@booyaka/mcp-vet 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -4,6 +4,89 @@ All notable changes to `mcp-vet` are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.0]
+
+An opt-in `--spec 2026-07-28` compliance suite for `mcp-vet probe` — six
+wire-level checks that run *in addition to* the existing ones, covering the
+stateless-protocol requirements and the three newly-deprecated features. Purely
+additive: no existing check changed, and plain `--spec-version 2026-07-28`
+behaves exactly as before.
+
+### Added
+
+- **`--spec <version>`** on `mcp-vet probe` — a shorthand for `--spec-version`
+  that ALSO runs the new compliance suite. `--spec 2026-07-28` vets against the
+  2026-07-28 revision *and* adds the six checks below.
+- **`stateless-no-session` (ERROR)** — sends a `tools/list` with no
+  `Mcp-Session-Id` and flags a server that rejects it with a session error
+  (sessions are removed, SEP-2567).
+- **`stateless-no-init` (ERROR)** — sends a `tools/list` with no
+  `initialize`/`initialized` handshake and flags a server that rejects it as
+  uninitialized (the handshake is removed, SEP-2575).
+- **`required-headers` (ERROR)** — sends a request carrying the now-required
+  `Mcp-Method` / `Mcp-Name` routing headers (Streamable HTTP) and flags a
+  server that errors on them; skipped for stdio targets (no request headers).
+- **`deprecated-sampling` (WARN)** — observes a server-initiated
+  `sampling/createMessage` request. Sampling is deprecated in 2026-07-28 and
+  eligible for removal July 2027; migrate to a direct LLM provider API.
+- **`deprecated-roots` (WARN)** — flags a `roots/list` that returns a result
+  (the roots capability is deprecated).
+- **`deprecated-logging` (WARN)** — observes a server-emitted
+  `notifications/message` (the MCP logging protocol is deprecated; migrate to
+  stderr or OpenTelemetry).
+- **`test/probe-fixtures/server-sessionful.mjs`** and
+  **`server-deprecated.mjs`** — new stdio fixtures isolating a session
+  requirement and the three deprecated features; 9 new tests (71 total),
+  including proof that the suite is gated behind `--spec` (plain
+  `--spec-version 2026-07-28` never runs it) and that a migrated server passes
+  every new check.
+
+### How it works
+
+The suite runs on its own fresh connection(s) after the existing probe path
+completes, so nothing above it changed. The prober's stdio/HTTP transports gain
+an optional server-message observer (used to catch the deprecated
+`sampling/createMessage` and `notifications/message` traffic) and per-request
+header support (used to send `Mcp-Method`/`Mcp-Name`).
+
+## [0.6.0]
+
+The full 2026-07-28 compliance suite — `mcp-vet probe --spec-version 2026-07-28`
+now covers all three breaking changes the release candidate makes to server
+behavior, not just the removed handshake.
+
+### Added
+
+- **`missing-server-discover` (ERROR, `--spec-version 2026-07-28`)** — calls
+  the `server/discover` RPC that every 2026-07-28 server MUST implement
+  (SEP-2575; it replaces the removed initialize handshake for up-front
+  capability discovery) and flags a server whose answer is an error, a hang, or
+  a result missing the required `capabilities` key. The spec defines
+  `server/discover` as JSON-RPC only — 2026-07-28 removes the HTTP GET
+  endpoint, so no `GET /mcp/discover` variant is probed.
+- **`legacy-resource-error-code` (ERROR, `--spec-version 2026-07-28`)** — reads
+  a deliberately nonexistent resource URI (`mcp-vet://probe/...`) and flags a
+  server that still answers `-32002` instead of the JSON-RPC standard `-32602`
+  (Invalid Params). Servers without `resources/read` (`-32601`) are skipped,
+  not flagged; unexpected codes are reported as inconclusive notes.
+- **`mcp-vet run`** — an alias for `mcp-vet probe`.
+- **`test/probe-fixtures/server-partial.mjs`** — a hybrid (handshake +
+  stateless) fixture with exactly one migration defect per mode
+  (`legacy-error-code` / `no-discover` / `bad-discover`), isolating each new
+  rule; 7 new tests (62 total), including proof that the new checks are gated
+  behind `--spec-version 2026-07-28` and the default probe is unchanged.
+
+### Changed
+
+- The stateless first request now sends the RC's exact namespaced `_meta` key
+  `io.modelcontextprotocol/clientCapabilities` (was the incorrect
+  `io.modelcontextprotocol/capabilities`); the stateless fixtures now *require*
+  the namespaced keys, locking the wire format into the tests.
+- The new checks run on whichever contact path succeeded (stateless or classic
+  fallback), so a handshake-only legacy server gets its complete 2026-07-28
+  migration report — handshake + discover findings — in a single probe.
+- `ProbeResult` gains `discoverOk` and `errorCodeOk` verdict fields.
+
 ## [0.5.0]
 
 The runtime-probe release — `mcp-vet probe` connects to a *running* MCP server

package/README.md

@@ -215,18 +215,21 @@ Each fixture is a plain JSON description (`send` headers + JSON-RPC body, `expec
 
 ## Vet a running server (`mcp-vet probe`)
 
-Where the scan reads your *source*, `probe` talks to your *running server* over the wire — stdio (a command it spawns) or Streamable HTTP (a URL) — and checks the two 2026-07-28 violations that only exist at runtime:
+Where the scan reads your *source*, `probe` talks to your *running server* over the wire — stdio (a command it spawns) or Streamable HTTP (a URL) — and checks the 2026-07-28 violations that only exist at runtime (`run` is an alias: `mcp-vet run …` ≡ `mcp-vet probe …`):
 
 | ID | Severity | What it checks |
 | --- | --- | --- |
 | `json-schema-dialect` | 🟡 WARN | calls `tools/list` and inspects every tool's `inputSchema`/`outputSchema` for a pre-2020-12 JSON Schema dialect ([SEP-2106](https://modelcontextprotocol.io/seps/2106-json-schema-2020-12)) — an explicit draft-04/-06/-07 `$schema` (**high** confidence), or no `$schema` but draft-only keyword forms: `definitions` instead of `$defs`, `$ref: "#/definitions/…"`, boolean `exclusiveMinimum`/`exclusiveMaximum`, array-form `items` (**medium** confidence) |
-| `requires-initialize-handshake` | 🔴 ERROR | with `--spec-version 2026-07-28`: makes a **stateless first request** — no `initialize`, capabilities/clientInfo/protocolVersion in `_meta` per the RC — and flags a server that rejects it or hangs waiting for the removed handshake |
+| `requires-initialize-handshake` | 🔴 ERROR | with `--spec-version 2026-07-28`: makes a **stateless first request** — no `initialize`, protocolVersion/clientInfo/clientCapabilities in namespaced `_meta` keys per the RC — and flags a server that rejects it or hangs waiting for the removed handshake. A valid `tools` array in the answer is asserted, not just a 200 |
+| `missing-server-discover` | 🔴 ERROR | with `--spec-version 2026-07-28`: calls the **`server/discover`** RPC that every 2026-07-28 server MUST implement ([SEP-2575](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2575) — it replaces the handshake for up-front capability discovery) and flags a server whose answer is an error or lacks the required `capabilities` key. (The spec defines `server/discover` as JSON-RPC only — 2026-07-28 *removes* the HTTP GET endpoint, so there is no `GET /mcp/discover` to fall back to) |
+| `legacy-resource-error-code` | 🔴 ERROR | with `--spec-version 2026-07-28`: reads a deliberately nonexistent resource URI and flags a server that still answers with the MCP-custom **`-32002`** instead of the JSON-RPC standard **`-32602`** (Invalid Params). Servers without `resources/read` (`-32601`) are skipped, not flagged |
 
 ```bash
 # vet the schemas of a stdio server (spawns the command; a lone .js file runs with Node)
 npx @booyaka/mcp-vet probe node ./dist/server.js
 
-# full 2026-07-28 readiness: stateless first contact + schema dialects
+# full 2026-07-28 readiness: stateless first contact + server/discover +
+# resource error code + schema dialects
 npx @booyaka/mcp-vet probe --spec-version 2026-07-28 http://localhost:3000/mcp
 ```
 
