@booyaka/mcp-vet 0.3.0 → 0.4.0

package/BENCHMARK.md

@@ -0,0 +1,112 @@
+# Benchmark: corpus, methodology, and honest limits
+
+The README claims high precision on real MCP code. This file is the evidence
+behind that claim — corpus, pinned commits, counts, labels, and what the
+scanner is *known to miss* — so the claim is checkable rather than vibes.
+
+> Prompted by community feedback on the launch post: *"'0 false positives' is
+> encouraging but incomplete without corpus size, commit SHAs, labeled
+> negatives, and recall."* Correct. Here they are.
+
+## Corpus (pinned)
+
+Scanned with `mcp-vet` v0.4.0 (`node dist/cli.js <roots> --json`), all rules
+enabled, default confidence (`low`), on 2026-07-23:
+
+| Repo | Commit | Scanned root | Files | LOC |
+| --- | --- | --- | --- | --- |
+| [modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers) | `d31124c982401739917fd817c2a59db344529c16` | `src/` | 78 | 14,742 |
+| [modelcontextprotocol/typescript-sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1e1392e3f91583884fe82a0b4b91335875c3fba6` | `examples/` | 144 | 17,224 |
+| [modelcontextprotocol/python-sdk](https://github.com/modelcontextprotocol/python-sdk) | `3a6f2996cdd8358957479791e8b26198c07d6a75` | `examples/` | 225 | 12,013 |
+| **Total** | | | **447** | **43,979** |
+
+File counts are candidate files (`.ts/.tsx/.js/.mjs/.cjs/.py`) under the
+scanned roots, excluding `node_modules`.
+
+## Results
+
+**105 findings across 41 files** (TypeScript/JavaScript: 93, Python: 12).
+By confidence: 66 high, 38 medium, 1 low.
+
+| Pattern | Findings |
+| --- | --- |
+| `MCP_SESSION_ID` | 49 |
+| `LOGGING_CAP` | 17 |
+| `SAMPLING_CAP` | 16 |
+| `ROOTS_CAP` | 15 |
+| `INITIALIZE_HANDLER` | 4 |
+| `TASKS_LEGACY` | 2 |
+| `TASKS_RESULT_REMOVED` | 2 |
+
+### Labeling
+
+Every finding was manually reviewed against its source line:
+
+- **104 / 105 true positives** — real references to a removed or deprecated
+  protocol surface (session headers/ids, handshake registration, legacy task
+  methods, deprecated capability declarations and method strings).
+- **1 / 105 false positive (0.95%)** —
+  `stories/json_response/client.py:62` in the typescript-sdk examples:
+  `assert "mcp-session-id" not in response.headers`. That line is
+  *already-migrated* test code asserting the header is **absent**; flagging it
+  as "will break" is wrong. It is exactly what inline suppression
+  (`# mcp-vet-disable-line MCP_SESSION_ID`) is for, but we count it as a false
+  positive rather than defining it away. So the honest headline is
+  **"1 false positive in 44k LOC"**, not zero.
+
+Notes on reading the numbers:
+
+- Two occurrences on one line (e.g. `transport.sessionId && sessions.delete(transport.sessionId)`)
+  are reported as two findings — column-level dedup, not line-level.
+- Findings in test files (`__tests__/…`) are counted as true positives: a test
+  that registers `sampling/createMessage` breaks the same way production code
+  does.
+
+### Labeled negatives
+
+Files asserted to stay **clean** are part of the repo's test suite and run in CI:
+
+- `test/fixtures/clean/` — a full server written in the 2026-07-28 style
+  (per-request `_meta`, `sessionIdGenerator: undefined`, `-32602`).
+- `test/fixtures/negatives/` — "false friend" patterns: `sessionId` on plain
+  app-level objects, `-32002` inside strings/comments, capability-like words
+  with no capabilities context.
+- `test/fixtures/adversarial/caught/` — obfuscations the scanner **must**
+  catch: aliased imports (TS + Python), namespace-qualified SDK constants,
+  client transports resuming a `sessionId`.
+
+Additionally, in the corpus above, comment-only mentions (e.g. `Mcp-Session-Id`
+in a comment, `initialize` in prose) produced zero findings — the AST layer
+distinguishes executable tokens from comments by construction.
+
+## Recall — what the scanner is known to miss
+
+Static token analysis proves known patterns are **absent**; it cannot prove
+your server **speaks the new wire contract**. Recall is bounded by
+construction, and the misses are locked into the test suite
+(`test/fixtures/adversarial/missed/`, asserted to produce zero findings so any
+silent claim-inflation fails CI):
+
+- split/computed method strings — `'tasks' + '/list'`, `` `tasks/${op}` ``, f-strings
+- computed capability keys — `{ ['roo'+'ts']: {} }`
+- generated/loop-driven registration from string fragments
+- framework-adapter indirection (route tables built at runtime)
+- cross-module renames — a wrapper re-exporting an SDK constant under a new
+  name is flagged in the wrapper file, but a consumer importing only the new
+  name scans clean on its own
+
+There is no corpus-wide recall *percentage*: that would require a labeled set
+of every legacy usage in the wild, which nobody has. What we can say is: for
+the pattern shapes listed in the README, detection is exact; for the shapes
+above, it is zero, and the tool says so — pair the scan with runtime checks
+(`mcp-vet fixtures`) to cover the difference.
+
+## Reproducing
+
+```bash
+git clone --depth 1 https://github.com/modelcontextprotocol/servers
+git clone --depth 1 https://github.com/modelcontextprotocol/typescript-sdk
+git clone --depth 1 https://github.com/modelcontextprotocol/python-sdk
+# check out the pinned SHAs above, then:
+npx @booyaka/mcp-vet servers/src typescript-sdk/examples python-sdk/examples --json --no-files
+```

package/CHANGELOG.md

@@ -4,6 +4,48 @@ All notable changes to `mcp-vet` are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0]
+
+The community-feedback release — everything in it traces to reader comments on
+the launch post (issues #1–#6). Static analysis got sharper, and the tool now
+ships the runtime half it was honest about not covering.
+
+### Added
+
+- **Client-side session-ownership detection** (#1) — a client transport
+  constructed with a real `sessionId`/`session_id` and reads of
+  `transport.sessionId` are flagged (`MCP_SESSION_ID`, medium). The migrated
+  `sessionId: undefined` / `session_id=None` forms are recognized as benign.
