST_CLIENT_ID ||\n clientSecret !== CONFORMANCE_TEST_CLIENT_SECRET\n ) {\n this.checks.push({\n id: 'client-credentials-basic-auth',\n name: 'ClientCredentialsBasicAuth',\n description: 'Invalid client credentials',\n status: 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.SEP_1046_CLIENT_CREDENTIALS],\n details: { clientId }\n });\n return {\n error: 'invalid_client',\n errorDescription: 'Invalid client credentials',\n statusCode: 401\n };\n }\n\n // Success!\n this.checks.push({\n id: 'client-credentials-basic-auth',\n name: 'ClientCredentialsBasicAuth',\n description:\n 'Client successfully authenticated with client_secret_basic',\n status: 'SUCCESS',\n timestamp,\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS\n ],\n details: { clientId }\n });\n\n const scopes = body.scope ? body.scope.split(' ') : [];\n return {\n token: `cc-token-${Date.now()}`,\n scopes\n };\n }\n });\n\n await this.authServer.start(authApp);\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n this.authServer.getUrl\n );\n\n await this.server.start(app);\n\n return {\n serverUrl: `${this.server.getUrl()}/mcp`,\n context: {\n client_id: CONFORMANCE_TEST_CLIENT_ID,\n client_secret: CONFORMANCE_TEST_CLIENT_SECRET\n }\n };\n }\n\n async stop() {\n await this.authServer.stop();\n await this.server.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n // Ensure we have the basic auth check\n const hasBasicAuthCheck = this.checks.some(\n (c) => c.id === 'client-credentials-basic-auth'\n );\n if (!hasBasicAuthCheck) {\n this.checks.push({\n id: 'client-credentials-basic-auth',\n name: 'ClientCredentialsBasicAuth',\n description: 'Client did not make a client_credentials token request',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.OAUTH_2_1_CLIENT_CREDENTIALS,\n SpecReferences.SEP_1046_CLIENT_CREDENTIALS\n ]\n });\n }\n\n return this.checks;\n }\n}\n",[],[141,254,422,511,592],"ffd1c242-5f4a-11f1-89cc-1607ee4eb77e","basic-cimd.ts","c20fe87e-5b64-11f1-9f3f-ee650bb23af1",98,["D",1780491114907],"import {\n AuthHandlerScenario,\n AuthHandlerContext,\n AuthHandlers,\n ConformanceCheck\n} from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { SpecReferences } from './spec-references.ts';\n\n/**\n * Fixed client metadata URL that clients should use for CIMD tests.\n * This URL doesn't need to resolve - the server will accept it as-is\n * and use hardcoded metadata.\n */\nexport const CIMD_CLIENT_METADATA_URL =\n 'https://conformance-test.local/client-metadata.json';\n\n/**\n * Scenario: Client ID Metadata Documents (SEP-991/URL-based client IDs)\n *\n * Tests that when a server advertises client_id_metadata_document_supported=true,\n * clients SHOULD use a URL as their client_id instead of using dynamic client\n * registration.\n */\nexport class AuthBasicCIMDScenario extends AuthHandlerScenario {\n name = 'auth/basic-cimd';\n readonly source = { introducedIn: '2025-11-25' } as const;\n description =\n 'Tests OAuth flow with Client ID Metadata Documents (SEP-991/URL-based client IDs). Server advertises client_id_metadata_document_supported=true and client should use URL as client_id instead of DCR.';\n private checks: ConformanceCheck[] = [];\n\n authHandlers(ctx: AuthHandlerContext): AuthHandlers {\n this.checks = [];\n const getAsUrl = () => ctx.getAuxBaseUrl('as');\n\n const authApp = createAuthServer(this.checks, getAsUrl, {\n clientIdMetadataDocumentSupported: true,\n onAuthorizationRequest: (data) => {\n // Check if client used URL-based client ID\n const usedUrlClientId = data.clientId === CIMD_CLIENT_METADATA_URL;\n this.checks.push({\n id: 'cimd-client-id-used',\n name: 'Client ID Metadata Document Usage',\n description: usedUrlClientId\n ? 'Client correctly used URL-based client ID when server supports client_id_metadata_document_supported'\n : 'Client SHOULD use URL-based client ID when server advertises client_id_metadata_document_supported=true',\n status: usedUrlClientId ? 'SUCCESS' : 'WARNING',\n timestamp: data.timestamp,\n specReferences: [\n SpecReferences.MCP_CLIENT_ID_METADATA_DOCUMENTS,\n SpecReferences.IETF_CIMD\n ],\n details: {\n expectedClientId: CIMD_CLIENT_METADATA_URL,\n actualClientId: data.clientId || 'none'\n }\n });\n }\n });\n\n const rsApp = createServer(this.checks, ctx.getRsBaseUrl, getAsUrl);\n\n return { rs: rsApp, aux: { as: authApp } };\n }\n\n getChecks(): ConformanceCheck[] {\n // Ensure we have the CIMD check - if not, the client didn't make an auth request\n const hasCimdCheck = this.checks.some(\n (c) => c.id === 'cimd-client-id-used'\n );\n if (!hasCimdCheck) {\n this.checks.push({\n id: 'cimd-client-id-used',\n name: 'Client ID Metadata Document Usage',\n description:\n 'Client did not make an authorization request to test CIMD support',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.MCP_CLIENT_ID_METADATA_DOCUMENTS,\n SpecReferences.IETF_CIMD\n ]\n });\n }\n\n return this.checks;\n }\n}\n",[],[141,254,422,511,600],"bfed2f84-5b64-11f1-b83c-ee650bb23af1","authorization-server-migration.ts","bfed3056-5b64-11f1-b83c-ee650bb23af1",39,["D",1780062369992],"/**\n * SEP-2352 — Authorization-server binding and migration.\n *\n * The MCP server's PRM initially lists AS₁. The client registers, authorizes,\n * and calls tools/list. The harness then invalidates the token and flips PRM\n * to AS₂. On the next 401 the client re-discovers PRM, sees a new issuer, and\n * MUST re-register with AS₂ rather than reuse AS₁'s client credentials.\n */\nimport type { Request, Response, NextFunction } from 'npm:express@^5.1.0';\nimport type { Scenario, ConformanceCheck } from '../../../types.ts';\nimport { ScenarioUrls, DRAFT_PROTOCOL_VERSION } from '../../../types.ts';\nimport { createAuthServer } from './helpers/createAuthServer.ts';\nimport { createServer } from './helpers/createServer.ts';\nimport { ServerLifecycle } from './helpers/serverLifecycle.ts';\nimport { MockTokenVerifier } from './helpers/mockTokenVerifier.ts';\nimport { SpecReferences } from './spec-references.ts';\n\nexport class AuthorizationServerMigrationScenario implements Scenario {\n name = 'auth/authorization-server-migration';\n readonly source = { introducedIn: DRAFT_PROTOCOL_VERSION } as const;\n description =\n 'Tests that a client, when the PRM authorization_servers changes to a new issuer, re-registers with the new authorization server and does not reuse credentials from the previous one (SEP-2352).';\n private as1 = new ServerLifecycle();\n private as2 = new ServerLifecycle();\n private server = new ServerLifecycle();\n private checks: ConformanceCheck[] = [];\n\n async start(): Promise {\n this.checks = [];\n const tokenVerifier = new MockTokenVerifier(this.checks, ['mcp:basic']);\n\n /** AS₁ issues a recognizable client_id so AS₂ can detect cross-AS reuse. */\n const AS1_CLIENT_ID = 'as1-client-id-LEAKED-IF-SEEN-AT-AS2';\n let as2SawRegister = false;\n let as2SawAs1ClientId = false;\n let as2SawAs1ClientIdAtToken = false;\n\n // ── AS₁ ────────────────────────────────────────────────────────────────\n const as1App = createAuthServer(this.checks, this.as1.getUrl, {\n tokenVerifier,\n onRegistrationRequest: () => ({\n clientId: AS1_CLIENT_ID,\n clientSecret: 'as1-client-secret'\n })\n });\n await this.as1.start(as1App);\n\n // ── AS₂ ────────────────────────────────────────────────────────────────\n const as2App = createAuthServer(this.checks, this.as2.getUrl, {\n tokenVerifier,\n onRegistrationRequest: () => {\n as2SawRegister = true;\n return { clientId: 'as2-client-id', clientSecret: 'as2-client-secret' };\n },\n onAuthorizationRequest: (data) => {\n if (data.clientId === AS1_CLIENT_ID) as2SawAs1ClientId = true;\n },\n onTokenRequest: (data) => {\n const cid =\n data.body.client_id ??