@@ -234,21 +237,59 @@ npx @booyaka/mcp-vet probe --spec-version 2026-07-28 http://localhost:3000/mcp
 mcp-vet probe — node ./dist/server.js · spec 2026-07-28 · stdio · 12 tool(s) listed
   stateless probe: stateless tools/list was rejected: -32002 Server not initialized
   fallback probe: initialize handshake + tools/list succeeded
+  server/discover: rejected (-32601)
+  resource error-code check skipped — server does not implement resources/read (-32601)
 
 ERROR  requires-initialize-handshake [high]
     The server rejected (or hung on) a stateless 2026-07-28-style first request ...
+ERROR  missing-server-discover [high]
+    The 2026-07-28 spec requires every server to implement the server/discover RPC ...
 WARN   json-schema-dialect [high]
     tool "echo" inputSchema: $schema = http://json-schema.org/draft-07/schema# (draft-07)
 ```
 
-The stateless verdict is **cross-checked** before it becomes a violation: `requires-initialize-handshake` is only emitted when the classic `2025-11-25` handshake path *does* work — a dead or non-MCP server is an operational error (exit 2), never a false violation. The dialect walker recurses only into schema positions (applicators like `properties`/`allOf`), so a *property* literally named `definitions` is never mistaken for the draft-07 keyword, and an explicit 2020-12 `$schema` declaration is trusted.
+The stateless verdict is **cross-checked** before it becomes a violation: `requires-initialize-handshake` is only emitted when the classic `2025-11-25` handshake path *does* work — a dead or non-MCP server is an operational error (exit 2), never a false violation. The `server/discover` and error-code checks then run on whichever contact path succeeded, so even a handshake-only server gets its complete migration report in one probe. The dialect walker recurses only into schema positions (applicators like `properties`/`allOf`), so a *property* literally named `definitions` is never mistaken for the draft-07 keyword, and an explicit 2020-12 `$schema` declaration is trusted.
+
+### `--spec-version` — which revision to vet against
+
+| Value | Behavior |
+| --- | --- |
+| `2025-11-25` *(default)* | today's stable contract: classic `initialize` handshake, then the `json-schema-dialect` check. **No 2026-07-28 assertions run** — a fully 2025-era server probes clean |
+| `2026-07-28` | the full new-spec compliance suite: stateless first contact, required `server/discover`, `-32602` resource error code, plus the dialect check |
+
+**Migration note.** The default stays `2025-11-25` so existing CI invocations keep their exact behavior — add the flag when *you* are ready, not when the spec ships. A practical rollout:
+
+1. Today: `mcp-vet probe <server>` (unchanged) plus the static scan in CI.
+2. When you start migrating: add a second CI job with `--spec-version 2026-07-28 --fail-on none` to *see* the new-spec violations without failing the build.
+3. When your server targets `2026-07-28` (e.g. after moving to `@modelcontextprotocol/server` 2.x): drop `--fail-on none` so the three ERROR-level checks gate the build. A correctly migrated server passes all of them; the pre-migration server fails `requires-initialize-handshake` and `missing-server-discover` immediately.
+4. Keep a `2025-11-25` probe in the matrix until every client you serve has moved (the rollout is a window, not a day — see [What actually happens on July 28](#what-actually-happens-on-july-28)).
+
+### `--spec 2026-07-28` — the extra compliance suite
+
+`--spec` is a shorthand for `--spec-version` that **also** runs six additional wire-level checks *on top of* the ones above. `--spec 2026-07-28` vets against the new revision **and** adds the suite; plain `--spec-version 2026-07-28` is unchanged and never runs it, so existing CI invocations keep their exact behavior.
+
+```bash
+# full readiness AND the extra compliance suite
+npx @booyaka/mcp-vet probe --spec 2026-07-28 node ./dist/server.js
+```
+
+| ID | Severity | What it checks |
+| --- | --- | --- |
+| `stateless-no-session` | 🔴 ERROR | sends `tools/list` with **no** `Mcp-Session-Id` and flags a server that rejects it with a session error — sessions are removed on 2026-07-28 (SEP-2567), so a stateless request must be served |
+| `stateless-no-init` | 🔴 ERROR | sends `tools/list` with **no** `initialize`/`initialized` handshake and flags a server that rejects it as uninitialized — the handshake is removed (SEP-2575); a compliant server answers the first request directly |
+| `required-headers` | 🔴 ERROR | sends a request carrying the now-required `Mcp-Method` / `Mcp-Name` routing headers and flags a server that errors on them. Skipped for **stdio** targets (there are no request headers over stdio) |
+| `deprecated-sampling` | 🟡 WARN | observes a server-initiated `sampling/createMessage` request. Sampling is deprecated in 2026-07-28 and **eligible for removal July 2027** — migrate to a direct LLM provider API |
+| `deprecated-roots` | 🟡 WARN | flags a `roots/list` that returns a result — the roots capability is deprecated |
+| `deprecated-logging` | 🟡 WARN | observes a server-emitted `notifications/message` — the MCP logging protocol is deprecated; migrate to stderr (stdio) or OpenTelemetry |
+
+The two `stateless-*` checks are cross-checked the same way the rest of the probe is: a server that answers a stateless, session-less, handshake-less `tools/list` passes both; one that rejects it is classified by *why* — a `session` error trips `stateless-no-session`, an `uninitialized` error trips `stateless-no-init` (a session rejection trips both, since a sessionful server is also not answering the first request directly). The two `deprecated-sampling` / `deprecated-logging` checks watch for server→client traffic for a short window (up to the spec's 5 s, bounded by `--timeout`) and report only what the server actually sends — a server that never samples or logs stays clean. The suite runs on its own fresh connection after the standard probe completes, so the ERROR checks above are unaffected.
 
 Probe findings use the same report formats as the scan: `--json` (machine-readable array on stdout) and `--sarif [file]` (SARIF 2.1.0 — `ERROR` maps to `error`, `WARN` to `warning`), plus `--fail-on breaking|any|none` (default `breaking`: exit 1 only on `ERROR`), `--timeout <ms>` (default 8000, also the hang-detection window), `--quiet`, and `--color`/`--no-color`.
 
-Try it against the official reference server — the July 2026 `@modelcontextprotocol/server-everything` answers stateless requests, but its tool schemas still declare draft-07, and `probe` catches all of them:
+Try it against the official reference server — the July 2026 `@modelcontextprotocol/server-everything` (beta 2026-07-28 SDK) answers stateless requests and already returns the new `-32602` resource error code, but it does not implement `server/discover` yet and its tool schemas still declare draft-07 — `probe` reports exactly that (1 ERROR, 13 WARN):
 
