@yawlabs/mcp-compliance 0.5.0 → 0.7.0

package/dist/{chunk-Z7VLPYIO.js → chunk-SELO4TOW.js}

@@ -56,7 +56,7 @@ function computeScore(tests) {
 
 // src/types.ts
 var TEST_DEFINITIONS = [
-  // ── Transport (10 tests) ─────────────────────────────────────────
+  // ── Transport (13 tests) ─────────────────────────────────────────
   {
     id: "transport-post",
     name: "HTTP POST accepted",
@@ -81,8 +81,8 @@ var TEST_DEFINITIONS = [
     category: "transport",
     required: false,
     specRef: "basic/transports#streamable-http",
-    description: "Verifies that sending a JSON-RPC notification (no id field) returns HTTP 202 Accepted with no body. Per spec, servers MUST return 202 for notifications.",
-    recommendation: "Detect JSON-RPC messages without an id field and return HTTP 202 with an empty body. Do not attempt to send a JSON-RPC response for notifications."
+    description: "Verifies that sending a JSON-RPC notification (no id field) returns exactly HTTP 202 Accepted with no body. Per spec, servers MUST return 202 \u2014 not 200 or 204.",
+    recommendation: "Detect JSON-RPC messages without an id field and return HTTP 202 with an empty body. Do not return 200 or 204 \u2014 the spec requires exactly 202 Accepted."
   },
   {
     id: "transport-session-id",
@@ -93,6 +93,24 @@ var TEST_DEFINITIONS = [
     description: "Tests that the server returns HTTP 400 when MCP-Session-Id header is missing on requests after initialization (when the server issued a session ID).",
     recommendation: "If your server issues an MCP-Session-Id header in the initialize response, reject subsequent requests that omit this header with HTTP 400."
   },
+  {
+    id: "transport-session-invalid",
+    name: "Returns 404 for unknown session ID",
+    category: "transport",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Sends a request with a fabricated MCP-Session-Id and verifies the server returns HTTP 404. Per spec, servers managing sessions MUST return 404 for unrecognized session IDs.",
+    recommendation: "Return HTTP 404 (Not Found) for requests with an MCP-Session-Id that does not match any active session. Do not return 400 \u2014 that is for missing session IDs."
+  },
+  {
+    id: "transport-content-type-reject",
+    name: "Rejects non-JSON request Content-Type",
+    category: "transport",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Sends a POST with Content-Type: text/plain instead of application/json and verifies the server rejects it with a 4xx status.",
+    recommendation: "Validate the Content-Type header on incoming POST requests. Reject requests that are not application/json with HTTP 415 (Unsupported Media Type) or 400."
+  },
   {
     id: "transport-get",
     name: "GET returns SSE stream or 405",
@@ -147,7 +165,16 @@ var TEST_DEFINITIONS = [
     description: "Sends multiple JSON-RPC requests in parallel and verifies the server responds to all with correct matching IDs. Tests that the server can handle concurrent connections.",
     recommendation: "Ensure your server can handle multiple simultaneous requests. Each response must include the correct id matching the request. Use async handlers or connection pooling."
   },
-  // ── Lifecycle (12 tests) ─────────────────────────────────────────
+  {
+    id: "transport-sse-event-field",
+    name: "SSE responses include event: message",
+    category: "transport",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Sends a request with Accept: text/event-stream and checks that SSE responses include the event: message field. Per spec, servers MUST set event: message for JSON-RPC messages in SSE streams.",
+    recommendation: 'Include "event: message" before each "data:" line in your SSE responses. This is required by the MCP spec for JSON-RPC messages sent over SSE.'
+  },
+  // ── Lifecycle (15 tests) ─────────────────────────────────────────
   {
     id: "lifecycle-init",
     name: "Initialize handshake",
@@ -220,6 +247,33 @@ var TEST_DEFINITIONS = [
     description: "Verifies that the JSON-RPC response id matches the request id sent by the client. This is a fundamental JSON-RPC 2.0 requirement.",
     recommendation: "Copy the id field from the request into the response. This is a core JSON-RPC 2.0 requirement. Check that your framework does not modify or discard the request ID."
   },
+  {
+    id: "lifecycle-string-id",
+    name: "Supports string request IDs",
+    category: "lifecycle",
+    required: false,
+    specRef: "basic",
+    description: "Sends a request with a string id instead of a number. JSON-RPC 2.0 allows both string and number IDs. The server must echo back the exact string id in the response.",
+    recommendation: "Ensure your JSON-RPC implementation supports both string and number request IDs. Echo the id back exactly as received, preserving its type."
+  },
+  {
+    id: "lifecycle-version-negotiate",
+    name: "Handles unknown protocol version",
+    category: "lifecycle",
+    required: false,
+    specRef: "basic/lifecycle#version-negotiation",
+    description: 'Sends an initialize request with a future protocol version ("2099-01-01") and verifies the server either negotiates down to a version it supports or returns an error.',
+    recommendation: "When the client requests an unsupported protocol version, respond with the closest version your server supports. Do not blindly accept unknown versions."
+  },
+  {
+    id: "lifecycle-reinit-reject",
+    name: "Rejects second initialize request",
+    category: "lifecycle",
+    required: false,
+    specRef: "basic/lifecycle#initialization",
+    description: "Sends a second initialize request within the same session. Per spec, the client MUST NOT send initialize more than once. The server should reject it.",
+    recommendation: "Track initialization state per session. Reject duplicate initialize requests with a JSON-RPC error or HTTP 4xx. Do not reset session state on re-initialization."
+  },
   {
     id: "lifecycle-logging",
     name: "logging/setLevel accepted",
@@ -249,12 +303,12 @@ var TEST_DEFINITIONS = [
   },
   {
     id: "lifecycle-progress",
-    name: "Accepts progress notifications",
+    name: "Handles progress notifications gracefully",
     category: "lifecycle",
     required: false,
     specRef: "basic/utilities#progress",
-    description: "Tests that the server accepts notifications/progress without error. Servers should handle progress notifications for request tracking.",
-    recommendation: "Accept notifications/progress with progressToken, progress, and optional total fields. Ignore notifications for unknown progress tokens."
+    description: "Sends a notifications/progress to the server and verifies it does not error. Note: per spec, progress flows from server to client during long-running requests. This test validates the server handles unexpected notifications gracefully.",
+    recommendation: "Accept unknown notifications without returning an error. The server should not crash or return a non-2xx status for notifications it does not recognize."
   },
   // ── Tools (4 tests) ──────────────────────────────────────────────
   {
@@ -263,7 +317,7 @@ var TEST_DEFINITIONS = [
     category: "tools",
     required: false,
     specRef: "server/tools#listing-tools",
-    description: "Calls tools/list and validates it returns an array of tool definitions. Required if the server declares tools capability.",
+    description: "Calls tools/list and validates it returns an array of tool definitions. Dynamically required at runtime if the server declares tools capability.",
     recommendation: "Implement the tools/list handler to return { tools: [...] } with an array of tool definition objects. Each tool needs at least a name and inputSchema."
   },
   {
@@ -300,7 +354,7 @@ var TEST_DEFINITIONS = [
     category: "resources",
     required: false,
     specRef: "server/resources#listing-resources",
-    description: "Calls resources/list and validates it returns an array. Required if the server declares resources capability.",
+    description: "Calls resources/list and validates it returns an array. Dynamically required at runtime if the server declares resources capability.",
     recommendation: "Implement resources/list to return { resources: [...] } with an array of resource objects. Each resource needs at least a uri and name."
   },
   {
@@ -346,7 +400,7 @@ var TEST_DEFINITIONS = [
     category: "prompts",
     required: false,
     specRef: "server/prompts#listing-prompts",
-    description: "Calls prompts/list and validates it returns an array. Required if the server declares prompts capability.",
+    description: "Calls prompts/list and validates it returns an array. Dynamically required at runtime if the server declares prompts capability.",
     recommendation: "Implement prompts/list to return { prompts: [...] } with an array of prompt objects. Each prompt needs at least a name field."
   },
   {
@@ -367,7 +421,7 @@ var TEST_DEFINITIONS = [
     description: "Tests cursor-based pagination on prompts/list. Validates nextCursor is a string if present and that fetching the next page works.",
     recommendation: "If you return nextCursor in prompts/list, ensure it is a string and that passing it back as cursor in the next request returns valid results."
