@booyaka/mcp-vet 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to `mcp-vet` are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0]
+
+The full 2026-07-28 compliance suite — `mcp-vet probe --spec-version 2026-07-28`
+now covers all three breaking changes the release candidate makes to server
+behavior, not just the removed handshake.
+
+### Added
+
+- **`missing-server-discover` (ERROR, `--spec-version 2026-07-28`)** — calls
+  the `server/discover` RPC that every 2026-07-28 server MUST implement
+  (SEP-2575; it replaces the removed initialize handshake for up-front
+  capability discovery) and flags a server whose answer is an error, a hang, or
+  a result missing the required `capabilities` key. The spec defines
+  `server/discover` as JSON-RPC only — 2026-07-28 removes the HTTP GET
+  endpoint, so no `GET /mcp/discover` variant is probed.
+- **`legacy-resource-error-code` (ERROR, `--spec-version 2026-07-28`)** — reads
+  a deliberately nonexistent resource URI (`mcp-vet://probe/...`) and flags a
+  server that still answers `-32002` instead of the JSON-RPC standard `-32602`
+  (Invalid Params). Servers without `resources/read` (`-32601`) are skipped,
+  not flagged; unexpected codes are reported as inconclusive notes.
+- **`mcp-vet run`** — an alias for `mcp-vet probe`.
+- **`test/probe-fixtures/server-partial.mjs`** — a hybrid (handshake +
+  stateless) fixture with exactly one migration defect per mode
+  (`legacy-error-code` / `no-discover` / `bad-discover`), isolating each new
+  rule; 7 new tests (62 total), including proof that the new checks are gated
+  behind `--spec-version 2026-07-28` and the default probe is unchanged.
+
+### Changed
+
+- The stateless first request now sends the RC's exact namespaced `_meta` key
+  `io.modelcontextprotocol/clientCapabilities` (was the incorrect
+  `io.modelcontextprotocol/capabilities`); the stateless fixtures now *require*
+  the namespaced keys, locking the wire format into the tests.
+- The new checks run on whichever contact path succeeded (stateless or classic
+  fallback), so a handshake-only legacy server gets its complete 2026-07-28
+  migration report — handshake + discover findings — in a single probe.
+- `ProbeResult` gains `discoverOk` and `errorCodeOk` verdict fields.
+
 ## [0.5.0]
 
 The runtime-probe release — `mcp-vet probe` connects to a *running* MCP server

package/README.md

@@ -215,18 +215,21 @@ Each fixture is a plain JSON description (`send` headers + JSON-RPC body, `expec
 
 ## Vet a running server (`mcp-vet probe`)
 
-Where the scan reads your *source*, `probe` talks to your *running server* over the wire — stdio (a command it spawns) or Streamable HTTP (a URL) — and checks the two 2026-07-28 violations that only exist at runtime:
+Where the scan reads your *source*, `probe` talks to your *running server* over the wire — stdio (a command it spawns) or Streamable HTTP (a URL) — and checks the 2026-07-28 violations that only exist at runtime (`run` is an alias: `mcp-vet run …` ≡ `mcp-vet probe …`):
 