+  Servers going stateless is only half the migration; clients that still behave
+  as if they own a session break too.
+- **Aliased-import resolution** (#2) — `import { InitializeRequestSchema as Init }`
+  (TS) and `from mcp.types import RootsCapability as RC` (Python) now flag both
+  the import line and the aliased usage sites. Python import lines surface
+  imported names even when only the alias is used later.
+- **Adversarial regression suite** (#3) — `test/fixtures/adversarial/` locks in
+  what the scanner catches (`caught/`) *and* what it is known to miss
+  (`missed/`, asserted zero findings): computed strings, computed capability
+  keys, generated registration, framework adapters, cross-module renames.
+- **`mcp-vet fixtures [dir]`** (#4) — emits nine protocol-level conformance
+  fixtures + `CHECKLIST.md`: `server/discover`, per-request `_meta`,
+  `Mcp-Method`/`Mcp-Name` routing headers (incl. mismatch rejection), stateless
+  auth, task-handle lifecycle, duplicate deliveries, retry on another instance,
+  `tools/list` cache invalidation, and downgrade/refusal behavior. Also exported
+  programmatically (`CONFORMANCE_FIXTURES`, `emitConformanceFixtures`).
+- **BENCHMARK.md** (#5) — the precision claim is now evidence: pinned corpus
+  SHAs, 447 files / ~44k LOC, every finding labeled (105 findings, 104 TP,
+  1 FP), labeled negatives, and an explicit recall discussion.
+
+### Changed
+
+- **Docs: spec-date semantics** (#6) — July 28 is a specification release, not
+  a remote kill switch; breakage appears when a client/server pair negotiates
+  the new revision. README and the post-scan notice now say so, and recommend
+  the dual-version (2025-11-25 + 2026-07-28) rollout test matrix.
+- The README "0 false positives" claim is replaced by the measured, reproducible
+  numbers in BENCHMARK.md (1 FP in 44k LOC — an already-migrated negative
+  assertion in test code).
+
 ## [0.3.0]
 
 The completeness release — full detection coverage, a real migration path, and a

package/README.md

@@ -15,11 +15,22 @@ npx @booyaka/mcp-vet .
 ```
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/Booyaka101/mcp-vet/main/assets/demo.svg" alt="mcp-vet scanning a server — BREAKING and DEPRECATED findings with before/after fixes and confidence tags" width="720">
+  <img src="https://raw.githubusercontent.com/Booyaka101/mcp-vet/main/assets/demo.png" alt="mcp-vet scanning a server — BREAKING and DEPRECATED findings with before/after fixes and confidence tags" width="720">
 </p>
 
 No account, no API key, no network calls — it parses your code locally (ts-morph for TS/JS, a bundled Python `ast` script for `.py`) and exits non-zero if it finds anything **BREAKING**, so you can drop it straight into CI.
 
+## What actually happens on July 28
+
+**July 28 is a specification release date, not a switch that remotely disables your deployment.** Nothing reaches into running servers and turns them off. Breakage appears when a **client and server pair negotiates or requires the new revision** — a client that sends `2026-07-28`-style requests (per-request `_meta`, no handshake, routing headers) against a server that still expects `2025-11-25` semantics, or vice versa.
+
+Two practical consequences:
+
+- **Your rollout is a window, not a day.** Until every client you care about has moved, keep **both** revisions in your production test matrix: a `2025-11-25` path and a `2026-07-28` path. `mcp-vet fixtures` emits wire-level test fixtures for exactly this (see [Runtime conformance fixtures](#runtime-conformance-fixtures)).
+- **Silent acceptance is the worst failure mode.** A server that quietly processes an old-revision request under new semantics (or the reverse) corrupts behavior instead of failing loudly. Verify *refusal* behavior, not just the happy path.
+
+The scan tells you *what to change in your source*; the date tells you *when clients start expecting it*.
+
 ---
 
 ## Real-world example
@@ -43,7 +54,7 @@ sse-polling.ts:107:13    BREAKING   MCP_SESSION_ID [medium]
 6 finding(s): 5 BREAKING, 1 DEPRECATED
 ```
 
-Note it catches the `sessionIdGenerator` session usage — the real signal in SDK-based servers, which usually never write the literal `Mcp-Session-Id` string. And it stays quiet where it should: the `Mcp-Session-Id` mentioned in a *comment*, the `initialize` in a comment in `dual-era.ts`, and the `sampling/createMessage` in `sampling.ts` (which appears only in comments and behind the `requestSampling()` helper) are all left alone. That precision — structural AST checks, not text matching — is what keeps the noise down on a real codebase: **6 findings, 0 false positives.**
+Note it catches the `sessionIdGenerator` session usage — the real signal in SDK-based servers, which usually never write the literal `Mcp-Session-Id` string. And it stays quiet where it should: the `Mcp-Session-Id` mentioned in a *comment*, the `initialize` in a comment in `dual-era.ts`, and the `sampling/createMessage` in `sampling.ts` (which appears only in comments and behind the `requestSampling()` helper) are all left alone. That precision — structural AST checks, not text matching — is what keeps the noise down on a real codebase: **6 findings, 0 false positives on these files.** (Across the full labeled corpus it's 104/105 true positives — see [BENCHMARK.md](./BENCHMARK.md).)
 
 ---
 
@@ -53,7 +64,7 @@ Note it catches the `sessionIdGenerator` session usage — the real signal in SD
 
 | ID | Pattern |
 | --- | --- |
-| `MCP_SESSION_ID` | `Mcp-Session-Id` header / `mcpSessionId` variable |
+| `MCP_SESSION_ID` | `Mcp-Session-Id` header / `mcpSessionId` variable / client-side session ownership (`sessionId` passed to or read from a client transport) |
 | `INITIALIZE_HANDLER` | `initialize` / `notifications/initialized` handler registration |
 | `ERROR_CODE_32002` | the numeric error code `-32002` |
 | `TASKS_LEGACY` | `tasks/get` · `tasks/update` · `tasks/cancel` legacy method strings |
@@ -73,7 +84,7 @@ Note it catches the `sessionIdGenerator` session usage — the real signal in SD
 Every finding carries a **confidence** so you can tune signal-to-noise with `--min-confidence`:
 
 - **high** — exact/deterministic match (session id, `-32002`, tasks methods), a structurally-verified capability (the `roots`/`sampling`/`logging` key is really *inside* a `capabilities` object), or an `initialize` string used as a method name (handler registration, `switch` case, or `req.method === 'initialize'`).