   },
-  // ── Error Handling (8 tests) ─────────────────────────────────────
+  // ── Error Handling (10 tests) ────────────────────────────────────
   {
     id: "error-unknown-method",
     name: "Returns JSON-RPC error for unknown method",
@@ -440,6 +494,24 @@ var TEST_DEFINITIONS = [
     description: "Calls tools/call with a nonexistent tool name and verifies the server returns an error response.",
     recommendation: "Return a JSON-RPC error or set isError: true when tools/call receives an unrecognized tool name. Do not return an empty success response."
   },
+  {
+    id: "error-capability-gated",
+    name: "Rejects methods for undeclared capabilities",
+    category: "errors",
+    required: false,
+    specRef: "basic/lifecycle#capability-negotiation",
+    description: "Calls list methods (tools/list, resources/list, prompts/list) for capabilities the server did NOT declare, and verifies the server returns an error instead of success.",
+    recommendation: "Return a JSON-RPC error (e.g., -32601 Method not found) for methods associated with capabilities not declared in your initialize response."
+  },
+  {
+    id: "error-invalid-cursor",
+    name: "Handles invalid pagination cursor gracefully",
+    category: "errors",
+    required: false,
+    specRef: "basic",
+    description: "Sends a garbage pagination cursor to a list method and verifies the server handles it gracefully \u2014 either returning an error or ignoring the invalid cursor.",
+    recommendation: "Validate pagination cursors before use. Return a JSON-RPC error for unrecognized cursors, or treat invalid cursors as a request for the first page."
+  },
   // ── Schema Validation (6 tests) ──────────────────────────────────
   {
     id: "tools-schema",
@@ -456,8 +528,8 @@ var TEST_DEFINITIONS = [
     category: "schema",
     required: false,
     specRef: "server/tools#annotations",
-    description: "Validates tool annotation fields if present: readOnlyHint, destructiveHint, idempotentHint, openWorldHint should be booleans; title should be a string.",
-    recommendation: "If you include annotations on tools, ensure readOnlyHint, destructiveHint, idempotentHint, and openWorldHint are booleans. Title must be a string."
+    description: "Validates tool annotation fields if present: readOnlyHint, destructiveHint, idempotentHint, openWorldHint should be booleans.",
+    recommendation: "If you include annotations on tools, ensure readOnlyHint, destructiveHint, idempotentHint, and openWorldHint are booleans. Note: title belongs on the Tool object, not inside annotations."
   },
   {
     id: "tools-title-field",
@@ -494,22 +566,275 @@ var TEST_DEFINITIONS = [
     specRef: "server/resources#data-types",
     description: "Validates every resource has a valid URI (parseable as a URL) and a name field.",
     recommendation: "Ensure every resource has a valid, parseable URI and a name field. Add description and mimeType for better client integration."
+  },
+  // ── Security: Auth & Transport (9 tests) ─────────────────────────
+  {
+    id: "security-auth-required",
+    name: "Rejects unauthenticated requests",
+    category: "security",
+    required: false,
+    specRef: "basic/authorization",
+    description: "Sends a request without an Authorization header and verifies the server returns HTTP 401. Servers exposed over the network should require authentication.",
+    recommendation: "Implement authentication on your MCP endpoint. Return HTTP 401 Unauthorized for requests without valid credentials. Use OAuth 2.1 or Bearer tokens as recommended by the MCP spec."
+  },
+  {
+    id: "security-auth-malformed",
+    name: "Rejects malformed auth credentials",
+    category: "security",
+    required: false,
+    specRef: "basic/authorization",
+    description: "Sends a request with a malformed Authorization header (garbage value) and verifies the server returns HTTP 401 or 403. Servers must validate auth tokens, not just check for presence.",
+    recommendation: "Validate the format and signature of Authorization header values. Reject malformed or invalid tokens with HTTP 401. Do not treat any non-empty Authorization header as valid."
+  },
+  {
+    id: "security-tls-required",
+    name: "Enforces HTTPS/TLS",
+    category: "security",
+    required: false,
+    specRef: "basic/authorization",
+    description: "If the server URL uses HTTPS, attempts an HTTP (plaintext) connection and verifies it is rejected or redirected. Production MCP servers should not accept plaintext connections.",
+    recommendation: "Configure your server to reject HTTP connections or redirect to HTTPS. Use TLS 1.2 or higher. The MCP spec requires HTTPS for production deployments."
+  },
+  {
+    id: "security-session-entropy",
+    name: "Session IDs are high-entropy",
+    category: "security",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Analyzes the MCP-Session-Id returned by the server. Session IDs should be cryptographically random and not sequential or predictable.",
+    recommendation: "Generate session IDs using a cryptographically secure random source (e.g., crypto.randomUUID()). Session IDs should be at least 128 bits of entropy. Do not use sequential counters or timestamps."
+  },
+  {
+    id: "security-session-not-auth",
+    name: "Session ID does not bypass auth",
+    category: "security",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Verifies that presenting a valid MCP-Session-Id without an Authorization header is still rejected. Per spec, servers MUST NOT use sessions for authentication.",
+    recommendation: "Always validate the Authorization header independently of the MCP-Session-Id. Sessions are for request routing, not authentication. Reject requests that lack valid auth even if they have a valid session ID."
+  },
+  {
+    id: "security-oauth-metadata",
+    name: "Protected Resource Metadata endpoint exists",
+    category: "security",
+    required: false,
+    specRef: "basic/authorization",
+    description: "Checks for a Protected Resource Metadata (RFC 9728) endpoint at /.well-known/oauth-protected-resource. Per MCP 2025-11-25, the MCP server publishes PRM with a resource identifier and authorization_servers array. Falls back to legacy /.well-known/oauth-authorization-server with a warning.",
+    recommendation: "Publish a Protected Resource Metadata document at /.well-known/oauth-protected-resource on your server's origin. Include 'resource' (your server's URL) and 'authorization_servers' (array of OAuth AS URLs). See RFC 9728."
+  },
+  {
+    id: "security-token-in-uri",
+    name: "Rejects auth tokens in query string",
+    category: "security",
+    required: false,
+    specRef: "basic/authorization",
+    description: "Sends a request with the auth token in the URL query string instead of the Authorization header. The MCP spec forbids transmitting credentials in URIs.",
+    recommendation: "Never accept authentication tokens from URL query parameters. Tokens in URIs are logged by proxies, appear in browser history, and leak via the Referer header. Only accept tokens in the Authorization header."
+  },
+  {
+    id: "security-cors-headers",
+    name: "CORS headers are restrictive",
+    category: "security",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "If the server returns CORS headers, verifies that Access-Control-Allow-Origin is not set to wildcard (*). Wildcard CORS on an authenticated API allows cross-origin credential theft.",
+    recommendation: 'Set Access-Control-Allow-Origin to specific trusted origins, not "*". If CORS is not needed (server-to-server only), do not send CORS headers at all.'
+  },
+  {
+    id: "security-origin-validation",
+    name: "Validates Origin header on requests",
+    category: "security",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Sends a request with a suspicious Origin header (https://evil-rebinding-attack.example.com) and verifies the server rejects it. Per spec, servers MUST validate the Origin header to prevent DNS rebinding attacks.",
+    recommendation: "Validate the Origin header on all incoming requests. Reject requests from untrusted origins with HTTP 403. Maintain an allowlist of permitted origins."
+  },
+  // ── Security: Input Validation (6 tests) ─────────────────────────
+  {
+    id: "security-command-injection",
+    name: "Resists command injection in tool params",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: "Calls each tool with OS command injection payloads in string parameters (e.g., '; cat /etc/passwd', '$(whoami)'). Verifies the server does not execute injected commands.",
+    recommendation: "Never pass tool argument values directly to shell commands. Use parameterized APIs, execFile() instead of exec(), or allowlists. Sanitize all user-provided input before use in system calls."
+  },
+  {
+    id: "security-sql-injection",
+    name: "Resists SQL injection in tool params",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: `Calls each tool with SQL injection payloads in string parameters (e.g., "' OR 1=1 --"). Verifies the server does not return database errors or unexpected data.`,
+    recommendation: "Use parameterized queries or prepared statements for all database operations. Never concatenate user input into SQL strings. Return generic error messages that do not reveal database structure."
+  },
+  {
+    id: "security-path-traversal",
+    name: "Resists path traversal in tool params",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: "Calls each tool with path traversal payloads in string parameters (e.g., '../../etc/passwd', '..\\\\..\\\\windows\\\\system.ini'). Verifies the server does not expose files outside its intended scope.",
+    recommendation: "Validate and sanitize file paths. Use path.resolve() and verify the result is within the allowed directory. Reject paths containing '..' segments. Use a chroot or sandboxed filesystem for file operations."
