@yawlabs/mcp-compliance 0.3.0 → 0.5.0

package/dist/index.js

@@ -1,11 +1,14 @@
 #!/usr/bin/env node
 
 // src/index.ts
+import { createRequire as createRequire3 } from "module";
+import chalk2 from "chalk";
+import { Command } from "commander";
+
+// src/mcp/server.ts
 import { createRequire as createRequire2 } from "module";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import chalk2 from "chalk";
-import { Command } from "commander";
 
 // src/mcp/tools.ts
 import { z } from "zod";
@@ -15,16 +18,14 @@ import { createRequire } from "module";
 import { request } from "undici";
 
 // src/badge.ts
+import { createHash } from "crypto";
+function urlHash(url) {
+  return createHash("sha256").update(url).digest("hex").slice(0, 12);
+}
 function generateBadge(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    parsed = new URL("https://unknown");
-  }
-  const encoded = encodeURIComponent(parsed.href);
-  const imageUrl = `https://mcp.hosting/api/compliance/${encoded}/badge`;
-  const reportUrl = `https://mcp.hosting/compliance/${encoded}`;
+  const hash = urlHash(url);
+  const imageUrl = `https://mcp.hosting/api/compliance/${hash}/badge`;
+  const reportUrl = `https://mcp.hosting/compliance/${hash}`;
   return {
     imageUrl,
     reportUrl,
@@ -70,14 +71,15 @@ function computeScore(tests) {
 
 // src/types.ts
 var TEST_DEFINITIONS = [
-  // ── Transport (7 tests) ──────────────────────────────────────────
+  // ── Transport (10 tests) ─────────────────────────────────────────
   {
     id: "transport-post",
     name: "HTTP POST accepted",
     category: "transport",
     required: true,
     specRef: "basic/transports#streamable-http",
-    description: "Verifies the server accepts HTTP POST requests and returns a 2xx status code. This is the fundamental transport requirement for Streamable HTTP MCP servers."
+    description: "Verifies the server accepts HTTP POST requests and returns a 2xx status code. This is the fundamental transport requirement for Streamable HTTP MCP servers.",
+    recommendation: "Ensure your server listens for POST requests on the MCP endpoint. If you see 401/403, pass --auth with a valid token. Check that the URL is correct and the server is running."
   },
   {
     id: "transport-content-type",
@@ -85,7 +87,8 @@ var TEST_DEFINITIONS = [
     category: "transport",
     required: true,
     specRef: "basic/transports#streamable-http",
-    description: "Checks that the server responds with Content-Type application/json or text/event-stream. MCP servers must use one of these two content types."
+    description: "Checks that the server responds with Content-Type application/json or text/event-stream. MCP servers must use one of these two content types.",
+    recommendation: 'Set the Content-Type response header to "application/json" for synchronous responses or "text/event-stream" for streaming. Do not use text/html or other types.'
   },
   {
     id: "transport-notification-202",
@@ -93,7 +96,8 @@ var TEST_DEFINITIONS = [
     category: "transport",
     required: false,
     specRef: "basic/transports#streamable-http",
-    description: "Verifies that sending a JSON-RPC notification (no id field) returns HTTP 202 Accepted with no body. Per spec, servers MUST return 202 for notifications."
+    description: "Verifies that sending a JSON-RPC notification (no id field) returns HTTP 202 Accepted with no body. Per spec, servers MUST return 202 for notifications.",
+    recommendation: "Detect JSON-RPC messages without an id field and return HTTP 202 with an empty body. Do not attempt to send a JSON-RPC response for notifications."
   },
   {
     id: "transport-session-id",
@@ -101,7 +105,8 @@ var TEST_DEFINITIONS = [
     category: "transport",
     required: false,
     specRef: "basic/transports#streamable-http",
-    description: "Tests that the server returns HTTP 400 when MCP-Session-Id header is missing on requests after initialization (when the server issued a session ID)."
+    description: "Tests that the server returns HTTP 400 when MCP-Session-Id header is missing on requests after initialization (when the server issued a session ID).",
+    recommendation: "If your server issues an MCP-Session-Id header in the initialize response, reject subsequent requests that omit this header with HTTP 400."
   },
   {
     id: "transport-get",
@@ -109,7 +114,8 @@ var TEST_DEFINITIONS = [
     category: "transport",
     required: false,
     specRef: "basic/transports#streamable-http",
-    description: "Tests the GET endpoint for server-initiated messages. Server should return text/event-stream or 405 Method Not Allowed."
+    description: "Tests the GET endpoint for server-initiated messages. Server should return text/event-stream or 405 Method Not Allowed.",
+    recommendation: "If your server supports server-initiated messages, handle GET with text/event-stream. Otherwise, return 405 Method Not Allowed."
   },
   {
     id: "transport-delete",
@@ -117,7 +123,8 @@ var TEST_DEFINITIONS = [
     category: "transport",
     required: false,
     specRef: "basic/transports#streamable-http",
-    description: "Tests the DELETE endpoint for session termination. Server should accept the request or return 405 Method Not Allowed."
+    description: "Tests the DELETE endpoint for session termination. Server should accept the request or return 405 Method Not Allowed.",
+    recommendation: "Handle DELETE requests for session cleanup, or return 405 if session termination is not supported. Do not return 500."
   },
   {
     id: "transport-batch-reject",
@@ -125,16 +132,45 @@ var TEST_DEFINITIONS = [
     category: "transport",
     required: true,
     specRef: "basic/transports#streamable-http",
-    description: "Sends a JSON-RPC batch request (array of messages) and verifies the server rejects it with an error. MCP does not support JSON-RPC batch requests."
+    description: "Sends a JSON-RPC batch request (array of messages) and verifies the server rejects it with an error. MCP does not support JSON-RPC batch requests.",
+    recommendation: "Check if the parsed JSON body is an array. If so, return a JSON-RPC error or HTTP 400. Do not process batch requests \u2014 MCP explicitly forbids them."
+  },
+  {
+    id: "transport-content-type-init",
+    name: "Initialize response has valid content type",
+    category: "transport",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Validates that the initialize response uses application/json or text/event-stream content type. Some servers return other types for the handshake.",
+    recommendation: 'Ensure the initialize response uses Content-Type "application/json" or "text/event-stream". Do not return text/html or other types for JSON-RPC responses.'
   },
-  // ── Lifecycle (10 tests) ─────────────────────────────────────────
+  {
+    id: "transport-get-stream",
+    name: "GET with session returns SSE or 405",
+    category: "transport",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Tests the GET endpoint with an active session ID for server-initiated messages. After initialization, the server should either return an SSE stream or 405.",
+    recommendation: "If your server supports server-initiated messages, return text/event-stream on GET with a valid session ID. Otherwise, return 405 Method Not Allowed."
+  },
+  {
+    id: "transport-concurrent",
+    name: "Handles concurrent requests",
+    category: "transport",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Sends multiple JSON-RPC requests in parallel and verifies the server responds to all with correct matching IDs. Tests that the server can handle concurrent connections.",
+    recommendation: "Ensure your server can handle multiple simultaneous requests. Each response must include the correct id matching the request. Use async handlers or connection pooling."
+  },
+  // ── Lifecycle (12 tests) ─────────────────────────────────────────
   {
     id: "lifecycle-init",
     name: "Initialize handshake",
     category: "lifecycle",
     required: true,
     specRef: "basic/lifecycle#initialization",
-    description: "Tests the initialize handshake by sending an initialize request with client capabilities. The server must return a result with protocolVersion."
+    description: "Tests the initialize handshake by sending an initialize request with client capabilities. The server must return a result with protocolVersion.",
+    recommendation: 'Implement the "initialize" method handler. Return a result object with at least protocolVersion, capabilities, and serverInfo fields.'
