@booyaka/mcp-vet 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -4,6 +4,51 @@ All notable changes to `mcp-vet` are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.0]
+
+An opt-in `--spec 2026-07-28` compliance suite for `mcp-vet probe` — six
+wire-level checks that run *in addition to* the existing ones, covering the
+stateless-protocol requirements and the three newly-deprecated features. Purely
+additive: no existing check changed, and plain `--spec-version 2026-07-28`
+behaves exactly as before.
+
+### Added
+
+- **`--spec <version>`** on `mcp-vet probe` — a shorthand for `--spec-version`
+  that ALSO runs the new compliance suite. `--spec 2026-07-28` vets against the
+  2026-07-28 revision *and* adds the six checks below.
+- **`stateless-no-session` (ERROR)** — sends a `tools/list` with no
+  `Mcp-Session-Id` and flags a server that rejects it with a session error
+  (sessions are removed, SEP-2567).
+- **`stateless-no-init` (ERROR)** — sends a `tools/list` with no
+  `initialize`/`initialized` handshake and flags a server that rejects it as
+  uninitialized (the handshake is removed, SEP-2575).
+- **`required-headers` (ERROR)** — sends a request carrying the now-required
+  `Mcp-Method` / `Mcp-Name` routing headers (Streamable HTTP) and flags a
+  server that errors on them; skipped for stdio targets (no request headers).
+- **`deprecated-sampling` (WARN)** — observes a server-initiated
+  `sampling/createMessage` request. Sampling is deprecated in 2026-07-28 and
+  eligible for removal July 2027; migrate to a direct LLM provider API.
+- **`deprecated-roots` (WARN)** — flags a `roots/list` that returns a result
+  (the roots capability is deprecated).
+- **`deprecated-logging` (WARN)** — observes a server-emitted
+  `notifications/message` (the MCP logging protocol is deprecated; migrate to
+  stderr or OpenTelemetry).
+- **`test/probe-fixtures/server-sessionful.mjs`** and
+  **`server-deprecated.mjs`** — new stdio fixtures isolating a session
+  requirement and the three deprecated features; 9 new tests (71 total),
+  including proof that the suite is gated behind `--spec` (plain
+  `--spec-version 2026-07-28` never runs it) and that a migrated server passes
+  every new check.
+
+### How it works
+
+The suite runs on its own fresh connection(s) after the existing probe path
+completes, so nothing above it changed. The prober's stdio/HTTP transports gain
+an optional server-message observer (used to catch the deprecated
+`sampling/createMessage` and `notifications/message` traffic) and per-request
+header support (used to send `Mcp-Method`/`Mcp-Name`).
+
 ## [0.6.0]
 
 The full 2026-07-28 compliance suite — `mcp-vet probe --spec-version 2026-07-28`

package/README.md

@@ -264,6 +264,26 @@ The stateless verdict is **cross-checked** before it becomes a violation: `requi
 3. When your server targets `2026-07-28` (e.g. after moving to `@modelcontextprotocol/server` 2.x): drop `--fail-on none` so the three ERROR-level checks gate the build. A correctly migrated server passes all of them; the pre-migration server fails `requires-initialize-handshake` and `missing-server-discover` immediately.
 4. Keep a `2025-11-25` probe in the matrix until every client you serve has moved (the rollout is a window, not a day — see [What actually happens on July 28](#what-actually-happens-on-july-28)).
 