+  },
+  {
+    id: "security-ssrf-internal",
+    name: "Resists SSRF to internal networks",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: "For tools that accept URL parameters, submits internal IP addresses (169.254.169.254, 127.0.0.1, 10.0.0.0/8) and cloud metadata endpoints. Verifies the server blocks requests to internal networks.",
+    recommendation: "Validate and restrict URLs in tool parameters. Block requests to private IP ranges (10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x), link-local addresses, and cloud metadata endpoints. Use an allowlist of permitted domains."
+  },
+  {
+    id: "security-oversized-input",
+    name: "Handles oversized inputs gracefully",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: "Sends a tools/call request with an extremely large argument value (1MB+ string). Verifies the server rejects it with an error instead of crashing or consuming excessive resources.",
+    recommendation: "Implement request body size limits. Return HTTP 413 or JSON-RPC error for oversized payloads. Set explicit maxBodyLength in your HTTP server configuration."
+  },
+  {
+    id: "security-extra-params",
+    name: "Rejects or ignores extra tool params",
+    category: "security",
+    required: false,
+    specRef: "server/tools#calling-tools",
+    description: "Calls a tool with unexpected additional parameters beyond what the schema defines. Verifies the server either rejects them (strict) or silently ignores them (permissive) without errors.",
+    recommendation: "Use JSON Schema validation with additionalProperties: false to reject unexpected parameters, or strip unknown properties before processing. Do not pass unvalidated properties to internal functions."
+  },
+  // ── Security: Tool Integrity (4 tests) ───────────────────────────
+  {
+    id: "security-tool-schema-defined",
+    name: "All tools define inputSchema",
+    category: "security",
+    required: false,
+    specRef: "server/tools#data-types",
+    description: "Verifies all tools have an inputSchema with type 'object'. Tools without schemas cannot have their inputs validated, creating an injection risk.",
+    recommendation: "Define a complete JSON Schema (inputSchema with type: 'object') for every tool. Specify all expected properties, their types, and constraints. This enables input validation and prevents parameter injection."
+  },
+  {
+    id: "security-tool-rug-pull",
+    name: "Tool definitions are stable across calls",
+    category: "security",
+    required: false,
+    specRef: "server/tools#listing-tools",
+    description: "Calls tools/list twice and compares the results. Tool definitions should not change between calls within the same session, which could indicate a rug-pull attack.",
+    recommendation: "Ensure tools/list returns consistent results within a session. If tools change dynamically, send a tools/list_changed notification. Never silently alter tool definitions \u2014 this is a known MCP attack vector (tool poisoning)."
+  },
+  {
+    id: "security-tool-description-poisoning",
+    name: "Tool descriptions free of injection patterns",
+    category: "security",
+    required: false,
+    specRef: "server/tools#data-types",
+    description: "Scans all tool names, descriptions, and parameter descriptions for prompt injection patterns: 'ignore previous', 'override', 'system prompt', hidden Unicode characters, and Base64-encoded strings.",
+    recommendation: "Review all tool descriptions for prompt injection patterns. Remove any text that attempts to override LLM instructions, references system prompts, or contains hidden characters. Tool descriptions are rendered to LLMs and can be used for prompt injection."
+  },
+  {
+    id: "security-tool-cross-reference",
+    name: "Tools do not reference other tools by name",
+    category: "security",
+    required: false,
+    specRef: "server/tools#data-types",
+    description: "Checks that tool descriptions do not reference other tool names. Cross-references between tools can be used to manipulate LLM tool selection and create implicit execution chains.",
+    recommendation: "Avoid referencing other tool names in tool descriptions. Each tool should be self-contained. If tools have dependencies, document them in server instructions, not in individual tool descriptions."
+  },
+  // ── Security: Information Disclosure (3 tests) ───────────────────
+  {
+    id: "security-error-no-stacktrace",
+    name: "Error responses do not leak stack traces",
+    category: "security",
+    required: false,
+    specRef: "basic",
+    description: "Triggers various error conditions and inspects responses for stack traces, file paths, and internal implementation details. Error responses should not reveal server internals.",
+    recommendation: "Sanitize error responses before returning them to clients. Remove stack traces, file paths, database connection strings, and internal IP addresses. Use generic error messages for unexpected failures."
+  },
+  {
+    id: "security-error-no-internal-ip",
+    name: "Error responses do not leak internal IPs",
+    category: "security",
+    required: false,
+    specRef: "basic",
+    description: "Inspects error response bodies for private IP addresses (10.x, 172.16-31.x, 192.168.x, 127.x) that would reveal internal network topology.",
+    recommendation: "Strip internal IP addresses from error responses. Configure your reverse proxy to not forward X-Real-IP or internal addressing. Use a centralized error handler that sanitizes responses."
+  },
+  {
+    id: "security-rate-limiting",
+    name: "Rate limiting is enforced",
+    category: "security",
+    required: false,
+    specRef: "basic/transports#streamable-http",
+    description: "Sends a burst of rapid requests and checks if the server eventually returns HTTP 429 Too Many Requests. Production servers should implement rate limiting to prevent abuse.",
+    recommendation: "Implement rate limiting on your MCP endpoint. Return HTTP 429 with a Retry-After header when limits are exceeded. Consider per-IP, per-token, and per-session rate limits."
   }
 ];
 
 // src/runner.ts
+var TEST_DEFINITIONS_MAP = new Map(TEST_DEFINITIONS.map((t) => [t.id, t]));
 var _require = createRequire(import.meta.url);
 var { version: TOOL_VERSION } = _require("../package.json");
 var SPEC_VERSION = "2025-11-25";
 var SPEC_BASE = `https://modelcontextprotocol.io/specification/${SPEC_VERSION}`;
 var VALID_CONTENT_TYPES = ["text", "image", "audio", "resource", "resource_link"];
+var INJECTION_PAYLOADS = {
+  command: ["; cat /etc/passwd", "$(whoami)", "| ls -la", "`id`", "&& echo pwned"],
+  sql: ["' OR 1=1 --", "'; DROP TABLE users; --", "1 UNION SELECT * FROM information_schema.tables--"],
+  pathTraversal: ["../../etc/passwd", "..\\..\\windows\\system.ini", "%2e%2e%2f%2e%2e%2fetc%2fpasswd"],
+  ssrf: ["http://169.254.169.254/latest/meta-data/", "http://127.0.0.1:22", "http://[::1]/", "http://10.0.0.1/"]
+};
+var STACK_TRACE_PATTERNS = [
+  /at\s+\S+\s+\(.*:\d+:\d+\)/i,
+  // Node.js: "at Function (file.js:10:5)"
+  /Traceback\s+\(most recent/i,
+  // Python
+  /\.py",\s+line\s+\d+/i,
+  // Python file reference
+  /\.java:\d+\)/i,
+  // Java
+  /\.go:\d+/i,
+  // Go
+  /from\s+\S+\.rb:\d+/i,
+  // Ruby
+  /\.cs:line\s+\d+/i,
+  // C#/.NET
+  /#\d+\s+\/.*\.php\(\d+\)/i,
+  // PHP
+  /panicked\s+at\s+'/i,
+  // Rust
+  /ENOENT|EACCES|EPERM/,
+  // Node.js system errors
+  /node_modules\//,
+  // Node.js module paths
+  /\/usr\/local\/|\/home\//,
+  // Unix paths
+  /[A-Z]:\\.*\\/,
+  // Windows paths
+  /password|passwd|secret|credential/i,
+  // Sensitive terms
+  /jdbc:|mysql:|postgres:|mongodb:/i
+  // DB connection strings
+];
+var INTERNAL_IP_PATTERNS = [
+  /\b10\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/,
+  /\b172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}\b/,
+  /\b192\.168\.\d{1,3}\.\d{1,3}\b/,
+  /\b127\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/,
+  /\b::1\b/,
+  // IPv6 loopback
+  /\bfe80:/i,
+  // IPv6 link-local
+  /\bf[cd][0-9a-f]{2}:/i
+  // IPv6 unique local (fc00::/fd00::)
+];
 function createIdCounter(start = 0) {
   let id = start;
   return () => ++id;
 }
 function parseSSEResponse(text) {
   const lines = text.split("\n");
-  let lastJsonRpcResponse = null;
+  let firstJsonRpcResponse = null;
   let currentData = [];
   function flushEvent() {
     if (currentData.length === 0) return;
@@ -518,8 +843,8 @@ function parseSSEResponse(text) {
     if (!data.trim()) return;
     try {
       const parsed = JSON.parse(data);
-      if (parsed.jsonrpc === "2.0" && parsed.id !== void 0) {
-        lastJsonRpcResponse = parsed;
+      if (!firstJsonRpcResponse && parsed.jsonrpc === "2.0" && parsed.id !== void 0) {
+        firstJsonRpcResponse = parsed;
       }
     } catch {
     }
@@ -533,7 +858,7 @@ function parseSSEResponse(text) {
     }
   }
   flushEvent();
