Tracking: 2026-07-28 spec conformance

[DaleSeo]

Epic tracking issue for reaching 100% conformance on the 2026-07-28 spec suite before the spec release on 2026-07-28.

Per-item status lives in the sub-issues below. The epic now links 31 work items: 28 dated-protocol implementation and conformance issues in the 2026-07-28 spec milestone, plus three extension work items tracked separately from the tier-scored core suite. All carry the 2026-07-28 label. The milestone adds the due date, while this epic provides context and discussion. Conformance-gap issues carry failing check IDs and a repro command. The public roadmap is ROADMAP.md.

Current snapshot

Measured locally on 2026-07-21 at main 8803d39 (after #999, #1000, #1005, #1011, #1012, #1018, and #1021 merged) with @modelcontextprotocol/conformance@0.2.0-alpha.9:

• Server: 40/40 scenarios passing (114/114 checks)
• Client: 30/32 scenarios passing (360/363 checks, plus 1 warning)

Movement since the 2026-07-18 snapshot (server 37/40, client 26/32):

• ✅ Server reached 40/40: fix: preserve negotiated progress responses #1005 fixed negotiated progress responses, fix: preserve JSON Schema 2020-12 keywords #1018 completed the JSON Schema 2020-12 fixture, and feat: add subscription listen streams (SEP-2575) #1000 completed server-stateless while adding five subscription checks.
• ✅ Client moved 26/32 → 30/32: fix: pass SEP-2243 client conformance #1012 completed all three SEP-2243 header scenarios, and fix: re-register after auth server change #1011 completed authorization-server migration (31/31).
• ✅ fix(server): serve draft-version requests statelessly per SEP-2567 #999 now serves 2026-07-28 requests statelessly even when legacy session mode is enabled.
• ✅ chore: run full conformance CI suite #1010 runs the full core conformance suites in CI; ci: expose extension conformance gaps #1019 exposes extension-suite gaps separately.
• ❌ The only failing core client scenarios are tools_call (0/1) and auth/scope-step-up (11/13, plus 1 warning). Both still hit the legacy lifecycle missing MCP-Protocol-Version header and remain tracked by Conformance client: legacy-lifecycle scenarios fail with -32020 missing MCP-Protocol-Version header at 2026-07-28 #1002.

For reference, the 2025-11-25 suite (0.1.16, npm latest) passes 100% on both server (30/30 + pending scenarios) and client (18/18 + legacy auth/2025-03-26-*).

Note that the 2026-07-28 suite is a per-version scenario set, not additive: 36 scenarios are shared with 2025-11-25, 36 are new, and 14 scenarios are dropped (initialize, ping, logging-set-level, resources-(un)subscribe, sse-retry, … — removals driven by SEP-2575/SEP-2577).

Extension coverage (informational)

Extension conformance is reported separately from the dated core 40-server / 32-client scenario suites. #1019 keeps these gaps visible in CI:

• Tasks Extension (SEP-2663): Implement SEP-2663: Tasks Extension #868
• MCP Apps (SEP-1865): Implement SEP-1865: MCP Apps - Interactive User Interfaces for MCP #891
• Extensions framework (SEP-2133): Implement SEP-2133: Extensions framework for MCP #892

Full scenario matrix (snapshot, 2026-07-21)

Snapshot of a full local run with 0.2.0-alpha.9 — regenerate with the commands below rather than hand-editing. Live per-item status is in the sub-issues.