+### `--spec 2026-07-28` — the extra compliance suite
+
+`--spec` is a shorthand for `--spec-version` that **also** runs six additional wire-level checks *on top of* the ones above. `--spec 2026-07-28` vets against the new revision **and** adds the suite; plain `--spec-version 2026-07-28` is unchanged and never runs it, so existing CI invocations keep their exact behavior.
+
+```bash
+# full readiness AND the extra compliance suite
+npx @booyaka/mcp-vet probe --spec 2026-07-28 node ./dist/server.js
+```
+
+| ID | Severity | What it checks |
+| --- | --- | --- |
+| `stateless-no-session` | 🔴 ERROR | sends `tools/list` with **no** `Mcp-Session-Id` and flags a server that rejects it with a session error — sessions are removed on 2026-07-28 (SEP-2567), so a stateless request must be served |
+| `stateless-no-init` | 🔴 ERROR | sends `tools/list` with **no** `initialize`/`initialized` handshake and flags a server that rejects it as uninitialized — the handshake is removed (SEP-2575); a compliant server answers the first request directly |
+| `required-headers` | 🔴 ERROR | sends a request carrying the now-required `Mcp-Method` / `Mcp-Name` routing headers and flags a server that errors on them. Skipped for **stdio** targets (there are no request headers over stdio) |
+| `deprecated-sampling` | 🟡 WARN | observes a server-initiated `sampling/createMessage` request. Sampling is deprecated in 2026-07-28 and **eligible for removal July 2027** — migrate to a direct LLM provider API |
+| `deprecated-roots` | 🟡 WARN | flags a `roots/list` that returns a result — the roots capability is deprecated |
+| `deprecated-logging` | 🟡 WARN | observes a server-emitted `notifications/message` — the MCP logging protocol is deprecated; migrate to stderr (stdio) or OpenTelemetry |
+
+The two `stateless-*` checks are cross-checked the same way the rest of the probe is: a server that answers a stateless, session-less, handshake-less `tools/list` passes both; one that rejects it is classified by *why* — a `session` error trips `stateless-no-session`, an `uninitialized` error trips `stateless-no-init` (a session rejection trips both, since a sessionful server is also not answering the first request directly). The two `deprecated-sampling` / `deprecated-logging` checks watch for server→client traffic for a short window (up to the spec's 5 s, bounded by `--timeout`) and report only what the server actually sends — a server that never samples or logs stays clean. The suite runs on its own fresh connection after the standard probe completes, so the ERROR checks above are unaffected.
+
 Probe findings use the same report formats as the scan: `--json` (machine-readable array on stdout) and `--sarif [file]` (SARIF 2.1.0 — `ERROR` maps to `error`, `WARN` to `warning`), plus `--fail-on breaking|any|none` (default `breaking`: exit 1 only on `ERROR`), `--timeout <ms>` (default 8000, also the hang-detection window), `--quiet`, and `--color`/`--no-color`.
 
 Try it against the official reference server — the July 2026 `@modelcontextprotocol/server-everything` (beta 2026-07-28 SDK) answers stateless requests and already returns the new `-32602` resource error code, but it does not implement `server/discover` yet and its tool schemas still declare draft-07 — `probe` reports exactly that (1 ERROR, 13 WARN):

package/dist/cli.js

@@ -142,7 +142,9 @@ function scanMain() {
         '  fixtures [dir]                 write protocol-level conformance fixtures + CHECKLIST.md (default: ./mcp-vet-fixtures)',
         '  probe [options] <url|command>  connect to a RUNNING server and vet its wire behavior (alias: run)',
         '                                 (JSON Schema 2020-12 dialect; with --spec-version 2026-07-28, also stateless',
-        '                                 readiness, the required server/discover RPC, and the -32602 resource error code)',
+        '                                 readiness, the required server/discover RPC, and the -32602 resource error code;',
+        '                                 with --spec 2026-07-28, ALSO the compliance suite: stateless-no-session,',
+        '                                 stateless-no-init, required-headers, deprecated-sampling/roots/logging)',
     ].join('\n'))
         .showHelpAfterError();
     program.parse(process.argv);

