@yawlabs/mcp-compliance 0.8.0 → 0.9.0

package/dist/{chunk-DOIOJVEE.js → chunk-T26GLXNK.js}

@@ -1,6 +1,6 @@
 // src/runner.ts
 import { createRequire } from "module";
-import { request } from "undici";
+import { request as request2 } from "undici";
 
 // src/badge.ts
 import { createHash } from "crypto";
@@ -9,8 +9,8 @@ function urlHash(url) {
 }
 function generateBadge(url) {
   const hash = urlHash(url);
-  const imageUrl = `https://mcp.hosting/api/compliance/${hash}/badge`;
-  const reportUrl = `https://mcp.hosting/compliance/${hash}`;
+  const imageUrl = `https://mcp.hosting/api/compliance/ext/${hash}/badge`;
+  const reportUrl = `https://mcp.hosting/compliance/ext/${hash}`;
   return {
     imageUrl,
     reportUrl,
@@ -54,6 +54,307 @@ function computeScore(tests) {
   };
 }
 
+// src/transport/http.ts
+import { request } from "undici";
+
+// src/sse.ts
+function parseSSEResponse(text) {
+  const lines = text.split("\n");
+  let firstJsonRpcResponse = null;
+  let currentData = [];
+  function flushEvent() {
+    if (currentData.length === 0) return;
+    const data = currentData.join("\n");
+    currentData = [];
+    if (!data.trim()) return;
+    try {
+      const parsed = JSON.parse(data);
+      if (!firstJsonRpcResponse && parsed.jsonrpc === "2.0" && parsed.id !== void 0) {
+        firstJsonRpcResponse = parsed;
+      }
+    } catch {
+    }
+  }
+  for (const line of lines) {
+    if (line.startsWith("data:")) {
+      const content = line.slice(5);
+      currentData.push(content.startsWith(" ") ? content.slice(1) : content);
+    } else if (line.trim() === "") {
+      flushEvent();
+    }
+  }
+  flushEvent();
+  return firstJsonRpcResponse;
+}
+
+// src/transport/http.ts
+function createHttpTransport(opts) {
+  const { url } = opts;
+  const userHeaders = { ...opts.headers ?? {} };
+  let sessionId = null;
+  let protocolVersion = null;
+  function sessionHeaders() {
+    const h = { ...userHeaders };
+    if (sessionId) h["mcp-session-id"] = sessionId;
+    if (protocolVersion) h["mcp-protocol-version"] = protocolVersion;
+    return h;
+  }
+  function normalizeHeaders(raw) {
+    const out = {};
+    for (const [k, v] of Object.entries(raw)) {
+      if (typeof v === "string") out[k] = v;
+    }
+    return out;
+  }
+  async function doRawRequest(method, body, extraHeaders, timeout) {
+    const headers = {
+      Accept: "application/json, text/event-stream",
+      ...sessionHeaders(),
+      ...extraHeaders
+    };
+    if (body !== void 0 && !("Content-Type" in headers) && !("content-type" in headers)) {
+      headers["Content-Type"] = "application/json";
+    }
+    const res = await request(url, {
+      method,
+      headers,
+      body,
+      signal: AbortSignal.timeout(timeout)
+    });
+    const text = await res.body.text();
+    return {
+      statusCode: res.statusCode,
+      body: text,
+      headers: normalizeHeaders(res.headers)
+    };
+  }
+  const transport = {
+    kind: "http",
+    url,
+    async request(method, params, nextId, init) {
+      const id = nextId();
+      const body = JSON.stringify({ jsonrpc: "2.0", id, method, params: params ?? {} });
+      const raw = await doRawRequest("POST", body, init.headers ?? {}, init.timeout);
+      const contentType = (raw.headers["content-type"] || "").toLowerCase();
+      let parsed;
+      if (contentType.includes("text/event-stream")) {
+        const sseParsed = parseSSEResponse(raw.body);
+        if (sseParsed) {
+          parsed = sseParsed;
+        } else {
+          try {
+            parsed = JSON.parse(raw.body);
+          } catch {
+            parsed = { _raw: raw.body };
+          }
+        }
+      } else {
+        try {
+          parsed = JSON.parse(raw.body);
+        } catch {
+          parsed = { _raw: raw.body };
+        }
+      }
+      return {
+        body: parsed,
+        requestId: id,
+        statusCode: raw.statusCode,
+        headers: raw.headers
+      };
+    },
+    async notify(method, params, init) {
+      const body = JSON.stringify({ jsonrpc: "2.0", method, ...params ? { params } : {} });
+      const raw = await doRawRequest("POST", body, init.headers ?? {}, init.timeout);
+      return { statusCode: raw.statusCode, headers: raw.headers };