 | ID | Severity | What it checks |
 | --- | --- | --- |
 | `json-schema-dialect` | 🟡 WARN | calls `tools/list` and inspects every tool's `inputSchema`/`outputSchema` for a pre-2020-12 JSON Schema dialect ([SEP-2106](https://modelcontextprotocol.io/seps/2106-json-schema-2020-12)) — an explicit draft-04/-06/-07 `$schema` (**high** confidence), or no `$schema` but draft-only keyword forms: `definitions` instead of `$defs`, `$ref: "#/definitions/…"`, boolean `exclusiveMinimum`/`exclusiveMaximum`, array-form `items` (**medium** confidence) |
-| `requires-initialize-handshake` | 🔴 ERROR | with `--spec-version 2026-07-28`: makes a **stateless first request** — no `initialize`, capabilities/clientInfo/protocolVersion in `_meta` per the RC — and flags a server that rejects it or hangs waiting for the removed handshake |
+| `requires-initialize-handshake` | 🔴 ERROR | with `--spec-version 2026-07-28`: makes a **stateless first request** — no `initialize`, protocolVersion/clientInfo/clientCapabilities in namespaced `_meta` keys per the RC — and flags a server that rejects it or hangs waiting for the removed handshake. A valid `tools` array in the answer is asserted, not just a 200 |
+| `missing-server-discover` | 🔴 ERROR | with `--spec-version 2026-07-28`: calls the **`server/discover`** RPC that every 2026-07-28 server MUST implement ([SEP-2575](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2575) — it replaces the handshake for up-front capability discovery) and flags a server whose answer is an error or lacks the required `capabilities` key. (The spec defines `server/discover` as JSON-RPC only — 2026-07-28 *removes* the HTTP GET endpoint, so there is no `GET /mcp/discover` to fall back to) |
+| `legacy-resource-error-code` | 🔴 ERROR | with `--spec-version 2026-07-28`: reads a deliberately nonexistent resource URI and flags a server that still answers with the MCP-custom **`-32002`** instead of the JSON-RPC standard **`-32602`** (Invalid Params). Servers without `resources/read` (`-32601`) are skipped, not flagged |
 
 ```bash
 # vet the schemas of a stdio server (spawns the command; a lone .js file runs with Node)
 npx @booyaka/mcp-vet probe node ./dist/server.js
 
-# full 2026-07-28 readiness: stateless first contact + schema dialects
+# full 2026-07-28 readiness: stateless first contact + server/discover +
+# resource error code + schema dialects
 npx @booyaka/mcp-vet probe --spec-version 2026-07-28 http://localhost:3000/mcp
 ```
 
@@ -234,21 +237,39 @@ npx @booyaka/mcp-vet probe --spec-version 2026-07-28 http://localhost:3000/mcp
 mcp-vet probe — node ./dist/server.js · spec 2026-07-28 · stdio · 12 tool(s) listed
   stateless probe: stateless tools/list was rejected: -32002 Server not initialized
   fallback probe: initialize handshake + tools/list succeeded
+  server/discover: rejected (-32601)
+  resource error-code check skipped — server does not implement resources/read (-32601)
 