package/dist/probe-cli.js

@@ -58,9 +58,10 @@ async function runProbeCli(argv) {
     const program = new commander_1.Command();
     program
         .name('mcp-vet probe')
-        .description('Connect to a RUNNING MCP server (stdio command or Streamable HTTP URL) and vet its wire behavior: JSON Schema dialect of tool schemas (SEP-2106) and, with --spec-version 2026-07-28, stateless-protocol readiness, the required server/discover RPC (SEP-2575), and the -32002 → -32602 resource error-code change.')
+        .description('Connect to a RUNNING MCP server (stdio command or Streamable HTTP URL) and vet its wire behavior: JSON Schema dialect of tool schemas (SEP-2106) and, with --spec-version 2026-07-28, stateless-protocol readiness, the required server/discover RPC (SEP-2575), and the -32002 → -32602 resource error-code change. Add --spec 2026-07-28 to ALSO run the compliance suite: stateless-no-session, stateless-no-init, required-headers, and the deprecated-sampling/roots/logging warnings.')
         .argument('<target...>', 'server URL (http/https) or a command + args to spawn (stdio)')
         .option('--spec-version <version>', `MCP revision to vet against: ${types_1.SPEC_VERSIONS.join(' | ')}`, '2025-11-25')
+        .option('--spec <version>', `shorthand for --spec-version that ALSO runs the extra compliance suite (stateless-no-session, stateless-no-init, required-headers, deprecated-sampling/roots/logging): ${types_1.SPEC_VERSIONS.join(' | ')}`)
         .option('--timeout <ms>', 'per-request timeout in milliseconds', '8000')
         .option('--fail-on <level>', `exit non-zero on: ${FAILON_VALUES.join(' | ')}`, 'breaking')
         .option('--json', 'print findings as a JSON array to stdout (notices go to stderr)')
@@ -80,10 +81,15 @@ async function runProbeCli(argv) {
         return code === 'commander.helpDisplayed' || code === 'commander.help' ? 0 : 2;
     }
     const opts = program.opts();
-    if (!types_1.SPEC_VERSIONS.includes(opts.specVersion)) {
-        fail(`invalid --spec-version "${opts.specVersion}". Valid: ${types_1.SPEC_VERSIONS.join(', ')}`);
+    // `--spec` is a shorthand for `--spec-version` that ALSO enables the extra
+    // compliance suite. When present it wins over --spec-version.
+    const specChecks = opts.spec !== undefined;
+    const rawSpec = opts.spec ?? opts.specVersion;
+    if (!types_1.SPEC_VERSIONS.includes(rawSpec)) {
+        const flag = opts.spec !== undefined ? '--spec' : '--spec-version';
+        fail(`invalid ${flag} "${rawSpec}". Valid: ${types_1.SPEC_VERSIONS.join(', ')}`);
     }
-    const specVersion = opts.specVersion;
+    const specVersion = rawSpec;
     const timeoutMs = Number(opts.timeout);
     if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
         fail(`invalid --timeout "${opts.timeout}" (need a positive number of milliseconds).`);
@@ -111,7 +117,7 @@ async function runProbeCli(argv) {
     }
     let result;
     try {
-        result = await (0, probe_1.probeServer)(target, { specVersion, timeoutMs });
+        result = await (0, probe_1.probeServer)(target, { specVersion, timeoutMs, specChecks });
     }
     catch (err) {
         if (err instanceof probe_1.ProbeError)

package/dist/probe.d.ts

@@ -14,6 +14,13 @@ export interface ProbeOptions {
     specVersion: SpecVersion;
     /** per-request timeout in ms (also the stateless hang-detection window) */
     timeoutMs: number;
+    /**
+     * Run the `--spec 2026-07-28` compliance suite in addition to the existing
+     * checks: stateless-no-session, stateless-no-init, required-headers, and the
+     * deprecated-sampling / deprecated-roots / deprecated-logging warnings. Only
+     * meaningful together with specVersion '2026-07-28'.
+     */
+    specChecks?: boolean;
 }
 export interface ProbeResult {
     /** human-readable target (the command line or the URL) */