\n this.basicAuthClientId(data.authorizationHeader);\n if (cid === AS1_CLIENT_ID) as2SawAs1ClientIdAtToken = true;\n const scopes = data.scope ? data.scope.split(' ') : ['mcp:basic'];\n const token = `test-token-as2-${Date.now()}`;\n tokenVerifier.registerToken(token, scopes);\n return { token, scopes };\n }\n });\n await this.as2.start(as2App);\n\n // ── MCP server with mutable PRM authorization_servers ──────────────────\n let migrated = false;\n const currentAuthServerUrl = () =>\n migrated ? this.as2.getUrl() : this.as1.getUrl();\n\n const resourceMetadataUrl = () =>\n `${this.server.getUrl()}/.well-known/oauth-protected-resource/mcp`;\n\n const middleware = async (\n req: Request,\n res: Response,\n next: NextFunction\n ) => {\n let body = req.body;\n if (typeof body === 'string') body = JSON.parse(body);\n const method = body?.method;\n // initialize / notifications never require auth\n if (method === 'initialize' || method?.startsWith('notifications/'))\n return next();\n\n const auth = req.headers.authorization;\n if (!auth || !auth.startsWith('Bearer ')) {\n return res\n .status(401)\n .set(\n 'WWW-Authenticate',\n `Bearer scope=\"mcp:basic\", resource_metadata=\"${resourceMetadataUrl()}\"`\n )\n .json({ error: 'invalid_token' });\n }\n const token = auth.substring('Bearer '.length);\n const info = await tokenVerifier.verifyAccessToken(token);\n\n // Phase 1: accept any verified token, then flip PRM to AS₂ for the next\n // call. Phase 2: reject the (now-stale) AS₁ token so the client\n // re-discovers PRM and sees AS₂.\n if (!migrated) {\n migrated = true;\n return next();\n }\n // After migration, only AS₂ tokens are valid.\n if (!info.token.startsWith('test-token-as2-')) {\n return res\n .status(401)\n .set(\n 'WWW-Authenticate',\n `Bearer scope=\"mcp:basic\", resource_metadata=\"${resourceMetadataUrl()}\"`\n )\n .json({\n error: 'invalid_token',\n error_description: 'authorization server has changed'\n });\n }\n return next();\n };\n\n const app = createServer(\n this.checks,\n this.server.getUrl,\n currentAuthServerUrl,\n {\n prmPath: '/.well-known/oauth-protected-resource/mcp',\n requiredScopes: ['mcp:basic'],\n includeScopeInWwwAuth: true,\n authMiddleware: middleware,\n tokenVerifier\n }\n );\n await this.server.start(app);\n\n // Record evaluation closures so getChecks can see them after stop().\n this._evaluate = () => {\n const ts = new Date().toISOString();\n const reusedAtAS2 = as2SawAs1ClientId || as2SawAs1ClientIdAtToken;\n this.checks.push({\n id: 'sep-2352-reregister-on-as-change',\n name: 'Client re-registers with the new authorization server',\n description: as2SawRegister\n ? 'Client performed Dynamic Client Registration with the new authorization server after PRM authorization_servers changed'\n : 'Client MUST re-register with the new authorization server when PRM authorization_servers changes (SEP-2352); no registration request was observed at the new AS',\n status: as2SawRegister ? 'SUCCESS' : 'FAILURE',\n timestamp: ts,\n specReferences: [SpecReferences.MCP_DCR]\n });\n this.checks.push({\n id: 'sep-2352-no-reuse-on-as-change',\n name: 'Client does not reuse the previous AS client credentials',\n description: reusedAtAS2\n ? 'Client MUST NOT reuse client credentials from a different authorization server (SEP-2352); the previous AS client_id was observed at the new AS'\n : 'Client did not present the previous AS client_id at the new authorization server',\n status: reusedAtAS2 ? 'FAILURE' : 'SUCCESS',\n timestamp: ts,\n specReferences: [SpecReferences.MCP_DCR],\n details: {\n previousClientId: AS1_CLIENT_ID,\n seenAtAuthorize: as2SawAs1ClientId,\n seenAtToken: as2SawAs1ClientIdAtToken\n }\n });\n // The \"no cross-AS credential reuse\" general MUST NOT is the same wire\n // observation as no-reuse-on-as-change in this scenario; emit it as a\n // distinct id so the yaml traceability is 1:1.\n this.checks.push({\n id: 'sep-2352-no-cross-as-credential-reuse',\n name: 'Client does not assume credentials are portable across authorization servers',\n description: reusedAtAS2\n ? 'Client MUST NOT assume that credentials valid for one authorization server will be accepted by another (SEP-2352)'\n : 'Client treated credentials as bound to the issuing authorization server',\n status: reusedAtAS2 ? 'FAILURE' : 'SUCCESS',\n timestamp: ts,\n specReferences: [SpecReferences.MCP_DCR]\n });\n };\n\n return { serverUrl: `${this.server.getUrl()}/mcp` };\n }\n\n private _evaluate: () => void = () => {};\n\n private basicAuthClientId(h?: string): string | undefined {\n if (!h?.startsWith('Basic ')) return undefined;\n try {\n const [id] = Buffer.from(h.slice(6), 'base64')\n .toString('utf8')\n .split(':');\n return id;\n } catch {\n return undefined;\n }\n }\n\n async stop() {\n await this.server.stop();\n await this.as1.stop();\n await this.as2.stop();\n }\n\n getChecks(): ConformanceCheck[] {\n this._evaluate();\n return this.checks;\n }\n}\n",[],[141,254,422,511,608],"c37188bc-5b64-11f1-b520-ee650bb23af1","serverLifecycle.ts","c371897a-5b64-11f1-b520-ee650bb23af1","84ef8e3d-61d9-4f49-aed3-d685fdf6d962",55,["D",1780062375888],"import express from 'npm:express@^5.1.0';\n\nexport class ServerLifecycle {\n private app: express.Application | null = null;\n private httpServer: any = null;\n private baseUrl: string = '';\n\n // Arrow function to avoid needing lots of .bind(this)\n getUrl = (): string => {\n return this.baseUrl;\n };\n\n async start(app: express.Application): Promise {\n this.app = app;\n this.httpServer = this.app.listen(0);\n const port = this.httpServer.address().port;\n this.baseUrl = `http://localhost:${port}`;\n return this.baseUrl;\n }\n\n async stop(): Promise {\n if (this.httpServer) {\n await new Promise((resolve) => {\n this.httpServer.closeAllConnections?.();\n this.httpServer.close(() => resolve());\n });\n this.httpServer = null;\n }\n this.app = null;\n }\n}\n",[],[141,254,422,511,624,616],"helpers","c338fe52-5b64-11f1-9f3f-ee650bb23af1","mockTokenVerifier.ts","c338fef2-5b64-11f1-9f3f-ee650bb23af1",54,["D",1780062375528],"import { OAuthTokenVerifier } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/auth/provider.js';\nimport { AuthInfo } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/auth/types.js';\nimport { InvalidTokenError } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/auth/errors.js';\nimport type { ConformanceCheck } from '../../../../types.ts';\nimport { SpecReferences } from '../spec-references.ts';\n\nexport class MockTokenVerifier implements OAuthTokenVerifier {\n private tokenScopes: Map = new Map();\n\n constructor(\n private checks: ConformanceCheck[],\n private expectedScopes: string[] = []\n ) {}\n\n registerToken(token: string, scopes: string[]) {\n this.tokenScopes.set(token, scopes);\n }\n\n async verifyAccessToken(token: string): Promise {\n // Accept tokens that start with known prefixes\n if (token.startsWith('test-token') || token.startsWith('cc-token')) {\n // Get scopes for this token, or use empty array\n const scopes = this.tokenScopes.get(token) || [];\n\n this.checks.push({\n id: 'valid-bearer-token',\n name: 'ValidBearerToken',\n description: 'Client provided valid bearer token',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_ACCESS_TOKEN_USAGE],\n details: {\n token: token.substring(0, 15) + '...',\n scopes\n }\n });\n return {\n token,\n clientId: 'test-client',\n scopes,\n expiresAt: Math.floor(Date.now() / 1000) + 3600\n };\n }\n\n this.checks.push({\n id: 'invalid-bearer-token',\n name: 'InvalidBearerToken',\n description: 'Client provided invalid bearer token',\n status: 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_ACCESS_TOKEN_USAGE],\n details: {\n message: 'Token verification failed',\n token: token ? token.substring(0, 10) + '...' : 'missing'\n }\n });\n throw new InvalidTokenError('Invalid token');\n }\n}\n",[],[141,254,422,511,624,626],"bf28eed0-5b64-11f1-911e-ee650bb23af1","createServer.ts","bf28efa2-5b64-11f1-911e-ee650bb23af1",36,["D",1780062368706],"import { Server } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/index.js';\nimport { StreamableHTTPServerTransport } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/streamableHttp.js';\nimport {\n CallToolRequestSchema,\n CallToolResult,\n ErrorCode,\n ListToolsRequestSchema,\n McpError\n} from 'npm:@modelcontextprotocol/sdk@^1.29.0/types.js';\nimport { requireBearerAuth } from 'npm:@modelcontextprotocol/sdk@^1.29.0/server/auth/middleware/bearerAuth.js';\nimport express, { Request, Response, NextFunction } from 'npm:express@^5.1.0';\nimport type { ConformanceCheck } from '../../../../types.ts';\nimport { createRequestLogger } from '../../../request-logger.ts';\nimport { MockTokenVerifier } from './mockTokenVerifier.ts';\nimport { SpecReferences } from '../spec-references.ts';\n\nexport interface ServerOptions {\n prmPath?: string | null;\n requiredScopes?: string[];\n