+    },
+    async close() {
+    },
+    setSessionId(id) {
+      sessionId = id;
+    },
+    setProtocolVersion(v) {
+      protocolVersion = v;
+    },
+    getSessionId() {
+      return sessionId;
+    },
+    getProtocolVersion() {
+      return protocolVersion;
+    },
+    rawPost(body, extraHeaders, timeout) {
+      return doRawRequest("POST", body, extraHeaders, timeout);
+    },
+    rawRequest(method, body, extraHeaders, timeout) {
+      return doRawRequest(method, body, extraHeaders, timeout);
+    }
+  };
+  return transport;
+}
+
+// src/transport/stdio.ts
+import { spawn } from "child_process";
+function createStdioTransport(opts) {
+  const { command, args = [], env, cwd, verbose = false } = opts;
+  const stderrBufferSize = opts.stderrBufferSize ?? 64 * 1024;
+  const isWindows = process.platform === "win32";
+  const child = spawn(command, args, {
+    env: env ? { ...process.env, ...env } : process.env,
+    cwd,
+    stdio: ["pipe", "pipe", "pipe"],
+    // Windows .cmd/.bat shims (npx, npm) need shell:true to launch.
+    shell: isWindows
+  });
+  let protocolVersion = null;
+  let exited = false;
+  let exitCode = null;
+  let spawnError = null;
+  const pending = /* @__PURE__ */ new Map();
+  let stdoutBuffer = "";
+  let stderrBuffer = "";
+  child.on("error", (err) => {
+    spawnError = err;
+    rejectAllPending(err);
+  });
+  child.on("exit", (code, signal) => {
+    exited = true;
+    exitCode = code;
+    if (pending.size > 0) {
+      const reason = signal ? `child exited (signal ${signal})` : `child exited with code ${code}`;
+      rejectAllPending(new Error(reason));
+    }
+  });
+  child.stdout?.setEncoding("utf8");
+  child.stdout?.on("data", (chunk) => {
+    stdoutBuffer += chunk;
+    let idx;
+    while ((idx = stdoutBuffer.indexOf("\n")) !== -1) {
+      const line = stdoutBuffer.slice(0, idx);
+      stdoutBuffer = stdoutBuffer.slice(idx + 1);
+      handleLine(line);
+    }
+  });
+  child.stderr?.setEncoding("utf8");
+  child.stderr?.on("data", (chunk) => {
+    if (verbose) process.stderr.write(chunk);
+    stderrBuffer += chunk;
+    if (stderrBuffer.length > stderrBufferSize) {
+      stderrBuffer = stderrBuffer.slice(stderrBuffer.length - stderrBufferSize);
+    }
+  });
+  function handleLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed) return;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      return;
+    }
+    if (!parsed || typeof parsed !== "object") return;
+    const msg = parsed;
+    if (typeof msg.id === "number" && pending.has(msg.id)) {
+      const p = pending.get(msg.id);
+      if (!p) return;
+      clearTimeout(p.timer);
+      pending.delete(msg.id);
+      p.resolve({ body: parsed, requestId: msg.id });
+    }
+  }
+  function rejectAllPending(err) {
+    for (const p of pending.values()) {
+      clearTimeout(p.timer);
+      p.reject(err);
+    }
+    pending.clear();
+  }
+  async function writeLine(line) {
+    if (exited) throw new Error("stdio transport: child has exited");
+    if (spawnError) throw new Error(`stdio transport: spawn failed \u2014 ${spawnError.message}`);
+    const stdin = child.stdin;
+    if (!stdin || stdin.destroyed) throw new Error("stdio transport: stdin is closed");
+    return new Promise((resolve, reject) => {
+      stdin.write(`${line}
+`, "utf8", (err) => err ? reject(err) : resolve());
+    });
+  }
+  const transport = {
+    kind: "stdio",
+    command,
+    args,
+    get pid() {
+      return child.pid;
+    },
+    get exited() {
+      return exited;
+    },
+    get exitCode() {
+      return exitCode;
+    },
+    stderrTail() {
+      return stderrBuffer;
+    },
+    async request(method, params, nextId, init) {
+      const id = nextId();
+      const body = JSON.stringify({ jsonrpc: "2.0", id, method, params: params ?? {} });
+      return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+          pending.delete(id);
+          reject(new Error(`stdio transport: request timed out after ${init.timeout}ms (method=${method})`));
+        }, init.timeout);
+        pending.set(id, { resolve, reject, id, timer });
+        writeLine(body).catch((err) => {
+          clearTimeout(timer);
+          pending.delete(id);
+          reject(err);