   },
   {
     id: "lifecycle-proto-version",
@@ -142,7 +178,8 @@ var TEST_DEFINITIONS = [
     category: "lifecycle",
     required: true,
     specRef: "basic/lifecycle#version-negotiation",
-    description: "Validates that the protocolVersion returned by the server matches the YYYY-MM-DD date format required by the spec."
+    description: "Validates that the protocolVersion returned by the server matches the YYYY-MM-DD date format required by the spec.",
+    recommendation: `Return protocolVersion as a YYYY-MM-DD string (e.g., "2025-11-25"). The server should negotiate based on the client's requested version.`
   },
   {
     id: "lifecycle-server-info",
@@ -150,7 +187,8 @@ var TEST_DEFINITIONS = [
     category: "lifecycle",
     required: false,
     specRef: "basic/lifecycle#initialization",
-    description: "Checks that the server includes a serverInfo object with at least a name field in its initialize response. While recommended, this is not strictly required."
+    description: "Checks that the server includes a serverInfo object with at least a name field in its initialize response. While recommended, this is not strictly required.",
+    recommendation: 'Add a serverInfo object to your initialize response: { name: "your-server", version: "1.0.0" }. This helps clients identify your server.'
   },
   {
     id: "lifecycle-capabilities",
@@ -158,7 +196,8 @@ var TEST_DEFINITIONS = [
     category: "lifecycle",
     required: true,
     specRef: "basic/lifecycle#capability-negotiation",
-    description: "Verifies the server returns a capabilities object in its initialize response. An empty object is valid (no optional features declared)."
+    description: "Verifies the server returns a capabilities object in its initialize response. An empty object is valid (no optional features declared).",
+    recommendation: "Include a capabilities object in your initialize response. Declare the features your server supports (tools, resources, prompts, logging, etc.). An empty object {} is valid."
   },
   {
     id: "lifecycle-jsonrpc",
@@ -166,7 +205,8 @@ var TEST_DEFINITIONS = [
     category: "lifecycle",
     required: true,
     specRef: "basic",
-    description: 'Validates that the initialize response is a proper JSON-RPC 2.0 message with jsonrpc="2.0", an id field, and either a result or error field.'
+    description: 'Validates that the initialize response is a proper JSON-RPC 2.0 message with jsonrpc="2.0", an id field, and either a result or error field.',
+    recommendation: 'Ensure every response includes jsonrpc: "2.0", the matching id from the request, and either a result or error field. Never omit the jsonrpc field.'
   },
   {
     id: "lifecycle-ping",
@@ -174,7 +214,8 @@ var TEST_DEFINITIONS = [
     category: "lifecycle",
     required: true,
     specRef: "basic/utilities#ping",
-    description: "Tests that the server responds to the ping method with an empty result object. This is a required utility method."
+    description: "Tests that the server responds to the ping method with an empty result object. This is a required utility method.",
+    recommendation: 'Implement a "ping" method handler that returns an empty result object {}. This is required by the MCP spec for keepalive and connectivity checking.'
   },
   {
     id: "lifecycle-instructions",
@@ -182,7 +223,8 @@ var TEST_DEFINITIONS = [
     category: "lifecycle",
     required: false,
     specRef: "basic/lifecycle#initialization",
-    description: "If the server includes an instructions field in the initialize response, validates it is a string. Instructions provide guidance for how the client should interact with the server."
+    description: "If the server includes an instructions field in the initialize response, validates it is a string. Instructions provide guidance for how the client should interact with the server.",
+    recommendation: "If you include an instructions field in the initialize response, ensure it is a string. Remove the field or fix the type if it is not a string."
   },
   {
     id: "lifecycle-id-match",
@@ -190,7 +232,8 @@ var TEST_DEFINITIONS = [
     category: "lifecycle",
     required: true,
     specRef: "basic",
-    description: "Verifies that the JSON-RPC response id matches the request id sent by the client. This is a fundamental JSON-RPC 2.0 requirement."
+    description: "Verifies that the JSON-RPC response id matches the request id sent by the client. This is a fundamental JSON-RPC 2.0 requirement.",
+    recommendation: "Copy the id field from the request into the response. This is a core JSON-RPC 2.0 requirement. Check that your framework does not modify or discard the request ID."
   },
   {
     id: "lifecycle-logging",
@@ -198,7 +241,8 @@ var TEST_DEFINITIONS = [
     category: "lifecycle",
     required: false,
     specRef: "server/utilities#logging",
-    description: "If the server declares logging capability, tests that logging/setLevel method is accepted with a valid log level."
+    description: "If the server declares logging capability, tests that logging/setLevel method is accepted with a valid log level.",
+    recommendation: 'If you declare logging in capabilities, implement the "logging/setLevel" handler. Accept standard log levels: debug, info, notice, warning, error, critical, alert, emergency.'
   },
   {
     id: "lifecycle-completions",
@@ -206,7 +250,26 @@ var TEST_DEFINITIONS = [
     category: "lifecycle",
     required: false,
     specRef: "server/utilities#completion",
-    description: "If the server declares completions capability, tests that the completion/complete method is accepted."
+    description: "If the server declares completions capability, tests that the completion/complete method is accepted.",
+    recommendation: 'If you declare completions in capabilities, implement the "completion/complete" handler. Return a completion object with a values array, even if empty.'
+  },
+  {
+    id: "lifecycle-cancellation",
+    name: "Handles cancellation notifications",
+    category: "lifecycle",
+    required: false,
+    specRef: "basic/utilities#cancellation",
+    description: "Tests that the server accepts notifications/cancelled without error. Servers should gracefully handle cancellation of unknown or completed requests.",
+    recommendation: "Accept notifications/cancelled and stop any in-progress work for the referenced requestId. If the request is unknown or already complete, silently ignore the cancellation."
+  },
+  {
+    id: "lifecycle-progress",
+    name: "Accepts progress notifications",
+    category: "lifecycle",
+    required: false,
+    specRef: "basic/utilities#progress",
+    description: "Tests that the server accepts notifications/progress without error. Servers should handle progress notifications for request tracking.",
+    recommendation: "Accept notifications/progress with progressToken, progress, and optional total fields. Ignore notifications for unknown progress tokens."
   },
   // ── Tools (4 tests) ──────────────────────────────────────────────
   {
@@ -215,7 +278,8 @@ var TEST_DEFINITIONS = [
     category: "tools",
     required: false,
     specRef: "server/tools#listing-tools",
-    description: "Calls tools/list and validates it returns an array of tool definitions. Required if the server declares tools capability."
+    description: "Calls tools/list and validates it returns an array of tool definitions. Required if the server declares tools capability.",
+    recommendation: "Implement the tools/list handler to return { tools: [...] } with an array of tool definition objects. Each tool needs at least a name and inputSchema."
   },
   {
     id: "tools-call",
@@ -223,7 +287,8 @@ var TEST_DEFINITIONS = [
     category: "tools",
     required: false,
     specRef: "server/tools#calling-tools",
-    description: "Calls the first tool with empty arguments and verifies the response format. Accepts both successful results and InvalidParams errors."
+    description: "Calls the first tool with empty arguments and verifies the response format. Accepts both successful results and InvalidParams errors.",
+    recommendation: "Ensure tools/call returns { content: [...] } with an array of content objects, each having a type field. Return isError: true for tool execution errors."
   },
   {
     id: "tools-pagination",
@@ -231,7 +296,8 @@ var TEST_DEFINITIONS = [
     category: "tools",
     required: false,
     specRef: "server/tools#listing-tools",
-    description: "Tests cursor-based pagination on tools/list. Validates nextCursor is a string if present and that fetching the next page returns a valid response."
+    description: "Tests cursor-based pagination on tools/list. Validates nextCursor is a string if present and that fetching the next page returns a valid response.",
+    recommendation: "If your server has many tools, include a nextCursor string in the response. Ensure passing this cursor back in a subsequent request returns the next page."