scopesSupported?: string[];\n includePrmInWwwAuth?: boolean;\n includeScopeInWwwAuth?: boolean;\n authMiddleware?: express.RequestHandler;\n tokenVerifier?: MockTokenVerifier;\n /** Override the resource field in PRM response (for testing resource mismatch) */\n prmResourceOverride?: string;\n}\n\nexport function createServer(\n checks: ConformanceCheck[],\n getBaseUrl: () => string,\n getAuthServerUrl: () => string,\n options: ServerOptions = {}\n): express.Application {\n const {\n prmPath = '/.well-known/oauth-protected-resource/mcp',\n requiredScopes = [],\n scopesSupported,\n includePrmInWwwAuth = true,\n includeScopeInWwwAuth = false,\n tokenVerifier,\n prmResourceOverride\n } = options;\n // Factory: create a fresh Server per request to avoid \"Already connected\" errors\n // after the v1.26.0 security fix (GHSA-345p-7cg4-v4c7)\n function createMcpServer() {\n const server = new Server(\n {\n name: 'auth-prm-pathbased-server',\n version: '1.0.0'\n },\n {\n capabilities: {\n tools: {}\n }\n }\n );\n\n server.setRequestHandler(ListToolsRequestSchema, async () => {\n return {\n tools: [\n {\n name: 'test-tool',\n inputSchema: { type: 'object' }\n }\n ]\n };\n });\n\n server.setRequestHandler(\n CallToolRequestSchema,\n async (request): Promise => {\n if (request.params.name === 'test-tool') {\n return {\n content: [{ type: 'text', text: 'test' }]\n };\n }\n throw new McpError(\n ErrorCode.InvalidParams,\n `Tool ${request.params.name} not found`\n );\n }\n );\n\n return server;\n }\n\n const app = express();\n app.use(express.json());\n\n app.use(\n createRequestLogger(checks, {\n incomingId: 'incoming-request',\n outgoingId: 'outgoing-response',\n mcpRoute: '/mcp'\n })\n );\n\n if (prmPath !== null) {\n app.get(prmPath, (req: Request, res: Response) => {\n checks.push({\n id: 'prm-pathbased-requested',\n name: 'PRMPathBasedRequested',\n description: 'Client requested PRM metadata at path-based location',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_PRM_DISCOVERY,\n SpecReferences.MCP_PRM_DISCOVERY\n ],\n details: {\n url: req.url,\n path: req.path\n }\n });\n\n // Resource is usually $baseUrl/mcp, but if PRM is at the root,\n // the resource identifier is the root.\n // Can be overridden via prmResourceOverride for testing resource mismatch.\n const resource =\n prmResourceOverride ??\n (prmPath === '/.well-known/oauth-protected-resource'\n ? getBaseUrl()\n : `${getBaseUrl()}/mcp`);\n\n const prmResponse: any = {\n resource,\n authorization_servers: [getAuthServerUrl()]\n };\n\n if (scopesSupported !== undefined) {\n prmResponse.scopes_supported = scopesSupported;\n }\n\n res.json(prmResponse);\n });\n }\n\n app.post('/mcp', async (req: Request, res: Response, next: NextFunction) => {\n // Apply bearer token auth per-request in order to delay setting PRM URL\n // until after the server has started\n // TODO: Find a way to do this w/ pre-applying middleware.\n const verifier =\n tokenVerifier || new MockTokenVerifier(checks, requiredScopes);\n\n const authMiddleware =\n options.authMiddleware ??\n requireBearerAuth({\n verifier,\n // Only pass requiredScopes if we want them in the WWW-Authenticate header\n requiredScopes: includeScopeInWwwAuth ? requiredScopes : [],\n ...(includePrmInWwwAuth &&\n prmPath !== null && {\n resourceMetadataUrl: `${getBaseUrl()}${prmPath}`\n })\n });\n\n authMiddleware(req, res, async (err?: any) => {\n if (err) return next(err);\n const server = createMcpServer();\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined\n });\n\n try {\n await server.connect(transport);\n\n await transport.handleRequest(req, res, req.body);\n res.on('close', () => {\n transport.close();\n server.close();\n });\n } catch (error) {\n console.error('Error handling MCP request:', error);\n if (!res.headersSent) {\n res.status(500).json({\n jsonrpc: '2.0',\n error: {\n code: -32603,\n message: 'Internal server error'\n },\n id: null\n });\n }\n }\n });\n });\n\n return app;\n}\n",[],[141,254,422,511,624,634],"fe7d6edc-5f4a-11f1-b469-1607ee4eb77e","createAuthServer.ts","bf65c1d4-5b64-11f1-9ce4-ee650bb23af1",96,["D",1780491112669],"import express, { Request, Response } from 'npm:express@^5.1.0';\nimport { createHash } from 'node:crypto';\nimport type { ConformanceCheck } from '../../../../types.ts';\nimport { createRequestLogger } from '../../../request-logger.ts';\nimport { SpecReferences } from '../spec-references.ts';\nimport { MockTokenVerifier } from './mockTokenVerifier.ts';\n\n/**\n * The authorization code is opaque to the client, so we use it to carry the\n * per-flow state (PKCE challenge, requested scopes) from /authorize to\n * /token. This keeps the AS stateless across processes — on serverless hosts\n * (val.town) the two requests can land on different isolates, where closure\n * state from /authorize doesn't exist. The closure variables remain as a\n * fallback for flows that don't round-trip our code (e.g. hand-rolled tests).\n */\ninterface AuthCodeState {\n challenge?: string;\n scopes?: string[];\n}\n\nconst AUTH_CODE_PREFIX = 'test-auth-code';\n\nfunction encodeAuthCode(state: AuthCodeState): string {\n return `${AUTH_CODE_PREFIX}.${Buffer.from(JSON.stringify(state)).toString('base64url')}`;\n}\n\nfunction decodeAuthCode(code: string | undefined): AuthCodeState | undefined {\n if (!code?.startsWith(`${AUTH_CODE_PREFIX}.`)) return undefined;\n try {\n return JSON.parse(\n Buffer.from(code.slice(AUTH_CODE_PREFIX.length + 1), 'base64url').toString()\n ) as AuthCodeState;\n } catch {\n return undefined;\n }\n}\n\n/**\n * Compute S256 code challenge from a code verifier.\n * BASE64URL(SHA256(code_verifier))\n */\nfunction computeS256Challenge(codeVerifier: string): string {\n const hash = createHash('sha256').update(codeVerifier).digest();\n return hash\n .toString('base64')\n .replace(/\\+/g, '-')\n .replace(/\\//g, '_')\n .replace(/=+$/, '');\n}\n\nexport interface TokenRequestResult {\n token: string;\n scopes: string[];\n}\n\nexport interface TokenRequestError {\n error: string;\n errorDescription?: string;\n statusCode?: number;\n}\n\nexport interface AuthServerOptions {\n metadataPath?: string;\n isOpenIdConfiguration?: boolean;\n loggingEnabled?: boolean;\n routePrefix?: string;\n scopesSupported?: string[];\n grantTypesSupported?: string[];\n tokenEndpointAuthMethodsSupported?: string[];\n tokenEndpointAuthSigningAlgValuesSupported?: string[];\n clientIdMetadataDocumentSupported?: boolean;\n /** Set to true to NOT advertise registration_endpoint (for pre-registration tests) */\n disableDynamicRegistration?: boolean;\n /** PKCE code_challenge_methods_supported. Set to null to omit from metadata. Default: ['S256'] */\n codeChallengeMethodsSupported?: string[] | null;\n /** Advertise authorization_response_iss_parameter_supported in AS metadata. Default: true. Pass null to omit. */\n issParameterSupported?: boolean | null;\n /**\n * What iss value to include in authorization redirect. Default: 'correct'.\n * 'normalized' sends a normalization-equivalent variant of the correct\n * issuer (trailing slash appended, exactly what `new URL(x).href`\n * round-tripping produces) — equal under RFC 3986 §6.2.2–6.2.3\n * normalization but not under simple string comparison.\n */\n issInRedirect?: 'correct' | 'wrong' | 'omit' | 'normalized';\n /**\n * Override the `issuer` value served in the AS metadata document. Used to\n * test that clients validate the metadata issuer against the issuer\n * identifier used to construct the well-known URL (RFC 8414 §3.3).