-  return lastJsonRpcResponse;
+  return firstJsonRpcResponse;
 }
 async function mcpRequest(backendUrl, method, params, nextId, extraHeaders, timeout) {
   const id = nextId();
@@ -743,6 +1068,32 @@ async function runComplianceSuite(url, options = {}) {
       return { passed: valid, details: `Content-Type: ${ct}` };
     }
   );
+  await test(
+    "transport-content-type-reject",
+    "Rejects non-JSON request Content-Type",
+    "transport",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      const res = await request(backendUrl, {
+        method: "POST",
+        headers: { "Content-Type": "text/plain", Accept: "application/json, text/event-stream", ...userHeaders },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 99905, method: "ping" }),
+        signal: AbortSignal.timeout(timeout)
+      });
+      await res.body.text();
+      if (res.statusCode >= 400 && res.statusCode < 500) {
+        return { passed: true, details: `HTTP ${res.statusCode} (incorrect Content-Type rejected)` };
+      }
+      if (res.statusCode >= 200 && res.statusCode < 300) {
+        return {
+          passed: false,
+          details: `HTTP ${res.statusCode} \u2014 server accepted text/plain Content-Type (should require application/json)`
+        };
+      }
+      return { passed: false, details: `HTTP ${res.statusCode}` };
+    }
+  );
   await test(
     "transport-get",
     "GET returns SSE stream or 405",
@@ -757,7 +1108,8 @@ async function runComplianceSuite(url, options = {}) {
         signal: AbortSignal.timeout(timeout)
       });
       const body = await res.body.text();
-      const ct = (res.headers["content-type"] || "").toLowerCase();
+      const rawCt = res.headers["content-type"];
+      const ct = (Array.isArray(rawCt) ? rawCt[0] : rawCt || "").toLowerCase();
       if (res.statusCode === 405) {
         return { passed: true, details: "HTTP 405 Method Not Allowed (acceptable)" };
       }
@@ -865,6 +1217,50 @@ async function runComplianceSuite(url, options = {}) {
       return { passed: valid, details: `Version: ${version}` };
     }
   );
+  await test(
+    "lifecycle-version-negotiate",
+    "Handles unknown protocol version",
+    "lifecycle",
+    false,
+    "basic/lifecycle#version-negotiation",
+    async () => {
+      try {
+        const futureRes = await mcpRequest(
+          backendUrl,
+          "initialize",
+          {
+            protocolVersion: "2099-01-01",
+            capabilities: {},
+            clientInfo: { name: "mcp-compliance", version: TOOL_VERSION }
+          },
+          createIdCounter(99960),
+          userHeaders,
+          timeout
+        );
+        const result = futureRes.body?.result;
+        const error = futureRes.body?.error;
+        if (error) {
+          return {
+            passed: true,
+            details: `Server rejected unknown version with error: ${error.code} \u2014 ${error.message}`
+          };
+        }
+        if (result?.protocolVersion) {
+          const offered = result.protocolVersion;
+          if (offered === "2099-01-01") {
+            return {
+              passed: false,
+              details: 'Server accepted impossible future version "2099-01-01" \u2014 should offer a version it actually supports'
+            };
+          }
+          return { passed: true, details: `Server negotiated down to ${offered} (correct)` };
+        }
+        return { passed: false, details: "No protocolVersion or error in response" };
+      } catch {
+        return { passed: true, details: "Connection rejected for unknown version (acceptable)" };
+      }
+    }
+  );
   await test(
     "lifecycle-server-info",
     "Includes serverInfo",
@@ -936,6 +1332,73 @@ async function runComplianceSuite(url, options = {}) {
       details: match ? `Request id=${res.requestId}, response id=${body.id} (match)` : `Request id=${res.requestId}, response id=${body.id} (MISMATCH)`
     };
   });
+  await test("lifecycle-string-id", "Supports string request IDs", "lifecycle", false, "basic", async () => {
+    const stringId = "compliance-test-string-id";
+    const body = JSON.stringify({ jsonrpc: "2.0", id: stringId, method: "ping", params: {} });
+    const res = await request(backendUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Accept: "application/json, text/event-stream",
+        ...buildHeaders()
+      },
+      body,
+      signal: AbortSignal.timeout(timeout)
+    });
+    const text = await res.body.text();
+    const rawCtStr = res.headers["content-type"];
+    const ct = (Array.isArray(rawCtStr) ? rawCtStr[0] : rawCtStr || "").toLowerCase();
+    let parsed;
+    if (ct.includes("text/event-stream")) {
+      parsed = parseSSEResponse(text);
+    }
+    if (!parsed) {
+      try {
+        parsed = JSON.parse(text);
+      } catch {
+      }
+    }
+    if (!parsed) return { passed: false, details: "Could not parse response" };
+    if (parsed.id === stringId) {
+      return { passed: true, details: `String id="${stringId}" echoed back correctly` };
+    }
+    if (parsed.id === void 0) {
+      return { passed: false, details: "No id in response" };
+    }
+    return {
+      passed: false,
+      details: `String id="${stringId}" sent, got back id=${JSON.stringify(parsed.id)} (type: ${typeof parsed.id})`
+    };
+  });
+  await test(
+    "lifecycle-reinit-reject",
+    "Rejects second initialize request",
+    "lifecycle",
+    false,
+    "basic/lifecycle#initialization",
+    async () => {
+      try {
+        const res = await rpc("initialize", {
+          protocolVersion: SPEC_VERSION,
+          capabilities: {},
+          clientInfo: { name: "mcp-compliance", version: TOOL_VERSION }
+        });
+        const error = res.body?.error;
+        if (error) {
+          return { passed: true, details: `Re-initialization rejected with error: ${error.code} \u2014 ${error.message}` };
+        }
+        if (res.statusCode >= 400) {
+          return { passed: true, details: `HTTP ${res.statusCode} (re-initialization rejected)` };
+        }
+        return {
+          passed: false,
+          details: `Server accepted second initialize (HTTP ${res.statusCode}) \u2014 should reject duplicate initialization`
+        };
+      } catch {
+        return { passed: true, details: "Connection rejected (acceptable)" };
+      }
+    }
+  );
   const hasLogging = !!serverInfo.capabilities.logging;
   await test(
     "lifecycle-logging",
@@ -1010,7 +1473,7 @@ async function runComplianceSuite(url, options = {}) {
   );
   await test(
     "lifecycle-progress",
-    "Accepts progress notifications",
+    "Handles progress notifications gracefully",
     "lifecycle",
     false,
     "basic/utilities#progress",
@@ -1023,9 +1486,12 @@ async function runComplianceSuite(url, options = {}) {
         timeout
       );
       if (res.statusCode >= 200 && res.statusCode < 300) {
-        return { passed: true, details: `HTTP ${res.statusCode} (progress notification accepted)` };
+        return { passed: true, details: `HTTP ${res.statusCode} (notification handled gracefully)` };
       }
-      return { passed: false, details: `HTTP ${res.statusCode} \u2014 server should accept progress notifications` };
+      return {
+        passed: false,
+        details: `HTTP ${res.statusCode} \u2014 server should accept unknown notifications without error`
+      };
     }
   );
   await test(
@@ -1067,7 +1533,11 @@ async function runComplianceSuite(url, options = {}) {
         return { passed: true, details: "HTTP 202 Accepted (correct)" };
       }
       if (res.statusCode >= 200 && res.statusCode < 300) {
-        return { passed: true, details: `HTTP ${res.statusCode} (accepted, but 202 is preferred)` };
+        warnings.push(`Notification returned HTTP ${res.statusCode} instead of spec-required 202 Accepted`);
+        return {
+          passed: false,
+          details: `HTTP ${res.statusCode} \u2014 spec requires 202 Accepted for notifications (MUST)`
+        };
       }
       return { passed: false, details: `HTTP ${res.statusCode} \u2014 expected 202 Accepted for notifications` };
     }
@@ -1098,6 +1568,34 @@ async function runComplianceSuite(url, options = {}) {
       return { passed: false, details: `HTTP ${res.statusCode}` };
     }
   );
+  await test(
+    "transport-session-invalid",
+    "Returns 404 for unknown session ID",
+    "transport",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      if (!sessionId) {
+        return { passed: true, details: "Server did not issue session ID (test not applicable)" };
+      }
+      const fakeHeaders = {
+        ...userHeaders,
+        "mcp-session-id": "invalid-nonexistent-session-id"
+      };
+      if (negotiatedProtocolVersion) fakeHeaders["mcp-protocol-version"] = negotiatedProtocolVersion;
+      const res = await mcpRequest(backendUrl, "ping", void 0, createIdCounter(99915), fakeHeaders, timeout);