-- **medium** — a `roots`/`sampling`/`logging` key/string within 5 lines of a `capabilities` mention but not structurally verified.
+- **medium** — a `roots`/`sampling`/`logging` key/string within 5 lines of a `capabilities` mention but not structurally verified; a real `sessionIdGenerator`; client-side session ownership (`sessionId`/`session_id` passed to or read from a transport/client).
 - **low** — a bare `'initialize'` string with no registration context.
 
 ---
@@ -96,6 +107,19 @@ function handle(req) {
 }
 ```
 
+This cuts both ways — **client-side session ownership breaks too**, even against a server that scans clean. A lot of tool-reliability bugs only show up when the server is stateless but the client still behaves as if it owns a session:
+
+```ts
+// ❌ before — the client resumes a stored session
+const transport = new StreamableHTTPClientTransport(url, { sessionId: stored });
+persist(transport.sessionId);
+
+// ✅ after — stateless: no stored session id, full _meta on every request
+const transport = new StreamableHTTPClientTransport(url, { sessionId: undefined });
+```
+
+`mcp-vet` flags a client transport constructed with a real `sessionId`/`session_id` and reads of `transport.sessionId` (medium confidence). The migrated `sessionId: undefined` / `session_id=None` forms are recognized and left alone.
+
 ### 2. `initialize` / `notifications/initialized` — the handshake is removed
 
 > *"The `initialize`/`initialized` handshake is removed. The protocol version, client info, and client capabilities that used to be exchanged once at connection time now travel in `_meta` on every request."*
@@ -167,6 +191,28 @@ case 'tasks/list': return listTasks();
 
 The CLI prints a one-line reminder of these after every scan.
 
+## Runtime conformance fixtures
+
+Static analysis proves known legacy patterns are *absent* from your source. Only wire-level tests prove your running server actually *speaks* the 2026-07-28 contract. `mcp-vet` ships both halves:
+
+```bash
+npx @booyaka/mcp-vet fixtures ./mcp-fixtures
+```
+
+writes nine ready-to-fire JSON fixtures plus a `CHECKLIST.md`, covering the runtime behaviors a linter cannot see:
+
+1. `server/discover` replaces the initialize handshake
+2. per-request `_meta` (protocolVersion, clientInfo, capabilities) — including explicit refusal when `_meta` is missing
+3. `Mcp-Method` / `Mcp-Name` routing headers, including the header/body-mismatch rejection case
+4. stateless auth context (no session-bound token cache)
+5. task-handle lifecycle: creation, `tasks/get` polling, resume on another instance, `tasks/list` and `tasks/result` returning method-not-found
+6. duplicate request delivery (idempotency under retries)
+7. retry against a different server instance (no sticky in-memory state)
+8. `tools/list` cache invalidation
+9. downgrade/refusal: old-revision requests get an explicit error, never silent acceptance under the wrong semantics
+
+Each fixture is a plain JSON description (`send` headers + JSON-RPC body, `expect` notes) you can replay with curl, supertest, pytest + httpx, or any HTTP harness. The checklist also spells out the **dual-version rollout matrix** — run both `2025-11-25` and `2026-07-28` paths until your clients have all moved — and a **client-side assumptions** list (session resume, per-request `_meta`, retries landing on other instances, `tools/list` revalidation).
+
 ## Usage
 
 ```bash
@@ -174,6 +220,7 @@ npx @booyaka/mcp-vet [paths...]        # scan directories and/or files (default:
 npx @booyaka/mcp-vet . --fix           # scan, and auto-apply the mechanical -32002 → -32602 rewrite
 npx @booyaka/mcp-vet ./src ./packages  # multiple roots
 npx @booyaka/mcp-vet server.py         # a single file
+npx @booyaka/mcp-vet fixtures ./dir    # write runtime conformance fixtures + checklist (default: ./mcp-vet-fixtures)
 ```
 
 Globs `**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}` and `**/*.py`, skipping `node_modules`, `.git`, `__pycache__`, `dist`, and `build`.
@@ -325,15 +372,25 @@ It matches the ways real servers are actually written, not just raw method strin
 - **SDK schema-constant registration** — `server.setRequestHandler(InitializeRequestSchema, …)` (how the official SDKs register handlers) maps `InitializeRequestSchema`, `ListRootsRequestSchema`, `CreateMessageRequestSchema`, `SetLevelRequestSchema`, `ListTasksRequestSchema`, `GetTaskResultRequestSchema`, … to the right rule.
 - **SDK capability constructors** — the Python SDK's `ClientCapabilities(roots=RootsCapability())` is recognized structurally (high confidence), and `RootsCapability` / `SamplingCapability` / `LoggingCapability` are matched directly.
 - **`sessionIdGenerator`** — flagged only when it's a real generator, not the migrated `sessionIdGenerator: undefined`.
+- **aliased imports** — `import { InitializeRequestSchema as Init }` (TS) and `from mcp.types import RootsCapability as RC` (Python) are resolved back to their canonical names, so both the import line and the aliased usage sites are flagged. Namespace access (`types.InitializeRequestSchema`) is matched too.
+- **client-side session ownership** — a client transport constructed with a real `sessionId`/`session_id`, or a read of `transport.sessionId`; the migrated `sessionId: undefined` / `session_id=None` forms are recognized as benign.
 
-Validated against a broad corpus of real MCP servers (the official reference servers, TS + Python): **0 false positives**.
+**Measured, not vibes:** scanned against the official MCP reference servers and both SDK example suites at pinned commits — 447 files / ~44k LOC — every finding manually labeled: **105 findings, 104 true positives, 1 false positive**. Corpus, commit SHAs, per-pattern counts, labeled negatives, and the recall discussion are in [BENCHMARK.md](./BENCHMARK.md).