\n */\n metadataIssuer?: string;\n tokenVerifier?: MockTokenVerifier;\n onTokenRequest?: (requestData: {\n scope?: string;\n grantType: string;\n timestamp: string;\n body: Record;\n authBaseUrl: string;\n tokenEndpoint: string;\n authorizationHeader?: string;\n }) =>\n | TokenRequestResult\n | TokenRequestError\n | Promise;\n onAuthorizationRequest?: (requestData: {\n clientId?: string;\n scope?: string;\n resource?: string;\n timestamp: string;\n }) => void;\n onRegistrationRequest?: (req: Request) => {\n clientId: string;\n clientSecret?: string;\n tokenEndpointAuthMethod?: string;\n };\n}\n\nexport function createAuthServer(\n checks: ConformanceCheck[],\n getAuthBaseUrl: () => string,\n options: AuthServerOptions = {}\n): express.Application {\n const {\n metadataPath = '/.well-known/oauth-authorization-server',\n isOpenIdConfiguration = false,\n loggingEnabled = true,\n routePrefix = '',\n scopesSupported,\n grantTypesSupported = ['authorization_code', 'refresh_token'],\n tokenEndpointAuthMethodsSupported = ['none'],\n tokenEndpointAuthSigningAlgValuesSupported,\n clientIdMetadataDocumentSupported,\n disableDynamicRegistration = false,\n codeChallengeMethodsSupported = ['S256'],\n issParameterSupported = true,\n issInRedirect = 'correct',\n metadataIssuer,\n tokenVerifier,\n onTokenRequest,\n onAuthorizationRequest,\n onRegistrationRequest\n } = options;\n\n // Track scopes from the most recent authorization request\n let lastAuthorizationScopes: string[] = [];\n // Track PKCE code_challenge for verification in token request\n let storedCodeChallenge: string | undefined;\n\n const authRoutes = {\n authorization_endpoint: `${routePrefix}/authorize`,\n token_endpoint: `${routePrefix}/token`,\n registration_endpoint: `${routePrefix}/register`\n };\n\n const app = express();\n app.use(express.json());\n app.use(express.urlencoded({ extended: true }));\n\n if (loggingEnabled) {\n app.use(\n createRequestLogger(checks, {\n incomingId: 'incoming-auth-request',\n outgoingId: 'outgoing-auth-response'\n })\n );\n }\n\n app.get(metadataPath, (req: Request, res: Response) => {\n checks.push({\n id: 'authorization-server-metadata',\n name: 'AuthorizationServerMetadata',\n description: 'Client requested authorization server metadata',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [\n SpecReferences.RFC_AUTH_SERVER_METADATA_REQUEST,\n SpecReferences.MCP_AUTH_DISCOVERY\n ],\n details: {\n url: req.url,\n path: req.path\n }\n });\n\n const metadata: any = {\n issuer: metadataIssuer ?? `${getAuthBaseUrl()}${routePrefix}`,\n authorization_endpoint: `${getAuthBaseUrl()}${authRoutes.authorization_endpoint}`,\n token_endpoint: `${getAuthBaseUrl()}${authRoutes.token_endpoint}`,\n ...(!disableDynamicRegistration && {\n registration_endpoint: `${getAuthBaseUrl()}${authRoutes.registration_endpoint}`\n }),\n response_types_supported: ['code'],\n grant_types_supported: grantTypesSupported,\n // PKCE support - null means omit from metadata (for negative testing)\n ...(codeChallengeMethodsSupported !== null && {\n code_challenge_methods_supported: codeChallengeMethodsSupported\n }),\n ...(issParameterSupported !== null && {\n authorization_response_iss_parameter_supported: issParameterSupported\n }),\n token_endpoint_auth_methods_supported: tokenEndpointAuthMethodsSupported,\n ...(tokenEndpointAuthSigningAlgValuesSupported && {\n token_endpoint_auth_signing_alg_values_supported:\n tokenEndpointAuthSigningAlgValuesSupported\n })\n };\n\n // Add scopes_supported if provided\n if (scopesSupported !== undefined) {\n metadata.scopes_supported = scopesSupported;\n }\n\n // Add client_id_metadata_document_supported if provided\n if (clientIdMetadataDocumentSupported !== undefined) {\n metadata.client_id_metadata_document_supported =\n clientIdMetadataDocumentSupported;\n }\n\n // Add OpenID Configuration specific fields\n if (isOpenIdConfiguration) {\n metadata.jwks_uri = `${getAuthBaseUrl()}/.well-known/jwks.json`;\n metadata.subject_types_supported = ['public'];\n metadata.id_token_signing_alg_values_supported = ['RS256'];\n }\n\n res.json(metadata);\n });\n\n app.get(authRoutes.authorization_endpoint, (req: Request, res: Response) => {\n const timestamp = new Date().toISOString();\n checks.push({\n id: 'authorization-request',\n name: 'AuthorizationRequest',\n description: 'Client made authorization request',\n status: 'SUCCESS',\n timestamp,\n specReferences: [SpecReferences.OAUTH_2_1_AUTHORIZATION_ENDPOINT],\n details: {\n query: req.query\n }\n });\n\n // PKCE: Store code_challenge for later verification\n const codeChallenge = req.query.code_challenge as string | undefined;\n const codeChallengeMethod = req.query.code_challenge_method as\n | string\n | undefined;\n storedCodeChallenge = codeChallenge;\n\n // PKCE: Check code_challenge is present\n checks.push({\n id: 'pkce-code-challenge-sent',\n name: 'PKCE Code Challenge',\n description: codeChallenge\n ? 'Client sent code_challenge in authorization request'\n : 'Client MUST send code_challenge in authorization request',\n status: codeChallenge ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PKCE]\n });\n\n // PKCE: Check S256 method is used\n checks.push({\n id: 'pkce-s256-method-used',\n name: 'PKCE S256 Method',\n description:\n codeChallengeMethod === 'S256'\n ? 'Client used S256 code challenge method'\n : 'Client MUST use S256 code challenge method when technically capable',\n status: codeChallengeMethod === 'S256' ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PKCE],\n details: {\n method: codeChallengeMethod || 'not specified'\n }\n });\n\n // Track scopes from authorization request for token issuance\n const scopeParam = req.query.scope as string | undefined;\n lastAuthorizationScopes = scopeParam ? scopeParam.split(' ') : [];\n\n if (onAuthorizationRequest) {\n onAuthorizationRequest({\n clientId: req.query.client_id as string | undefined,\n scope: scopeParam,\n resource: req.query.resource as string | undefined,\n timestamp\n });\n }\n\n const redirectUri = req.query.redirect_uri as string;\n const state = req.query.state as string;\n const redirectUrl = new URL(redirectUri);\n redirectUrl.searchParams.set(\n 'code',\n encodeAuthCode({\n challenge: codeChallenge,\n scopes: lastAuthorizationScopes\n })\n );\n if (state) {\n redirectUrl.searchParams.set('state', state);\n }\n\n // ISS: Include iss parameter in redirect if configured\n if (issInRedirect === 'correct') {\n redirectUrl.searchParams.set('iss', `${getAuthBaseUrl()}${routePrefix}`);\n } else if (issInRedirect === 'wrong') {\n redirectUrl.searchParams.set('iss', 'https://evil.example.com');\n } else if (issInRedirect === 'normalized') {\n // Normalization-equivalent variant of the correct issuer: identical\n // after RFC 3986 scheme-based normalization (trailing slash on an\n // empty path) but different under simple string comparison.\n redirectUrl.searchParams.set('iss', `${getAuthBaseUrl()}${routePrefix}/`);\n }\n\n res.redirect(redirectUrl.toString());\n });\n\n app.post(authRoutes.token_endpoint, async (req: Request, res: Response) => {\n const timestamp = new Date().toISOString();\n const requestedScope = req.body.scope;\n const grantType = req.body.grant_type;\n\n // Recover per-flow state from the code itself (survives process changes\n // on serverless hosts); fall back to closure state for codes we didn't\n // mint via encodeAuthCode.\n const codeState = decodeAuthCode(req.body.code as string | undefined);\n const flowChallenge = codeState?.challenge ?? storedCodeChallenge;\n const flowScopes = codeState?.scopes ?? lastAuthorizationScopes;\n\n checks.push({\n id: 'token-request',\n name: 'TokenRequest',\n description: 'Client requested access token',\n status: 'SUCCESS',\n timestamp,\n specReferences: [SpecReferences.OAUTH_2_1_TOKEN],\n details: {\n endpoint: '/token',\n grantType\n }\n });\n\n // PKCE: Check code_verifier is present (only for authorization_code grant)\n const codeVerifier = req.body.code_verifier as string | undefined;\n if (grantType === 'authorization_code') {\n checks.push({\n id: 'pkce-code-verifier-sent',\n name: 'PKCE Code Verifier',\n description: codeVerifier\n ? 'Client sent code_verifier in token request'\n : 'Client MUST send code_verifier in token request',\n status: codeVerifier ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PKCE]\n });\n\n // PKCE: Validate code_verifier matches code_challenge (S256)\n // Fail if either is missing\n const computedChallenge =\n codeVerifier && flowChallenge\n ? computeS256Challenge(codeVerifier)\n : undefined;\n const matches =\n computedChallenge !== undefined && computedChallenge === flowChallenge;\n\n let description: string;\n if (!flowChallenge && !codeVerifier) {\n description =\n 'Neither code_challenge nor code_verifier were sent - PKCE is required';\n } else if (!flowChallenge) {\n description =\n 'code_challenge was not sent in authorization request - PKCE is required';\n } else if (!codeVerifier) {\n description =\n 'code_verifier was not sent in token request - PKCE is required';\n } else if (matches) {\n description = 'code_verifier correctly matches code_challenge (S256)';\n } else {\n description = 'code_verifier does not match code_challenge';\n }\n\n checks.push({\n id: 'pkce-verifier-matches-challenge',\n name: 'PKCE Verifier Validation',\n description,\n status: matches ? 