+      if (res.statusCode === 404) {
+        return { passed: true, details: "HTTP 404 for unknown session ID (correct per spec)" };
+      }
+      if (res.statusCode === 400) {
+        return {
+          passed: false,
+          details: "HTTP 400 \u2014 spec requires 404 (Not Found) for unrecognized session IDs, not 400"
+        };
+      }
+      return { passed: false, details: `HTTP ${res.statusCode} \u2014 spec requires 404 for unrecognized MCP-Session-Id` };
+    }
+  );
   await test(
     "transport-get-stream",
     "GET with session returns SSE or 405",
@@ -1114,7 +1612,8 @@ async function runComplianceSuite(url, options = {}) {
         signal: AbortSignal.timeout(Math.min(timeout, 3e3))
       });
       const body = await res.body.text();
-      const ct = (res.headers["content-type"] || "").toLowerCase();
+      const rawCt2 = res.headers["content-type"];
+      const ct = (Array.isArray(rawCt2) ? rawCt2[0] : rawCt2 || "").toLowerCase();
       if (res.statusCode === 405) {
         return { passed: true, details: "HTTP 405 (server does not support server-initiated messages)" };
       }
@@ -1153,7 +1652,8 @@ async function runComplianceSuite(url, options = {}) {
           signal: AbortSignal.timeout(timeout)
         }).then(async (res) => {
           const text = await res.body.text();
-          const ct = (res.headers["content-type"] || "").toLowerCase();
+          const rawCtConcurrent = res.headers["content-type"];
+          const ct = (Array.isArray(rawCtConcurrent) ? rawCtConcurrent[0] : rawCtConcurrent || "").toLowerCase();
           let body;
           if (ct.includes("text/event-stream")) {
             body = parseSSEResponse(text);
@@ -1180,6 +1680,42 @@ async function runComplianceSuite(url, options = {}) {
       return { passed: true, details: `${results.length} concurrent requests handled correctly` };
     }
   );
+  await test(
+    "transport-sse-event-field",
+    "SSE responses include event: message",
+    "transport",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      const res = await request(backendUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "text/event-stream",
+          ...buildHeaders()
+        },
+        body: JSON.stringify({ jsonrpc: "2.0", id: createIdCounter(99940)(), method: "ping" }),
+        signal: AbortSignal.timeout(timeout)
+      });
+      const text = await res.body.text();
+      const rawCtSse = res.headers["content-type"];
+      const ct = (Array.isArray(rawCtSse) ? rawCtSse[0] : rawCtSse || "").toLowerCase();
+      if (!ct.includes("text/event-stream")) {
+        return { passed: true, details: "Server responded with JSON (not SSE) \u2014 event field check not applicable" };
+      }
+      const hasEventMessage = /^event:\s*message\s*$/m.test(text);
+      if (hasEventMessage) {
+        return { passed: true, details: "SSE response includes required event: message field" };
+      }
+      if (text.includes("data:")) {
+        return {
+          passed: false,
+          details: "SSE response has data: fields but missing required event: message field (spec: MUST include event: message)"
+        };
+      }
+      return { passed: true, details: "SSE response empty or no data fields \u2014 check not applicable" };
+    }
+  );
   const hasTools = !!serverInfo.capabilities.tools;
   let cachedToolsList = null;
   await test(
@@ -1261,9 +1797,6 @@ async function runComplianceSuite(url, options = {}) {
             issues.push(`${tool.name}: annotations.${field} should be boolean, got ${typeof ann[field]}`);
           }
         }
-        if (ann.title !== void 0 && typeof ann.title !== "string") {
-          issues.push(`${tool.name}: annotations.title should be string`);
-        }
       }
       if (issues.length > 0) return { passed: false, details: issues.join("; ") };
       return {
@@ -1811,6 +2344,822 @@ async function runComplianceSuite(url, options = {}) {
     }
     return { passed: false, details: `HTTP ${res.statusCode} \u2014 expected error code -32600` };
   });
+  const undeclaredMethods = [
+    { method: "tools/list", capability: "tools", declared: hasTools },
+    { method: "resources/list", capability: "resources", declared: hasResources },
+    { method: "prompts/list", capability: "prompts", declared: hasPrompts }
+  ];
+  const undeclared = undeclaredMethods.filter((m) => !m.declared);
+  await test(
+    "error-capability-gated",
+    "Rejects methods for undeclared capabilities",
+    "errors",
+    false,
+    "basic/lifecycle#capability-negotiation",
+    async () => {
+      if (undeclared.length === 0) {
+        return {
+          passed: true,
+          details: "Server declares all capabilities (tools, resources, prompts) \u2014 no undeclared methods to test"
+        };
+      }
+      const issues = [];
+      for (const { method, capability } of undeclared) {
+        const res = await rpc(method);
+        const error = res.body?.error;
+        if (!error && res.body?.result) {
+          issues.push(`${method} returned success despite missing ${capability} capability`);
+        }
+      }
+      if (issues.length > 0) return { passed: false, details: issues.join("; ") };
+      return {
+        passed: true,
+        details: `Tested ${undeclared.length} undeclared method(s): ${undeclared.map((m) => m.method).join(", ")} \u2014 all returned errors`
+      };
+    }
+  );
+  const listMethodForCursor = hasTools ? "tools/list" : hasResources ? "resources/list" : hasPrompts ? "prompts/list" : null;
+  await test(
+    "error-invalid-cursor",
+    "Handles invalid pagination cursor gracefully",
+    "errors",
+    false,
+    "basic",
+    async () => {
+      if (!listMethodForCursor) {
+        return { passed: true, details: "No list methods available to test (skipped)" };
+      }
+      const res = await rpc(listMethodForCursor, { cursor: "!!!invalid-garbage-cursor-$$$" });
+      const error = res.body?.error;
+      if (error) {
+        return { passed: true, details: `Invalid cursor rejected with error: ${error.code} \u2014 ${error.message}` };
+      }
+      const result = res.body?.result;
+      if (result) {
+        return { passed: true, details: "Server returned results (likely ignored invalid cursor)" };
+      }
+      return { passed: false, details: "No error or result for invalid cursor" };
+    }
+  );
+  const hasAuth = !!userHeaders.Authorization || !!userHeaders.authorization;
+  await test(
+    "security-auth-required",
+    "Rejects unauthenticated requests",
+    "security",
+    false,
+    "basic/authorization",
+    async () => {
+      if (!hasAuth) {
+        return {
+          passed: false,
+          details: "Server does not require auth (no --auth provided and server accepted unauthenticated requests)"
+        };
+      }
+      const noAuthHeaders = {};
+      if (sessionId) noAuthHeaders["mcp-session-id"] = sessionId;
+      try {
+        const res = await mcpRequest(backendUrl, "ping", void 0, nextId, noAuthHeaders, timeout);
+        if (res.statusCode === 401 || res.statusCode === 403) {
+          return { passed: true, details: `HTTP ${res.statusCode} (unauthenticated request rejected)` };
+        }
+        return { passed: false, details: `HTTP ${res.statusCode} \u2014 server accepted unauthenticated request` };
+      } catch (err) {
+        return { passed: true, details: "Connection rejected (acceptable)" };
+      }
+    }
+  );
+  await test(
+    "security-auth-malformed",
+    "Rejects malformed auth credentials",
+    "security",
+    false,
+    "basic/authorization",
+    async () => {
+      if (!hasAuth) {
+        return { passed: false, details: "Skipped: server does not require auth" };
+      }
+      const malformedHeaders = {
+        Authorization: "Bearer INVALID_GARBAGE_TOKEN_!@#$%^&*()"
+      };
+      if (sessionId) malformedHeaders["mcp-session-id"] = sessionId;
+      try {
+        const res = await mcpRequest(backendUrl, "ping", void 0, nextId, malformedHeaders, timeout);
+        if (res.statusCode === 401 || res.statusCode === 403) {
+          return { passed: true, details: `HTTP ${res.statusCode} (malformed auth rejected)` };
+        }
+        return { passed: false, details: `HTTP ${res.statusCode} \u2014 server accepted malformed auth token` };
+      } catch (err) {
+        return { passed: true, details: "Connection rejected (acceptable)" };
+      }
+    }
+  );
+  await test("security-tls-required", "Enforces HTTPS/TLS", "security", false, "basic/authorization", async () => {
+    const parsedUrl = new URL(url);
+    if (parsedUrl.protocol !== "https:") {
+      return { passed: false, details: `Server URL uses ${parsedUrl.protocol} \u2014 production servers should use HTTPS` };
+    }
+    const httpUrl = url.replace(/^https:/, "http:");
+    try {
+      const res = await request(httpUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 99950, method: "ping" }),