 ERROR  requires-initialize-handshake [high]
     The server rejected (or hung on) a stateless 2026-07-28-style first request ...
+ERROR  missing-server-discover [high]
+    The 2026-07-28 spec requires every server to implement the server/discover RPC ...
 WARN   json-schema-dialect [high]
     tool "echo" inputSchema: $schema = http://json-schema.org/draft-07/schema# (draft-07)
 ```
 
-The stateless verdict is **cross-checked** before it becomes a violation: `requires-initialize-handshake` is only emitted when the classic `2025-11-25` handshake path *does* work — a dead or non-MCP server is an operational error (exit 2), never a false violation. The dialect walker recurses only into schema positions (applicators like `properties`/`allOf`), so a *property* literally named `definitions` is never mistaken for the draft-07 keyword, and an explicit 2020-12 `$schema` declaration is trusted.
+The stateless verdict is **cross-checked** before it becomes a violation: `requires-initialize-handshake` is only emitted when the classic `2025-11-25` handshake path *does* work — a dead or non-MCP server is an operational error (exit 2), never a false violation. The `server/discover` and error-code checks then run on whichever contact path succeeded, so even a handshake-only server gets its complete migration report in one probe. The dialect walker recurses only into schema positions (applicators like `properties`/`allOf`), so a *property* literally named `definitions` is never mistaken for the draft-07 keyword, and an explicit 2020-12 `$schema` declaration is trusted.
+
+### `--spec-version` — which revision to vet against
+
+| Value | Behavior |
+| --- | --- |
+| `2025-11-25` *(default)* | today's stable contract: classic `initialize` handshake, then the `json-schema-dialect` check. **No 2026-07-28 assertions run** — a fully 2025-era server probes clean |
+| `2026-07-28` | the full new-spec compliance suite: stateless first contact, required `server/discover`, `-32602` resource error code, plus the dialect check |
+
+**Migration note.** The default stays `2025-11-25` so existing CI invocations keep their exact behavior — add the flag when *you* are ready, not when the spec ships. A practical rollout:
+
+1. Today: `mcp-vet probe <server>` (unchanged) plus the static scan in CI.
+2. When you start migrating: add a second CI job with `--spec-version 2026-07-28 --fail-on none` to *see* the new-spec violations without failing the build.
+3. When your server targets `2026-07-28` (e.g. after moving to `@modelcontextprotocol/server` 2.x): drop `--fail-on none` so the three ERROR-level checks gate the build. A correctly migrated server passes all of them; the pre-migration server fails `requires-initialize-handshake` and `missing-server-discover` immediately.
+4. Keep a `2025-11-25` probe in the matrix until every client you serve has moved (the rollout is a window, not a day — see [What actually happens on July 28](#what-actually-happens-on-july-28)).
 
 Probe findings use the same report formats as the scan: `--json` (machine-readable array on stdout) and `--sarif [file]` (SARIF 2.1.0 — `ERROR` maps to `error`, `WARN` to `warning`), plus `--fail-on breaking|any|none` (default `breaking`: exit 1 only on `ERROR`), `--timeout <ms>` (default 8000, also the hang-detection window), `--quiet`, and `--color`/`--no-color`.
 
-Try it against the official reference server — the July 2026 `@modelcontextprotocol/server-everything` answers stateless requests, but its tool schemas still declare draft-07, and `probe` catches all of them:
+Try it against the official reference server — the July 2026 `@modelcontextprotocol/server-everything` (beta 2026-07-28 SDK) answers stateless requests and already returns the new `-32602` resource error code, but it does not implement `server/discover` yet and its tool schemas still declare draft-07 — `probe` reports exactly that (1 ERROR, 13 WARN):
 
 ```bash
-npx @booyaka/mcp-vet probe --spec-version 2026-07-28 npx -y mcp-server-everything stdio
+npx @booyaka/mcp-vet probe --spec-version 2026-07-28 npx -y @modelcontextprotocol/server-everything stdio
 ```
 
 ## Usage
@@ -259,7 +280,7 @@ npx @booyaka/mcp-vet . --fix           # scan, and auto-apply the mechanical -32
 npx @booyaka/mcp-vet ./src ./packages  # multiple roots
 npx @booyaka/mcp-vet server.py         # a single file
 npx @booyaka/mcp-vet fixtures ./dir    # write runtime conformance fixtures + checklist (default: ./mcp-vet-fixtures)
-npx @booyaka/mcp-vet probe <url|cmd>   # vet a RUNNING server's wire behavior (see section above)
+npx @booyaka/mcp-vet probe <url|cmd>   # vet a RUNNING server's wire behavior (see section above; alias: run)
 ```
 
 Globs `**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}` and `**/*.py`, skipping `node_modules`, `.git`, `__pycache__`, `dist`, and `build`.
@@ -465,10 +486,10 @@ Also exported: `renderJson` / `renderMarkdown` / `renderSarif`, `RULES`, and the
 ```bash
 npm install      # installs deps and builds (via prepare)
 npm run build    # tsc -> dist/ + copies the Python script
-npm test         # builds, then runs the Node.js built-in test runner (55 tests)
+npm test         # builds, then runs the Node.js built-in test runner (62 tests)
 ```
 
-Test fixtures live in `test/fixtures/` (dirty TS + Python servers, a `clean/` server with zero violations, `negatives/` true-negatives, a `confidence/` gradient, and `suppress/` cases). Runtime-probe fixtures live in `test/probe-fixtures/` — minimal stdio + Streamable-HTTP MCP servers: one returning draft-07 schemas, one requiring the initialize handshake, and one fully stateless 2026-07-28-native.
+Test fixtures live in `test/fixtures/` (dirty TS + Python servers, a `clean/` server with zero violations, `negatives/` true-negatives, a `confidence/` gradient, and `suppress/` cases). Runtime-probe fixtures live in `test/probe-fixtures/` — minimal stdio + Streamable-HTTP MCP servers: one returning draft-07 schemas, one requiring the initialize handshake, one fully migrated 2026-07-28-native (stateless + `server/discover` + `-32602`), and a `server-partial.mjs` with one deliberate migration defect per mode (`legacy-error-code` / `no-discover` / `bad-discover`).
 