 
 ### Known limitations
 
+These are locked into the test suite as `test/fixtures/adversarial/missed/` — fixtures asserted to produce **zero** findings, so the claims below can't silently rot in either direction:
+
+- **Split/computed method strings** — `"tasks" + "/list"`, `` `tasks/${op}` ``, or `f"tasks/{x}"` are not reconstructed.
+- **Computed capability keys** — `{ ['roo'+'ts']: {} }` never exists as a single token.
+- **Generated/loop-driven registration** — method tables assembled from string fragments at runtime.
+- **Framework-adapter indirection** — routes built dynamically (`app.post('/rpc/' + ns + '/' + action, ...)`).
+- **Cross-module renames** — a wrapper module re-exporting an SDK constant under a new name is flagged *in the wrapper file*, but a consumer importing only the new name scans clean on its own. Scan whole projects, not single files.
 - **Python SDK decorator/method registration** — a handler wired purely as `@server.list_roots()` or a bare `session.list_roots()` call (with no capability declaration or method string in the file) is not matched, to avoid false positives on generic method names. The capability declaration in the same server is normally caught.
-- **Split/computed method strings** — `"tasks" + "/list"` or `f"tasks/{x}"` are not reconstructed.
 - The **regex fallback** (no Python interpreter) covers only the deterministic rules at reduced precision; install Python for full `.py` fidelity.
 
+This is the recall boundary of static analysis: it proves known patterns are *absent*, not that the server *speaks the new wire contract*. Cover the difference with the [runtime conformance fixtures](#runtime-conformance-fixtures).
+
 ## Programmatic API
 
 The scanner is usable as a library (typed) as well as a CLI — for editor extensions, custom CI steps, or migration harnesses:

package/dist/cli.js

@@ -44,6 +44,7 @@ const types_1 = require("./types");
 const constants_1 = require("./constants");
 const reporters_1 = require("./reporters");
 const autofix_1 = require("./autofix");
+const conformance_1 = require("./conformance");
 const CONF_VALUES = ['high', 'medium', 'low'];
 const FAILON_VALUES = ['breaking', 'any', 'none'];
 function fail(msg) {
@@ -79,6 +80,23 @@ function readIgnoreFile(dir) {
         return [];
     }
 }
+// `mcp-vet fixtures [dir]` — emit the protocol-level conformance fixtures that
+// pair with the static scan (runtime wire-contract checks a linter can't make).
+// Dispatched before commander so the scan pipeline stays untouched; a directory
+// literally named "fixtures" can still be scanned as `mcp-vet ./fixtures`.
+if (process.argv[2] === 'fixtures') {
+    const rawDir = process.argv[3];
+    const dir = path.resolve(process.cwd(), rawDir && !rawDir.startsWith('-') ? rawDir : 'mcp-vet-fixtures');
+    try {
+        const res = (0, conformance_1.emitConformanceFixtures)(dir);
+        console.log(`mcp-vet: wrote ${res.files.length} conformance file(s) to ${res.dir}`);
+        console.log('Replay them against your running server and work through CHECKLIST.md — including the dual-version (2025-11-25 + 2026-07-28) rollout matrix.');
+        process.exit(0);
+    }
+    catch (err) {
+        fail(`could not write fixtures: ${err.message}`);
+    }
+}
 const program = new commander_1.Command();
 program
     .name('mcp-vet')
@@ -106,6 +124,7 @@ program
     .option('--no-color', 'disable colored output')
     .option('--quiet', 'suppress the human-readable terminal report')
     .version((0, constants_1.getVersion)(), '-v, --version')
+    .addHelpText('after', '\nCommands:\n  fixtures [dir]  write protocol-level conformance fixtures + CHECKLIST.md (default: ./mcp-vet-fixtures)')
     .showHelpAfterError();
 program.parse(process.argv);
 const opts = program.opts();

package/dist/conformance.d.ts

@@ -0,0 +1,24 @@
+export interface ConformanceStep {
+    /** what to send — a JSON-RPC body, plus any required HTTP headers */
+    send: {
+        headers?: Record<string, string>;
+        body: unknown;
+    };
+    /** what a conformant 2026-07-28 server must do with it */
+    expect: string;
+}
+export interface ConformanceFixture {
+    /** file stem, e.g. "01-discover" */
+    id: string;
+    title: string;
+    /** why this fixture exists — the failure mode it exposes */
+    description: string;
+    steps: ConformanceStep[];
+}
+export declare const CONFORMANCE_FIXTURES: ConformanceFixture[];
+export interface EmitResult {
+    dir: string;
+    files: string[];
+}
+/** Write all conformance fixtures plus CHECKLIST.md into `dir`. */
+export declare function emitConformanceFixtures(dir: string): EmitResult;

package/dist/conformance.js

@@ -0,0 +1,310 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFORMANCE_FIXTURES = void 0;
+exports.emitConformanceFixtures = emitConformanceFixtures;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const constants_1 = require("./constants");
+/**
+ * Protocol-level conformance fixtures — the runtime companion to the static
+ * scan. Static analysis proves known legacy patterns are *absent*; only
+ * wire-level tests prove the server actually *speaks* the 2026-07-28 contract.
+ * `mcp-vet fixtures <dir>` emits these as ready-to-fire JSON files plus a
+ * checklist, so a migration harness (curl, supertest, pytest, ...) can replay
+ * them against a real server during rollout.