package/dist/probe.js

@@ -115,6 +115,7 @@ function openStdio(rawCommand, args) {
     let closedReason = '';
     const stderrTail = [];
     const pending = new Map();
+    const serverListeners = new Set();
     const failAll = (reason) => {
         closed = true;
         closedReason = reason;
@@ -142,6 +143,12 @@ function openStdio(rawCommand, args) {
                 pending.delete(msg.id);
                 p.resolve(msg);
             }
+            else if (msg && typeof msg === 'object' && typeof msg.method === 'string') {
+                // A server-initiated request or notification (its id, if any, is not one
+                // we issued) — surface it to any deprecated-traffic observers.
+                for (const l of serverListeners)
+                    l(msg);
+            }
         }
     });
     child.stderr.on('data', (d) => {
@@ -156,7 +163,8 @@ function openStdio(rawCommand, args) {
             (tail ? ` — stderr: ${tail}` : ''));
     });
     return {
-        request(method, params, timeoutMs) {
+        // extraHeaders is a Streamable-HTTP concept; stdio has no request headers.
+        request(method, params, timeoutMs, _extraHeaders) {
             return new Promise((resolve, reject) => {
                 if (closed)
                     return reject(new ConnectionClosedError(closedReason));
@@ -195,6 +203,10 @@ function openStdio(rawCommand, args) {
                 /* connection already down — the next request reports it */
             }
         },
+        onServerMessage(listener) {
+            serverListeners.add(listener);
+            return () => serverListeners.delete(listener);
+        },
         close() {
             closed = true;
             try {
@@ -227,7 +239,16 @@ function parseSse(body, id) {
 function openHttp(url, specVersion) {
     let nextId = 1;
     let sessionId;
-    const post = async (payload, method, timeoutMs) => {
+    const serverListeners = new Set();
+    // Feed any server-initiated (method-bearing) message from a response body to
+    // the deprecated-traffic observers, ignoring replies to our own request id.
+    const dispatchServer = (msg, ourId) => {
+        if (msg && typeof msg === 'object' && typeof msg.method === 'string' && msg.id !== ourId) {
+            for (const l of serverListeners)
+                l(msg);
+        }
+    };
+    const post = async (payload, method, timeoutMs, extraHeaders) => {
         const headers = {
             'content-type': 'application/json',
             accept: 'application/json, text/event-stream',
@@ -238,6 +259,9 @@ function openHttp(url, specVersion) {
         // mirrors the JSON-RPC body.
         if (specVersion === '2026-07-28')
             headers['mcp-method'] = method;
+        if (extraHeaders)
+            for (const [k, v] of Object.entries(extraHeaders))
+                headers[k.toLowerCase()] = v;
         let res;
         try {
             res = await fetch(url, {
@@ -260,19 +284,38 @@ function openHttp(url, specVersion) {
         return res;
     };
     return {
-        async request(method, params, timeoutMs) {
+        async request(method, params, timeoutMs, extraHeaders) {
             const id = nextId++;
-            const res = await post({ jsonrpc: '2.0', id, method, params }, method, timeoutMs);
+            const res = await post({ jsonrpc: '2.0', id, method, params }, method, timeoutMs, extraHeaders);
             const body = await res.text();
             const ct = res.headers.get('content-type') ?? '';
             let msg = null;
             if (ct.includes('text/event-stream')) {
+                // A single POST may carry server→client traffic (e.g. a sampling
+                // request) alongside our reply in the SSE stream — surface it.
+                for (const line of body.split(/\r?\n/)) {
+                    if (!line.startsWith('data:'))
+                        continue;
+                    try {
+                        dispatchServer(JSON.parse(line.slice(5).trim()), id);
+                    }
+                    catch {
+                        /* not a JSON data line */
+                    }
+                }
                 msg = parseSse(body, id);
             }
             else {
                 try {
                     const parsed = JSON.parse(body);
-                    msg = Array.isArray(parsed) ? parsed.find((m) => m && m.id === id) ?? null : parsed;
+                    if (Array.isArray(parsed)) {
+                        for (const m of parsed)
+                            dispatchServer(m, id);
+                        msg = parsed.find((m) => m && m.id === id) ?? null;
+                    }
+                    else {