 ## License
 

package/dist/cli.js

@@ -99,9 +99,10 @@ if (process.argv[2] === 'fixtures') {
     }
 }
 // `mcp-vet probe [options] <url | command...>` — connect to a RUNNING server and
-// vet its wire behavior (JSON Schema dialect, stateless-protocol readiness).
+// vet its wire behavior (JSON Schema dialect, stateless-protocol readiness,
+// server/discover, resource error code). `run` is an alias for `probe`.
 // Async, so the scan pipeline only runs in the else-branch.
-if (process.argv[2] === 'probe') {
+if (process.argv[2] === 'probe' || process.argv[2] === 'run') {
     (0, probe_cli_1.runProbeCli)(process.argv.slice(3)).then((code) => process.exit(code), (err) => fail(err.message));
 }
 else {
@@ -139,8 +140,9 @@ function scanMain() {
         '',
         'Commands:',
         '  fixtures [dir]                 write protocol-level conformance fixtures + CHECKLIST.md (default: ./mcp-vet-fixtures)',
-        '  probe [options] <url|command>  connect to a RUNNING server and vet its wire behavior',
-        '                                 (JSON Schema 2020-12 dialect; with --spec-version 2026-07-28, stateless readiness)',
+        '  probe [options] <url|command>  connect to a RUNNING server and vet its wire behavior (alias: run)',
+        '                                 (JSON Schema 2020-12 dialect; with --spec-version 2026-07-28, also stateless',
+        '                                 readiness, the required server/discover RPC, and the -32602 resource error code)',
     ].join('\n'))
         .showHelpAfterError();
     program.parse(process.argv);

package/dist/probe-cli.js

@@ -58,7 +58,7 @@ async function runProbeCli(argv) {
     const program = new commander_1.Command();
     program
         .name('mcp-vet probe')
-        .description('Connect to a RUNNING MCP server (stdio command or Streamable HTTP URL) and vet its wire behavior: JSON Schema dialect of tool schemas (SEP-2106) and, with --spec-version 2026-07-28, stateless-protocol readiness.')
+        .description('Connect to a RUNNING MCP server (stdio command or Streamable HTTP URL) and vet its wire behavior: JSON Schema dialect of tool schemas (SEP-2106) and, with --spec-version 2026-07-28, stateless-protocol readiness, the required server/discover RPC (SEP-2575), and the -32002 → -32602 resource error-code change.')
         .argument('<target...>', 'server URL (http/https) or a command + args to spawn (stdio)')
         .option('--spec-version <version>', `MCP revision to vet against: ${types_1.SPEC_VERSIONS.join(' | ')}`, '2025-11-25')
         .option('--timeout <ms>', 'per-request timeout in milliseconds', '8000')

package/dist/probe.d.ts

@@ -27,6 +27,10 @@ export interface ProbeResult {
     statelessOk: boolean | null;
     /** classic initialize-handshake verdict; null = not attempted */
     handshakeOk: boolean | null;
+    /** server/discover verdict; null = not probed (spec 2025-11-25) */
+    discoverOk: boolean | null;
+    /** nonexistent-resource error-code verdict; null = not probed or inconclusive */
+    errorCodeOk: boolean | null;
     notes: string[];
 }
 export declare function targetLabel(target: ProbeTarget): string;