+ */
+const NEW_REV = '2026-07-28';
+const OLD_REV = '2025-11-25';
+/** The per-request `_meta` that replaces the removed initialize handshake. */
+const META = {
+    protocolVersion: NEW_REV,
+    clientInfo: { name: 'mcp-vet-conformance', version: '1.0.0' },
+    capabilities: { tools: {} },
+};
+const rpc = (id, method, params = {}) => ({
+    jsonrpc: '2.0',
+    id,
+    method,
+    params: { ...params, _meta: META },
+});
+const routingHeaders = (method, name) => ({
+    'Content-Type': 'application/json',
+    'Mcp-Method': method,
+    ...(name ? { 'Mcp-Name': name } : {}),
+});
+exports.CONFORMANCE_FIXTURES = [
+    {
+        id: '01-discover',
+        title: 'server/discover replaces the initialize handshake',
+        description: 'A fresh connection must be able to discover server info and capabilities via server/discover with no prior handshake of any kind.',
+        steps: [
+            {
+                send: { headers: routingHeaders('server/discover'), body: rpc(1, 'server/discover') },
+                expect: 'HTTP 200 with a result carrying serverInfo, capabilities, and protocolVersion "' +
+                    NEW_REV +
+                    '". Any "session not initialized" style error is a conformance failure.',
+            },
+        ],
+    },
+    {
+        id: '02-per-request-meta',
+        title: 'every request carries and honors _meta',
+        description: 'protocolVersion, clientInfo, and capabilities travel in _meta on every request. A cold request (no prior traffic) must succeed on _meta alone.',
+        steps: [
+            {
+                send: { headers: routingHeaders('tools/list'), body: rpc(1, 'tools/list') },
+                expect: 'HTTP 200 with the tool list. The server must not require any earlier request.',
+            },
+            {
+                send: {
+                    headers: routingHeaders('tools/list'),
+                    body: { jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} },
+                },
+                expect: 'Request WITHOUT _meta: the server must refuse explicitly (JSON-RPC error, e.g. -32602) — not silently assume a protocol revision.',
+            },
+        ],
+    },
+    {
+        id: '03-http-routing-headers',
+        title: 'Mcp-Method / Mcp-Name headers must mirror the body',
+        description: 'Streamable HTTP requires routing headers that mirror the JSON-RPC body; a mismatch must be rejected, not routed by either half.',
+        steps: [
+            {
+                send: {
+                    headers: routingHeaders('tools/call', 'echo'),
+                    body: rpc(1, 'tools/call', { name: 'echo', arguments: {} }),
+                },
+                expect: 'HTTP 200 — headers and body agree.',
+            },
+            {
+                send: {
+                    headers: routingHeaders('tools/list'),
+                    body: rpc(2, 'tools/call', { name: 'echo', arguments: {} }),
+                },
+                expect: 'HTTP 4xx rejection — the Mcp-Method header says tools/list but the body says tools/call. Accepting either interpretation is a conformance failure.',
+            },
+        ],
+    },
+    {
+        id: '04-stateless-auth',
+        title: 'auth context is derived per-request, not per-session',
+        description: 'With sessions gone there is nowhere to cache an auth handshake. Every request must be authorized from its own credentials.',
+        steps: [
+            {
+                send: {
+                    headers: { ...routingHeaders('tools/list'), Authorization: 'Bearer <token>' },
+                    body: rpc(1, 'tools/list'),
+                },
+                expect: 'HTTP 200. The same request against a server instance that has never seen this client before must behave identically (no session-bound token cache).',
+            },
+            {
+                send: { headers: routingHeaders('tools/list'), body: rpc(2, 'tools/list') },
+                expect: 'If the server requires auth: HTTP 401/403 on EVERY unauthenticated request — not just the first one of a "session".',
+            },
+        ],
+    },
+    {
+        id: '05-task-handle-lifecycle',
+        title: 'task handles: explicit creation and resume',
+        description: 'tools/call returns a task handle; the client drives it with tasks/get / tasks/update / tasks/cancel using the new argument shapes. tasks/list and tasks/result no longer exist.',
+        steps: [
+            {
+                send: {
+                    headers: routingHeaders('tools/call', 'long-running'),
+                    body: rpc(1, 'tools/call', { name: 'long-running', arguments: {} }),
+                },
+                expect: 'Result contains a task handle (task.taskId per the ' + NEW_REV + ' schema).',
+            },
+            {
+                send: {
+                    headers: routingHeaders('tasks/get'),
+                    body: rpc(2, 'tasks/get', { taskId: '<handle-from-step-1>' }),
+                },
+                expect: 'Task status (and result once terminal) — including when this request lands on a DIFFERENT server instance than step 1. Poll tasks/get; there is no blocking tasks/result.',
+            },
+            {
+                send: { headers: routingHeaders('tasks/list'), body: rpc(3, 'tasks/list') },
+                expect: 'JSON-RPC method-not-found (-32601). tasks/list is removed.',
+            },
+            {
+                send: {
+                    headers: routingHeaders('tasks/result'),
+                    body: rpc(4, 'tasks/result', { taskId: '<handle-from-step-1>' }),
+                },
+                expect: 'JSON-RPC method-not-found (-32601). tasks/result is removed (SEP-2663).',
+            },
+        ],
+    },
+    {
+        id: '06-duplicate-requests',
+        title: 'duplicate request delivery is safe',
+        description: 'Stateless HTTP means retried deliveries happen. Sending the identical request twice must not corrupt state or fail on the second delivery.',
+        steps: [
+            {
+                send: {
+                    headers: routingHeaders('tools/call', 'echo'),
+                    body: rpc(1, 'tools/call', { name: 'echo', arguments: { value: 'dup' } }),
+                },
+                expect: 'HTTP 200.',
+            },
+            {
+                send: {
+                    headers: routingHeaders('tools/call', 'echo'),
+                    body: rpc(1, 'tools/call', { name: 'echo', arguments: { value: 'dup' } }),
+                },
+                expect: 'Same request, same id, delivered again: a conformant server handles it without "already initialized" / duplicate-session errors.',
+            },
+        ],
+    },
+    {
+        id: '07-retry-other-instance',
+        title: 'retry against a different server instance',
+        description: 'Run the same sequence against two separate instances (or restart the server between steps). Nothing may depend on in-memory per-client state.',
+        steps: [
+            {
+                send: { headers: routingHeaders('tools/list'), body: rpc(1, 'tools/list') },