   },
   {
     id: "tools-content-types",
@@ -239,7 +305,8 @@ var TEST_DEFINITIONS = [
     category: "tools",
     required: false,
     specRef: "server/tools#calling-tools",
-    description: "Validates that content items returned by tools/call have a recognized type field (text, image, audio, resource, resource_link)."
+    description: "Validates that content items returned by tools/call have a recognized type field (text, image, audio, resource, resource_link).",
+    recommendation: 'Every content item returned by tools/call must have a type field set to one of: "text", "image", "audio", "resource", or "resource_link". Check for typos or missing type fields.'
   },
   // ── Resources (5 tests) ──────────────────────────────────────────
   {
@@ -248,7 +315,8 @@ var TEST_DEFINITIONS = [
     category: "resources",
     required: false,
     specRef: "server/resources#listing-resources",
-    description: "Calls resources/list and validates it returns an array. Required if the server declares resources capability."
+    description: "Calls resources/list and validates it returns an array. Required if the server declares resources capability.",
+    recommendation: "Implement resources/list to return { resources: [...] } with an array of resource objects. Each resource needs at least a uri and name."
   },
   {
     id: "resources-read",
@@ -256,7 +324,8 @@ var TEST_DEFINITIONS = [
     category: "resources",
     required: false,
     specRef: "server/resources#reading-resources",
-    description: "Reads the first resource and validates the response contains a contents array with proper uri and text/blob fields."
+    description: "Reads the first resource and validates the response contains a contents array with proper uri and text/blob fields.",
+    recommendation: "Implement resources/read to return { contents: [...] } where each item has a uri and either a text or blob field. Ensure the uri matches the requested resource."
   },
   {
     id: "resources-templates",
@@ -264,7 +333,8 @@ var TEST_DEFINITIONS = [
     category: "resources",
     required: false,
     specRef: "server/resources#resource-templates",
-    description: "Tests the resource templates endpoint. Accepts Method not found (-32601) since templates are optional."
+    description: "Tests the resource templates endpoint. Accepts Method not found (-32601) since templates are optional.",
+    recommendation: "If your server supports resource templates, implement resources/templates/list returning { resourceTemplates: [...] }. Otherwise, return error code -32601."
   },
   {
     id: "resources-pagination",
@@ -272,7 +342,8 @@ var TEST_DEFINITIONS = [
     category: "resources",
     required: false,
     specRef: "server/resources#listing-resources",
-    description: "Tests cursor-based pagination on resources/list. Validates nextCursor is a string if present and that fetching the next page works."
+    description: "Tests cursor-based pagination on resources/list. Validates nextCursor is a string if present and that fetching the next page works.",
+    recommendation: "If you return nextCursor in resources/list, ensure it is a string and that passing it back as cursor in the next request returns valid results."
   },
   {
     id: "resources-subscribe",
@@ -280,7 +351,8 @@ var TEST_DEFINITIONS = [
     category: "resources",
     required: false,
     specRef: "server/resources#subscriptions",
-    description: "If the server declares resources.subscribe capability, tests that resources/subscribe and resources/unsubscribe methods are accepted."
+    description: "If the server declares resources.subscribe capability, tests that resources/subscribe and resources/unsubscribe methods are accepted.",
+    recommendation: "If you declare resources.subscribe capability, implement both resources/subscribe and resources/unsubscribe handlers. Both should accept a uri parameter."
   },
   // ── Prompts (3 tests) ────────────────────────────────────────────
   {
@@ -289,7 +361,8 @@ var TEST_DEFINITIONS = [
     category: "prompts",
     required: false,
     specRef: "server/prompts#listing-prompts",
-    description: "Calls prompts/list and validates it returns an array. Required if the server declares prompts capability."
+    description: "Calls prompts/list and validates it returns an array. Required if the server declares prompts capability.",
+    recommendation: "Implement prompts/list to return { prompts: [...] } with an array of prompt objects. Each prompt needs at least a name field."
   },
   {
     id: "prompts-get",
@@ -297,7 +370,8 @@ var TEST_DEFINITIONS = [
     category: "prompts",
     required: false,
     specRef: "server/prompts#getting-a-prompt",
-    description: "Gets the first prompt and validates the response contains a messages array with proper role and content fields."
+    description: "Gets the first prompt and validates the response contains a messages array with proper role and content fields.",
+    recommendation: 'Implement prompts/get to return { messages: [...] } where each message has a role ("user" or "assistant") and a content field.'
   },
   {
     id: "prompts-pagination",
@@ -305,7 +379,8 @@ var TEST_DEFINITIONS = [
     category: "prompts",
     required: false,
     specRef: "server/prompts#listing-prompts",
-    description: "Tests cursor-based pagination on prompts/list. Validates nextCursor is a string if present and that fetching the next page works."
+    description: "Tests cursor-based pagination on prompts/list. Validates nextCursor is a string if present and that fetching the next page works.",
+    recommendation: "If you return nextCursor in prompts/list, ensure it is a string and that passing it back as cursor in the next request returns valid results."
   },
   // ── Error Handling (8 tests) ─────────────────────────────────────
   {
@@ -314,7 +389,8 @@ var TEST_DEFINITIONS = [
     category: "errors",
     required: true,
     specRef: "basic",
-    description: "Sends an unknown method and verifies the server returns a JSON-RPC error. The spec requires error code -32601 (Method not found)."
+    description: "Sends an unknown method and verifies the server returns a JSON-RPC error. The spec requires error code -32601 (Method not found).",
+    recommendation: "Return a JSON-RPC error with code -32601 (Method not found) for any unrecognized method name. Do not silently ignore unknown methods."
   },
   {
     id: "error-method-code",
@@ -322,7 +398,8 @@ var TEST_DEFINITIONS = [
     category: "errors",
     required: false,
     specRef: "basic",
-    description: "Checks the error code is specifically -32601 (Method not found) for unknown methods, as required by JSON-RPC 2.0."
+    description: "Checks the error code is specifically -32601 (Method not found) for unknown methods, as required by JSON-RPC 2.0.",
+    recommendation: "Use exactly error code -32601 for unknown methods. Do not use generic error codes like -32000. This is required by JSON-RPC 2.0."
   },
   {
     id: "error-invalid-jsonrpc",
@@ -330,7 +407,8 @@ var TEST_DEFINITIONS = [
     category: "errors",
     required: true,
     specRef: "basic",
-    description: "Sends a malformed JSON-RPC message (missing required fields) and verifies the server returns an error or 4xx status."
+    description: "Sends a malformed JSON-RPC message (missing required fields) and verifies the server returns an error or 4xx status.",
+    recommendation: "Validate incoming JSON-RPC messages for required fields (jsonrpc, method). Return error code -32600 (Invalid Request) or HTTP 400 for malformed messages."
   },
   {
     id: "error-invalid-json",
@@ -338,7 +416,8 @@ var TEST_DEFINITIONS = [
     category: "errors",
     required: false,
     specRef: "basic",
-    description: "Sends invalid JSON and verifies the server returns a parse error (-32700) or 4xx status code."
+    description: "Sends invalid JSON and verifies the server returns a parse error (-32700) or 4xx status code.",
+    recommendation: "Catch JSON parse errors and return error code -32700 (Parse error) with a descriptive message. Do not return 500 for malformed input."
   },
   {
     id: "error-missing-params",
@@ -346,7 +425,8 @@ var TEST_DEFINITIONS = [
     category: "errors",
     required: false,
     specRef: "server/tools#error-handling",
-    description: "Calls tools/call with an empty params object (missing required name field) and verifies an error is returned."
+    description: "Calls tools/call with an empty params object (missing required name field) and verifies an error is returned.",
+    recommendation: "Validate tools/call params and return error code -32602 (Invalid params) when the required name field is missing."