package/dist/probe.js

@@ -46,10 +46,19 @@ exports.probeServer = probeServer;
  *     2026-07-28) — makes a stateless first request (no initialize; capabilities
  *     travel in _meta per the 2026-07-28 RC). A server that rejects or hangs on
  *     it still requires the removed handshake.
+ *  3. `missing-server-discover` (ERROR, 2026-07-28 only) — calls the required
+ *     server/discover RPC (SEP-2575) and expects a result with a `capabilities`
+ *     key. There is no HTTP GET variant — 2026-07-28 removes the GET endpoint.
+ *  4. `legacy-resource-error-code` (ERROR, 2026-07-28 only) — reads a
+ *     deliberately nonexistent resource URI and flags a server that still
+ *     answers with the removed -32002 code instead of -32602 (Invalid Params).
+ *     Servers without resources support (-32601) are skipped, not flagged.
  *
  * The stateless verdict is cross-checked: the violation is only emitted when
  * the classic 2025-11-25 handshake path *does* work, so a dead/broken server is
- * reported as an operational error (exit 2), not a false violation.
+ * reported as an operational error (exit 2), not a false violation. Checks 3-4
+ * run on whichever contact path succeeded, so a legacy server gets a complete
+ * migration report in one probe.
  */
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
@@ -305,12 +314,12 @@ function openConnection(target, specVersion) {
 function clientInfo() {
     return { name: 'mcp-vet', version: (0, constants_1.getVersion)() };
 }
-/** _meta for a stateless 2026-07-28 first request (per the RC's namespaced keys). */
+/** _meta for a stateless 2026-07-28 request (per the RC's namespaced keys). */
 function statelessMeta() {
     return {
         'io.modelcontextprotocol/protocolVersion': '2026-07-28',
         'io.modelcontextprotocol/clientInfo': clientInfo(),
-        'io.modelcontextprotocol/capabilities': {},
+        'io.modelcontextprotocol/clientCapabilities': {},
     };
 }
 /** Stateless 2026-07-28 first contact: tools/list with _meta, NO initialize. */
@@ -319,6 +328,7 @@ async function tryStateless(target, opts) {
     try {
         const resp = await conn.request('tools/list', { _meta: statelessMeta() }, opts.timeoutMs);
         if (resp.error) {
+            conn.close();
             return {
                 ok: false,
                 evidence: `stateless tools/list was rejected: ${resp.error.code ?? '?'} ${resp.error.message ?? ''}`.trim(),
@@ -326,11 +336,13 @@ async function tryStateless(target, opts) {
         }
         const tools = resp.result?.tools;
         if (!Array.isArray(tools)) {
+            conn.close();
             return { ok: false, evidence: 'stateless tools/list answered without a tools array' };
         }
-        return { ok: true, tools, evidence: 'server answered a stateless tools/list (no initialize)' };
+        return { ok: true, tools, conn, evidence: 'server answered a stateless tools/list (no initialize)' };
     }
     catch (err) {
+        conn.close();
         if (err instanceof TimeoutError) {
             return {
                 ok: false,
@@ -339,9 +351,6 @@ async function tryStateless(target, opts) {
         }
         return { ok: false, evidence: err.message };
     }
-    finally {
-        conn.close();
-    }
 }
 /** Classic 2025-11-25 contact: initialize → notifications/initialized → tools/list. */
 async function tryClassic(target, opts) {
@@ -349,6 +358,7 @@ async function tryClassic(target, opts) {
     try {
         const init = await conn.request('initialize', { protocolVersion: '2025-11-25', capabilities: {}, clientInfo: clientInfo() }, opts.timeoutMs);
         if (init.error) {
+            conn.close();
             return {
                 ok: false,
                 evidence: `initialize was rejected: ${init.error.code ?? '?'} ${init.error.message ?? ''}`.trim(),
@@ -357,6 +367,7 @@ async function tryClassic(target, opts) {
         await conn.notify('notifications/initialized', {});
         const lst = await conn.request('tools/list', {}, opts.timeoutMs);
         if (lst.error) {
+            conn.close();
             return {
                 ok: false,
                 evidence: `tools/list after handshake was rejected: ${lst.error.code ?? '?'} ${lst.error.message ?? ''}`.trim(),
@@ -364,26 +375,106 @@ async function tryClassic(target, opts) {