+                expect: 'Send to instance A: HTTP 200.',
+            },
+            {
+                send: { headers: routingHeaders('tools/list'), body: rpc(2, 'tools/list') },
+                expect: 'Send to instance B (no prior traffic from this client): identical behavior. Divergence means hidden session state survived the migration.',
+            },
+        ],
+    },
+    {
+        id: '08-tools-list-cache-invalidation',
+        title: 'tools/list cache invalidation',
+        description: 'Without a session there is no notifications channel to piggyback list_changed on outside of an active request. Clients must revalidate; servers must not serve a stale list after tool changes.',
+        steps: [
+            {
+                send: { headers: routingHeaders('tools/list'), body: rpc(1, 'tools/list') },
+                expect: 'Baseline tool list.',
+            },
+            {
+                send: { headers: routingHeaders('tools/list'), body: rpc(2, 'tools/list') },
+                expect: 'After the server adds/removes a tool (harness step): the new list. If the deployment caches tool lists, verify the cache is invalidated on change.',
+            },
+        ],
+    },
+    {
+        id: '09-downgrade-refusal',
+        title: 'old-revision requests are refused, not silently accepted',
+        description: 'A request declaring protocolVersion ' +
+            OLD_REV +
+            ' (or arriving in the old handshake style) must get an explicit refusal — processing it under new semantics silently is the worst failure mode.',
+        steps: [
+            {
+                send: {
+                    headers: routingHeaders('tools/list'),
+                    body: {
+                        jsonrpc: '2.0',
+                        id: 1,
+                        method: 'tools/list',
+                        params: { _meta: { ...META, protocolVersion: OLD_REV } },
+                    },
+                },
+                expect: 'Explicit JSON-RPC error naming the supported revision(s) — unless the server intentionally supports both revisions during rollout, in which case it must apply ' +
+                    OLD_REV +
+                    ' semantics consistently for this request.',
+            },
+            {
+                send: {
+                    headers: routingHeaders('initialize'),
+                    body: {
+                        jsonrpc: '2.0',
+                        id: 2,
+                        method: 'initialize',
+                        params: { protocolVersion: OLD_REV, clientInfo: META.clientInfo, capabilities: {} },
+                    },
+                },
+                expect: 'A ' +
+                    NEW_REV +
+                    '-only server: method-not-found (-32601). A dual-revision server: a valid ' +
+                    OLD_REV +
+                    ' initialize result. Anything else (crash, silent success under new semantics) fails.',
+            },
+        ],
+    },
+];
+function checklist() {
+    const lines = [
+        '# mcp-vet conformance checklist (2026-07-28)',
+        '',
+        'The static scan proves known legacy patterns are absent from your source.',
+        'These fixtures prove the running server actually speaks the new wire contract.',
+        'Replay each `*.json` fixture against your server with your HTTP harness of',
+        'choice (curl, supertest, pytest + httpx, ...) and check the `expect` notes.',
+        '',
+        `Spec: ${constants_1.SPEC_URL}`,
+        '',
+        '## The dual-version rollout matrix',
+        '',
+        `**July 28 is a specification release date, not a switch that remotely disables`,
+        `existing deployments.** Breakage appears when a client and server negotiate or`,
+        `require the new revision. Until every client you care about has moved, your`,
+        `production test matrix needs BOTH paths:`,
+        '',
+        `- \`${OLD_REV}\` client -> your server (old semantics, or an explicit refusal)`,
+        `- \`${NEW_REV}\` client -> your server (new semantics)`,
+        '',
+        'Run fixture 09 in both configurations. Verify refusal is explicit — a server',
+        'that silently accepts a request under the wrong semantics is the failure mode',
+        'that reaches production.',
+        '',
+        '## Fixtures',
+        '',
+    ];
+    for (const f of exports.CONFORMANCE_FIXTURES) {
+        lines.push(`- [ ] **${f.id}** — ${f.title}`);
+        lines.push(`      ${f.description}`);
+    }
+    lines.push('', '## Client-side assumptions (test these too)', '', 'Reliability bugs also hide in clients that still behave as if they own a', 'session while the server is stateless:', '', '- [ ] client works with `sessionId: undefined` / no stored session id', '- [ ] client sends full `_meta` on every request, not just the first', '- [ ] client survives its next request landing on a different server instance', '- [ ] client retries do not depend on server-side per-client state', '- [ ] client revalidates tools/list instead of trusting list_changed pushes', '');
+    return lines.join('\n');
+}
+/** Write all conformance fixtures plus CHECKLIST.md into `dir`. */
+function emitConformanceFixtures(dir) {
+    fs.mkdirSync(dir, { recursive: true });
+    const files = [];
+    for (const f of exports.CONFORMANCE_FIXTURES) {
+        const p = path.join(dir, `${f.id}.json`);
+        fs.writeFileSync(p, JSON.stringify(f, null, 2) + '\n', 'utf8');
+        files.push(p);
+    }
+    const cl = path.join(dir, 'CHECKLIST.md');
+    fs.writeFileSync(cl, checklist(), 'utf8');
+    files.push(cl);
+    return { dir, files };
+}

package/dist/index.d.ts

@@ -23,6 +23,8 @@ export { applyFixes, isFixable } from './autofix';
 export type { FixResult } from './autofix';
 export { renderJson, renderMarkdown, renderSarif, toPublicFinding } from './reporters';
 export { RULES } from './rules';
+export { CONFORMANCE_FIXTURES, emitConformanceFixtures } from './conformance';
+export type { ConformanceFixture, ConformanceStep, EmitResult } from './conformance';
 export { IgnoreMatcher } from './ignore';
 export { SPEC_URL, SPEC_DATE, CHANGELOG_URL, MANUAL_REVIEW, getVersion } from './constants';
 export { ALL_PATTERN_IDS } from './types';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ALL_PATTERN_IDS = exports.getVersion = exports.MANUAL_REVIEW = exports.CHANGELOG_URL = exports.SPEC_DATE = exports.SPEC_URL = exports.IgnoreMatcher = exports.RULES = exports.toPublicFinding = exports.renderSarif = exports.renderMarkdown = exports.renderJson = exports.isFixable = exports.applyFixes = exports.ScanError = exports.scan = void 0;
+exports.ALL_PATTERN_IDS = exports.getVersion = exports.MANUAL_REVIEW = exports.CHANGELOG_URL = exports.SPEC_DATE = exports.SPEC_URL = exports.IgnoreMatcher = exports.emitConformanceFixtures = exports.CONFORMANCE_FIXTURES = exports.RULES = exports.toPublicFinding = exports.renderSarif = exports.renderMarkdown = exports.renderJson = exports.isFixable = exports.applyFixes = exports.ScanError = exports.scan = void 0;
 /**
  * Programmatic API for mcp-vet.
