Tracking: 2026-07-28 spec conformance

[DaleSeo]

Epic tracking issue for reaching 100% conformance on the 2026-07-28 spec suite before the spec release on 2026-07-28.

Per-item status lives in the sub-issues below — one per 2026-07-28 work item (conformance gaps and spec feature work, including completed ones so the progress bar reflects cumulative progress). The sub-issues mirror the 2026-07-28 spec milestone issue-for-issue, so the two progress numbers track the same set; the milestone adds the due date, this epic adds context and discussion. Conformance-gap issues carry failing check IDs and a repro command. The public roadmap is ROADMAP.md.

Current snapshot

Measured locally on 2026-07-16 at main 2e2c791 (after #973, #995, #888, #996, #997 merged) with @modelcontextprotocol/conformance@0.2.0-alpha.9:

• Server: 37/40 scenarios passing (98/109 checks)
• Client: 15/32 scenarios passing (193/220 checks)

Movement since the 2026-07-13 baseline (server 37/40, client 24/32):

• ✅ http-custom-header-server-validation 0/5 → 9/9 (feat(conformance): add SEP-2243 header validation tool #997 closed Implement SEP-2243: server-side custom header validation #979)
• ✅ request-metadata crash → 5/5 (feat: add modern client lifecycle modes (SEP-2575) #995 closed request-metadata client conformance: populate required request _meta (SEP-2575) #981)
• ⬆️ server-stateless 2/28 → 18/25 (feat!: add server discovery and negotiation (SEP-2575) #973/feat: add modern client lifecycle modes (SEP-2575) #995 closed Implement SEP-2575: Make MCP Stateless #869; remaining gaps: server-stateless conformance: 7 remaining check failures after SEP-2575 foundation (18/25) #1004)
• ❌ tools-call-with-progress regressed 1/1 → 0/1 — feat!: add server discovery and negotiation (SEP-2575) #973's modern per-request path reintroduced the bug fix(streamable-http): preserve progress in JSON mode #990 fixed for the legacy path (Stateless streamable HTTP: tools/call with progress returns notification as response body #980 reopened)
• ❌ json-schema-2020-12 4/4 → 4/7 — the run now exercises SEP-2106 keyword-preservation checks that need conformance-server fixtures (Conformance server: json-schema-2020-12 SEP-2106 keyword-preservation checks fail (4/7) #1003); pre-existing, not a regression from the merges
• ❌ Client scenario count dropped for harness reasons, not library regressions: chore: update client conformance test scenarios #991 removed the unknown-scenario auth fallback, so ten scenarios (auth/iss-*, auth/offline-access-*, auth/authorization-server-migration, auth/metadata-issuer-mismatch, json-schema-ref-no-deref mapping) error out (Conformance client: auth scenarios unmapped since #991 dispatch change (blocks verifying SEP-2468/SEP-2352 fixes) #1001), and legacy-lifecycle scenarios die on a missing MCP-Protocol-Version header at initialize (Conformance client: legacy-lifecycle scenarios fail with -32020 missing MCP-Protocol-Version header at 2026-07-28 #1002). This currently blocks end-to-end verification of the merged feat: accumulate client-side scopes during step-up authorization (SEP-2350) #888 (SEP-2350) and fix(auth): validate discovered metadata issuer #996 (SEP-2468) fixes.

For reference, the 2025-11-25 suite (0.1.16, npm latest) passes 100% on both server (30/30 + pending scenarios) and client (18/18 + legacy auth/2025-03-26-*).

Note that the 2026-07-28 suite is a per-version scenario set, not additive: 36 scenarios are shared with 2025-11-25, 36 are new, and 14 scenarios are dropped (initialize, ping, logging-set-level, resources-(un)subscribe, sse-retry, … — removals driven by SEP-2575/SEP-2577).

Full scenario matrix (snapshot, 2026-07-16)

Snapshot of a full local run with 0.2.0-alpha.9 — regenerate with the commands below rather than hand-editing. Live per-item status is in the sub-issues.

Server — 37/40 passing

Scenario	New in 2026-07-28	Checks	Status	Tracking
completion-complete		1/1	✅
tools-list		2/2	✅
tools-call-simple-text		1/1	✅
tools-call-image		1/1	✅
tools-call-audio		1/1	✅
tools-call-embedded-resource		1/1	✅
tools-call-mixed-content		1/1	✅
tools-call-error		1/1	✅
tools-call-with-progress		0/1	❌ regressed by #973	#980 (reopened)
server-sse-multiple-streams		1/1	✅
resources-list		1/1	✅
resources-read-text		1/1	✅
resources-read-binary		1/1	✅
resources-templates-read		1/1	✅
prompts-list		1/1	✅
prompts-get-simple		1/1	✅
prompts-get-with-args		1/1	✅
prompts-get-embedded-resource		1/1	✅
prompts-get-with-image		1/1	✅
dns-rebinding-protection		2/2	✅
json-schema-2020-12		4/7	❌ SEP-2106 keyword fixtures	#1003
sep-2164-resource-not-found	🆕	3/3	✅
caching	🆕	7/7	✅
http-header-validation	🆕	13/13	✅
http-custom-header-server-validation	🆕	9/9	✅ (was 0/5)	#979 → #997
server-stateless	🆕	18/25 (+5 skipped)	❌ (was 2/28)	#869 → #973/#995 · remaining: #1004
input-required-result-basic-elicitation	🆕	2/2	✅
input-required-result-basic-sampling	🆕	2/2	✅
input-required-result-basic-list-roots	🆕	2/2	✅
input-required-result-request-state	🆕	2/2	✅
input-required-result-multiple-input-requests	🆕	2/2	✅
input-required-result-multi-round	🆕	3/3	✅
input-required-result-missing-input-response	🆕	1/1	✅
input-required-result-non-tool-request	🆕	2/2	✅
input-required-result-result-type	🆕	1/1	✅
input-required-result-unsupported-methods	🆕	1/1	✅
input-required-result-tampered-state	🆕	1/1	✅
input-required-result-capability-check	🆕	1/1	✅
input-required-result-ignore-extra-params	🆕	1/1	✅
input-required-result-validate-input	🆕	2/2	✅