+        signal: AbortSignal.timeout(Math.min(timeout, 5e3))
+      });
+      await res.body.text();
+      if (res.statusCode === 301 || res.statusCode === 302 || res.statusCode === 308) {
+        return { passed: true, details: `HTTP ${res.statusCode} redirect to HTTPS (good)` };
+      }
+      if (res.statusCode >= 400) {
+        return { passed: true, details: `HTTP ${res.statusCode} (plaintext rejected)` };
+      }
+      return { passed: false, details: `HTTP ${res.statusCode} \u2014 server accepts plaintext HTTP connections` };
+    } catch {
+      return { passed: true, details: "HTTP connection refused (HTTPS enforced)" };
+    }
+  });
+  await test(
+    "security-session-entropy",
+    "Session IDs are high-entropy",
+    "security",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      if (!sessionId) {
+        return { passed: true, details: "Server does not issue session IDs (skipped)" };
+      }
+      if (sessionId.length < 16) {
+        return {
+          passed: false,
+          details: `Session ID too short (${sessionId.length} chars): "${sessionId}" \u2014 should be \u226516 chars`
+        };
+      }
+      if (/^\d+$/.test(sessionId)) {
+        return {
+          passed: false,
+          details: `Session ID is purely numeric: "${sessionId}" \u2014 likely sequential, not random`
+        };
+      }
+      const uniqueChars = new Set(sessionId.toLowerCase()).size;
+      if (uniqueChars < 8) {
+        return {
+          passed: false,
+          details: `Session ID has low character diversity (${uniqueChars} unique chars): "${sessionId}"`
+        };
+      }
+      return {
+        passed: true,
+        details: `Session ID has good entropy (${sessionId.length} chars, ${uniqueChars} unique): "${sessionId.substring(0, 16)}..."`
+      };
+    }
+  );
+  await test(
+    "security-session-not-auth",
+    "Session ID does not bypass auth",
+    "security",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      if (!hasAuth) {
+        return { passed: true, details: "Skipped: server does not require auth" };
+      }
+      if (!sessionId) {
+        return { passed: true, details: "Skipped: server does not issue session IDs" };
+      }
+      const sessionOnlyHeaders = {
+        "mcp-session-id": sessionId
+      };
+      try {
+        const res = await mcpRequest(backendUrl, "ping", void 0, nextId, sessionOnlyHeaders, timeout);
+        if (res.statusCode === 401 || res.statusCode === 403) {
+          return { passed: true, details: `HTTP ${res.statusCode} (session ID alone not sufficient for auth)` };
+        }
+        return {
+          passed: false,
+          details: `HTTP ${res.statusCode} \u2014 server accepted session ID without auth (spec: MUST NOT use sessions for authentication)`
+        };
+      } catch {
+        return { passed: true, details: "Connection rejected (acceptable)" };
+      }
+    }
+  );
+  await test(
+    "security-oauth-metadata",
+    "Protected Resource Metadata endpoint exists",
+    "security",
+    false,
+    "basic/authorization",
+    async () => {
+      if (!hasAuth) {
+        return { passed: true, details: "Skipped: server does not require auth" };
+      }
+      const parsedUrl = new URL(url);
+      const prmUrl = `${parsedUrl.protocol}//${parsedUrl.host}/.well-known/oauth-protected-resource`;
+      try {
+        const res = await request(prmUrl, {
+          method: "GET",
+          headers: { Accept: "application/json" },
+          signal: AbortSignal.timeout(Math.min(timeout, 5e3))
+        });
+        const text = await res.body.text();
+        if (res.statusCode === 200) {
+          try {
+            const meta = JSON.parse(text);
+            if (!meta.resource) {
+              return { passed: false, details: "PRM response missing required 'resource' field" };
+            }
+            if (!Array.isArray(meta.authorization_servers) || meta.authorization_servers.length === 0) {
+              return { passed: false, details: "PRM response missing 'authorization_servers' array" };
+            }
+            return {
+              passed: true,
+              details: `Protected Resource Metadata found: resource=${meta.resource}, ${meta.authorization_servers.length} auth server(s)`
+            };
+          } catch {
+            return { passed: false, details: "PRM endpoint returned non-JSON response" };
+          }
+        }
+        const legacyUrl = `${parsedUrl.protocol}//${parsedUrl.host}/.well-known/oauth-authorization-server`;
+        try {
+          const legacyRes = await request(legacyUrl, {
+            method: "GET",
+            headers: { Accept: "application/json" },
+            signal: AbortSignal.timeout(Math.min(timeout, 5e3))
+          });
+          const legacyText = await legacyRes.body.text();
+          if (legacyRes.statusCode === 200) {
+            try {
+              const legacyMeta = JSON.parse(legacyText);
+              if (legacyMeta.issuer && legacyMeta.token_endpoint) {
+                warnings.push(
+                  "Server uses legacy /.well-known/oauth-authorization-server instead of /.well-known/oauth-protected-resource (RFC 9728). Update to PRM for 2025-11-25 compliance."
+                );
+                return {
+                  passed: true,
+                  details: `Legacy OAuth AS metadata found: issuer=${legacyMeta.issuer} (should migrate to PRM)`
+                };
+              }
+            } catch {
+            }
+          }
+        } catch {
+        }
+        return {
+          passed: false,
+          details: `PRM endpoint returned HTTP ${res.statusCode} and no legacy OAuth metadata found`
+        };
+      } catch {
+        return { passed: false, details: "PRM endpoint unreachable" };
+      }
+    }
+  );
+  await test(
+    "security-token-in-uri",
+    "Rejects auth tokens in query string",
+    "security",
+    false,
+    "basic/authorization",
+    async () => {
+      if (!hasAuth) {
+        return { passed: true, details: "Skipped: server does not require auth" };
+      }
+      const authValue = userHeaders.Authorization || userHeaders.authorization || "";
+      const token = authValue.replace(/^Bearer\s+/i, "");
+      if (!token) {
+        return { passed: true, details: "Skipped: could not extract token from auth header" };
+      }
+      const uriWithToken = `${url}${url.includes("?") ? "&" : "?"}access_token=${encodeURIComponent(token)}`;
+      try {
+        const noAuthHeaders = {};
+        if (sessionId) noAuthHeaders["mcp-session-id"] = sessionId;
+        const res = await mcpRequest(uriWithToken, "ping", void 0, nextId, noAuthHeaders, timeout);
+        if (res.statusCode === 401 || res.statusCode === 403) {
+          return { passed: true, details: `HTTP ${res.statusCode} (token in query string rejected)` };
+        }
+        if (res.statusCode >= 200 && res.statusCode < 300) {
+          return {
+            passed: false,
+            details: "Server accepted auth token in query string (spec: MUST NOT transmit credentials in URIs)"
+          };
+        }
+        return { passed: true, details: `HTTP ${res.statusCode} (token in query string not accepted)` };
+      } catch {
+        return { passed: true, details: "Connection rejected (acceptable)" };
+      }
+    }
+  );
+  await test(
+    "security-cors-headers",
+    "CORS headers are restrictive",
+    "security",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      try {
+        const res = await request(backendUrl, {
+          method: "OPTIONS",
+          headers: {
+            Origin: "https://evil.example.com",
+            "Access-Control-Request-Method": "POST",
+            ...buildHeaders()
+          },
+          signal: AbortSignal.timeout(Math.min(timeout, 5e3))
+        });
+        await res.body.text();
+        const acao = res.headers["access-control-allow-origin"];
+        if (!acao) {
+          return { passed: true, details: "No CORS headers returned (server-to-server only, acceptable)" };
+        }
+        if (acao === "*") {
+          return {
+            passed: false,
+            details: 'Access-Control-Allow-Origin is "*" (wildcard) \u2014 allows cross-origin credential theft'
+          };
+        }
+        if (acao === "https://evil.example.com") {
+          return { passed: false, details: "Server reflects arbitrary Origin in CORS \u2014 effectively wildcard" };
+        }
+        return { passed: true, details: `CORS restricted to: ${acao}` };
+      } catch {
+        return { passed: true, details: "OPTIONS request failed (no CORS, acceptable)" };
+      }
+    }
+  );
+  await test(
+    "security-origin-validation",
+    "Validates Origin header on requests",
+    "security",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      try {