  *
@@ -33,6 +33,9 @@ Object.defineProperty(exports, "renderSarif", { enumerable: true, get: function
 Object.defineProperty(exports, "toPublicFinding", { enumerable: true, get: function () { return reporters_1.toPublicFinding; } });
 var rules_1 = require("./rules");
 Object.defineProperty(exports, "RULES", { enumerable: true, get: function () { return rules_1.RULES; } });
+var conformance_1 = require("./conformance");
+Object.defineProperty(exports, "CONFORMANCE_FIXTURES", { enumerable: true, get: function () { return conformance_1.CONFORMANCE_FIXTURES; } });
+Object.defineProperty(exports, "emitConformanceFixtures", { enumerable: true, get: function () { return conformance_1.emitConformanceFixtures; } });
 var ignore_1 = require("./ignore");
 Object.defineProperty(exports, "IgnoreMatcher", { enumerable: true, get: function () { return ignore_1.IgnoreMatcher; } });
 var constants_1 = require("./constants");

package/dist/python/mcp_ast_scan.py

@@ -23,7 +23,9 @@ CAP = {"roots", "sampling", "logging"}
 INIT_STRINGS = {"initialize", "notifications/initialized"}
 HANDLERISH = re.compile(r"handler|handle|register|route|request|notification|method|^on$", re.I)
 CAPS_RE = re.compile(r"capabilit", re.I)
+TRANSPORTISH = re.compile(r"transport|client", re.I)
 METHODISH = ("method", "type")
+SESSION_KWARGS = ("session_id", "sessionId")
 
 
 def _func_mentions_caps(func):
@@ -103,10 +105,40 @@ def _is_registration(node):
     return False
 
 
+def _func_name(func):
+    if isinstance(func, ast.Attribute):
+        return func.attr
+    if isinstance(func, ast.Name):
+        return func.id
+    return ""
+
+
+def _base_name(node):
+    """Leftmost usable name of an attribute chain (`transport.session_id` -> 'transport')."""
+    if isinstance(node, ast.Attribute):
+        return _base_name(node.value) or node.attr
+    if isinstance(node, ast.Name):
+        return node.id
+    return ""
+
+
+def _collect_aliases(tree):
+    """Map local alias -> canonical imported name, so `from mcp.types import
+    RootsCapability as RC` still flags `RC()` usage sites (and the import line)."""
+    aliases = {}
+    for n in ast.walk(tree):
+        if isinstance(n, (ast.Import, ast.ImportFrom)):
+            for a in n.names:
+                if a.asname and a.asname != a.name:
+                    aliases[a.asname] = a.name.rsplit(".", 1)[-1]
+    return aliases
+
+
 class Scanner:
-    def __init__(self, lines):
+    def __init__(self, lines, aliases=None):
         self.tokens = []
         self.lines = lines
+        self.aliases = aliases or {}
 
     def _col(self, node):
         c = getattr(node, "col_offset", None)
@@ -136,8 +168,24 @@ class Scanner:
             )
         elif isinstance(node, ast.Name):
             self.tokens.append({"kind": "name", "value": node.id, "line": node.lineno, "col": self._col(node)})
+            # An aliased identifier also counts as its canonical imported name.
+            original = self.aliases.get(node.id)
+            if original:
+                self.tokens.append({"kind": "name", "value": original, "line": node.lineno, "col": self._col(node)})
         elif isinstance(node, ast.Attribute):
-            self.tokens.append({"kind": "name", "value": node.attr, "line": node.lineno, "col": self._col(node)})
+            tok = {"kind": "name", "value": node.attr, "line": node.lineno, "col": self._col(node)}
+            # `transport.session_id` read = client-side session ownership.
+            if node.attr in SESSION_KWARGS and TRANSPORTISH.search(_base_name(node.value)):
+                tok["clientSession"] = True
+            self.tokens.append(tok)
+        elif isinstance(node, (ast.Import, ast.ImportFrom)):
+            # Surface imported names so `from mcp.types import X as Y` still
+            # flags the import line even though usages only say `Y`.
+            for a in node.names:
+                line = getattr(a, "lineno", None) or node.lineno
+                self.tokens.append(
+                    {"kind": "name", "value": a.name.rsplit(".", 1)[-1], "line": line, "col": self._col(a) or self._col(node)}
+                )
 
     def visit(self, node, in_caps):
         self.emit_for(node, in_caps)
@@ -168,6 +216,13 @@ class Scanner:
                     tok = {"kind": "key", "value": kw.arg, "line": line, "col": self._col(kw)}
                     if kw.arg in CAP:
                         tok["inCapabilities"] = caps_ctx
+                    # `session_id=` into a transport/client factory = the client
+                    # resuming/owning a session. `session_id=None` is migrated.
+                    if kw.arg in SESSION_KWARGS and TRANSPORTISH.search(_func_name(node.func)):
+                        if isinstance(kw.value, ast.Constant) and kw.value.value is None:
+                            tok["benign"] = True
+                        else:
+                            tok["clientSession"] = True
                     self.tokens.append(tok)
                 child_caps = caps_ctx or (kw.arg == "capabilities")
                 self.visit(kw.value, child_caps)
@@ -185,7 +240,7 @@ def scan_source(src):
     for n in ast.walk(tree):
         for c in ast.iter_child_nodes(n):
             c.parent = n
-    scanner = Scanner(src.split("\n"))
+    scanner = Scanner(src.split("\n"), _collect_aliases(tree))
     try:
         scanner.visit(tree, False)
     except RecursionError:

package/dist/reporters.js

@@ -117,6 +117,7 @@ function reportTerminal(result, opts = {}) {
 /** One-line pointer to the changes static analysis can't catch — keeps the tool honest. */
 function printManualReview(c) {
     console.error(c.gray(`note: ${constants_1.MANUAL_REVIEW.length} more 2026-07-28 changes need manual review (SSE push, required headers, auth, JSON Schema 2020-12) — see the README "Needs manual review" section.`));
+    console.error(c.gray('note: July 28 is a spec release, not a remote kill switch — breakage appears when a client/server pair negotiates the new revision. Test both 2025-11-25 and 2026-07-28 paths during rollout (`mcp-vet fixtures`).'));
 }
 function mdEscape(s) {
     return s.replace(/\|/g, '\\|').replace(/\r?\n/g, ' ');

package/dist/rules.js

@@ -232,6 +232,16 @@ function applyRules(relPath, lines, tokens, opts) {
             !t.benign) {
             push('MCP_SESSION_ID', t, 'medium');
         }
+        // Rule 11 — client-side session ownership. A client transport constructed
+        // with a real sessionId / session_id, or a read of transport.sessionId,
+        // means the client still behaves as if it owns a session — which breaks
+        // against a stateless 2026-07-28 server even when the server scans clean.