'SUCCESS' : 'FAILURE',\n timestamp,\n specReferences: [SpecReferences.MCP_PKCE],\n details: {\n matches,\n storedChallenge: flowChallenge || 'not sent',\n computedChallenge: computedChallenge || 'not computed'\n }\n });\n }\n\n let token = `test-token-${Date.now()}`;\n let scopes: string[] = flowScopes;\n\n if (onTokenRequest) {\n const result = await onTokenRequest({\n scope: requestedScope,\n grantType,\n timestamp,\n body: req.body,\n authBaseUrl: getAuthBaseUrl(),\n tokenEndpoint: `${getAuthBaseUrl()}${authRoutes.token_endpoint}`,\n authorizationHeader: req.headers.authorization\n });\n\n // Check if result is an error\n if ('error' in result) {\n res.status(result.statusCode || 400).json({\n error: result.error,\n error_description: result.errorDescription\n });\n return;\n }\n\n token = result.token;\n scopes = result.scopes;\n }\n\n // Register token with verifier if provided\n if (tokenVerifier) {\n tokenVerifier.registerToken(token, scopes);\n }\n\n res.json({\n access_token: token,\n token_type: 'Bearer',\n expires_in: 3600,\n ...(scopes.length > 0 && { scope: scopes.join(' ') })\n });\n });\n\n app.post(authRoutes.registration_endpoint, (req: Request, res: Response) => {\n let clientId = 'test-client-id';\n let clientSecret: string | undefined = 'test-client-secret';\n let tokenEndpointAuthMethod: string | undefined;\n\n if (onRegistrationRequest) {\n const result = onRegistrationRequest(req);\n clientId = result.clientId;\n clientSecret = result.clientSecret;\n tokenEndpointAuthMethod = result.tokenEndpointAuthMethod;\n }\n\n checks.push({\n id: 'client-registration',\n name: 'ClientRegistration',\n description: 'Client registered with authorization server',\n status: 'SUCCESS',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_DCR],\n details: {\n endpoint: '/register',\n clientName: req.body.client_name,\n ...(tokenEndpointAuthMethod && { tokenEndpointAuthMethod })\n }\n });\n\n // SEP-837: clients MUST specify an appropriate application_type during DCR.\n // The harness can't know the client's real class (native vs web), so this\n // checks presence + that the value is one of the two OIDC-defined values.\n const appType = req.body.application_type;\n const validAppType = appType === 'native' || appType === 'web';\n checks.push({\n id: 'sep-837-application-type-present',\n name: 'DCR application_type specified',\n description: validAppType\n ? `Client specified application_type \"${appType}\" during Dynamic Client Registration`\n : appType === undefined\n ? 'Client MUST specify an appropriate application_type during Dynamic Client Registration (SEP-837); field was omitted'\n : `Client MUST specify an appropriate application_type during Dynamic Client Registration (SEP-837); got \"${appType}\", expected \"native\" or \"web\"`,\n status: validAppType ? 'SUCCESS' : 'FAILURE',\n timestamp: new Date().toISOString(),\n specReferences: [SpecReferences.MCP_DCR],\n details: { application_type: appType ?? '(omitted)' }\n });\n\n res.status(201).json({\n client_id: clientId,\n ...(clientSecret && { client_secret: clientSecret }),\n client_name: req.body.client_name || 'test-client',\n redirect_uris: req.body.redirect_uris || [],\n ...(tokenEndpointAuthMethod && {\n token_endpoint_auth_method: tokenEndpointAuthMethod\n })\n });\n });\n\n return app;\n}\n",[],[141,254,422,511,624,642],"bf29245e-5b64-11f1-911e-ee650bb23af1",["D",1780062368706],[180,181,182,183],[141,254,422,511,624],"b921d592-5b64-11f1-a593-ee650bb23af1",11,["D",1780062358592],[179,184,185,186,187,188,189,190,191,192,193,194,195,196,197],[141,254,422,511],"b83f7652-5b64-11f1-9ce4-ee650bb23af1",7,["D",1780062357110],[178,198,199,200,201,202,203,204,205,206,207,208],[141,254,422],"b8e7039a-5b64-11f1-911e-ee650bb23af1","authorization-server-metadata.ts","b8e70444-5b64-11f1-911e-ee650bb23af1","b7366fed-a5c9-4ea7-bad4-7173486b4ce1",10,["D",1780062358210],"/**\n * Authorization server metadata endpoint test scenarios for MCP authorization servers\n */\nimport {\n ClientScenarioForAuthorizationServer,\n ConformanceCheck\n} from '../../types.ts';\nimport { request } from 'npm:undici@^7.25.0';\n\ntype Status = 'SUCCESS' | 'FAILURE';\n\nexport class AuthorizationServerMetadataEndpointScenario implements ClientScenarioForAuthorizationServer {\n name = 'authorization-server-metadata-endpoint';\n readonly source = { introducedIn: '2025-03-26' } as const;\n description = `Test authorization server metadata endpoint.\n\n**Authorization Server Implementation Requirements:**\n\n**Endpoint**: \\`authorization server metadata\\`\n\n**Requirements**:\n- HTTP response status code MUST be 200 OK\n- Content-Type header MUST be application/json\n- Return a JSON response including issuer, authorization_endpoint, token_endpoint and response_types_supported\n- The issuer value MUST match the URI obtained by removing the well-known URI string from the authorization server metadata URI.`;\n\n async run(serverUrl: string): Promise {\n let status: Status = 'SUCCESS';\n let errorMessage: string | undefined;\n let details: any;\n let response: any | null = null;\n try {\n const wellKnownUrls = this.createWellKnownUrl(serverUrl);\n\n for (const url of wellKnownUrls) {\n try {\n const checkResponse = await request(url, { method: 'GET' });\n if (checkResponse.statusCode === 200) {\n response = checkResponse;\n break;\n }\n } catch {\n // Ignore the error and proceed to the next loop.\n }\n }\n\n if (!response) {\n throw new Error(\n 'All authorization server metadata endpoints returned invalid status code.'\n );\n }\n\n this.validateContentType(response.headers['content-type']);\n\n const body = await this.parseJson(response);\n const errors: string[] = [];\n this.validateMetadataBody(body, serverUrl, errors);\n\n if (errors.length > 0) {\n status = 'FAILURE';\n errorMessage = errors.join(', ');\n }\n\n details = {\n contentType: response.headers['content-type'],\n body\n };\n } catch (error) {\n status = 'FAILURE';\n errorMessage = error instanceof Error ? error.message : String(error);\n }\n\n return [\n {\n id: 'authorization-server-metadata',\n name: 'AuthorizationServerMetadata',\n description: 'Valid authorization server metadata response',\n status,\n timestamp: new Date().toISOString(),\n errorMessage,\n specReferences: [\n {\n id: 'Authorization-Server-Metadata',\n url: 'https://datatracker.ietf.org/doc/html/rfc8414'\n }\n ],\n ...(details ? { details } : {})\n }\n ];\n }\n\n private createWellKnownUrl(serverUrl: string): string[] {\n const base = new URL(serverUrl);\n const origin = base.origin;\n const path = base.pathname.replace(/\\/$/, '');\n\n const urls = new Set();\n urls.add(`${origin}/.well-known/oauth-authorization-server${path}`);\n urls.add(`${origin}/.well-known/openid-configuration${path}`);\n urls.add(`${origin}${path}/.well-known/openid-configuration`);\n\n return Array.from(urls);\n }\n\n private validateContentType(contentType?: string | string[]): void {\n const valid =\n typeof contentType === 'string' &&\n contentType.toLowerCase().includes('application/json');\n\n if (!valid) {\n throw new Error(`Invalid Content-Type: ${contentType ?? '(missing)'}`);\n }\n }\n\n private async parseJson(response: any): Promise> {\n const body = await response.body.json();\n if (typeof body !== 'object' || body === null) {\n throw new Error('Response body is not an object');\n }\n return body;\n }\n\n private validateMetadataBody(\n body: Record,\n serverUrl: string,\n errors: string[]\n ): void {\n this.assertString(\n body.authorization_endpoint,\n 'authorization_endpoint',\n errors\n );\n this.assertString(body.token_endpoint, 'token_endpoint', errors);\n\n if (\n !Array.isArray(body.response_types_supported) ||\n !body.response_types_supported.includes('code')\n ) {\n errors.push(\n 'Response body does not include valid \"response_types_supported\" claim'\n );\n }\n\n if (\n !Array.isArray(body.code_challenge_methods_supported) ||\n !body.code_challenge_methods_supported.includes('S256')\n ) {\n errors.push(\n 'Response body does not include valid \"code_challenge_methods_supported\" claim'\n );\n }\n\n if (body.issuer !