 ```bash
-npx @booyaka/mcp-vet probe --spec-version 2026-07-28 npx -y mcp-server-everything stdio
+npx @booyaka/mcp-vet probe --spec-version 2026-07-28 npx -y @modelcontextprotocol/server-everything stdio
 ```
 
 ## Usage
@@ -259,7 +300,7 @@ npx @booyaka/mcp-vet . --fix           # scan, and auto-apply the mechanical -32
 npx @booyaka/mcp-vet ./src ./packages  # multiple roots
 npx @booyaka/mcp-vet server.py         # a single file
 npx @booyaka/mcp-vet fixtures ./dir    # write runtime conformance fixtures + checklist (default: ./mcp-vet-fixtures)
-npx @booyaka/mcp-vet probe <url|cmd>   # vet a RUNNING server's wire behavior (see section above)
+npx @booyaka/mcp-vet probe <url|cmd>   # vet a RUNNING server's wire behavior (see section above; alias: run)
 ```
 
 Globs `**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}` and `**/*.py`, skipping `node_modules`, `.git`, `__pycache__`, `dist`, and `build`.
@@ -465,10 +506,10 @@ Also exported: `renderJson` / `renderMarkdown` / `renderSarif`, `RULES`, and the
 ```bash
 npm install      # installs deps and builds (via prepare)
 npm run build    # tsc -> dist/ + copies the Python script
-npm test         # builds, then runs the Node.js built-in test runner (55 tests)
+npm test         # builds, then runs the Node.js built-in test runner (62 tests)
 ```
 
-Test fixtures live in `test/fixtures/` (dirty TS + Python servers, a `clean/` server with zero violations, `negatives/` true-negatives, a `confidence/` gradient, and `suppress/` cases). Runtime-probe fixtures live in `test/probe-fixtures/` — minimal stdio + Streamable-HTTP MCP servers: one returning draft-07 schemas, one requiring the initialize handshake, and one fully stateless 2026-07-28-native.
+Test fixtures live in `test/fixtures/` (dirty TS + Python servers, a `clean/` server with zero violations, `negatives/` true-negatives, a `confidence/` gradient, and `suppress/` cases). Runtime-probe fixtures live in `test/probe-fixtures/` — minimal stdio + Streamable-HTTP MCP servers: one returning draft-07 schemas, one requiring the initialize handshake, one fully migrated 2026-07-28-native (stateless + `server/discover` + `-32602`), and a `server-partial.mjs` with one deliberate migration defect per mode (`legacy-error-code` / `no-discover` / `bad-discover`).
 
 ## License
 

package/dist/cli.js

@@ -99,9 +99,10 @@ if (process.argv[2] === 'fixtures') {
     }
 }
 // `mcp-vet probe [options] <url | command...>` — connect to a RUNNING server and
-// vet its wire behavior (JSON Schema dialect, stateless-protocol readiness).
+// vet its wire behavior (JSON Schema dialect, stateless-protocol readiness,
+// server/discover, resource error code). `run` is an alias for `probe`.
 // Async, so the scan pipeline only runs in the else-branch.
-if (process.argv[2] === 'probe') {
+if (process.argv[2] === 'probe' || process.argv[2] === 'run') {
     (0, probe_cli_1.runProbeCli)(process.argv.slice(3)).then((code) => process.exit(code), (err) => fail(err.message));
 }
 else {
@@ -139,8 +140,11 @@ function scanMain() {
         '',
         'Commands:',
         '  fixtures [dir]                 write protocol-level conformance fixtures + CHECKLIST.md (default: ./mcp-vet-fixtures)',
-        '  probe [options] <url|command>  connect to a RUNNING server and vet its wire behavior',
-        '                                 (JSON Schema 2020-12 dialect; with --spec-version 2026-07-28, stateless readiness)',
+        '  probe [options] <url|command>  connect to a RUNNING server and vet its wire behavior (alias: run)',
+        '                                 (JSON Schema 2020-12 dialect; with --spec-version 2026-07-28, also stateless',
+        '                                 readiness, the required server/discover RPC, and the -32602 resource error code;',
+        '                                 with --spec 2026-07-28, ALSO the compliance suite: stateless-no-session,',
+        '                                 stateless-no-init, required-headers, deprecated-sampling/roots/logging)',
     ].join('\n'))
         .showHelpAfterError();
     program.parse(process.argv);