Server — 40/40 passing

Scenario	New in 2026-07-28	Checks	Status	Tracking
completion-complete		1/1	✅
tools-list		2/2	✅
tools-call-simple-text		1/1	✅
tools-call-image		1/1	✅
tools-call-audio		1/1	✅
tools-call-embedded-resource		1/1	✅
tools-call-mixed-content		1/1	✅
tools-call-error		1/1	✅
tools-call-with-progress		1/1	✅	#980 → #1005
server-sse-multiple-streams		1/1	✅
resources-list		1/1	✅
resources-read-text		1/1	✅
resources-read-binary		1/1	✅
resources-templates-read		1/1	✅
prompts-list		1/1	✅
prompts-get-simple		1/1	✅
prompts-get-with-args		1/1	✅
prompts-get-embedded-resource		1/1	✅
prompts-get-with-image		1/1	✅
dns-rebinding-protection		2/2	✅
json-schema-2020-12		7/7	✅	#1003 → #1018
sep-2164-resource-not-found	🆕	3/3	✅
caching	🆕	7/7	✅
http-header-validation	🆕	13/13	✅
http-custom-header-server-validation	🆕	9/9	✅ (was 0/5)	#979 → #997
server-stateless	🆕	30/30	✅	#869 → #973/#995/#1000; #1004 closed
input-required-result-basic-elicitation	🆕	2/2	✅
input-required-result-basic-sampling	🆕	2/2	✅
input-required-result-basic-list-roots	🆕	2/2	✅
input-required-result-request-state	🆕	2/2	✅
input-required-result-multiple-input-requests	🆕	2/2	✅
input-required-result-multi-round	🆕	3/3	✅
input-required-result-missing-input-response	🆕	1/1	✅
input-required-result-non-tool-request	🆕	2/2	✅
input-required-result-result-type	🆕	1/1	✅
input-required-result-unsupported-methods	🆕	1/1	✅
input-required-result-tampered-state	🆕	1/1	✅
input-required-result-capability-check	🆕	1/1	✅
input-required-result-ignore-extra-params	🆕	1/1	✅
input-required-result-validate-input	🆕	2/2	✅

Client — 30/32 passing

Check counts vary slightly between runs (the mock emits some checks conditionally); statuses are stable.

Scenario	New in 2026-07-28	Checks	Status	Tracking
tools_call		0/1	❌ -32020 at initialize	#1002
request-metadata	🆕	5/5	✅	#981 → #995
auth/metadata-default		13/13	✅
auth/metadata-var1		14/14	✅
auth/metadata-var2		14/14	✅
auth/metadata-var3		13/13	✅
auth/basic-cimd		12/12	✅
auth/scope-from-www-authenticate		14/14	✅
auth/scope-from-scopes-supported		14/14	✅
auth/scope-omitted-when-undefined		14/14	✅
auth/scope-step-up		11/13 (+1 warning)	❌ dies at -32020 before escalation — #888's fix unverifiable	#877 → #888 · blocked by #1002
auth/scope-retry-limit		12/12	✅
auth/token-endpoint-auth-basic		18/18	✅
auth/token-endpoint-auth-post		18/18	✅
auth/token-endpoint-auth-none		18/18	✅
auth/pre-registration		10/10	✅ (was 5/6)	#984 → #994
auth/resource-mismatch	🆕	2/2	✅
auth/offline-access-scope	🆕	12/12	✅	#1001 → #1008
auth/offline-access-not-supported	🆕	14/14	✅	#1001 → #1008
auth/authorization-server-migration	🆕	31/31	✅	#879 → #998/#1011
auth/iss-supported	🆕	14/14	✅	#1001 → #1008
auth/iss-not-advertised	🆕	14/14	✅	#1001 → #1008
auth/iss-supported-missing	🆕	8/8	✅	#1001 → #1008
auth/iss-wrong-issuer	🆕	8/8	✅	#1001 → #1008
auth/iss-unexpected	🆕	8/8	✅	#1001 → #1008
auth/iss-normalized	🆕	8/8	✅	#1001 → #1008
auth/metadata-issuer-mismatch	🆕	3/3	✅ — #996 verified	#983 → #996/#1008
sep-2322-client-request-state	🆕	5/5	✅
http-standard-headers	🆕	3/3	✅	#978 → #1012
http-custom-headers	🆕	18/18	✅	#978 → #1012
http-invalid-tool-headers	🆕	11/11	✅	#978 → #1012
json-schema-ref-no-deref	🆕	1/1	✅ (was timeout)	#1001 → #1008