         }
         const tools = lst.result?.tools;
         if (!Array.isArray(tools)) {
+            conn.close();
             return { ok: false, evidence: 'tools/list after handshake answered without a tools array' };
         }
-        return { ok: true, tools, evidence: 'initialize handshake + tools/list succeeded' };
+        return { ok: true, tools, conn, evidence: 'initialize handshake + tools/list succeeded' };
     }
     catch (err) {
+        conn.close();
         return { ok: false, evidence: err.message };
     }
-    finally {
-        conn.close();
+}
+/** server/discover is REQUIRED on 2026-07-28 (SEP-2575) and must advertise capabilities. */
+async function checkServerDiscover(conn, label, opts) {
+    try {
+        const resp = await conn.request('server/discover', { _meta: statelessMeta() }, opts.timeoutMs);
+        if (resp.error) {
+            const evidence = `server/discover was rejected: ${resp.error.code ?? '?'} ${resp.error.message ?? ''}`.trim();
+            return {
+                ok: false,
+                finding: runtimeFinding('missing-server-discover', label, evidence, 'high'),
+                note: `server/discover: rejected (${resp.error.code ?? '?'})`,
+            };
+        }
+        const caps = resp.result?.capabilities;
+        if (!caps || typeof caps !== 'object') {
+            const evidence = 'server/discover answered, but its result has no capabilities key';
+            return {
+                ok: false,
+                finding: runtimeFinding('missing-server-discover', label, evidence, 'high'),
+                note: 'server/discover: result missing the required capabilities key',
+            };
+        }
+        const versions = Array.isArray(resp.result?.supportedVersions)
+            ? ` · supportedVersions: ${resp.result.supportedVersions.join(', ')}`
+            : '';
+        return {
+            ok: true,
+            note: `server/discover: capabilities advertised (${Object.keys(caps).join(', ') || 'empty object'})${versions}`,
+        };
+    }
+    catch (err) {
+        if (err instanceof TimeoutError) {
+            // No reply at all — a compliant server (or a legacy one) would at least
+            // answer -32601. A hang is a failure, but not a deterministic one.
+            return {
+                ok: false,
+                finding: runtimeFinding('missing-server-discover', label, `server/discover hung (${err.message})`, 'medium'),
+                note: 'server/discover: no response (hung)',
+            };
+        }
+        return { ok: null, note: `server/discover: check inconclusive — ${err.message}` };
     }
 }
-function handshakeFinding(targetLabel, evidence) {
-    const rule = rules_1.RUNTIME_RULES['requires-initialize-handshake'];
+/** A URI no real server should resolve — used to elicit the not-found error code. */
+const NONEXISTENT_URI = 'mcp-vet://probe/nonexistent-resource';
+/** 2026-07-28 changes resource-not-found from -32002 to -32602 (Invalid Params). */
+async function checkResourceErrorCode(conn, label, opts) {
+    try {
+        const resp = await conn.request('resources/read', { uri: NONEXISTENT_URI, _meta: statelessMeta() }, opts.timeoutMs);
+        if (!resp.error) {
+            return {
+                ok: null,
+                note: `resource error-code check inconclusive — resources/read of ${NONEXISTENT_URI} unexpectedly succeeded`,
+            };
+        }
+        const code = resp.error.code;
+        if (code === -32002) {
+            const evidence = `resources/read of nonexistent ${NONEXISTENT_URI} returned the removed code -32002 (${resp.error.message ?? ''})`.trim();
+            return {
+                ok: false,
+                finding: runtimeFinding('legacy-resource-error-code', label, evidence, 'high'),
+                note: 'resource error code: -32002 (legacy — must be -32602)',
+            };
+        }
+        if (code === -32602) {
+            return { ok: true, note: 'resource error code: -32602 (Invalid Params — correct for 2026-07-28)' };
+        }
+        if (code === -32601) {
+            return {
+                ok: null,
+                note: 'resource error-code check skipped — server does not implement resources/read (-32601)',
+            };
+        }
+        return {
+            ok: null,