package/dist/probe-cli.js

@@ -58,9 +58,10 @@ async function runProbeCli(argv) {
     const program = new commander_1.Command();
     program
         .name('mcp-vet probe')
-        .description('Connect to a RUNNING MCP server (stdio command or Streamable HTTP URL) and vet its wire behavior: JSON Schema dialect of tool schemas (SEP-2106) and, with --spec-version 2026-07-28, stateless-protocol readiness.')
+        .description('Connect to a RUNNING MCP server (stdio command or Streamable HTTP URL) and vet its wire behavior: JSON Schema dialect of tool schemas (SEP-2106) and, with --spec-version 2026-07-28, stateless-protocol readiness, the required server/discover RPC (SEP-2575), and the -32002 → -32602 resource error-code change. Add --spec 2026-07-28 to ALSO run the compliance suite: stateless-no-session, stateless-no-init, required-headers, and the deprecated-sampling/roots/logging warnings.')
         .argument('<target...>', 'server URL (http/https) or a command + args to spawn (stdio)')
         .option('--spec-version <version>', `MCP revision to vet against: ${types_1.SPEC_VERSIONS.join(' | ')}`, '2025-11-25')
+        .option('--spec <version>', `shorthand for --spec-version that ALSO runs the extra compliance suite (stateless-no-session, stateless-no-init, required-headers, deprecated-sampling/roots/logging): ${types_1.SPEC_VERSIONS.join(' | ')}`)
         .option('--timeout <ms>', 'per-request timeout in milliseconds', '8000')
         .option('--fail-on <level>', `exit non-zero on: ${FAILON_VALUES.join(' | ')}`, 'breaking')
         .option('--json', 'print findings as a JSON array to stdout (notices go to stderr)')
@@ -80,10 +81,15 @@ async function runProbeCli(argv) {
         return code === 'commander.helpDisplayed' || code === 'commander.help' ? 0 : 2;
     }
     const opts = program.opts();
-    if (!types_1.SPEC_VERSIONS.includes(opts.specVersion)) {
-        fail(`invalid --spec-version "${opts.specVersion}". Valid: ${types_1.SPEC_VERSIONS.join(', ')}`);
+    // `--spec` is a shorthand for `--spec-version` that ALSO enables the extra
+    // compliance suite. When present it wins over --spec-version.
+    const specChecks = opts.spec !== undefined;
+    const rawSpec = opts.spec ?? opts.specVersion;
+    if (!types_1.SPEC_VERSIONS.includes(rawSpec)) {
+        const flag = opts.spec !== undefined ? '--spec' : '--spec-version';
+        fail(`invalid ${flag} "${rawSpec}". Valid: ${types_1.SPEC_VERSIONS.join(', ')}`);
     }
-    const specVersion = opts.specVersion;
+    const specVersion = rawSpec;
     const timeoutMs = Number(opts.timeout);
     if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
         fail(`invalid --timeout "${opts.timeout}" (need a positive number of milliseconds).`);
@@ -111,7 +117,7 @@ async function runProbeCli(argv) {
     }
     let result;
     try {
-        result = await (0, probe_1.probeServer)(target, { specVersion, timeoutMs });
+        result = await (0, probe_1.probeServer)(target, { specVersion, timeoutMs, specChecks });
     }
     catch (err) {
         if (err instanceof probe_1.ProbeError)

package/dist/probe.d.ts

@@ -14,6 +14,13 @@ export interface ProbeOptions {
     specVersion: SpecVersion;
     /** per-request timeout in ms (also the stateless hang-detection window) */
     timeoutMs: number;
+    /**
+     * Run the `--spec 2026-07-28` compliance suite in addition to the existing
+     * checks: stateless-no-session, stateless-no-init, required-headers, and the
+     * deprecated-sampling / deprecated-roots / deprecated-logging warnings. Only
+     * meaningful together with specVersion '2026-07-28'.
+     */
+    specChecks?: boolean;
 }
 export interface ProbeResult {
     /** human-readable target (the command line or the URL) */
@@ -27,6 +34,10 @@ export interface ProbeResult {
     statelessOk: boolean | null;
     /** classic initialize-handshake verdict; null = not attempted */
     handshakeOk: boolean | null;
+    /** server/discover verdict; null = not probed (spec 2025-11-25) */
+    discoverOk: boolean | null;
+    /** nonexistent-resource error-code verdict; null = not probed or inconclusive */
+    errorCodeOk: boolean | null;
     notes: string[];
 }
 export declare function targetLabel(target: ProbeTarget): string;