+        if ((t.kind === 'key' || t.kind === 'name') &&
+            (v === 'sessionId' || v === 'session_id') &&
+            t.clientSession &&
+            !t.benign) {
+            push('MCP_SESSION_ID', t, 'medium');
+        }
         // Rules 5-7 — deprecated capabilities.
         // High confidence when structurally inside a `capabilities` object (AST);
         // medium when only within 5 lines of a "capabilities" mention.

package/dist/ts-analyzer.js

@@ -41,6 +41,26 @@ function safePropName(node) {
         return undefined;
     }
 }
+const TRANSPORTISH = /transport|client/i;
+/**
+ * Is `node` inside a call/constructor argument of something transport/client
+ * shaped (e.g. `new StreamableHTTPClientTransport(url, { sessionId })`)?
+ * Drives the client-side session-ownership check.
+ */
+function isClientTransportContext(node) {
+    let depth = 0;
+    for (const anc of node.getAncestors()) {
+        if (depth++ > 8)
+            break;
+        const k = anc.getKind();
+        if (k === ts_morph_1.SyntaxKind.CallExpression || k === ts_morph_1.SyntaxKind.NewExpression) {
+            const expr = anc.getExpression?.();
+            if (expr && TRANSPORTISH.test(expr.getText()))
+                return true;
+        }
+    }
+    return false;
+}
 /** Is `node` structurally inside a `capabilities` object / call argument? */
 function isInCapabilities(node) {
     let depth = 0;
@@ -143,6 +163,22 @@ function analyzeTs(absPath, text) {
             return { line: node.getStartLineNumber(), col: undefined };
         }
     };
+    // Aliased named imports (`import { InitializeRequestSchema as Init }`): map the
+    // local alias back to its canonical SDK name so *usage sites* are flagged too,
+    // not just the import line where the original identifier happens to appear.
+    const aliases = new Map();
+    try {
+        for (const imp of sf.getImportDeclarations()) {
+            for (const spec of imp.getNamedImports()) {
+                const aliasNode = spec.getAliasNode();
+                if (aliasNode)
+                    aliases.set(aliasNode.getText(), spec.getName());
+            }
+        }
+    }
+    catch {
+        /* ignore malformed imports */
+    }
     try {
         sf.forEachDescendant((node) => {
             const kind = node.getKind();
@@ -183,10 +219,33 @@ function analyzeTs(absPath, text) {
             }
             if (kind === ts_morph_1.SyntaxKind.Identifier) {
                 const { line, col } = posOf(node);
-                tokens.push({ kind: 'name', value: node.getText(), line, col });
+                const text = node.getText();
+                tokens.push({ kind: 'name', value: text, line, col });
+                // An aliased identifier also counts as its canonical imported name —
+                // except inside the import specifier itself, where the original
+                // identifier is already present (avoids a duplicate import-line finding).
+                const original = aliases.get(text);
+                if (original && node.getParent()?.getKind() !== ts_morph_1.SyntaxKind.ImportSpecifier) {
+                    tokens.push({ kind: 'name', value: original, line, col });
+                }
                 return;
             }
         });
+        // Client-side session ownership: reads of `<transport>.sessionId` mean the
+        // client still behaves as if it owns a session against a stateless server.
+        for (const pae of sf.getDescendantsOfKind(ts_morph_1.SyntaxKind.PropertyAccessExpression)) {
+            try {
+                if (pae.getName() !== 'sessionId')
+                    continue;
+                if (!TRANSPORTISH.test(pae.getExpression().getText()))
+                    continue;
+                const { line, col } = posOf(pae.getNameNode());
+                tokens.push({ kind: 'name', value: 'sessionId', line, col, clientSession: true });
+            }
+            catch {
+                /* ignore */
+            }
+        }
         // Object literal keys (roots:, "sampling":, logging shorthand, ...)
         const emitKey = (nameNode, value, benign = false) => {
             const { line, col } = posOf(nameNode);
@@ -195,14 +254,20 @@ function analyzeTs(absPath, text) {
                 tok.inCapabilities = isInCapabilities(nameNode);
             if (benign)
                 tok.benign = true;
+            // `sessionId` passed into a client transport constructor/factory = the
+            // client resuming/owning a session.
+            if (value === 'sessionId' && isClientTransportContext(nameNode)) {
+                tok.clientSession = true;
+            }
             tokens.push(tok);
         };
         for (const pa of sf.getDescendantsOfKind(ts_morph_1.SyntaxKind.PropertyAssignment)) {
             try {
                 const name = pa.getName();
-                // `sessionIdGenerator: undefined` (or null) is the migrated, stateless form.
+                // `sessionIdGenerator: undefined` / `sessionId: undefined` (or null) is
+                // the migrated, stateless form.
                 let benign = false;
-                if (name === 'sessionIdGenerator') {
+                if (name === 'sessionIdGenerator' || name === 'sessionId') {
                     const init = pa.getInitializer()?.getText();
                     benign = init === 'undefined' || init === 'null';
                 }

package/dist/types.d.ts

@@ -31,6 +31,13 @@ export interface Token {
      * e.g. `sessionIdGenerator: undefined`, the documented stateless migration.
      */
     benign?: boolean;
+    /**
+     * True when a `sessionId`/`session_id` token sits in *client-side* session
+     * ownership context — a client transport constructed with a session id, or a
+     * read of `transport.sessionId`. Client code that still owns a session breaks
+     * against a stateless server even when the server itself scans clean.
+     */
+    clientSession?: boolean;
 }
 export interface Finding {
     /** path relative to the scan root, forward-slashed */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@booyaka/mcp-vet",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Scan MCP server source code for patterns that break under the 2026-07-28 Model Context Protocol spec release candidate.",
   "type": "commonjs",
   "main": "dist/index.js",
@@ -21,6 +21,7 @@
     "schema",
     "README.md",
     "CHANGELOG.md",
+    "BENCHMARK.md",
     "LICENSE"
   ],
   "engines": {