   },
   {
     id: "error-parse-code",
@@ -354,7 +434,8 @@ var TEST_DEFINITIONS = [
     category: "errors",
     required: false,
     specRef: "basic",
-    description: "Checks that the server returns the specific JSON-RPC error code -32700 (Parse error) when receiving invalid JSON, as required by the JSON-RPC 2.0 specification."
+    description: "Checks that the server returns the specific JSON-RPC error code -32700 (Parse error) when receiving invalid JSON, as required by the JSON-RPC 2.0 specification.",
+    recommendation: "Return exactly error code -32700 for JSON parse failures. Most JSON-RPC frameworks handle this automatically \u2014 check yours does not override the code."
   },
   {
     id: "error-invalid-request-code",
@@ -362,7 +443,8 @@ var TEST_DEFINITIONS = [
     category: "errors",
     required: false,
     specRef: "basic",
-    description: "Checks that the server returns the specific JSON-RPC error code -32600 (Invalid Request) for malformed JSON-RPC messages missing required fields."
+    description: "Checks that the server returns the specific JSON-RPC error code -32600 (Invalid Request) for malformed JSON-RPC messages missing required fields.",
+    recommendation: "Return exactly error code -32600 for structurally invalid JSON-RPC messages (e.g., missing method field). Check your JSON-RPC middleware configuration."
   },
   {
     id: "tools-call-unknown",
@@ -370,7 +452,8 @@ var TEST_DEFINITIONS = [
     category: "errors",
     required: false,
     specRef: "server/tools#error-handling",
-    description: "Calls tools/call with a nonexistent tool name and verifies the server returns an error response."
+    description: "Calls tools/call with a nonexistent tool name and verifies the server returns an error response.",
+    recommendation: "Return a JSON-RPC error or set isError: true when tools/call receives an unrecognized tool name. Do not return an empty success response."
   },
   // ── Schema Validation (6 tests) ──────────────────────────────────
   {
@@ -379,7 +462,8 @@ var TEST_DEFINITIONS = [
     category: "schema",
     required: false,
     specRef: "server/tools#data-types",
-    description: 'Validates every tool has a valid name (1-128 chars, alphanumeric/underscore/hyphen/dot) and a required inputSchema of type "object".'
+    description: 'Validates every tool has a valid name (1-128 chars, alphanumeric/underscore/hyphen/dot) and a required inputSchema of type "object".',
+    recommendation: 'Ensure every tool has a name (1-128 chars, [A-Za-z0-9_.-]) and an inputSchema with type: "object". Add descriptions to tools for better AI assistant integration.'
   },
   {
     id: "tools-annotations",
@@ -387,7 +471,8 @@ var TEST_DEFINITIONS = [
     category: "schema",
     required: false,
     specRef: "server/tools#annotations",
-    description: "Validates tool annotation fields if present: readOnlyHint, destructiveHint, idempotentHint, openWorldHint should be booleans; title should be a string."
+    description: "Validates tool annotation fields if present: readOnlyHint, destructiveHint, idempotentHint, openWorldHint should be booleans; title should be a string.",
+    recommendation: "If you include annotations on tools, ensure readOnlyHint, destructiveHint, idempotentHint, and openWorldHint are booleans. Title must be a string."
   },
   {
     id: "tools-title-field",
@@ -395,7 +480,8 @@ var TEST_DEFINITIONS = [
     category: "schema",
     required: false,
     specRef: "server/tools#data-types",
-    description: "Checks if tools include the optional title field for human-readable display names. Added in spec version 2025-11-25."
+    description: "Checks if tools include the optional title field for human-readable display names. Added in spec version 2025-11-25.",
+    recommendation: "Add a title field (human-readable string) to each tool definition. This helps MCP clients display your tools in a user-friendly way."
   },
   {
     id: "tools-output-schema",
@@ -403,7 +489,8 @@ var TEST_DEFINITIONS = [
     category: "schema",
     required: false,
     specRef: "server/tools#structured-content",
-    description: 'If tools declare an outputSchema, validates it is a valid JSON Schema object with type "object". Used for structured output validation.'
+    description: 'If tools declare an outputSchema, validates it is a valid JSON Schema object with type "object". Used for structured output validation.',
+    recommendation: 'If you declare outputSchema on a tool, ensure it is a valid JSON Schema object with type: "object". Remove outputSchema if you do not need structured output.'
   },
   {
     id: "prompts-schema",
@@ -411,7 +498,8 @@ var TEST_DEFINITIONS = [
     category: "schema",
     required: false,
     specRef: "server/prompts#data-types",
-    description: "Validates every prompt has a name and that any arguments array contains items with name fields."
+    description: "Validates every prompt has a name and that any arguments array contains items with name fields.",
+    recommendation: "Ensure every prompt has a name field. If the prompt has arguments, each argument object must include a name field."
   },
   {
     id: "resources-schema",
@@ -419,7 +507,8 @@ var TEST_DEFINITIONS = [
     category: "schema",
     required: false,
     specRef: "server/resources#data-types",
-    description: "Validates every resource has a valid URI (parseable as a URL) and a name field."
+    description: "Validates every resource has a valid URI (parseable as a URL) and a name field.",
+    recommendation: "Ensure every resource has a valid, parseable URI and a name field. Add description and mimeType for better client integration."
   }
 ];
 
@@ -523,19 +612,39 @@ async function mcpNotification(backendUrl, method, params, extraHeaders, timeout
   return { statusCode: res.statusCode, headers: responseHeaders };
 }
 async function runComplianceSuite(url, options = {}) {
-  let parsed;
   try {
-    parsed = new URL(url);
+    const parsed = new URL(url);
     if (!["http:", "https:"].includes(parsed.protocol)) {
       throw new Error("Only HTTP and HTTPS URLs are supported");
     }
   } catch (e) {
-    if (e.message.includes("Only HTTP")) throw e;
+    if (e instanceof Error && e.message.includes("Only HTTP")) throw e;
     throw new Error(`Invalid URL: ${url}`);
   }
   const backendUrl = url;
+  let serverReachable = true;
+  try {
+    const preflight = await request(backendUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json, text/event-stream",
+        ...options.headers
+      },
+      body: JSON.stringify({ jsonrpc: "2.0", id: 0, method: "ping" }),
+      signal: AbortSignal.timeout(Math.min(options.timeout || 15e3, 1e4))
+    });
+    await preflight.body.text();
+  } catch {
+    serverReachable = false;
+  }
   const tests = [];
   const warnings = [];
+  if (!serverReachable) {
+    warnings.push(
+      `Server at ${url} is unreachable \u2014 all tests will fail. Check the URL and ensure the server is running.`
+    );
+  }
   const nextId = createIdCounter(1e3);
   const timeout = options.timeout || 15e3;
   const retries = options.retries || 0;
@@ -580,7 +689,8 @@ async function runComplianceSuite(url, options = {}) {
         if (lastResult.passed) break;
         if (attempt < retries) await new Promise((r) => setTimeout(r, 1e3 * (attempt + 1)));
       } catch (err) {
-        lastResult = { passed: false, details: `Error: ${err.message}` };
+        const message = err instanceof Error ? err.message : String(err);
+        lastResult = { passed: false, details: `Error: ${message}` };
         if (attempt < retries) await new Promise((r) => setTimeout(r, 1e3 * (attempt + 1)));
       }
     }
@@ -609,10 +719,23 @@ async function runComplianceSuite(url, options = {}) {
         body: JSON.stringify({ jsonrpc: "2.0", id: 99901, method: "ping" }),
         signal: AbortSignal.timeout(timeout)
       });
-      await res.body.text();
-      const passed = res.statusCode >= 200 && res.statusCode < 300;