package/dist/probe.js

@@ -46,10 +46,19 @@ exports.probeServer = probeServer;
  *     2026-07-28) — makes a stateless first request (no initialize; capabilities
  *     travel in _meta per the 2026-07-28 RC). A server that rejects or hangs on
  *     it still requires the removed handshake.
+ *  3. `missing-server-discover` (ERROR, 2026-07-28 only) — calls the required
+ *     server/discover RPC (SEP-2575) and expects a result with a `capabilities`
+ *     key. There is no HTTP GET variant — 2026-07-28 removes the GET endpoint.
+ *  4. `legacy-resource-error-code` (ERROR, 2026-07-28 only) — reads a
+ *     deliberately nonexistent resource URI and flags a server that still
+ *     answers with the removed -32002 code instead of -32602 (Invalid Params).
+ *     Servers without resources support (-32601) are skipped, not flagged.
  *
  * The stateless verdict is cross-checked: the violation is only emitted when
  * the classic 2025-11-25 handshake path *does* work, so a dead/broken server is
- * reported as an operational error (exit 2), not a false violation.
+ * reported as an operational error (exit 2), not a false violation. Checks 3-4
+ * run on whichever contact path succeeded, so a legacy server gets a complete
+ * migration report in one probe.
  */
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
@@ -106,6 +115,7 @@ function openStdio(rawCommand, args) {
     let closedReason = '';
     const stderrTail = [];
     const pending = new Map();
+    const serverListeners = new Set();
     const failAll = (reason) => {
         closed = true;
         closedReason = reason;
@@ -133,6 +143,12 @@ function openStdio(rawCommand, args) {
                 pending.delete(msg.id);
                 p.resolve(msg);
             }
+            else if (msg && typeof msg === 'object' && typeof msg.method === 'string') {
+                // A server-initiated request or notification (its id, if any, is not one
+                // we issued) — surface it to any deprecated-traffic observers.
+                for (const l of serverListeners)
+                    l(msg);
+            }
         }
     });
     child.stderr.on('data', (d) => {
@@ -147,7 +163,8 @@ function openStdio(rawCommand, args) {
             (tail ? ` — stderr: ${tail}` : ''));
     });
     return {
-        request(method, params, timeoutMs) {
+        // extraHeaders is a Streamable-HTTP concept; stdio has no request headers.
+        request(method, params, timeoutMs, _extraHeaders) {
             return new Promise((resolve, reject) => {
                 if (closed)
                     return reject(new ConnectionClosedError(closedReason));
@@ -186,6 +203,10 @@ function openStdio(rawCommand, args) {
                 /* connection already down — the next request reports it */
             }
         },
+        onServerMessage(listener) {
+            serverListeners.add(listener);
+            return () => serverListeners.delete(listener);
+        },
         close() {
             closed = true;
             try {
@@ -218,7 +239,16 @@ function parseSse(body, id) {
 function openHttp(url, specVersion) {
     let nextId = 1;
     let sessionId;
-    const post = async (payload, method, timeoutMs) => {
+    const serverListeners = new Set();
+    // Feed any server-initiated (method-bearing) message from a response body to
+    // the deprecated-traffic observers, ignoring replies to our own request id.
+    const dispatchServer = (msg, ourId) => {
+        if (msg && typeof msg === 'object' && typeof msg.method === 'string' && msg.id !== ourId) {
+            for (const l of serverListeners)
+                l(msg);
+        }
+    };
+    const post = async (payload, method, timeoutMs, extraHeaders) => {
         const headers = {
             'content-type': 'application/json',
             accept: 'application/json, text/event-stream',
@@ -229,6 +259,9 @@ function openHttp(url, specVersion) {
         // mirrors the JSON-RPC body.
         if (specVersion === '2026-07-28')
             headers['mcp-method'] = method;
+        if (extraHeaders)
+            for (const [k, v] of Object.entries(extraHeaders))
+                headers[k.toLowerCase()] = v;
         let res;
         try {
             res = await fetch(url, {
@@ -251,19 +284,38 @@ function openHttp(url, specVersion) {
         return res;
     };
     return {
-        async request(method, params, timeoutMs) {
+        async request(method, params, timeoutMs, extraHeaders) {
             const id = nextId++;
-            const res = await post({ jsonrpc: '2.0', id, method, params }, method, timeoutMs);
+            const res = await post({ jsonrpc: '2.0', id, method, params }, method, timeoutMs, extraHeaders);
             const body = await res.text();
             const ct = res.headers.get('content-type') ?? '';
             let msg = null;
             if (ct.includes('text/event-stream')) {
+                // A single POST may carry server→client traffic (e.g. a sampling
+                // request) alongside our reply in the SSE stream — surface it.
+                for (const line of body.split(/\r?\n/)) {
+                    if (!line.startsWith('data:'))
+                        continue;
+                    try {
+                        dispatchServer(JSON.parse(line.slice(5).trim()), id);
+                    }
+                    catch {
+                        /* not a JSON data line */
+                    }
+                }
                 msg = parseSse(body, id);
             }
             else {
                 try {
                     const parsed = JSON.parse(body);
-                    msg = Array.isArray(parsed) ? parsed.find((m) => m && m.id === id) ?? null : parsed;
+                    if (Array.isArray(parsed)) {
+                        for (const m of parsed)
+                            dispatchServer(m, id);
+                        msg = parsed.find((m) => m && m.id === id) ?? null;
+                    }
+                    else {
+                        msg = parsed;
+                    }
                 }
                 catch {
                     msg = null;
@@ -289,6 +341,10 @@ function openHttp(url, specVersion) {
                 /* notifications are best-effort */
             }
         },
+        onServerMessage(listener) {
+            serverListeners.add(listener);
+            return () => serverListeners.delete(listener);
+        },
         close() {
             /* nothing persistent to tear down */
         },
@@ -305,12 +361,12 @@ function openConnection(target, specVersion) {
 function clientInfo() {
     return { name: 'mcp-vet', version: (0, constants_1.getVersion)() };
 }
-/** _meta for a stateless 2026-07-28 first request (per the RC's namespaced keys). */
+/** _meta for a stateless 2026-07-28 request (per the RC's namespaced keys). */
 function statelessMeta() {
     return {
         'io.modelcontextprotocol/protocolVersion': '2026-07-28',
         'io.modelcontextprotocol/clientInfo': clientInfo(),
-        'io.modelcontextprotocol/capabilities': {},
+        'io.modelcontextprotocol/clientCapabilities': {},
     };
 }
 /** Stateless 2026-07-28 first contact: tools/list with _meta, NO initialize. */
@@ -319,6 +375,7 @@ async function tryStateless(target, opts) {
     try {
         const resp = await conn.request('tools/list', { _meta: statelessMeta() }, opts.timeoutMs);
         if (resp.error) {
+            conn.close();
             return {
                 ok: false,
                 evidence: `stateless tools/list was rejected: ${resp.error.code ?? '?'} ${resp.error.message ?? ''}`.trim(),
@@ -326,11 +383,13 @@ async function tryStateless(target, opts) {
         }
         const tools = resp.result?.tools;
         if (!Array.isArray(tools)) {
+            conn.close();
             return { ok: false, evidence: 'stateless tools/list answered without a tools array' };
         }
-        return { ok: true, tools, evidence: 'server answered a stateless tools/list (no initialize)' };
+        return { ok: true, tools, conn, evidence: 'server answered a stateless tools/list (no initialize)' };
     }
     catch (err) {
+        conn.close();
         if (err instanceof TimeoutError) {
             return {
                 ok: false,
@@ -339,9 +398,6 @@ async function tryStateless(target, opts) {
         }
         return { ok: false, evidence: err.message };
     }
-    finally {
-        conn.close();
-    }
 }
 /** Classic 2025-11-25 contact: initialize → notifications/initialized → tools/list. */
 async function tryClassic(target, opts) {
@@ -349,6 +405,7 @@ async function tryClassic(target, opts) {
     try {
         const init = await conn.request('initialize', { protocolVersion: '2025-11-25', capabilities: {}, clientInfo: clientInfo() }, opts.timeoutMs);
         if (init.error) {
+            conn.close();
             return {
                 ok: false,
                 evidence: `initialize was rejected: ${init.error.code ?? '?'} ${init.error.message ?? ''}`.trim(),