+                        msg = parsed;
+                    }
                 }
                 catch {
                     msg = null;
@@ -298,6 +341,10 @@ function openHttp(url, specVersion) {
                 /* notifications are best-effort */
             }
         },
+        onServerMessage(listener) {
+            serverListeners.add(listener);
+            return () => serverListeners.delete(listener);
+        },
         close() {
             /* nothing persistent to tear down */
         },
@@ -503,6 +550,161 @@ function dialectFinding(targetLabel, toolName, field, issue) {
 function targetLabel(target) {
     return target.kind === 'http' ? target.url : [target.command, ...target.args].join(' ');
 }
+// ---------------------------------------------------------------------------
+// `--spec 2026-07-28` compliance suite — opt-in, run IN ADDITION to the checks
+// above. Each check uses its own fresh connection so the existing probe path is
+// left exactly as it was.
+// ---------------------------------------------------------------------------
+const SESSION_ERR_RE = /session/i;
+const UNINIT_ERR_RE = /initial/i; // matches initialize / initialized / uninitialized
+function delay(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+/** Resolve once `pred()` is true or `windowMs` elapses (cheap polling). */
+async function waitUntil(pred, windowMs) {
+    const deadline = Date.now() + windowMs;
+    while (!pred() && Date.now() < deadline)
+        await delay(25);
+}
+/**
+ * Runs the six `--spec 2026-07-28` compliance checks and returns the findings
+ * plus human-readable notes to fold into the ProbeResult:
+ *   1. stateless-no-session   ERROR  — a no-session request must not be refused
+ *   2. stateless-no-init      ERROR  — a no-handshake request must be answered
+ *   3. required-headers       ERROR  — Mcp-Method/Mcp-Name must be accepted (HTTP)
+ *   4. deprecated-sampling    WARN   — server issued sampling/createMessage
+ *   5. deprecated-roots       WARN   — roots/list returned a result
+ *   6. deprecated-logging     WARN   — server emitted notifications/message
+ */
+async function runSpecChecks(target, opts) {
+    const label = targetLabel(target);
+    const findings = [];
+    const notes = [];
+    const isHttp = target.kind === 'http';
+    const conn = openConnection(target, '2026-07-28');
+    // Passively watch for deprecated server→client traffic while we drive the
+    // connection (checks 4 & 6). Register before the first request so the window
+    // covers everything the server sends.
+    let sawSampling = false;
+    let sawLogging = false;
+    const unsub = conn.onServerMessage?.((m) => {
+        if (m && m.method === 'sampling/createMessage')
+            sawSampling = true;
+        if (m && m.method === 'notifications/message')
+            sawLogging = true;
+    });
+    try {
+        // Checks 1 & 2 — a single stateless (no session), no-initialize tools/list.
+        let resp;
+        try {
+            resp = await conn.request('tools/list', { _meta: statelessMeta() }, opts.timeoutMs);
+        }
+        catch (err) {
+            resp = { error: { message: err.message } };
+        }
+        if (resp.error) {
+            const code = resp.error.code;
+            const message = resp.error.message ?? '';
+            const evidence = `stateless tools/list (no session, no initialize) was rejected: ${code ?? '?'} ${message}`.trim();
+            const isSession = SESSION_ERR_RE.test(message);
+            const isUninit = UNINIT_ERR_RE.test(message);
+            if (isSession) {
+                findings.push(runtimeFinding('stateless-no-session', label, evidence));
+                notes.push(`stateless-no-session: FAIL — server requires a session (${code ?? '?'})`);
+            }
+            else {
+                notes.push('stateless-no-session: passed — no session was required');
+            }
+            // Per the brief, an "uninitialized" OR a "session" rejection fails no-init.
+            if (isUninit || isSession) {
+                findings.push(runtimeFinding('stateless-no-init', label, evidence));
+                notes.push(`stateless-no-init: FAIL — request rejected without an initialize handshake (${code ?? '?'})`);
+            }
+            else {
+                notes.push(`stateless-no-init: inconclusive — rejected for an unrelated reason (${code ?? '?'})`);
+            }
+        }
+        else if (Array.isArray(resp.result?.tools)) {
+            notes.push('stateless-no-session: passed — no session was required');
+            notes.push('stateless-no-init: passed — answered the first request with no handshake');
+        }
+        else {