-      const note = res.statusCode === 401 || res.statusCode === 403 ? " (auth required)" : "";
-      return { passed, details: `HTTP ${res.statusCode}${note}` };
+      const text = await res.body.text();
+      if (res.statusCode >= 200 && res.statusCode < 300) {
+        return { passed: true, details: `HTTP ${res.statusCode}` };
+      }
+      if (res.statusCode === 401 || res.statusCode === 403) {
+        return { passed: false, details: `HTTP ${res.statusCode} (auth required \u2014 pass --auth)` };
+      }
+      if (res.statusCode === 400) {
+        try {
+          const body = JSON.parse(text);
+          if (body?.error || body?.jsonrpc) {
+            return { passed: true, details: "HTTP 400 with JSON-RPC response (server requires initialization first)" };
+          }
+        } catch {
+        }
+      }
+      return { passed: false, details: `HTTP ${res.statusCode}` };
     }
   );
   await test(
@@ -642,18 +765,29 @@ async function runComplianceSuite(url, options = {}) {
     false,
     "basic/transports#streamable-http",
     async () => {
+      const getHeaders = { Accept: "text/event-stream", ...buildHeaders() };
       const res = await request(backendUrl, {
         method: "GET",
-        headers: { Accept: "text/event-stream", ...userHeaders },
+        headers: getHeaders,
         signal: AbortSignal.timeout(timeout)
       });
-      await res.body.text();
+      const body = await res.body.text();
       const ct = (res.headers["content-type"] || "").toLowerCase();
       if (res.statusCode === 405) {
         return { passed: true, details: "HTTP 405 Method Not Allowed (acceptable)" };
       }
       if (ct.includes("text/event-stream")) {
-        return { passed: true, details: "Returns text/event-stream for SSE" };
+        if (body.trim().length > 0) {
+          const hasDataFields = body.includes("data:");
+          const hasEventFields = body.includes("event:");
+          if (!hasDataFields && !hasEventFields) {
+            return {
+              passed: false,
+              details: "Content-Type is text/event-stream but body has no SSE data: or event: fields"
+            };
+          }
+        }
+        return { passed: true, details: "Returns text/event-stream with valid SSE format" };
       }
       if (res.statusCode >= 200 && res.statusCode < 300) {
         return { passed: true, details: `HTTP ${res.statusCode} (accepted)` };
@@ -661,31 +795,6 @@ async function runComplianceSuite(url, options = {}) {
       return { passed: false, details: `HTTP ${res.statusCode}, Content-Type: ${ct}` };
     }
   );
-  await test(
-    "transport-delete",
-    "DELETE accepted or returns 405",
-    "transport",
-    false,
-    "basic/transports#streamable-http",
-    async () => {
-      const res = await request(backendUrl, {
-        method: "DELETE",
-        headers: { ...userHeaders },
-        signal: AbortSignal.timeout(timeout)
-      });
-      await res.body.text();
-      if (res.statusCode === 405) {
-        return { passed: true, details: "HTTP 405 Method Not Allowed (acceptable)" };
-      }
-      if (res.statusCode >= 200 && res.statusCode < 300) {
-        return { passed: true, details: `HTTP ${res.statusCode} (session termination supported)` };
-      }
-      if (res.statusCode === 400 || res.statusCode === 404) {
-        return { passed: true, details: `HTTP ${res.statusCode} (no active session, acceptable)` };
-      }
-      return { passed: false, details: `HTTP ${res.statusCode}` };
-    }
-  );
   await test(
     "transport-batch-reject",
     "Rejects JSON-RPC batch requests",
@@ -723,7 +832,7 @@ async function runComplianceSuite(url, options = {}) {
   try {
     initRes = await rpc("initialize", {
       protocolVersion: SPEC_VERSION,
-      capabilities: { roots: { listChanged: true }, sampling: {} },
+      capabilities: {},
       clientInfo: { name: "mcp-compliance", version: TOOL_VERSION }
     });
     const result = initRes?.body?.result;
@@ -736,7 +845,7 @@ async function runComplianceSuite(url, options = {}) {
       if (sid) sessionId = sid;
       if (result.protocolVersion) negotiatedProtocolVersion = result.protocolVersion;
     }
-  } catch (err) {
+  } catch {
   }
   try {
     await mcpNotification(backendUrl, "notifications/initialized", void 0, buildHeaders(), timeout);
@@ -762,13 +871,13 @@ async function runComplianceSuite(url, options = {}) {
     true,
     "basic/lifecycle#version-negotiation",
     async () => {
-      const version2 = initRes?.body?.result?.protocolVersion;
-      if (!version2) return { passed: false, details: "No protocolVersion" };
-      const valid = /^\d{4}-\d{2}-\d{2}$/.test(version2);
-      if (valid && version2 !== SPEC_VERSION) {
-        warnings.push(`Server negotiated protocol version ${version2} (latest is ${SPEC_VERSION})`);
+      const version3 = initRes?.body?.result?.protocolVersion;
+      if (!version3) return { passed: false, details: "No protocolVersion" };
+      const valid = /^\d{4}-\d{2}-\d{2}$/.test(version3);
+      if (valid && version3 !== SPEC_VERSION) {
+        warnings.push(`Server negotiated protocol version ${version3} (latest is ${SPEC_VERSION})`);
       }
-      return { passed: valid, details: `Version: ${version2}` };
+      return { passed: valid, details: `Version: ${version3}` };
     }
   );
   await test(
@@ -855,7 +964,17 @@ async function runComplianceSuite(url, options = {}) {
       if (res.body?.error) {
         return { passed: false, details: `Error: ${res.body.error.code} \u2014 ${res.body.error.message}` };
       }
-      return { passed: true, details: "logging/setLevel accepted" };
+      const invalidRes = await rpc("logging/setLevel", { level: "__invalid_level__" });
+      const validatesInput = !!invalidRes.body?.error;
+      const validLevels = ["debug", "warning", "error"];
+      const accepted = [];
+      for (const level of validLevels) {
+        const r = await rpc("logging/setLevel", { level });
+        if (!r.body?.error) accepted.push(level);
+      }
+      const details = validatesInput ? `logging/setLevel accepted (validates levels, ${accepted.length + 1} levels accepted)` : "logging/setLevel accepted (warning: server does not reject invalid log levels)";
+      if (!validatesInput) warnings.push("Server accepts invalid log levels without error");
+      return { passed: true, details };
     }
   );
   const hasCompletions = !!serverInfo.capabilities.completions;
@@ -884,6 +1003,59 @@ async function runComplianceSuite(url, options = {}) {
       return { passed: true, details: "completion/complete accepted" };
     }
   );
+  await test(
+    "lifecycle-cancellation",
+    "Handles cancellation notifications",
+    "lifecycle",
+    false,
+    "basic/utilities#cancellation",
+    async () => {
+      const res = await mcpNotification(
+        backendUrl,
+        "notifications/cancelled",
+        { requestId: 99999, reason: "compliance test" },
+        buildHeaders(),
+        timeout
+      );
+      if (res.statusCode >= 200 && res.statusCode < 300) {
+        return { passed: true, details: `HTTP ${res.statusCode} (cancellation accepted)` };
+      }
+      return { passed: false, details: `HTTP ${res.statusCode} \u2014 server should accept cancellation notifications` };
+    }
+  );
+  await test(
+    "lifecycle-progress",
+    "Accepts progress notifications",
+    "lifecycle",
+    false,
+    "basic/utilities#progress",
+    async () => {
+      const res = await mcpNotification(
+        backendUrl,
+        "notifications/progress",
+        { progressToken: "compliance-test-token", progress: 50, total: 100 },
+        buildHeaders(),
+        timeout
+      );
+      if (res.statusCode >= 200 && res.statusCode < 300) {
+        return { passed: true, details: `HTTP ${res.statusCode} (progress notification accepted)` };
+      }
+      return { passed: false, details: `HTTP ${res.statusCode} \u2014 server should accept progress notifications` };
+    }
+  );
+  await test(
+    "transport-content-type-init",