== serverUrl) {\n errors.push(`Invalid issuer: ${body.issuer ?? '(missing)'}`);\n }\n }\n\n private assertString(value: unknown, name: string, errors: string[]): void {\n if (typeof value !== 'string' || value.length === 0) {\n errors.push(`Response body does not include valid \"${name}\" claim`);\n }\n }\n}\n",[],[141,254,672,664],"authorization-server","b8e74008-5b64-11f1-911e-ee650bb23af1",["D",1780062358210],[176],[141,254,672],"b7946226-5b64-11f1-9ce4-ee650bb23af1",["D",1780062355899],[175,177,209,228,229],[141,254],"f908242e-5f4a-11f1-a8ce-1607ee4eb77e","session.ts","b80f91e4-5b64-11f1-9de2-ee650bb23af1","c962419b-89c2-42ca-bb90-1cccfe244f57",85,["D",1780491103530],"/**\n * Session management for the hosted conformance server.\n *\n * A \"run\" is one isolated exercise of a scenario. Each run owns a fresh\n * Scenario instance and the RequestListener it returns from handler() — no\n * loopback port, no proxy. Runs are keyed by a path-embedded id so\n * correlation works for stateless-transport clients that never echo\n * mcp-session-id.\n */\n\nimport { randomBytes } from 'node:crypto';\nimport {\n Scenario,\n ConformanceCheck,\n RequestListener,\n AuthHandlerScenario,\n AuxOriginRole\n} from '../types.ts';\nimport { getScenario, scenarios } from '../scenarios/index.ts';\n\nexport interface HostedRun {\n id: string;\n scenarioName: string;\n scenario: Scenario;\n /** The mounted RS handler — invoke directly with (req, res). */\n listener: RequestListener;\n /** Aux-origin handlers (AS, IdP, …) for auth scenarios. */\n auxListeners?: Partial>;\n /** Sub-path under the run prefix where the MCP endpoint lives. */\n mcpPath: string;\n createdAt: number;\n lastSeenAt: number;\n context?: Record;\n}\n\nexport interface SessionManagerOptions {\n /** Idle ms after which a run is reaped. Default 5 minutes. */\n ttlMs?: number;\n sweepIntervalMs?: number;\n /**\n * Public origins of the relay deployments, keyed by role. Required for any\n * scenario that exposes `authHandlers()`. Each value is the relay's public\n * URL (no trailing slash); per-run AS issuer becomes `/r/`.\n */\n auxOrigins?: Partial>;\n}\n\nexport class SessionManager {\n private runs = new Map();\n private readonly ttlMs: number;\n private readonly auxOrigins: Partial>;\n private sweeper: ReturnType;\n\n constructor(opts: SessionManagerOptions = {}) {\n this.ttlMs = opts.ttlMs ?? 5 * 60_000;\n this.auxOrigins = opts.auxOrigins ?? {};\n const sweepIntervalMs = opts.sweepIntervalMs ?? 30_000;\n this.sweeper = setInterval(() => this.sweep(), sweepIntervalMs);\n this.sweeper.unref?.();\n }\n\n /**\n * Get the run for (scenario, id), creating it on first reference. The id is\n * caller-chosen so URLs are predictable; pass undefined to mint one.\n */\n getOrCreate(\n scenarioName: string,\n id: string | undefined,\n baseUrlFor: (runId: string) => string\n ): HostedRun {\n if (id) {\n const existing = this.runs.get(id);\n if (existing && existing.scenarioName === scenarioName) {\n existing.lastSeenAt = Date.now();\n return existing;\n }\n // Same id reused for a different scenario → replace, don't merge checks.\n if (existing) void this.destroy(id);\n }\n\n const proto = getScenario(scenarioName);\n if (!proto) throw new UnknownScenarioError(scenarioName);\n\n const Ctor = proto.constructor as new () => Scenario;\n const scenario = new Ctor();\n const runId = id ?? randomBytes(6).toString('base64url');\n\n let listener: RequestListener;\n let auxListeners: HostedRun['auxListeners'];\n let context: Record | undefined;\n\n if (scenario instanceof AuthHandlerScenario) {\n // Multi-origin scenario: build RS + aux handlers from authHandlers().\n // Aux issuer is /r/ so the run-id is recoverable\n // from any RFC 8414 well-known path the client constructs from it.\n const missing = scenario.auxRoles.filter((r) => !this.auxOrigins[r]);\n if (missing.length) {\n throw new NotHostableError(\n scenarioName,\n `needs aux origin(s) [${missing.join(', ')}] — start with --as-origin`\n );\n }\n const handlers = scenario.authHandlers({\n getRsBaseUrl: () => baseUrlFor(runId),\n getAuxBaseUrl: (role) => `${this.auxOrigins[role]}/r/${runId}`\n });\n listener = handlers.rs;\n auxListeners = handlers.aux;\n context = (\n scenario as unknown as {\n scenarioContext?: () => Record;\n }\n ).scenarioContext?.();\n } else if (scenario.handler) {\n listener = scenario.handler(() => baseUrlFor(runId));\n } else {\n throw new NotHostableError(scenarioName);\n }\n\n const run: HostedRun = {\n id: runId,\n scenarioName,\n scenario,\n listener,\n auxListeners,\n mcpPath: scenario.mcpPath ?? '',\n createdAt: Date.now(),\n lastSeenAt: Date.now(),\n context\n };\n this.runs.set(runId, run);\n return run;\n }\n\n get(id: string): HostedRun | undefined {\n const r = this.runs.get(id);\n if (r) r.lastSeenAt = Date.now();\n return r;\n }\n\n results(id: string): ConformanceCheck[] | undefined {\n return this.runs.get(id)?.scenario.getChecks();\n }\n\n list(): HostedRun[] {\n return Array.from(this.runs.values());\n }\n\n async destroy(id: string): Promise {\n const r = this.runs.get(id);\n if (!r) return;\n this.runs.delete(id);\n // handler() never started a server, but some scenarios hold timers/streams\n // that stop() cleans up. Safe to call even though start() wasn't.\n try {\n await r.scenario.stop();\n } catch {\n // best-effort\n }\n }\n\n async close(): Promise {\n clearInterval(this.sweeper);\n await Promise.all(\n Array.from(this.runs.keys()).map((id) => this.destroy(id))\n );\n }\n\n private sweep(): void {\n const now = Date.now();\n for (const [id, r] of this.runs) {\n if (now - r.lastSeenAt > this.ttlMs) void this.destroy(id);\n }\n }\n}\n\nexport class UnknownScenarioError extends Error {\n constructor(name: string) {\n super(\n `Unknown scenario '${name}'. Available: ${Array.from(scenarios.keys()).join(', ')}`\n );\n }\n}\n\nexport class NotHostableError extends Error {\n constructor(name: string, why?: string) {\n super(\n `Scenario '${name}' cannot run hosted` +\n (why\n ? `: ${why}`\n : ` (no handler() or authHandlers() — typically backcompat scenarios that need root-of-origin endpoints).`)\n );\n }\n}\n\n/** Scenarios that can run hosted, partitioned by what they need. */\nexport function listHostableScenarios(\n withAuxOrigins: readonly AuxOriginRole[] = []\n): string[] {\n const have = new Set(withAuxOrigins);\n return Array.from(scenarios.entries())\n .filter(([, s]) => {\n if (typeof s.handler === 'function') return true;\n if (s instanceof AuthHandlerScenario) {\n return s.auxRoles.every((r) => have.has(r));\n }\n return false;\n })\n .map(([name]) => name);\n}\n",[],[141,690,682],"hosted","1d041d8a-8c27-4294-a371-53f69f7de5c7",["D",1780655710179],[],[141,690,33],"b7cc5b0e-5b64-11f1-9ce4-ee650bb23af1","html.ts","b7cc5bcc-5b64-11f1-9ce4-ee650bb23af1",5,["D",1780062356323],"import { ConformanceCheck, CheckStatus } from '../types.ts';\n\nconst STATUS_STYLE: Record = {\n SUCCESS: 'background:#d1fae5;color:#065f46',\n FAILURE: 'background:#fee2e2;color:#991b1b',\n WARNING: 'background:#fef3c7;color:#92400e',\n SKIPPED: 'background:#e5e7eb;color:#374151',\n INFO: 'background:#dbeafe;color:#1e40af'\n};\n\nconst css = `\n body{font:14px/1.5 ui-sans-serif,system-ui,sans-serif;max-width:960px;\n margin:2rem auto;padding:0 1rem;color:#111}\n code,pre{font:12px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace}\n pre{background:#f6f8fa;padding:.75rem;border-radius:6px;overflow:auto}\n .pill{display:inline-block;padding:2px 8px;border-radius:10px;\n font-size:11px;font-weight:600}\n .check{border:1px solid #e5e7eb;border-radius:6px;padding:.75rem;\n margin:.5rem 0}\n .check h3{margin:0 0 .25rem;font-size:14px}\n details>summary{cursor:pointer;color:#6b7280;font-size:12px}\n table{border-collapse:collapse;width:100%}\n td,th{text-align:left;padding:.4rem .6rem;border-bottom:1px solid #eee}\n a{color:#2563eb}\n`;\n\nfunction esc(s: string): string {\n return s.replace(\n /[&<>\"]/g,\n (c) => ({ '&': '&', '<': '<', '>': '>', '\"': '"' })[c]!\n );\n}\n\nexport function renderLanding(origin: string, scenarios: string[]): string {\n const rows = scenarios\n .map(\n (n) =>\n `${esc(n)}` +\n `${esc(origin)}/s/${esc(n)}/<run-id>` +\n `mint`\n )\n .join('');\n return `\nMCP Conformance — hosted\n