+            notes.push('stateless-no-session / stateless-no-init: inconclusive — no tools array in the answer');
+        }
+        // Check 3 — the required Mcp-Method / Mcp-Name routing headers (HTTP only;
+        // stdio has no request headers).
+        if (!isHttp) {
+            notes.push('required-headers: skipped — Mcp-Method/Mcp-Name are a Streamable HTTP concern; target is stdio');
+        }
+        else {
+            let hdrResp;
+            try {
+                hdrResp = await conn.request('tools/list', { _meta: statelessMeta() }, opts.timeoutMs, {
+                    'mcp-method': 'tools/list',
+                    'mcp-name': 'tools/list',
+                });
+            }
+            catch (err) {
+                hdrResp = { error: { message: err.message } };
+            }
+            if (!hdrResp.error) {
+                notes.push('required-headers: passed — server accepted a request carrying Mcp-Method and Mcp-Name');
+            }
+            else if (/header|mcp-method|mcp-name|routing/i.test(hdrResp.error.message ?? '')) {
+                const evidence = `tools/list carrying the Mcp-Method/Mcp-Name headers was rejected: ${hdrResp.error.code ?? '?'} ${hdrResp.error.message ?? ''}`.trim();
+                findings.push(runtimeFinding('required-headers', label, evidence));
+                notes.push('required-headers: FAIL — server errored on the required routing headers');
+            }
+            else {
+                notes.push(`required-headers: inconclusive — request errored for an unrelated reason (${hdrResp.error.code ?? '?'})`);
+            }
+        }
+        // Check 5 — a roots/list that returns a result means the deprecated roots
+        // capability is in use.
+        try {
+            const rootsResp = await conn.request('roots/list', { _meta: statelessMeta() }, opts.timeoutMs);
+            if (!rootsResp.error && rootsResp.result && typeof rootsResp.result === 'object') {
+                const roots = rootsResp.result.roots;
+                const count = Array.isArray(roots) ? ` (${roots.length} root(s))` : '';
+                findings.push(runtimeFinding('deprecated-roots', label, `roots/list returned a result${count} — the deprecated roots capability is in use`));
+                notes.push('deprecated-roots: WARN — server answered roots/list with a result');
+            }
+            else {
+                notes.push(`deprecated-roots: clean — roots/list not served (${rootsResp.error?.code ?? 'no result'})`);
+            }
+        }
+        catch (err) {
+            notes.push(`deprecated-roots: inconclusive — ${err.message}`);
+        }
+        // Checks 4 & 6 — give the server the spec's window (up to 5 s) to emit
+        // deprecated server→client traffic, resolving early once both are seen.
+        if (conn.onServerMessage) {
+            await waitUntil(() => sawSampling && sawLogging, Math.min(5000, opts.timeoutMs));
+            if (sawSampling) {
+                findings.push(runtimeFinding('deprecated-sampling', label, 'server issued a sampling/createMessage request'));
+                notes.push('deprecated-sampling: WARN — server issued sampling/createMessage');
+            }
+            else {
+                notes.push('deprecated-sampling: clean — no sampling/createMessage observed');
+            }
+            if (sawLogging) {
+                findings.push(runtimeFinding('deprecated-logging', label, 'server emitted a notifications/message log notification'));
+                notes.push('deprecated-logging: WARN — server emitted notifications/message');
+            }
+            else {
+                notes.push('deprecated-logging: clean — no notifications/message observed');
+            }
+        }
+        else {
+            notes.push('deprecated-sampling / deprecated-logging: skipped — this transport cannot observe server-initiated traffic');
+        }
+    }
+    finally {
+        unsub?.();
+        conn.close();
+    }
+    return { findings, notes };
+}
 async function probeServer(target, opts) {
     const label = targetLabel(target);
     const findings = [];
@@ -573,6 +775,13 @@ async function probeServer(target, opts) {
                 findings.push(dialectFinding(label, name, field, issue));
         }
     }
+    // The opt-in `--spec 2026-07-28` compliance suite runs on its own fresh
+    // connection(s), in addition to everything above.
+    if (opts.specChecks && opts.specVersion === '2026-07-28') {
+        const extra = await runSpecChecks(target, opts);
+        findings.push(...extra.findings);
+        notes.push(...extra.notes);
+    }
     return {
         target: label,
         transport: target.kind,