+    "Initialize response has valid content type",
+    "transport",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      if (!initRes) return { passed: false, details: "No init response to check" };
+      const ct = (initRes.headers["content-type"] || "").toLowerCase();
+      const valid = ct.includes("application/json") || ct.includes("text/event-stream");
+      return { passed: valid, details: `Content-Type: ${ct || "missing"}` };
+    }
+  );
   await test(
     "transport-notification-202",
     "Notification returns 202 Accepted",
@@ -941,6 +1113,88 @@ async function runComplianceSuite(url, options = {}) {
       return { passed: false, details: `HTTP ${res.statusCode}` };
     }
   );
+  await test(
+    "transport-get-stream",
+    "GET with session returns SSE or 405",
+    "transport",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      if (!sessionId) {
+        return { passed: true, details: "No session ID \u2014 server-initiated messages not applicable" };
+      }
+      const res = await request(backendUrl, {
+        method: "GET",
+        headers: { Accept: "text/event-stream", ...buildHeaders() },
+        signal: AbortSignal.timeout(Math.min(timeout, 3e3))
+      });
+      const body = await res.body.text();
+      const ct = (res.headers["content-type"] || "").toLowerCase();
+      if (res.statusCode === 405) {
+        return { passed: true, details: "HTTP 405 (server does not support server-initiated messages)" };
+      }
+      if (ct.includes("text/event-stream")) {
+        if (body.trim().length > 0) {
+          const hasSSEFields = body.includes("data:") || body.includes("event:");
+          if (!hasSSEFields) {
+            return { passed: false, details: "Content-Type is text/event-stream but body has no SSE fields" };
+          }
+        }
+        return { passed: true, details: "GET with session returns SSE stream for server-initiated messages" };
+      }
+      if (res.statusCode >= 200 && res.statusCode < 300) {
+        return { passed: true, details: `HTTP ${res.statusCode} (accepted)` };
+      }
+      return { passed: false, details: `HTTP ${res.statusCode}, Content-Type: ${ct}` };
+    }
+  );
+  await test(
+    "transport-concurrent",
+    "Handles concurrent requests",
+    "transport",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      const ids = [createIdCounter(99930)(), createIdCounter(99931)(), createIdCounter(99932)()];
+      const promises = ids.map(
+        (id) => request(backendUrl, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+            ...buildHeaders()
+          },
+          body: JSON.stringify({ jsonrpc: "2.0", id, method: "ping" }),
+          signal: AbortSignal.timeout(timeout)
+        }).then(async (res) => {
+          const text = await res.body.text();
+          const ct = (res.headers["content-type"] || "").toLowerCase();
+          let body;
+          if (ct.includes("text/event-stream")) {
+            body = parseSSEResponse(text);
+          }
+          if (!body) {
+            try {
+              body = JSON.parse(text);
+            } catch {
+            }
+          }
+          return { statusCode: res.statusCode, body, requestId: id };
+        })
+      );
+      const results = await Promise.all(promises);
+      const issues = [];
+      for (const r of results) {
+        if (r.statusCode < 200 || r.statusCode >= 300) {
+          issues.push(`Request id=${r.requestId}: HTTP ${r.statusCode}`);
+        } else if (r.body?.id !== r.requestId) {
+          issues.push(`Request id=${r.requestId}: response id=${r.body?.id} (mismatch)`);
+        }
+      }
+      if (issues.length > 0) return { passed: false, details: issues.join("; ") };
+      return { passed: true, details: `${results.length} concurrent requests handled correctly` };
+    }
+  );
   const hasTools = !!serverInfo.capabilities.tools;
   let cachedToolsList = null;
   await test(
@@ -962,6 +1216,7 @@ async function runComplianceSuite(url, options = {}) {
       };
     }
   );
+  const toolsListOk = cachedToolsList !== null;
   await test(
     "tools-schema",
     "All tools have name and inputSchema",
@@ -969,7 +1224,8 @@ async function runComplianceSuite(url, options = {}) {
     hasTools,
     "server/tools#data-types",
     async () => {
-      const tools = cachedToolsList ?? (await rpc("tools/list")).body?.result?.tools ?? [];
+      if (!toolsListOk) return { passed: false, details: "Skipped: tools/list failed" };
+      const tools = cachedToolsList ?? [];
       const issues = [];
       for (const tool of tools) {
         if (!tool.name) {
@@ -1001,7 +1257,8 @@ async function runComplianceSuite(url, options = {}) {
     false,
     "server/tools#annotations",
     async () => {
-      const tools = cachedToolsList ?? (await rpc("tools/list")).body?.result?.tools ?? [];
+      if (!toolsListOk) return { passed: false, details: "Skipped: tools/list failed" };
+      const tools = cachedToolsList ?? [];
       if (tools.length === 0) return { passed: true, details: "No tools to validate" };
       const issues = [];
       let annotatedCount = 0;
@@ -1031,7 +1288,8 @@ async function runComplianceSuite(url, options = {}) {
     }
   );
   await test("tools-title-field", "Tools include title field", "schema", false, "server/tools#data-types", async () => {
-    const tools = cachedToolsList ?? (await rpc("tools/list")).body?.result?.tools ?? [];
+    if (!toolsListOk) return { passed: false, details: "Skipped: tools/list failed" };
+    const tools = cachedToolsList ?? [];
     if (tools.length === 0) return { passed: true, details: "No tools to validate" };
     const withTitle = tools.filter((t) => typeof t.title === "string");
     const issues = [];
@@ -1053,7 +1311,8 @@ async function runComplianceSuite(url, options = {}) {
     false,
     "server/tools#structured-content",
     async () => {
-      const tools = cachedToolsList ?? (await rpc("tools/list")).body?.result?.tools ?? [];
+      if (!toolsListOk) return { passed: false, details: "Skipped: tools/list failed" };
+      const tools = cachedToolsList ?? [];
       if (tools.length === 0) return { passed: true, details: "No tools to validate" };
       const issues = [];
       let withSchema = 0;
@@ -1094,14 +1353,14 @@ async function runComplianceSuite(url, options = {}) {
           return { passed: true, details: `Protocol error: code ${code} \u2014 ${error.message}` };
         }
         if (result?.content && Array.isArray(result.content)) {
+          if (result.isError) {
+            return { passed: true, details: "Tool returned execution error with content (valid)" };
+          }
           const badItems = result.content.filter((c) => !c.type);
           if (badItems.length > 0)
             return { passed: false, details: `${badItems.length} content item(s) missing 'type' field` };
           return { passed: true, details: `Returned ${result.content.length} content item(s)` };
         }
-        if (result?.isError && result?.content && Array.isArray(result.content)) {
-          return { passed: true, details: "Tool returned execution error with content (valid)" };
-        }
         return { passed: false, details: "Response missing content array" };
       }
     );
@@ -1203,6 +1462,7 @@ async function runComplianceSuite(url, options = {}) {
         return { passed: true, details: `${resourceCount} resource(s)` };
       }
     );
+    const resourcesListOk = cachedResourcesList !== null;
     await test(
       "resources-schema",
       "Resources have uri and name",
@@ -1210,7 +1470,8 @@ async function runComplianceSuite(url, options = {}) {
       true,
       "server/resources#data-types",
       async () => {
-        const resources = cachedResourcesList ?? (await rpc("resources/list")).body?.result?.resources ?? [];
+        if (!resourcesListOk) return { passed: false, details: "Skipped: resources/list failed" };
+        const resources = cachedResourcesList ?? [];
         const issues = [];
         for (const r of resources) {