+        const res = await request(backendUrl, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+            Origin: "https://evil-rebinding-attack.example.com",
+            ...buildHeaders()
+          },
+          body: JSON.stringify({ jsonrpc: "2.0", id: createIdCounter(99970)(), method: "ping" }),
+          signal: AbortSignal.timeout(timeout)
+        });
+        await res.body.text();
+        if (res.statusCode === 403 || res.statusCode === 401) {
+          return { passed: true, details: `HTTP ${res.statusCode} (suspicious Origin rejected)` };
+        }
+        if (res.statusCode >= 200 && res.statusCode < 300) {
+          return {
+            passed: false,
+            details: `HTTP ${res.statusCode} \u2014 server accepted request with untrusted Origin header (spec: MUST validate Origin for DNS rebinding protection)`
+          };
+        }
+        if (res.statusCode >= 400) {
+          return { passed: true, details: `HTTP ${res.statusCode} (suspicious Origin rejected)` };
+        }
+        return { passed: false, details: `HTTP ${res.statusCode}` };
+      } catch {
+        return { passed: true, details: "Connection rejected (acceptable)" };
+      }
+    }
+  );
+  async function runInjectionTest(toolName, paramName, payloads, detectPattern, label) {
+    const issues = [];
+    for (const payload of payloads) {
+      try {
+        const res = await rpc("tools/call", { name: toolName, arguments: { [paramName]: payload } });
+        const content = res.body?.result?.content;
+        if (Array.isArray(content)) {
+          const text = content.map((c) => c.text || "").join(" ");
+          if (detectPattern.test(text)) {
+            issues.push(`Payload "${payload}" ${label} (output: ${text.substring(0, 100)})`);
+          }
+        }
+      } catch {
+      }
+    }
+    if (issues.length > 0) return { passed: false, details: issues.join("; ") };
+    return {
+      passed: true,
+      details: `Tested ${payloads.length} payloads against ${toolName}.${paramName} \u2014 no ${label.split(" ")[0]} detected`
+    };
+  }
+  if (toolNames.length > 0) {
+    const allTools = cachedToolsList ?? [];
+    const toolsWithStringParams = allTools.filter((t) => {
+      const props = t.inputSchema?.properties;
+      if (!props) return false;
+      return Object.values(props).some((p) => p.type === "string");
+    });
+    const injectionTarget = toolsWithStringParams[0] || allTools[0];
+    const targetStringParam = injectionTarget?.inputSchema?.properties ? Object.entries(injectionTarget.inputSchema.properties).find(
+      ([_, v]) => v.type === "string"
+    )?.[0] ?? null : null;
+    await test(
+      "security-command-injection",
+      "Resists command injection in tool params",
+      "security",
+      false,
+      "server/tools#calling-tools",
+      async () => {
+        if (!injectionTarget || !targetStringParam)
+          return { passed: true, details: "No tools with string parameters to test" };
+        return runInjectionTest(
+          injectionTarget.name,
+          targetStringParam,
+          INJECTION_PAYLOADS.command,
+          /root:.*:\d+:\d+:.*:\/|uid=\d+\(\w+\)|drwxr|pwned/i,
+          "appears to have executed"
+        );
+      }
+    );
+    await test(
+      "security-sql-injection",
+      "Resists SQL injection in tool params",
+      "security",
+      false,
+      "server/tools#calling-tools",
+      async () => {
+        if (!injectionTarget || !targetStringParam)
+          return { passed: true, details: "No tools with string parameters to test" };
+        return runInjectionTest(
+          injectionTarget.name,
+          targetStringParam,
+          INJECTION_PAYLOADS.sql,
+          /syntax error|sql|mysql|postgres|sqlite|information_schema|table_name/i,
+          "triggered database error"
+        );
+      }
+    );
+    await test(
+      "security-path-traversal",
+      "Resists path traversal in tool params",
+      "security",
+      false,
+      "server/tools#calling-tools",
+      async () => {
+        if (!injectionTarget || !targetStringParam)
+          return { passed: true, details: "No tools with string parameters to test" };
+        return runInjectionTest(
+          injectionTarget.name,
+          targetStringParam,
+          INJECTION_PAYLOADS.pathTraversal,
+          /root:.*:0:0|\[boot loader\]|\[extensions\]/i,
+          "returned sensitive file content"
+        );
+      }
+    );
+    await test(
+      "security-ssrf-internal",
+      "Resists SSRF to internal networks",
+      "security",
+      false,
+      "server/tools#calling-tools",
+      async () => {
+        const urlParamTool = allTools.find((t) => {
+          const props = t.inputSchema?.properties;
+          if (!props) return false;
+          return Object.entries(props).some(
+            ([k, v]) => v.type === "string" && /url|uri|endpoint|link|href/i.test(k)
+          );
+        });
+        if (!urlParamTool) return { passed: true, details: "No tools with URL parameters found (skipped)" };
+        const urlParam = Object.entries(urlParamTool.inputSchema.properties).find(
+          ([k, v]) => v.type === "string" && /url|uri|endpoint|link|href/i.test(k)
+        )?.[0];
+        if (!urlParam) return { passed: true, details: "No URL parameter found" };
+        return runInjectionTest(
+          urlParamTool.name,
+          urlParam,
+          INJECTION_PAYLOADS.ssrf,
+          /ami-|instance-id|hostname|iam|security-credentials/i,
+          "returned internal data"
+        );
+      }
+    );
+  } else {
+    for (const testId of [
+      "security-command-injection",
+      "security-sql-injection",
+      "security-path-traversal",
+      "security-ssrf-internal"
+    ]) {
+      await test(
+        testId,
+        TEST_DEFINITIONS_MAP.get(testId)?.name || testId,
+        "security",
+        false,
+        "server/tools#calling-tools",
+        async () => ({ passed: true, details: "No tools available to test (skipped)" })
+      );
+    }
+  }
+  await test(
+    "security-oversized-input",
+    "Handles oversized inputs gracefully",
+    "security",
+    false,
+    "server/tools#calling-tools",
+    async () => {
+      const largeValue = "A".repeat(1048576);
+      try {
+        const res = await request(backendUrl, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+            ...buildHeaders()
+          },
+          body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: nextId(),
+            method: "tools/call",
+            params: { name: toolNames[0] || "test", arguments: { data: largeValue } }
+          }),
+          signal: AbortSignal.timeout(timeout)
+        });
+        await res.body.text();
+        if (res.statusCode === 413) {
+          return { passed: true, details: "HTTP 413 Payload Too Large (good)" };
+        }
+        if (res.statusCode >= 400) {
+          return { passed: true, details: `HTTP ${res.statusCode} (oversized input rejected)` };
+        }
+        return { passed: true, details: `HTTP ${res.statusCode} \u2014 server handled 1MB payload without crashing` };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (msg.includes("timeout") || msg.includes("abort")) {
+          return { passed: false, details: "Request timed out \u2014 server may be struggling with oversized input" };
+        }
+        return { passed: true, details: "Connection rejected (acceptable for oversized input)" };
+      }
+    }
+  );
+  await test(
+    "security-extra-params",
+    "Rejects or ignores extra tool params",
+    "security",
+    false,
+    "server/tools#calling-tools",
+    async () => {
+      if (toolNames.length === 0) {
+        return { passed: true, details: "No tools available to test (skipped)" };
+      }
+      try {
+        const res = await rpc("tools/call", {
+          name: toolNames[0],
+          arguments: { __injected_param__: "malicious_value", __proto__: { admin: true } }
+        });
+        const error = res.body?.error;
+        if (error) {
+          return { passed: true, details: `Extra params rejected with error: ${error.code} \u2014 ${error.message}` };
+        }
+        return { passed: true, details: "Server processed request (extra params likely ignored)" };
+      } catch {
+        return { passed: true, details: "Request rejected (acceptable)" };
+      }
+    }
+  );
+  await test(
+    "security-tool-schema-defined",
+    "All tools define inputSchema",
+    "security",
+    false,
+    "server/tools#data-types",
+    async () => {
+      if (!toolsListOk) return { passed: true, details: "Skipped: tools/list not available" };
+      const tools = cachedToolsList ?? [];
+      if (tools.length === 0) return { passed: true, details: "No tools to validate" };
+      const missing = tools.filter((t) => !t.inputSchema || t.inputSchema.type !== "object");
+      if (missing.length > 0) {
+        return {
+          passed: false,