package/dist/rules.js

@@ -129,6 +129,55 @@ exports.RUNTIME_RULES = {
         after: "return { error: { code: -32602, message: 'Invalid params' } }; // was -32002 — the static scan's --fix rewrites source occurrences",
         docUrl: constants_1.SPEC_URL,
     },
+    // --- `--spec 2026-07-28` compliance suite (added on top of the four above) ---
+    'stateless-no-session': {
+        id: 'stateless-no-session',
+        label: 'requires a protocol-level session',
+        severity: 'ERROR',
+        explanation: 'A stateless tools/list sent with no Mcp-Session-Id was rejected with a session error. The 2026-07-28 spec removes the Mcp-Session-Id header and the protocol-level session (SEP-2567); the server must serve requests without one.',
+        after: 'Stop requiring a session: remove sessionIdGenerator / the Mcp-Session-Id gate and serve each request statelessly (client identity & capabilities arrive in per-request _meta).',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'stateless-no-init': {
+        id: 'stateless-no-init',
+        label: 'requires initialization before requests',
+        severity: 'ERROR',
+        explanation: 'A tools/list sent without a prior initialize/initialized handshake was rejected as uninitialized. The 2026-07-28 spec removes the handshake (SEP-2575); a compliant server answers the first request directly.',
+        after: 'Remove the initialize/initialized gate and answer requests immediately; read protocolVersion/clientInfo/capabilities from params._meta on every request.',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'required-headers': {
+        id: 'required-headers',
+        label: 'rejects the required Mcp-Method / Mcp-Name headers',
+        severity: 'ERROR',
+        explanation: 'The 2026-07-28 Streamable HTTP transport requires each request to carry Mcp-Method and Mcp-Name routing headers that mirror the JSON-RPC body. This server errored on a request that set them, so it will reject conforming 2026-07-28 clients.',
+        after: 'Accept (and, per spec, validate against the body) the Mcp-Method and Mcp-Name request headers rather than rejecting them.',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'deprecated-sampling': {
+        id: 'deprecated-sampling',
+        label: 'uses deprecated sampling (sampling/createMessage)',
+        severity: 'WARN',
+        explanation: 'The server issued a sampling/createMessage request. Sampling is deprecated in 2026-07-28 and eligible for removal in July 2027; the server-driven LLM call is being phased out.',
+        after: 'Migrate off sampling: call your LLM provider’s API directly from the server instead of asking the client to sample. Eligible for removal July 2027.',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'deprecated-roots': {
+        id: 'deprecated-roots',
+        label: 'uses deprecated roots',
+        severity: 'WARN',
+        explanation: 'The server answered roots/list with a result, indicating it relies on the roots capability, which is deprecated in 2026-07-28.',
+        after: 'Migrate off roots: pass the paths/URIs the server needs as explicit tool parameters instead of discovering them via the roots capability.',
+        docUrl: constants_1.SPEC_URL,
+    },
+    'deprecated-logging': {
+        id: 'deprecated-logging',
+        label: 'uses deprecated MCP logging (notifications/message)',
+        severity: 'WARN',
+        explanation: 'The server emitted a notifications/message log notification. The MCP logging protocol is deprecated in 2026-07-28.',
+        after: 'Migrate off MCP logging: write logs to stderr (stdio transport) or emit OpenTelemetry instead of notifications/message.',
+        docUrl: constants_1.SPEC_URL,
+    },
 };
 const CAP_RE = /capabilities/i;
 const CAP_NAMES = {

package/dist/types.d.ts

@@ -15,7 +15,7 @@ export declare const ALL_PATTERN_IDS: PatternId[];
  * not by static source analysis. Kebab-case ids are deliberate — they are the
  * wire-level category names, distinct from the static PatternId rule ids.
  */
-export type RuntimeRuleId = 'json-schema-dialect' | 'requires-initialize-handshake' | 'missing-server-discover' | 'legacy-resource-error-code';
+export type RuntimeRuleId = 'json-schema-dialect' | 'requires-initialize-handshake' | 'missing-server-discover' | 'legacy-resource-error-code' | 'stateless-no-session' | 'stateless-no-init' | 'required-headers' | 'deprecated-sampling' | 'deprecated-roots' | 'deprecated-logging';
 export declare const ALL_RUNTIME_RULE_IDS: RuntimeRuleId[];
 /** Any violation id — static pattern or runtime probe category. */
 export type ViolationId = PatternId | RuntimeRuleId;

package/dist/types.js

@@ -18,4 +18,10 @@ exports.ALL_RUNTIME_RULE_IDS = [
     'requires-initialize-handshake',
     'missing-server-discover',
     'legacy-resource-error-code',
+    'stateless-no-session',
+    'stateless-no-init',
+    'required-headers',
+    'deprecated-sampling',
+    'deprecated-roots',
+    'deprecated-logging',
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@booyaka/mcp-vet",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Scan MCP server source code for patterns that break under the 2026-07-28 Model Context Protocol spec release candidate.",
   "type": "commonjs",
   "main": "dist/index.js",