           if (!r.uri) issues.push("Resource missing uri");
@@ -1239,7 +1500,7 @@ async function runComplianceSuite(url, options = {}) {
         false,
         "server/resources#reading-resources",
         async () => {
-          const resources = cachedResourcesList ?? (await rpc("resources/list")).body?.result?.resources ?? [];
+          const resources = cachedResourcesList ?? [];
           const firstUri = resources[0]?.uri;
           if (!firstUri) return { passed: false, details: "No resource URI to test" };
           const readRes = await rpc("resources/read", { uri: firstUri });
@@ -1272,8 +1533,15 @@ async function runComplianceSuite(url, options = {}) {
         if (!Array.isArray(templates)) return { passed: false, details: "No resourceTemplates array" };
         const issues = [];
         for (const t of templates) {
-          if (!t.uriTemplate) issues.push("Template missing uriTemplate");
+          if (!t.uriTemplate) {
+            issues.push("Template missing uriTemplate");
+          } else if (typeof t.uriTemplate !== "string") {
+            issues.push(`uriTemplate should be a string, got ${typeof t.uriTemplate}`);
+          } else if (!t.uriTemplate.includes("{") || !t.uriTemplate.includes("}")) {
+            warnings.push(`Template "${t.name || t.uriTemplate}" has no URI template parameters (e.g., {id})`);
+          }
           if (!t.name) issues.push(`${t.uriTemplate || "?"}: missing name`);
+          if (!t.description) warnings.push(`Template "${t.name || t.uriTemplate || "?"}" missing description`);
         }
         if (issues.length > 0) return { passed: false, details: issues.join("; ") };
         return { passed: true, details: `${templates.length} resource template(s)` };
@@ -1315,7 +1583,7 @@ async function runComplianceSuite(url, options = {}) {
         true,
         "server/resources#subscriptions",
         async () => {
-          const resources = cachedResourcesList ?? (await rpc("resources/list")).body?.result?.resources ?? [];
+          const resources = cachedResourcesList ?? [];
           const firstUri = resources[0]?.uri;
           if (!firstUri) return { passed: false, details: "No resource URI for subscribe test" };
           const subRes = await rpc("resources/subscribe", { uri: firstUri });
@@ -1359,8 +1627,10 @@ async function runComplianceSuite(url, options = {}) {
         };
       }
     );
+    const promptsListOk = cachedPromptsList !== null;
     await test("prompts-schema", "Prompts have name field", "schema", true, "server/prompts#data-types", async () => {
-      const prompts = cachedPromptsList ?? (await rpc("prompts/list")).body?.result?.prompts ?? [];
+      if (!promptsListOk) return { passed: false, details: "Skipped: prompts/list failed" };
+      const prompts = cachedPromptsList ?? [];
       const issues = [];
       for (const p of prompts) {
         if (!p.name) issues.push("Prompt missing name");
@@ -1556,6 +1826,60 @@ async function runComplianceSuite(url, options = {}) {
     }
     return { passed: false, details: `HTTP ${res.statusCode} \u2014 expected error code -32600` };
   });
+  await test(
+    "transport-delete",
+    "DELETE accepted or returns 405",
+    "transport",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      const deleteHeaders = { ...buildHeaders() };
+      const res = await request(backendUrl, {
+        method: "DELETE",
+        headers: deleteHeaders,
+        signal: AbortSignal.timeout(timeout)
+      });
+      await res.body.text();
+      if (res.statusCode === 405) {
+        return { passed: true, details: "HTTP 405 Method Not Allowed (acceptable)" };
+      }
+      if (res.statusCode >= 200 && res.statusCode < 300) {
+        if (sessionId) {
+          try {
+            const verifyRes = await mcpRequest(
+              backendUrl,
+              "ping",
+              void 0,
+              createIdCounter(99920),
+              deleteHeaders,
+              timeout
+            );
+            if (verifyRes.statusCode === 400 || verifyRes.statusCode === 404 || verifyRes.statusCode === 409) {
+              return {
+                passed: true,
+                details: `HTTP ${res.statusCode} (session terminated, post-delete request correctly rejected with ${verifyRes.statusCode})`
+              };
+            }
+          } catch {
+            return {
+              passed: true,
+              details: `HTTP ${res.statusCode} (session terminated, post-delete request rejected)`
+            };
+          }
+        }
+        return { passed: true, details: `HTTP ${res.statusCode} (session termination supported)` };
+      }
+      if (res.statusCode === 400 || res.statusCode === 404) {
+        return { passed: true, details: `HTTP ${res.statusCode} (no active session, acceptable)` };
+      }
+      return { passed: false, details: `HTTP ${res.statusCode}` };
+    }
+  );
+  const MAX_WARNINGS = 50;
+  if (warnings.length > MAX_WARNINGS) {
+    const truncated = warnings.length - MAX_WARNINGS;
+    warnings.splice(MAX_WARNINGS, truncated, `... and ${truncated} more warning(s) suppressed`);
+  }
   const { score, grade, overall, summary, categories } = computeScore(tests);
   const badge = generateBadge(url);
   return {
@@ -1585,7 +1909,7 @@ async function runComplianceSuite(url, options = {}) {
 function registerTools(server) {
   server.tool(
     "mcp_compliance_test",
-    "Run the full MCP compliance test suite against a server URL. Returns grade (A-F), score, and detailed results for all 43 tests covering transport, lifecycle, tools, resources, prompts, errors, and schema validation.",
+    "Run the full MCP compliance test suite against a server URL. Returns grade (A-F), score, and detailed results for all 48 tests covering transport, lifecycle, tools, resources, prompts, errors, and schema validation.",
     {
       url: z.string().url().describe("The MCP server URL to test (must be HTTP or HTTPS)"),
       auth: z.string().optional().describe('Authorization header value (e.g., "Bearer tok123")'),
@@ -1641,8 +1965,9 @@ ${JSON.stringify(report, null, 2)}` }
           ]
         };
       } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
         return {
-          content: [{ type: "text", text: `Error running compliance test: ${err.message}` }],
+          content: [{ type: "text", text: `Error running compliance test: ${message}` }],
           isError: true
         };
       }
@@ -1690,8 +2015,9 @@ ${JSON.stringify(report, null, 2)}` }
           ]
         };
       } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
         return {
-          content: [{ type: "text", text: `Error: ${err.message}` }],
+          content: [{ type: "text", text: `Error: ${message}` }],
           isError: true
         };
       }
@@ -1735,9 +2061,11 @@ ${TEST_DEFINITIONS.map((t) => t.id).join(", ")}`
               `Name: ${def.name}`,
               `Category: ${def.category}`,
               `Required: ${def.required ? "Yes" : "No"}`,
-              `Spec reference: https://modelcontextprotocol.io/specification/2025-11-25/${def.specRef}`,
+              `Spec reference: ${SPEC_BASE}/${def.specRef}`,
+              "",
+              def.description,
               "",
-              def.description
+              `Fix: ${def.recommendation}`
             ].join("\n")
           }
         ]
@@ -1746,6 +2074,27 @@ ${TEST_DEFINITIONS.map((t) => t.id).join(", ")}`
   );
 }
 
+// src/mcp/server.ts
+var require2 = createRequire2(import.meta.url);
+var { version } = require2("../../package.json");
+function createComplianceServer() {
+  const server = new McpServer({ name: "mcp-compliance", version });
+  registerTools(server);
+  return server;
+}
+async function startServer() {
+  const server = createComplianceServer();
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+}
+var isDirectRun = process.argv[1]?.endsWith("mcp/server.js") || process.argv[1]?.endsWith("mcp\\server.js");
+if (isDirectRun) {
+  startServer().catch((err) => {