+            note: `resource error-code check inconclusive — nonexistent resource returned ${code ?? 'no code'} (neither -32002 nor -32602)`,
+        };
+    }
+    catch (err) {
+        return { ok: null, note: `resource error-code check inconclusive — ${err.message}` };
+    }
+}
+function runtimeFinding(ruleId, targetLabel, evidence, confidence = 'high') {
+    const rule = rules_1.RUNTIME_RULES[ruleId];
     return {
         file: targetLabel,
         line: 1,
         patternId: rule.id,
         patternLabel: rule.label,
         severity: rule.severity,
-        confidence: 'high',
+        confidence,
         explanation: rule.explanation,
         docUrl: rule.docUrl,
         before: evidence,
@@ -419,35 +510,58 @@ async function probeServer(target, opts) {
     let tools = null;
     let statelessOk = null;
     let handshakeOk = null;
-    if (opts.specVersion === '2026-07-28') {
-        const st = await tryStateless(target, opts);
-        statelessOk = st.ok;
-        notes.push(`stateless probe: ${st.evidence}`);
-        if (st.ok) {
-            tools = st.tools;
+    let discoverOk = null;
+    let errorCodeOk = null;
+    let conn = null;
+    try {
+        if (opts.specVersion === '2026-07-28') {
+            const st = await tryStateless(target, opts);
+            statelessOk = st.ok;
+            notes.push(`stateless probe: ${st.evidence}`);
+            if (st.ok) {
+                tools = st.tools;
+                conn = st.conn;
+            }
+            else {
+                const cl = await tryClassic(target, opts);
+                handshakeOk = cl.ok;
+                if (cl.ok) {
+                    // Confirmed: the server works — but only through the removed handshake.
+                    tools = cl.tools;
+                    conn = cl.conn;
+                    notes.push(`fallback probe: ${cl.evidence}`);
+                    findings.push(runtimeFinding('requires-initialize-handshake', label, st.evidence));
+                }
+                else {
+                    throw new ProbeError(`could not reach the server statelessly (${st.evidence}) nor via the 2025-11-25 initialize handshake (${cl.evidence}) — is it running and speaking MCP?`);
+                }
+            }
+            // The remaining 2026-07-28 checks run on whichever contact path worked,
+            // so even a handshake-only server gets a complete migration report.
+            const disc = await checkServerDiscover(conn, label, opts);
+            discoverOk = disc.ok;
+            notes.push(disc.note);
+            if (disc.finding)
+                findings.push(disc.finding);
+            const ec = await checkResourceErrorCode(conn, label, opts);
+            errorCodeOk = ec.ok;
+            notes.push(ec.note);
+            if (ec.finding)
+                findings.push(ec.finding);
         }
         else {
             const cl = await tryClassic(target, opts);
             handshakeOk = cl.ok;
-            if (cl.ok) {
-                // Confirmed: the server works — but only through the removed handshake.
-                tools = cl.tools;
-                notes.push(`fallback probe: ${cl.evidence}`);
-                findings.push(handshakeFinding(label, st.evidence));
-            }
-            else {
-                throw new ProbeError(`could not reach the server statelessly (${st.evidence}) nor via the 2025-11-25 initialize handshake (${cl.evidence}) — is it running and speaking MCP?`);
+            notes.push(`handshake probe: ${cl.evidence}`);
+            if (!cl.ok) {
+                throw new ProbeError(`could not connect: ${cl.evidence}`);
             }
+            tools = cl.tools;
+            conn = cl.conn;
         }
     }
-    else {
-        const cl = await tryClassic(target, opts);
-        handshakeOk = cl.ok;
-        notes.push(`handshake probe: ${cl.evidence}`);
-        if (!cl.ok) {
-            throw new ProbeError(`could not connect: ${cl.evidence}`);
-        }
-        tools = cl.tools;
+    finally {
+        conn?.close();
     }
     for (const tool of tools) {
         if (!tool || typeof tool !== 'object')
@@ -467,6 +581,8 @@ async function probeServer(target, opts) {
         toolCount: tools.length,
         statelessOk,
         handshakeOk,
+        discoverOk,
+        errorCodeOk,
         notes,
     };
 }