@@ -357,6 +414,7 @@ async function tryClassic(target, opts) {
         await conn.notify('notifications/initialized', {});
         const lst = await conn.request('tools/list', {}, opts.timeoutMs);
         if (lst.error) {
+            conn.close();
             return {
                 ok: false,
                 evidence: `tools/list after handshake was rejected: ${lst.error.code ?? '?'} ${lst.error.message ?? ''}`.trim(),
@@ -364,26 +422,106 @@ async function tryClassic(target, opts) {
         }
         const tools = lst.result?.tools;
         if (!Array.isArray(tools)) {
+            conn.close();
             return { ok: false, evidence: 'tools/list after handshake answered without a tools array' };
         }
-        return { ok: true, tools, evidence: 'initialize handshake + tools/list succeeded' };
+        return { ok: true, tools, conn, evidence: 'initialize handshake + tools/list succeeded' };
     }
     catch (err) {
+        conn.close();
         return { ok: false, evidence: err.message };
     }
-    finally {
-        conn.close();
+}
+/** server/discover is REQUIRED on 2026-07-28 (SEP-2575) and must advertise capabilities. */
+async function checkServerDiscover(conn, label, opts) {
+    try {
+        const resp = await conn.request('server/discover', { _meta: statelessMeta() }, opts.timeoutMs);
+        if (resp.error) {
+            const evidence = `server/discover was rejected: ${resp.error.code ?? '?'} ${resp.error.message ?? ''}`.trim();
+            return {
+                ok: false,
+                finding: runtimeFinding('missing-server-discover', label, evidence, 'high'),
+                note: `server/discover: rejected (${resp.error.code ?? '?'})`,
+            };
+        }
+        const caps = resp.result?.capabilities;
+        if (!caps || typeof caps !== 'object') {
+            const evidence = 'server/discover answered, but its result has no capabilities key';
+            return {
+                ok: false,
+                finding: runtimeFinding('missing-server-discover', label, evidence, 'high'),
+                note: 'server/discover: result missing the required capabilities key',
+            };
+        }
+        const versions = Array.isArray(resp.result?.supportedVersions)
+            ? ` · supportedVersions: ${resp.result.supportedVersions.join(', ')}`
+            : '';
+        return {
+            ok: true,
+            note: `server/discover: capabilities advertised (${Object.keys(caps).join(', ') || 'empty object'})${versions}`,
+        };
+    }
+    catch (err) {
+        if (err instanceof TimeoutError) {
+            // No reply at all — a compliant server (or a legacy one) would at least
+            // answer -32601. A hang is a failure, but not a deterministic one.
+            return {
+                ok: false,
+                finding: runtimeFinding('missing-server-discover', label, `server/discover hung (${err.message})`, 'medium'),
+                note: 'server/discover: no response (hung)',
+            };
+        }
+        return { ok: null, note: `server/discover: check inconclusive — ${err.message}` };
     }
 }
-function handshakeFinding(targetLabel, evidence) {
-    const rule = rules_1.RUNTIME_RULES['requires-initialize-handshake'];
+/** A URI no real server should resolve — used to elicit the not-found error code. */
+const NONEXISTENT_URI = 'mcp-vet://probe/nonexistent-resource';
+/** 2026-07-28 changes resource-not-found from -32002 to -32602 (Invalid Params). */
+async function checkResourceErrorCode(conn, label, opts) {
+    try {
+        const resp = await conn.request('resources/read', { uri: NONEXISTENT_URI, _meta: statelessMeta() }, opts.timeoutMs);
+        if (!resp.error) {
+            return {
+                ok: null,
+                note: `resource error-code check inconclusive — resources/read of ${NONEXISTENT_URI} unexpectedly succeeded`,
+            };
+        }
+        const code = resp.error.code;
+        if (code === -32002) {
+            const evidence = `resources/read of nonexistent ${NONEXISTENT_URI} returned the removed code -32002 (${resp.error.message ?? ''})`.trim();
+            return {
+                ok: false,
+                finding: runtimeFinding('legacy-resource-error-code', label, evidence, 'high'),
+                note: 'resource error code: -32002 (legacy — must be -32602)',
+            };
+        }
+        if (code === -32602) {
+            return { ok: true, note: 'resource error code: -32602 (Invalid Params — correct for 2026-07-28)' };
+        }
+        if (code === -32601) {
+            return {
+                ok: null,
+                note: 'resource error-code check skipped — server does not implement resources/read (-32601)',
+            };
+        }
+        return {
+            ok: null,
+            note: `resource error-code check inconclusive — nonexistent resource returned ${code ?? 'no code'} (neither -32002 nor -32602)`,
+        };
+    }
+    catch (err) {
+        return { ok: null, note: `resource error-code check inconclusive — ${err.message}` };
+    }
+}
+function runtimeFinding(ruleId, targetLabel, evidence, confidence = 'high') {
+    const rule = rules_1.RUNTIME_RULES[ruleId];
     return {
         file: targetLabel,
         line: 1,
         patternId: rule.id,
         patternLabel: rule.label,
         severity: rule.severity,
-        confidence: 'high',
+        confidence,
         explanation: rule.explanation,
         docUrl: rule.docUrl,
         before: evidence,
@@ -412,6 +550,161 @@ function dialectFinding(targetLabel, toolName, field, issue) {
 function targetLabel(target) {
     return target.kind === 'http' ? target.url : [target.command, ...target.args].join(' ');
 }
+// ---------------------------------------------------------------------------
+// `--spec 2026-07-28` compliance suite — opt-in, run IN ADDITION to the checks
+// above. Each check uses its own fresh connection so the existing probe path is
+// left exactly as it was.
+// ---------------------------------------------------------------------------
+const SESSION_ERR_RE = /session/i;
+const UNINIT_ERR_RE = /initial/i; // matches initialize / initialized / uninitialized
+function delay(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+/** Resolve once `pred()` is true or `windowMs` elapses (cheap polling). */
+async function waitUntil(pred, windowMs) {
+    const deadline = Date.now() + windowMs;
+    while (!pred() && Date.now() < deadline)
+        await delay(25);
+}
+/**
+ * Runs the six `--spec 2026-07-28` compliance checks and returns the findings
+ * plus human-readable notes to fold into the ProbeResult:
+ *   1. stateless-no-session   ERROR  — a no-session request must not be refused
+ *   2. stateless-no-init      ERROR  — a no-handshake request must be answered
+ *   3. required-headers       ERROR  — Mcp-Method/Mcp-Name must be accepted (HTTP)
+ *   4. deprecated-sampling    WARN   — server issued sampling/createMessage
+ *   5. deprecated-roots       WARN   — roots/list returned a result
+ *   6. deprecated-logging     WARN   — server emitted notifications/message
+ */
+async function runSpecChecks(target, opts) {
+    const label = targetLabel(target);
+    const findings = [];
+    const notes = [];
+    const isHttp = target.kind === 'http';
+    const conn = openConnection(target, '2026-07-28');
+    // Passively watch for deprecated server→client traffic while we drive the
+    // connection (checks 4 & 6). Register before the first request so the window
+    // covers everything the server sends.
+    let sawSampling = false;
+    let sawLogging = false;
+    const unsub = conn.onServerMessage?.((m) => {
+        if (m && m.method === 'sampling/createMessage')
+            sawSampling = true;
+        if (m && m.method === 'notifications/message')
+            sawLogging = true;
+    });
+    try {
+        // Checks 1 & 2 — a single stateless (no session), no-initialize tools/list.
+        let resp;
+        try {
+            resp = await conn.request('tools/list', { _meta: statelessMeta() }, opts.timeoutMs);
+        }
+        catch (err) {
+            resp = { error: { message: err.message } };
+        }
+        if (resp.error) {
+            const code = resp.error.code;
+            const message = resp.error.message ?? '';
+            const evidence = `stateless tools/list (no session, no initialize) was rejected: ${code ?? '?'} ${message}`.trim();
+            const isSession = SESSION_ERR_RE.test(message);
+            const isUninit = UNINIT_ERR_RE.test(message);
+            if (isSession) {
+                findings.push(runtimeFinding('stateless-no-session', label, evidence));
+                notes.push(`stateless-no-session: FAIL — server requires a session (${code ?? '?'})`);
+            }
+            else {
+                notes.push('stateless-no-session: passed — no session was required');
+            }
+            // Per the brief, an "uninitialized" OR a "session" rejection fails no-init.