+    console.error("MCP server error:", err);
+    process.exit(1);
+  });
+}
+
 // src/reporter.ts
 import chalk from "chalk";
 var CATEGORY_LABELS = {
@@ -1788,8 +2137,16 @@ function testLine(t) {
   const icon = t.passed ? chalk.green("  PASS") : chalk.red("  FAIL");
   const req = t.required ? chalk.dim(" (required)") : "";
   const dur = chalk.dim(` ${t.durationMs}ms`);
-  return `${icon}  ${t.name}${req}${dur}
+  let line = `${icon}  ${t.name}${req}${dur}
 ${chalk.dim(`         ${t.details}`)}`;
+  if (!t.passed) {
+    const def = TEST_DEFINITIONS.find((d) => d.id === t.id);
+    if (def?.recommendation) {
+      line += `
+${chalk.cyan(`         Fix: ${def.recommendation}`)}`;
+    }
+  }
+  return line;
 }
 function formatTerminal(report) {
   const lines = [];
@@ -1872,10 +2229,85 @@ function formatTerminal(report) {
 function formatJson(report) {
   return JSON.stringify(report, null, 2);
 }
+function formatSarif(report) {
+  const rules = report.tests.map((t) => {
+    const def = TEST_DEFINITIONS.find((d) => d.id === t.id);
+    return {
+      id: t.id,
+      name: t.name,
+      shortDescription: { text: t.name },
+      fullDescription: { text: def?.description || t.details },
+      helpUri: t.specRef || `${SPEC_BASE}/basic`,
+      properties: {
+        category: t.category,
+        required: t.required
+      }
+    };
+  });
+  const results = report.tests.filter((t) => !t.passed).map((t) => {
+    const def = TEST_DEFINITIONS.find((d) => d.id === t.id);
+    return {
+      ruleId: t.id,
+      level: t.required ? "error" : "warning",
+      message: {
+        text: def?.recommendation ? `${t.details}. Fix: ${def.recommendation}` : t.details
+      },
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: {
+              uri: report.url,
+              uriBaseId: "MCP_SERVER"
+            }
+          }
+        }
+      ],
+      properties: {
+        category: t.category,
+        durationMs: t.durationMs
+      }
+    };
+  });
+  const sarif = {
+    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "mcp-compliance",
+            version: report.toolVersion,
+            informationUri: "https://github.com/YawLabs/mcp-compliance",
+            rules
+          }
+        },
+        results,
+        invocations: [
+          {
+            executionSuccessful: report.overall !== "fail",
+            properties: {
+              grade: report.grade,
+              score: report.score,
+              overall: report.overall,
+              specVersion: report.specVersion,
+              serverUrl: report.url,
+              serverName: report.serverInfo.name,
+              serverVersion: report.serverInfo.version,
+              protocolVersion: report.serverInfo.protocolVersion,
+              testsPassed: report.summary.passed,
+              testsTotal: report.summary.total
+            }
+          }
+        ]
+      }
+    ]
+  };
+  return JSON.stringify(sarif, null, 2);
+}
 
 // src/index.ts
-var require2 = createRequire2(import.meta.url);
-var { version } = require2("../package.json");
+var require3 = createRequire3(import.meta.url);
+var { version: version2 } = require3("../package.json");
 function parseHeaderArg(value, prev) {
   const idx = value.indexOf(":");
   if (idx === -1) {
@@ -1886,12 +2318,27 @@ function parseHeaderArg(value, prev) {
   prev[key] = val;
   return prev;
 }
+function parsePositiveInt(value, name, min = 0) {
+  const n = Number.parseInt(value, 10);
+  if (Number.isNaN(n) || n < min) {
+    throw new Error(`${name} must be an integer >= ${min}, got "${value}"`);
+  }
+  return n;
+}
 function parseList(value) {
   return value.split(",").map((s) => s.trim()).filter(Boolean);
 }
 var program = new Command();
-program.name("mcp-compliance").description("Test MCP servers for spec compliance").version(version);
-program.command("test").description("Run the full compliance test suite against an MCP server").argument("<url>", "MCP server URL to test").option("--format <format>", "Output format: terminal or json", "terminal").option("--strict", "Exit with code 1 on any required test failure (for CI)").option("-H, --header <header>", 'Add header to all requests (format: "Key: Value", repeatable)', parseHeaderArg, {}).option("--auth <token>", 'Shorthand for -H "Authorization: <token>"').option("--timeout <ms>", "Request timeout in milliseconds", "15000").option("--retries <n>", "Number of retries for failed tests", "0").option("--only <items>", "Only run tests matching these categories or test IDs (comma-separated)", parseList).option("--skip <items>", "Skip tests matching these categories or test IDs (comma-separated)", parseList).option("--verbose", "Print each test result as it runs").action(
+program.name("mcp-compliance").description("Test MCP servers for spec compliance").version(version2);
+program.command("test").description("Run the full compliance test suite against an MCP server").argument("<url>", "MCP server URL to test").option("--format <format>", "Output format: terminal, json, or sarif", "terminal").option("--strict", "Exit with code 1 on any required test failure (for CI)").option("-H, --header <header>", 'Add header to all requests (format: "Key: Value", repeatable)', parseHeaderArg, {}).option("--auth <token>", 'Shorthand for -H "Authorization: <token>"').option("--timeout <ms>", "Request timeout in milliseconds", "15000").option("--retries <n>", "Number of retries for failed tests", "0").option(
+  "--only <items>",
+  'Only run matching categories or test IDs, comma-separated (e.g., "transport,lifecycle" or "transport-post,lifecycle-init")',
+  parseList
+).option(
+  "--skip <items>",
+  'Skip matching categories or test IDs, comma-separated (e.g., "schema" or "tools-pagination")',
+  parseList
+).option("--verbose", "Print each test result as it runs").action(
   async (url, opts) => {
     try {
       const headers = { ...opts.header };
@@ -1903,8 +2350,8 @@ Testing ${url}...
       }
       const report = await runComplianceSuite(url, {
         headers,
-        timeout: Number.parseInt(opts.timeout, 10) || 15e3,
-        retries: Number.parseInt(opts.retries, 10) || 0,
+        timeout: parsePositiveInt(opts.timeout, "--timeout", 1),
+        retries: parsePositiveInt(opts.retries, "--retries"),
         only: opts.only,
         skip: opts.skip,
         onProgress: opts.verbose ? (testId, passed, details) => {
@@ -1917,6 +2364,8 @@ Testing ${url}...
       }
       if (opts.format === "json") {
         console.log(formatJson(report));
+      } else if (opts.format === "sarif") {
+        console.log(formatSarif(report));
       } else {
         console.log(formatTerminal(report));
       }
@@ -1924,11 +2373,12 @@ Testing ${url}...
         process.exit(1);
       }
     } catch (err) {
-      if (opts.format === "json") {
-        console.error(JSON.stringify({ error: err.message }));
+      const message = err instanceof Error ? err.message : String(err);
+      if (opts.format === "json" || opts.format === "sarif") {
+        console.error(JSON.stringify({ error: message }));
       } else {
         console.error(chalk2.red(`
-Error: ${err.message}
+Error: ${message}
 `));
       }
       process.exit(1);
@@ -1944,23 +2394,21 @@ Testing ${url}...
 `));
     const report = await runComplianceSuite(url, {
       headers,
-      timeout: Number.parseInt(opts.timeout, 10) || 15e3
+      timeout: parsePositiveInt(opts.timeout, "--timeout", 1)
     });
     console.log(`Grade: ${report.grade} (${report.score}%)
 `);
     console.log(report.badge.markdown);
     console.log("");
   } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
     console.error(chalk2.red(`
-Error: ${err.message}
+Error: ${message}
 `));
     process.exit(1);
   }
 });
 program.command("mcp").description("Start the MCP compliance server (stdio transport)").action(async () => {
-  const server = new McpServer({ name: "mcp-compliance", version });
-  registerTools(server);
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
+  await startServer();
 });
 program.parse();