+          details: `${missing.length} tool(s) missing inputSchema: ${missing.map((t) => t.name).join(", ")}`
+        };
+      }
+      return { passed: true, details: `All ${tools.length} tool(s) have inputSchema defined` };
+    }
+  );
+  await test(
+    "security-tool-rug-pull",
+    "Tool definitions are stable across calls",
+    "security",
+    false,
+    "server/tools#listing-tools",
+    async () => {
+      if (!toolsListOk) return { passed: true, details: "Skipped: tools/list not available" };
+      try {
+        const res = await rpc("tools/list");
+        const tools2 = res.body?.result?.tools;
+        if (!Array.isArray(tools2)) return { passed: false, details: "Second tools/list call failed" };
+        const tools1 = cachedToolsList ?? [];
+        if (tools1.length !== tools2.length) {
+          return {
+            passed: false,
+            details: `Tool count changed: ${tools1.length} \u2192 ${tools2.length} (possible rug-pull)`
+          };
+        }
+        const names1 = tools1.map((t) => t.name).sort().join(",");
+        const names2 = tools2.map((t) => t.name).sort().join(",");
+        if (names1 !== names2) {
+          return { passed: false, details: "Tool names changed between calls (possible rug-pull)" };
+        }
+        for (const t1 of tools1) {
+          const t2 = tools2.find((t) => t.name === t1.name);
+          if (t2 && t1.description !== t2.description) {
+            return {
+              passed: false,
+              details: `Tool "${t1.name}" description changed between calls (possible rug-pull)`
+            };
+          }
+        }
+        return { passed: true, details: `${tools1.length} tool(s) consistent across 2 calls` };
+      } catch {
+        return { passed: false, details: "Second tools/list call threw an error" };
+      }
+    }
+  );
+  await test(
+    "security-tool-description-poisoning",
+    "Tool descriptions free of injection patterns",
+    "security",
+    false,
+    "server/tools#data-types",
+    async () => {
+      if (!toolsListOk) return { passed: true, details: "Skipped: tools/list not available" };
+      const tools = cachedToolsList ?? [];
+      if (tools.length === 0) return { passed: true, details: "No tools to validate" };
+      const suspiciousPatterns = [
+        { pattern: /ignore\s+(all\s+)?previous/i, label: "ignore previous instructions" },
+        { pattern: /override\s+(system|instructions|rules)/i, label: "override instructions" },
+        { pattern: /system\s+prompt/i, label: "system prompt reference" },
+        { pattern: /you\s+must\s+(always|never)/i, label: "behavioral override" },
+        { pattern: /do\s+not\s+(tell|inform|mention)/i, label: "concealment instruction" },
+        { pattern: /\b[A-Za-z0-9+/]{40,}={0,2}\b/, label: "possible Base64-encoded payload" },
+        // Zero-width characters (U+200B, U+200C, U+200D, U+FEFF)
+        { pattern: /\u200B|\u200C|\u200D|\uFEFF/, label: "hidden Unicode characters" }
+      ];
+      const issues = [];
+      for (const tool of tools) {
+        const textsToCheck = [
+          tool.description || "",
+          ...tool.inputSchema?.properties ? Object.values(tool.inputSchema.properties).map((p) => p.description || "") : []
+        ];
+        const combined = textsToCheck.join(" ");
+        for (const { pattern, label } of suspiciousPatterns) {
+          if (pattern.test(combined)) {
+            issues.push(`Tool "${tool.name}": ${label}`);
+          }
+        }
+      }
+      if (issues.length > 0) return { passed: false, details: issues.join("; ") };
+      return { passed: true, details: `${tools.length} tool(s) scanned \u2014 no injection patterns found` };
+    }
+  );
+  await test(
+    "security-tool-cross-reference",
+    "Tools do not reference other tools by name",
+    "security",
+    false,
+    "server/tools#data-types",
+    async () => {
+      if (!toolsListOk) return { passed: true, details: "Skipped: tools/list not available" };
+      const tools = cachedToolsList ?? [];
+      if (tools.length < 2)
+        return { passed: true, details: "Fewer than 2 tools \u2014 cross-reference check not applicable" };
+      const names = tools.map((t) => t.name).filter(Boolean);
+      const issues = [];
+      for (const tool of tools) {
+        const desc = (tool.description || "").toLowerCase();
+        for (const otherName of names) {
+          if (otherName === tool.name) continue;
+          if (desc.includes(otherName.toLowerCase())) {
+            issues.push(`Tool "${tool.name}" description references "${otherName}"`);
+          }
+        }
+      }
+      if (issues.length > 0) {
+        warnings.push(`Cross-tool references found: ${issues.join("; ")}`);
+        return { passed: false, details: issues.join("; ") };
+      }
+      return { passed: true, details: `${tools.length} tool(s) checked \u2014 no cross-references found` };
+    }
+  );
+  await test(
+    "security-error-no-stacktrace",
+    "Error responses do not leak stack traces",
+    "security",
+    false,
+    "basic",
+    async () => {
+      const errorResponses = [];
+      const errorPayloads = [
+        "{this is not valid json!!!",
+        JSON.stringify({ jsonrpc: "2.0", id: nextId(), method: "nonexistent/___crash___test___" }),
+        JSON.stringify({
+          jsonrpc: "2.0",
+          id: nextId(),
+          method: "tools/call",
+          params: { name: "___nonexistent___tool___" }
+        })
+      ];
+      for (const payload of errorPayloads) {
+        try {
+          const res = await request(backendUrl, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              Accept: "application/json, text/event-stream",
+              ...buildHeaders()
+            },
+            body: payload,
+            signal: AbortSignal.timeout(timeout)
+          });
+          const text = await res.body.text();
+          errorResponses.push(text);
+        } catch {
+        }
+      }
+      const issues = [];
+      for (const text of errorResponses) {
+        for (const pattern of STACK_TRACE_PATTERNS) {
+          if (pattern.test(text)) {
+            issues.push(`Response contains: ${pattern.source} (matched in: ${text.substring(0, 80)}...)`);
+            break;
+          }
+        }
+      }
+      if (issues.length > 0) return { passed: false, details: issues.slice(0, 3).join("; ") };
+      return {
+        passed: true,
+        details: `${errorResponses.length} error responses checked \u2014 no stack traces or sensitive data found`
+      };
+    }
+  );
+  await test(
+    "security-error-no-internal-ip",
+    "Error responses do not leak internal IPs",
+    "security",
+    false,
+    "basic",
+    async () => {
+      try {
+        const res = await request(backendUrl, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Accept: "application/json, text/event-stream",
+            ...buildHeaders()
+          },
+          body: JSON.stringify({ jsonrpc: "2.0", id: nextId(), method: "___trigger_error___" }),
+          signal: AbortSignal.timeout(timeout)
+        });
+        const text = await res.body.text();
+        for (const pattern of INTERNAL_IP_PATTERNS) {
+          const match = text.match(pattern);
+          if (match) {
+            return { passed: false, details: `Error response contains internal IP: ${match[0]}` };
+          }
+        }
+        return { passed: true, details: "No internal IP addresses found in error responses" };
+      } catch {
+        return { passed: true, details: "No response to check (connection error)" };
+      }
+    }
+  );
+  await test(
+    "security-rate-limiting",
+    "Rate limiting is enforced",
+    "security",
+    false,
+    "basic/transports#streamable-http",
+    async () => {
+      const burstSize = 50;
+      let got429 = false;
+      const promises = Array.from(
+        { length: burstSize },
+        () => mcpRequest(backendUrl, "ping", void 0, nextId, buildHeaders(), timeout).then((res) => {
+          if (res.statusCode === 429) got429 = true;
+          return res.statusCode;
+        }).catch(() => 0)
+      );
+      const statusCodes = await Promise.all(promises);
+      if (got429) {
+        return { passed: true, details: `Rate limiting detected (429 returned after ${burstSize} rapid requests)` };
+      }
+      const errorCount = statusCodes.filter((c) => c >= 500).length;
+      if (errorCount > burstSize / 2) {
+        return {
+          passed: false,
+          details: `Server returned ${errorCount}/${burstSize} 5xx errors under load \u2014 should return 429 instead of crashing`
+        };
+      }
+      return {
+        passed: false,
+        details: `No rate limiting detected (${burstSize} rapid requests all returned ${[...new Set(statusCodes)].join(",")})`
+      };
+    }
+  );
   await test(
     "transport-delete",
     "DELETE accepted or returns 405",