MCP Conformance — hosted

Point your MCP client at /s/<scenario>/<run-id>.\nPick any <run-id> (e.g. local-1) — the run is\ncreated on first request, and because the id is in the path it works with\nstateless transports too. Then GET\n/results/<run-id> (append .html for a\nreport).

Too lazy to pick an id? GET /s/<scenario> mints one and\nreturns {mcpUrl, resultsUrl}.

This server is also an MCP server at ${esc(origin)}/mcp with\nlist_scenarios / start_run /\nget_results tools.

Scenarios (${scenarios.length})

\n${rows}

name	MCP URL pattern

Example

$ npx @modelcontextprotocol/inspector ${esc(origin)}/s/initialize/demo\n$ curl ${esc(origin)}/results/demo | jq .summary

`;\n}\n\nexport function renderResults(\n scenario: string,\n sessionId: string,\n checks: ConformanceCheck[]\n): string {\n const items = checks\n .map((c) => {\n const pill = `${c.status}`;\n const refs = (c.specReferences ?? [])\n .map((r) =>\n r.url\n ? `${esc(r.id)}`\n : `${esc(r.id)}`\n )\n .join(' · ');\n const details =\n c.details || c.errorMessage\n ? `

details

${esc(\n              JSON.stringify(\n                { errorMessage: c.errorMessage, ...c.details },\n                null,\n                2\n              )\n            )}

`\n : '';\n return `

${pill} `${esc(c.id)}` — ${esc(\n c.name\n )}

${esc(c.description)}

${refs}

${details}

`;\n })\n .join('');\n const passed = checks.filter((c) => c.status === 'SUCCESS').length;\n const failed = checks.filter((c) => c.status === 'FAILURE').length;\n return `\n${esc(scenario)} — ${sessionId}\n

`${esc(scenario)}`

session ${esc(sessionId)} — ${passed} passed, ${failed} failed,\n${checks.length} total