+            if (isUninit || isSession) {
+                findings.push(runtimeFinding('stateless-no-init', label, evidence));
+                notes.push(`stateless-no-init: FAIL — request rejected without an initialize handshake (${code ?? '?'})`);
+            }
+            else {
+                notes.push(`stateless-no-init: inconclusive — rejected for an unrelated reason (${code ?? '?'})`);
+            }
+        }
+        else if (Array.isArray(resp.result?.tools)) {
+            notes.push('stateless-no-session: passed — no session was required');
+            notes.push('stateless-no-init: passed — answered the first request with no handshake');
+        }
+        else {
+            notes.push('stateless-no-session / stateless-no-init: inconclusive — no tools array in the answer');
+        }
+        // Check 3 — the required Mcp-Method / Mcp-Name routing headers (HTTP only;
+        // stdio has no request headers).
+        if (!isHttp) {
+            notes.push('required-headers: skipped — Mcp-Method/Mcp-Name are a Streamable HTTP concern; target is stdio');
+        }
+        else {
+            let hdrResp;
+            try {
+                hdrResp = await conn.request('tools/list', { _meta: statelessMeta() }, opts.timeoutMs, {
+                    'mcp-method': 'tools/list',
+                    'mcp-name': 'tools/list',
+                });
+            }
+            catch (err) {
+                hdrResp = { error: { message: err.message } };
+            }
+            if (!hdrResp.error) {
+                notes.push('required-headers: passed — server accepted a request carrying Mcp-Method and Mcp-Name');
+            }
+            else if (/header|mcp-method|mcp-name|routing/i.test(hdrResp.error.message ?? '')) {
+                const evidence = `tools/list carrying the Mcp-Method/Mcp-Name headers was rejected: ${hdrResp.error.code ?? '?'} ${hdrResp.error.message ?? ''}`.trim();
+                findings.push(runtimeFinding('required-headers', label, evidence));
+                notes.push('required-headers: FAIL — server errored on the required routing headers');
+            }
+            else {
+                notes.push(`required-headers: inconclusive — request errored for an unrelated reason (${hdrResp.error.code ?? '?'})`);
+            }
+        }
+        // Check 5 — a roots/list that returns a result means the deprecated roots
+        // capability is in use.
+        try {
+            const rootsResp = await conn.request('roots/list', { _meta: statelessMeta() }, opts.timeoutMs);
+            if (!rootsResp.error && rootsResp.result && typeof rootsResp.result === 'object') {
+                const roots = rootsResp.result.roots;
+                const count = Array.isArray(roots) ? ` (${roots.length} root(s))` : '';
+                findings.push(runtimeFinding('deprecated-roots', label, `roots/list returned a result${count} — the deprecated roots capability is in use`));
+                notes.push('deprecated-roots: WARN — server answered roots/list with a result');
+            }
+            else {
+                notes.push(`deprecated-roots: clean — roots/list not served (${rootsResp.error?.code ?? 'no result'})`);
+            }
+        }
+        catch (err) {
+            notes.push(`deprecated-roots: inconclusive — ${err.message}`);
+        }
+        // Checks 4 & 6 — give the server the spec's window (up to 5 s) to emit
+        // deprecated server→client traffic, resolving early once both are seen.
+        if (conn.onServerMessage) {
+            await waitUntil(() => sawSampling && sawLogging, Math.min(5000, opts.timeoutMs));
+            if (sawSampling) {
+                findings.push(runtimeFinding('deprecated-sampling', label, 'server issued a sampling/createMessage request'));
+                notes.push('deprecated-sampling: WARN — server issued sampling/createMessage');
+            }
+            else {
+                notes.push('deprecated-sampling: clean — no sampling/createMessage observed');
+            }
+            if (sawLogging) {
+                findings.push(runtimeFinding('deprecated-logging', label, 'server emitted a notifications/message log notification'));
+                notes.push('deprecated-logging: WARN — server emitted notifications/message');
+            }
+            else {
+                notes.push('deprecated-logging: clean — no notifications/message observed');
+            }
+        }
+        else {
+            notes.push('deprecated-sampling / deprecated-logging: skipped — this transport cannot observe server-initiated traffic');
+        }
+    }
+    finally {
+        unsub?.();
+        conn.close();
+    }
+    return { findings, notes };
+}
 async function probeServer(target, opts) {
     const label = targetLabel(target);
     const findings = [];
@@ -419,35 +712,58 @@ async function probeServer(target, opts) {
     let tools = null;
     let statelessOk = null;
     let handshakeOk = null;
-    if (opts.specVersion === '2026-07-28') {
-        const st = await tryStateless(target, opts);
-        statelessOk = st.ok;
-        notes.push(`stateless probe: ${st.evidence}`);
-        if (st.ok) {
-            tools = st.tools;
+    let discoverOk = null;
+    let errorCodeOk = null;
+    let conn = null;
+    try {
+        if (opts.specVersion === '2026-07-28') {
+            const st = await tryStateless(target, opts);
+            statelessOk = st.ok;
+            notes.push(`stateless probe: ${st.evidence}`);
+            if (st.ok) {
+                tools = st.tools;
+                conn = st.conn;
+            }
+            else {
+                const cl = await tryClassic(target, opts);
+                handshakeOk = cl.ok;
+                if (cl.ok) {
+                    // Confirmed: the server works — but only through the removed handshake.
+                    tools = cl.tools;
+                    conn = cl.conn;
+                    notes.push(`fallback probe: ${cl.evidence}`);
+                    findings.push(runtimeFinding('requires-initialize-handshake', label, st.evidence));
+                }
+                else {
+                    throw new ProbeError(`could not reach the server statelessly (${st.evidence}) nor via the 2025-11-25 initialize handshake (${cl.evidence}) — is it running and speaking MCP?`);
+                }
+            }
+            // The remaining 2026-07-28 checks run on whichever contact path worked,
+            // so even a handshake-only server gets a complete migration report.
+            const disc = await checkServerDiscover(conn, label, opts);
+            discoverOk = disc.ok;
+            notes.push(disc.note);
+            if (disc.finding)
+                findings.push(disc.finding);
+            const ec = await checkResourceErrorCode(conn, label, opts);
+            errorCodeOk = ec.ok;
+            notes.push(ec.note);
+            if (ec.finding)
+                findings.push(ec.finding);
         }
         else {
             const cl = await tryClassic(target, opts);
             handshakeOk = cl.ok;
-            if (cl.ok) {
-                // Confirmed: the server works — but only through the removed handshake.
-                tools = cl.tools;
-                notes.push(`fallback probe: ${cl.evidence}`);
-                findings.push(handshakeFinding(label, st.evidence));
-            }
-            else {
-                throw new ProbeError(`could not reach the server statelessly (${st.evidence}) nor via the 2025-11-25 initialize handshake (${cl.evidence}) — is it running and speaking MCP?`);
+            notes.push(`handshake probe: ${cl.evidence}`);
+            if (!cl.ok) {
+                throw new ProbeError(`could not connect: ${cl.evidence}`);
             }
+            tools = cl.tools;
+            conn = cl.conn;
         }
     }
-    else {
-        const cl = await tryClassic(target, opts);
-        handshakeOk = cl.ok;
-        notes.push(`handshake probe: ${cl.evidence}`);
-        if (!cl.ok) {
-            throw new ProbeError(`could not connect: ${cl.evidence}`);
-        }
-        tools = cl.tools;
+    finally {
+        conn?.close();
     }
     for (const tool of tools) {
         if (!tool || typeof tool !== 'object')
@@ -459,6 +775,13 @@ async function probeServer(target, opts) {
                 findings.push(dialectFinding(label, name, field, issue));
         }
     }
+    // The opt-in `--spec 2026-07-28` compliance suite runs on its own fresh
+    // connection(s), in addition to everything above.
+    if (opts.specChecks && opts.specVersion === '2026-07-28') {
+        const extra = await runSpecChecks(target, opts);
+        findings.push(...extra.findings);
+        notes.push(...extra.notes);
+    }
     return {
         target: label,
         transport: target.kind,
@@ -467,6 +790,8 @@ async function probeServer(target, opts) {
         toolCount: tools.length,
         statelessOk,
         handshakeOk,
+        discoverOk,
+        errorCodeOk,
         notes,
     };
 }