Running the suites

The 2026-07-28 suite uses the stateless discovery lifecycle for its server scenarios. Since #999, requests negotiating that version are served statelessly even when legacy session mode is enabled; STATELESS=1 remains useful to make the conformance harness intent explicit. Pass --suite all on the server run too — the default "active" suite skips scenarios including server-stateless and caching.

cargo build -p mcp-conformance
STATELESS=1 PORT=8002 ./target/debug/conformance-server &
npx -y @modelcontextprotocol/conformance@0.2.0-alpha.9 server \
  --url http://127.0.0.1:8002/mcp --suite all --spec-version 2026-07-28 -o results
npx -y @modelcontextprotocol/conformance@0.2.0-alpha.9 client \
  --command ./target/debug/conformance-client --suite all --spec-version 2026-07-28 -o results-client

The suite is still alpha; re-baseline (and diff conformance list --spec-version 2026-07-28) on each version bump.

History

• 2026-07-13 baseline: server 37/40, client 24/32. Server gaps: tools-call-with-progress (Stateless streamable HTTP: tools/call with progress returns notification as response body #980), http-custom-header-server-validation (Implement SEP-2243: server-side custom header validation #979), server-stateless 2/28 (Implement SEP-2575: Make MCP Stateless #869).

• 2026-07-16: feat!: add server discovery and negotiation (SEP-2575) #973, feat: add modern client lifecycle modes (SEP-2575) #995, feat: accumulate client-side scopes during step-up authorization (SEP-2350) #888, fix(auth): validate discovered metadata issuer #996, and feat(conformance): add SEP-2243 header validation tool #997 merged. Server moved to 98/109 checks while remaining 37/40; client measured 15/32 because chore: update client conformance test scenarios #991 had orphaned eleven scenario mappings (Conformance client: auth scenarios unmapped since #991 dispatch change (blocks verifying SEP-2468/SEP-2352 fixes) #1001) and the legacy lifecycle lacked the required protocol-version header (Conformance client: legacy-lifecycle scenarios fail with -32020 missing MCP-Protocol-Version header at 2026-07-28 #1002).

• 2026-07-18: fix(auth): add an SDK path for pre-registered OAuth clients #994, feat(auth): bind DCR client credentials to issuing authorization server (SEP-2352) #998, and fix: enumerate conformance client scenarios #1008 merged; auth/pre-registration: new pre-registration-auth conformance check fails #984, Implement SEP-2352: Clarify authorization server binding and migration #879, and Conformance client: auth scenarios unmapped since #991 dispatch change (blocks verifying SEP-2468/SEP-2352 fixes) #1001 closed. Client moved 15/32 → 26/32. SEP-2468 now passes end-to-end; SEP-2352 is implemented but remains 15/16 because fix: enumerate conformance client scenarios #1008 shadows the dedicated migration harness path. Server remains 37/40.

• 2026-07-21: fix(server): serve draft-version requests statelessly per SEP-2567 #999, feat: add subscription listen streams (SEP-2575) #1000, fix: preserve negotiated progress responses #1005, chore: run full conformance CI suite #1010, fix: re-register after auth server change #1011, fix: pass SEP-2243 client conformance #1012, and fix: preserve JSON Schema 2020-12 keywords #1018 merged. Server reached 40/40 (114/114 checks); client reached 30/32 (360/363 checks, plus 1 warning). Only tools_call and auth/scope-step-up remain blocked by Conformance client: legacy-lifecycle scenarios fail with -32020 missing MCP-Protocol-Version header at 2026-07-28 #1002.

Out of scope here, tracked elsewhere

• Non-conformance Tier 1 requirements: VERSIONING.md, dependency update policy, documentation coverage (26/48 → 48/48) — see ROADMAP.md
• The implementation ships as v3.0.0 (chore: release v3.0.0 #964); tiering/relegation are evaluated against the latest stable release, so the release itself is on the critical path. Migration guide: discussion Migrating to 3.x (draft) #969.