${items}`;\n}\n",[],[141,690,696],"b70c7fc8-5b64-11f1-8713-ee650bb23af1",["D",1780062355087],[171,172,173],[141,690],"c30829c6-5b64-11f1-be20-ee650bb23af1","c3082aa2-5b64-11f1-be20-ee650bb23af1","bbef4320-4422-429c-80fb-67d79053017a",53,["D",1780062375192],"// Namespaced exports for client checks\nimport * as client from './client.ts';\n\nexport const clientChecks = client;\n",[],[141,715,256],"checks","c3a00d04-5b64-11f1-8ff0-ee650bb23af1","client.ts","c3a00dae-5b64-11f1-8ff0-ee650bb23af1",56,["D",1780062376203],"import {\n ConformanceCheck,\n CheckStatus,\n LATEST_SPEC_VERSION,\n NEGOTIABLE_PROTOCOL_VERSIONS\n} from '../types.ts';\n\nexport function createServerInfoCheck(serverInfo: {\n name: string;\n version: string;\n}): ConformanceCheck {\n return {\n id: 'server-info',\n name: 'ServerInfo',\n description: 'Test server info returned to client',\n status: 'INFO',\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Lifecycle',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle'\n }\n ],\n details: {\n serverName: serverInfo.name,\n serverVersion: serverInfo.version\n }\n };\n}\n\nexport function createClientInitializationCheck(\n initializeRequest: any,\n expectedSpecVersion: string = LATEST_SPEC_VERSION\n): ConformanceCheck {\n const protocolVersionSent = initializeRequest?.protocolVersion;\n\n // Accept known valid versions OR custom expected version (for backward compatibility)\n const validVersions = NEGOTIABLE_PROTOCOL_VERSIONS.includes(\n expectedSpecVersion\n )\n ? NEGOTIABLE_PROTOCOL_VERSIONS\n : [...NEGOTIABLE_PROTOCOL_VERSIONS, expectedSpecVersion];\n const versionMatch = validVersions.includes(protocolVersionSent);\n\n const errors: string[] = [];\n if (!protocolVersionSent) errors.push('Protocol version not provided');\n if (!versionMatch)\n errors.push(\n `Version mismatch: expected ${expectedSpecVersion}, got ${protocolVersionSent}`\n );\n if (!initializeRequest?.clientInfo?.name) errors.push('Client name missing');\n if (!initializeRequest?.clientInfo?.version)\n errors.push('Client version missing');\n\n const status: CheckStatus = errors.length === 0 ? 'SUCCESS' : 'FAILURE';\n\n return {\n id: 'mcp-client-initialization',\n name: 'MCPClientInitialization',\n description: 'Validates that MCP client properly initializes with server',\n status,\n timestamp: new Date().toISOString(),\n specReferences: [\n {\n id: 'MCP-Lifecycle',\n url: 'https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle'\n }\n ],\n details: {\n protocolVersionSent,\n expectedSpecVersion,\n versionMatch,\n clientName: initializeRequest?.clientInfo?.name,\n clientVersion: initializeRequest?.clientInfo?.version\n },\n errorMessage: errors.length > 0 ? errors.join('; ') : undefined,\n logs: errors.length > 0 ? errors : undefined\n };\n}\n",[],[141,715,717],"c3084fa0-5b64-11f1-be20-ee650bb23af1",["D",1780062375192],[168,169],[141,715],["D",1780062355087],[167,170,174,230],[141],"f800a0ec-5f4a-11f1-8af8-1607ee4eb77e","valtown.ts","b6ab6260-5b64-11f1-bb92-ee650bb23af1","cc09b591-ab36-47d7-a7a0-618641fcafb7",81,["D",1780491101793],"/**\n * MCP conformance — val.town deployment.\n *\n * The hosted runner mounts each scenario's `handler()` (a Node\n * `RequestListener`) under `/s//`. On val.town the entry\n * point is a fetch handler, so we bridge web Request→Node req/res once and\n * reuse the *real* scenario implementations from the package — no\n * reimplementation, no loopback port.\n *\n * Deploy: create an HTTP val and paste:\n *\n * import handler from \"https://esm.sh/@modelcontextprotocol/conformance/examples/hosted/valtown.ts\";\n * export default handler;\n *\n * or copy this file in directly. Requires a runtime with Node-compat\n * (`node:http`, `node:stream`) — val.town, Deno Deploy, Bun all qualify.\n *\n * Limitation: scenarios that rely on long-lived SSE streams or connection-\n * close timing (`sse-retry`) won't behave correctly through a buffered\n * Request→Response bridge. They're filtered out below.\n */\n\nimport { IncomingMessage, ServerResponse } from 'node:http';\nimport { Socket } from 'node:net';\nimport { createHostedApp } from '../../src/hosted/server.ts';\n\nconst NOT_FETCH_SAFE = new Set(['sse-retry']);\n\n// Auth scenarios need a second public origin (RFC 8414 well-known is\n// origin-rooted). Deploy examples/hosted/valtown-relay.ts as a separate val\n// and point CONFORMANCE_AS_ORIGIN at it; both vals share\n// CONFORMANCE_RELAY_SECRET so /__aux can't be hit directly.\nconst { app } = createHostedApp({\n auxOrigins: {\n as: process.env.CONFORMANCE_AS_ORIGIN,\n as2: process.env.CONFORMANCE_AS2_ORIGIN,\n idp: process.env.CONFORMANCE_IDP_ORIGIN\n },\n relaySecret: process.env.CONFORMANCE_RELAY_SECRET\n});\n\nexport default async function (request: Request): Promise {\n const url = new URL(request.url);\n\n // Short-circuit scenarios that need true streaming.\n const m = url.pathname.match(/^\\/s\\/([^/]+)/);\n if (m && NOT_FETCH_SAFE.has(m[1])) {\n return Response.json(\n {\n error: `scenario '${m[1]}' relies on SSE stream lifecycle and is not available via the fetch bridge`\n },\n { status: 501 }\n );\n }\n\n // --- web Request → Node IncomingMessage ---\n const body = request.body\n ? Buffer.from(await request.arrayBuffer())\n : undefined;\n // Express's req.protocol/req.ip read socket.encrypted/.remoteAddress, and\n // IncomingMessage._destroy calls socket.destroy(), so a real (unconnected)\n // Socket with the encrypted flag patched on is the path of least surprise.\n const socket = Object.assign(new Socket(), { encrypted: false });\n const nodeReq = new IncomingMessage(socket);\n nodeReq.method = request.method;\n nodeReq.url = url.pathname + url.search;\n nodeReq.httpVersion = '1.1';\n nodeReq.httpVersionMajor = 1;\n nodeReq.httpVersionMinor = 1;\n nodeReq.headers = Object.fromEntries(request.headers);\n nodeReq.headers.host ??= url.host;\n if (body?.length) nodeReq.headers['content-length'] = String(body.length);\n // The SDK's StreamableHTTPServerTransport converts Node→Web via\n // @hono/node-server, which reads rawHeaders (the [k,v,k,v,...] array),\n // not the parsed headers object. Deno's node:http compat exposes\n // rawHeaders as a getter-only accessor, so shadow it with an own\n // property instead of assigning.\n Object.defineProperty(nodeReq, 'rawHeaders', {\n value: Object.entries(nodeReq.headers).flat() as string[],\n writable: true,\n configurable: true\n });\n if (body?.length) nodeReq.push(body);\n nodeReq.push(null);\n\n // --- Node ServerResponse → web Response ---\n // Intercept the user-facing write surface (writeHead/setHeader/write/end)\n // so we never touch ServerResponse's socket-coupled internals. This is the\n // approach serverless-http and light-my-request take.\n const nodeRes = new ServerResponse(nodeReq);\n const chunks: Buffer[] = [];\n let status = 200;\n const headers = new Headers();\n\n const captureHeaders = (h?: Record) => {\n for (const [k, v] of Object.entries(h ?? {})) {\n headers.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n }\n };\n nodeRes.setHeader = ((k: string, v: string | string[] | number) => {\n headers.set(k, Array.isArray(v) ? v.join(', ') : String(v));\n return nodeRes;\n }) as ServerResponse['setHeader'];\n nodeRes.getHeader = (k: string) => headers.get(k.toLowerCase()) ?? undefined;\n nodeRes.removeHeader = (k: string) => headers.delete(k);\n nodeRes.writeHead = ((code: number, h?: Record) => {\n status = code;\n captureHeaders(h);\n return nodeRes;\n }) as ServerResponse['writeHead'];\n nodeRes.write = ((c: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n return true;\n }) as ServerResponse['write'];\n nodeRes.flushHeaders = () => {};\n Object.defineProperty(nodeRes, 'statusCode', {\n get: () => status,\n set: (v: number) => {\n status = v;\n }\n });\n\n return new Promise((resolve) => {\n nodeRes.end = ((c?: string | Buffer, enc?: BufferEncoding) => {\n if (c) chunks.push(typeof c === 'string' ? Buffer.from(c, enc) : c);\n resolve(\n new Response(chunks.length ? Buffer.concat(chunks) : null, {\n status,\n headers\n })\n );\n return nodeRes;\n }) as ServerResponse['end'];\n\n app(nodeReq, nodeRes);\n });\n}\n",[],[148,690,732],"b6abc1a6-5b64-11f1-bb92-ee650bb23af1",["D",1780062354427],[165],[148,690],["D",1780062354427],[164],[148],["D",1780062353614],{"_95":94,"_102":98},{"_95":94,"_96":-5,"_97":98,"_18":55,"_99":100,"_101":25},{"_13":84,"_32":85,"_44":43,"_86":45,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":46,"_93":94},"ctx",{"_77":-5,"_123":784,"_785":786,"_787":788,"_789":25,"_790":25,"_791":25,"_792":121,"_793":-5,"_794":-7,"_795":-7,"_796":61,"_797":25,"_798":25,"_799":-5,"_800":25,"_801":25,"_802":25,"_803":-5},"ENV",{"_755":756,"_757":758,"_759":85,"_760":761,"_762":763,"_764":765,"_766":767,"_768":769,"_770":771,"_772":773,"_774":775,"_776":777,"_778":779,"_780":781,"_782":783},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

MCP Conformance — hosted

Scenarios (${scenarios.length})

Example

${pill} ${esc(c.id)} — ${esc(\n c.name\n )}

${esc(scenario)}

${pill} `${esc(c.id)}` — ${esc(\n c.name\n )}

`${esc(scenario)}`

Diff · v103