package/dist/reporters.js

@@ -286,7 +286,7 @@ function reportProbeTerminal(result, opts = {}) {
     if (findings.length === 0) {
         console.log(c.green(`✔ no runtime violations — ` +
             (result.specVersion === '2026-07-28'
-                ? 'the server answers stateless 2026-07-28 requests and all tool schemas are JSON Schema 2020-12 compatible'
+                ? 'the server answers stateless 2026-07-28 requests, implements server/discover, uses the new resource error code, and all tool schemas are JSON Schema 2020-12 compatible'
                 : 'all tool schemas are JSON Schema 2020-12 compatible')));
         return;
     }

package/dist/rules.js

@@ -113,6 +113,71 @@ exports.RUNTIME_RULES = {
         after: 'Update your SDK to @modelcontextprotocol/server (the new 2026-07-28 package) and remove any initialize handler assumptions',
         docUrl: constants_1.SPEC_URL,
     },
+    'missing-server-discover': {
+        id: 'missing-server-discover',
+        label: 'server/discover not implemented',
+        severity: 'ERROR',
+        explanation: 'The 2026-07-28 spec requires every server to implement the server/discover RPC (SEP-2575) — it replaces the removed initialize handshake as the way clients fetch supported protocol versions, capabilities, and identity. This server did not answer it with a result containing a capabilities key.',
+        after: 'Implement server/discover returning { capabilities, supportedVersions, ... } — @modelcontextprotocol/server (the 2026-07-28 SDK) answers it for you automatically.',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'legacy-resource-error-code': {
+        id: 'legacy-resource-error-code',
+        label: 'legacy -32002 resource error code',
+        severity: 'ERROR',
+        explanation: 'Reading a nonexistent resource returned the MCP-custom error code -32002; the 2026-07-28 spec changes it to the JSON-RPC standard -32602 (Invalid Params). Clients matching on the new code will misclassify this error.',
+        after: "return { error: { code: -32602, message: 'Invalid params' } }; // was -32002 — the static scan's --fix rewrites source occurrences",
+        docUrl: constants_1.SPEC_URL,
+    },
+    // --- `--spec 2026-07-28` compliance suite (added on top of the four above) ---
+    'stateless-no-session': {
+        id: 'stateless-no-session',
+        label: 'requires a protocol-level session',
+        severity: 'ERROR',
+        explanation: 'A stateless tools/list sent with no Mcp-Session-Id was rejected with a session error. The 2026-07-28 spec removes the Mcp-Session-Id header and the protocol-level session (SEP-2567); the server must serve requests without one.',
+        after: 'Stop requiring a session: remove sessionIdGenerator / the Mcp-Session-Id gate and serve each request statelessly (client identity & capabilities arrive in per-request _meta).',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'stateless-no-init': {
+        id: 'stateless-no-init',
+        label: 'requires initialization before requests',
+        severity: 'ERROR',
+        explanation: 'A tools/list sent without a prior initialize/initialized handshake was rejected as uninitialized. The 2026-07-28 spec removes the handshake (SEP-2575); a compliant server answers the first request directly.',
+        after: 'Remove the initialize/initialized gate and answer requests immediately; read protocolVersion/clientInfo/capabilities from params._meta on every request.',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'required-headers': {
+        id: 'required-headers',
+        label: 'rejects the required Mcp-Method / Mcp-Name headers',
+        severity: 'ERROR',
+        explanation: 'The 2026-07-28 Streamable HTTP transport requires each request to carry Mcp-Method and Mcp-Name routing headers that mirror the JSON-RPC body. This server errored on a request that set them, so it will reject conforming 2026-07-28 clients.',
+        after: 'Accept (and, per spec, validate against the body) the Mcp-Method and Mcp-Name request headers rather than rejecting them.',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'deprecated-sampling': {
+        id: 'deprecated-sampling',
+        label: 'uses deprecated sampling (sampling/createMessage)',
+        severity: 'WARN',
+        explanation: 'The server issued a sampling/createMessage request. Sampling is deprecated in 2026-07-28 and eligible for removal in July 2027; the server-driven LLM call is being phased out.',
+        after: 'Migrate off sampling: call your LLM provider’s API directly from the server instead of asking the client to sample. Eligible for removal July 2027.',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'deprecated-roots': {
+        id: 'deprecated-roots',
+        label: 'uses deprecated roots',
+        severity: 'WARN',
+        explanation: 'The server answered roots/list with a result, indicating it relies on the roots capability, which is deprecated in 2026-07-28.',
+        after: 'Migrate off roots: pass the paths/URIs the server needs as explicit tool parameters instead of discovering them via the roots capability.',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'deprecated-logging': {
+        id: 'deprecated-logging',
+        label: 'uses deprecated MCP logging (notifications/message)',
+        severity: 'WARN',
+        explanation: 'The server emitted a notifications/message log notification. The MCP logging protocol is deprecated in 2026-07-28.',
+        after: 'Migrate off MCP logging: write logs to stderr (stdio transport) or emit OpenTelemetry instead of notifications/message.',
+        docUrl: constants_1.SPEC_URL,
+    },
 };
 const CAP_RE = /capabilities/i;
 const CAP_NAMES = {

package/dist/types.d.ts

@@ -15,7 +15,7 @@ export declare const ALL_PATTERN_IDS: PatternId[];
  * not by static source analysis. Kebab-case ids are deliberate — they are the
  * wire-level category names, distinct from the static PatternId rule ids.
  */
-export type RuntimeRuleId = 'json-schema-dialect' | 'requires-initialize-handshake';
+export type RuntimeRuleId = 'json-schema-dialect' | 'requires-initialize-handshake' | 'missing-server-discover' | 'legacy-resource-error-code' | 'stateless-no-session' | 'stateless-no-init' | 'required-headers' | 'deprecated-sampling' | 'deprecated-roots' | 'deprecated-logging';
 export declare const ALL_RUNTIME_RULE_IDS: RuntimeRuleId[];
 /** Any violation id — static pattern or runtime probe category. */
 export type ViolationId = PatternId | RuntimeRuleId;

package/dist/types.js

@@ -16,4 +16,12 @@ exports.ALL_PATTERN_IDS = [
 exports.ALL_RUNTIME_RULE_IDS = [
     'json-schema-dialect',
     'requires-initialize-handshake',
+    'missing-server-discover',
+    'legacy-resource-error-code',
+    'stateless-no-session',
+    'stateless-no-init',
+    'required-headers',
+    'deprecated-sampling',
+    'deprecated-roots',
+    'deprecated-logging',
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@booyaka/mcp-vet",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Scan MCP server source code for patterns that break under the 2026-07-28 Model Context Protocol spec release candidate.",
   "type": "commonjs",
   "main": "dist/index.js",