Client — 15/32 passing

Check counts vary slightly between runs (the mock emits some checks conditionally); statuses are stable.

Scenario	New in 2026-07-28	Checks	Status	Tracking
tools_call		0/1	❌ -32020 at initialize	#1002
request-metadata	🆕	5/5	✅ (was crash)	#981 → #995
auth/metadata-default		11/11	✅
auth/metadata-var1		12/12	✅
auth/metadata-var2		12/12	✅
auth/metadata-var3		11/11	✅
auth/basic-cimd		10/10	✅
auth/scope-from-www-authenticate		12/12	✅
auth/scope-from-scopes-supported		12/12	✅
auth/scope-omitted-when-undefined		12/12	✅
auth/scope-step-up		11/13	❌ dies at -32020 before escalation — #888's fix unverifiable	#877 → #888 · blocked by #1002
auth/scope-retry-limit		12/12	✅
auth/token-endpoint-auth-basic		16/16	✅
auth/token-endpoint-auth-post		16/16	✅
auth/token-endpoint-auth-none		16/16	✅
auth/pre-registration		5/6	❌	#984
auth/resource-mismatch	🆕	2/2	✅
auth/offline-access-scope	🆕	unsupported scenario	❌ (was 10/10)	#1001
auth/offline-access-not-supported	🆕	unsupported scenario	❌ (was 12/12)	#1001
auth/authorization-server-migration	🆕	2/3	❌	#879 · blocked by #1001
auth/iss-supported	🆕	unsupported scenario	❌ (was 12/12)	#1001
auth/iss-not-advertised	🆕	unsupported scenario	❌ (was 12/12)	#1001
auth/iss-supported-missing	🆕	unsupported scenario	❌ (was 8/8)	#1001
auth/iss-wrong-issuer	🆕	unsupported scenario	❌ (was 8/8)	#1001
auth/iss-unexpected	🆕	unsupported scenario	❌ (was 8/8)	#1001
auth/iss-normalized	🆕	unsupported scenario	❌ (was 8/8)	#1001
auth/metadata-issuer-mismatch	🆕	unsupported scenario	❌ — #996's fix unverifiable	#983 → #996 · blocked by #1001
sep-2322-client-request-state	🆕	5/5	✅
http-standard-headers	🆕	4/5	❌	#978 · #1002
http-custom-headers	🆕	6/7	❌	#978
http-invalid-tool-headers	🆕	1/11	❌	#978
json-schema-ref-no-deref	🆕	timeout	❌ (was 1/1)	#1001

Running the suites

The 2026-07-28 suite speaks the stateless lifecycle for all scenarios (bare JSON-RPC POSTs, no initialize handshake), so server runs must target the STATELESS=1 conformance server. Running against the stateful server fails everything with HTTP 422. Pass --suite all on the server run too — the default "active" suite skips 18 of the 40 scenarios (including server-stateless and caching).

cargo build -p mcp-conformance
STATELESS=1 PORT=8002 ./target/debug/conformance-server &
npx -y @modelcontextprotocol/conformance@0.2.0-alpha.9 server \
  --url http://127.0.0.1:8002/mcp --suite all --spec-version 2026-07-28 -o results
npx -y @modelcontextprotocol/conformance@0.2.0-alpha.9 client \
  --command ./target/debug/conformance-client --suite all --spec-version 2026-07-28 -o results-client

The suite is still alpha; re-baseline (and diff conformance list --spec-version 2026-07-28) on each version bump.

History

• 2026-07-13 baseline: server 37/40, client 24/32. Server gaps: tools-call-with-progress (Stateless streamable HTTP: tools/call with progress returns notification as response body #980), http-custom-header-server-validation (Implement SEP-2243: server-side custom header validation #979), server-stateless 2/28 (Implement SEP-2575: Make MCP Stateless #869).
• 2026-07-16: feat!: add server discovery and negotiation (SEP-2575) #973, feat: add modern client lifecycle modes (SEP-2575) #995, feat: accumulate client-side scopes during step-up authorization (SEP-2350) #888, fix(auth): validate discovered metadata issuer #996, feat(conformance): add SEP-2243 header validation tool #997 merged; snapshot above.

Out of scope here, tracked elsewhere

• Non-conformance Tier 1 requirements: VERSIONING.md, dependency update policy, documentation coverage (26/48 → 48/48) — see ROADMAP.md
• The implementation ships as v3.0.0 (chore: release v3.0.0 #964); tiering/relegation are evaluated against the latest stable release, so the release itself is on the critical path. Migration guide: discussion Migrating to 3.x (draft) #969.