package/dist/reporters.js

@@ -286,7 +286,7 @@ function reportProbeTerminal(result, opts = {}) {
     if (findings.length === 0) {
         console.log(c.green(`✔ no runtime violations — ` +
             (result.specVersion === '2026-07-28'
-                ? 'the server answers stateless 2026-07-28 requests and all tool schemas are JSON Schema 2020-12 compatible'
+                ? 'the server answers stateless 2026-07-28 requests, implements server/discover, uses the new resource error code, and all tool schemas are JSON Schema 2020-12 compatible'
                 : 'all tool schemas are JSON Schema 2020-12 compatible')));
         return;
     }

package/dist/rules.js

@@ -113,6 +113,22 @@ exports.RUNTIME_RULES = {
         after: 'Update your SDK to @modelcontextprotocol/server (the new 2026-07-28 package) and remove any initialize handler assumptions',
         docUrl: constants_1.SPEC_URL,
     },
+    'missing-server-discover': {
+        id: 'missing-server-discover',
+        label: 'server/discover not implemented',
+        severity: 'ERROR',
+        explanation: 'The 2026-07-28 spec requires every server to implement the server/discover RPC (SEP-2575) — it replaces the removed initialize handshake as the way clients fetch supported protocol versions, capabilities, and identity. This server did not answer it with a result containing a capabilities key.',
+        after: 'Implement server/discover returning { capabilities, supportedVersions, ... } — @modelcontextprotocol/server (the 2026-07-28 SDK) answers it for you automatically.',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'legacy-resource-error-code': {
+        id: 'legacy-resource-error-code',
+        label: 'legacy -32002 resource error code',
+        severity: 'ERROR',
+        explanation: 'Reading a nonexistent resource returned the MCP-custom error code -32002; the 2026-07-28 spec changes it to the JSON-RPC standard -32602 (Invalid Params). Clients matching on the new code will misclassify this error.',
+        after: "return { error: { code: -32602, message: 'Invalid params' } }; // was -32002 — the static scan's --fix rewrites source occurrences",
+        docUrl: constants_1.SPEC_URL,
+    },
 };
 const CAP_RE = /capabilities/i;
 const CAP_NAMES = {

package/dist/types.d.ts

@@ -15,7 +15,7 @@ export declare const ALL_PATTERN_IDS: PatternId[];
  * not by static source analysis. Kebab-case ids are deliberate — they are the
  * wire-level category names, distinct from the static PatternId rule ids.
  */
-export type RuntimeRuleId = 'json-schema-dialect' | 'requires-initialize-handshake';
+export type RuntimeRuleId = 'json-schema-dialect' | 'requires-initialize-handshake' | 'missing-server-discover' | 'legacy-resource-error-code';
 export declare const ALL_RUNTIME_RULE_IDS: RuntimeRuleId[];
 /** Any violation id — static pattern or runtime probe category. */
 export type ViolationId = PatternId | RuntimeRuleId;

package/dist/types.js

@@ -16,4 +16,6 @@ exports.ALL_PATTERN_IDS = [
 exports.ALL_RUNTIME_RULE_IDS = [
     'json-schema-dialect',
     'requires-initialize-handshake',
+    'missing-server-discover',
+    'legacy-resource-error-code',
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@booyaka/mcp-vet",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Scan MCP server source code for patterns that break under the 2026-07-28 Model Context Protocol spec release candidate.",
   "type": "commonjs",
   "main": "dist/index.js",