+        });
+      });
+    },
+    async notify(method, params, _init) {
+      const body = JSON.stringify({ jsonrpc: "2.0", method, ...params ? { params } : {} });
+      await writeLine(body);
+      return {};
+    },
+    async close() {
+      if (exited) return;
+      try {
+        child.stdin?.end();
+      } catch {
+      }
+      const gracePeriodMs = 2e3;
+      await new Promise((resolve) => {
+        const timer = setTimeout(() => {
+          try {
+            child.kill("SIGKILL");
+          } catch {
+          }
+          resolve();
+        }, gracePeriodMs);
+        child.once("exit", () => {
+          clearTimeout(timer);
+          resolve();
+        });
+        try {
+          child.kill(isWindows ? void 0 : "SIGTERM");
+        } catch {
+        }
+      });
+      rejectAllPending(new Error("stdio transport: closed"));
+    },
+    setSessionId(_id) {
+    },
+    setProtocolVersion(v) {
+      protocolVersion = v;
+    },
+    getSessionId() {
+      return null;
+    },
+    getProtocolVersion() {
+      return protocolVersion;
+    }
+  };
+  return transport;
+}
+
 // src/types.ts
 var TEST_DEFINITIONS = [
   // ── Transport (13 tests) ─────────────────────────────────────────
@@ -174,6 +475,37 @@ var TEST_DEFINITIONS = [
     description: "Sends a request with Accept: text/event-stream and checks that SSE responses include the event: message field. Per spec, servers MUST set event: message for JSON-RPC messages in SSE streams.",
     recommendation: 'Include "event: message" before each "data:" line in your SSE responses. This is required by the MCP spec for JSON-RPC messages sent over SSE.'
   },
+  // ── Stdio transport (stdio-only) ─────────────────────────────────
+  {
+    id: "stdio-framing",
+    name: "Newline-delimited JSON framing",
+    category: "transport",
+    required: true,
+    specRef: "basic/transports#stdio",
+    description: "Fires several JSON-RPC requests in rapid succession and verifies the server frames each response with a trailing newline per the MCP stdio transport spec.",
+    recommendation: "Emit one JSON message per line on stdout, terminated by \\n. Do not split a single message across multiple lines or merge multiple messages onto one line.",
+    transports: ["stdio"]
+  },
+  {
+    id: "stdio-unicode",
+    name: "UTF-8 unicode roundtrip",
+    category: "transport",
+    required: false,
+    specRef: "basic/transports#stdio",
+    description: "Sends a request with non-ASCII (CJK + emoji) parameters and verifies the response preserves the characters. Catches byte-level encoding mistakes in framing/parsing.",
+    recommendation: "Decode stdin as UTF-8 and encode stdout as UTF-8. Avoid latin-1 or platform-default encodings on Windows. Most JSON libraries handle this correctly if you don't override defaults.",
+    transports: ["stdio"]
+  },
+  {
+    id: "stdio-unknown-method-recovers",
+    name: "Recovers after unknown method",
+    category: "transport",
+    required: false,
+    specRef: "basic/transports#stdio",
+    description: "Sends an unknown method, then a valid ping immediately after. Verifies the server returns a JSON-RPC error for the unknown method and continues serving the subsequent request without crashing.",
+    recommendation: "Return JSON-RPC error -32601 (Method not found) for unknown methods. Do not exit the process or disconnect \u2014 the client should be able to keep using the session after an error.",
+    transports: ["stdio"]
+  },
   // ── Lifecycle (17 tests) ─────────────────────────────────────────
   {
     id: "lifecycle-init",
@@ -859,127 +1191,97 @@ function createIdCounter(start = 0) {
   let id = start;
   return () => ++id;
 }
-function parseSSEResponse(text) {
-  const lines = text.split("\n");
-  let firstJsonRpcResponse = null;
-  let currentData = [];
-  function flushEvent() {
-    if (currentData.length === 0) return;
-    const data = currentData.join("\n");
-    currentData = [];
-    if (!data.trim()) return;
-    try {
-      const parsed = JSON.parse(data);
-      if (!firstJsonRpcResponse && parsed.jsonrpc === "2.0" && parsed.id !== void 0) {
-        firstJsonRpcResponse = parsed;
-      }
-    } catch {
-    }
-  }
-  for (const line of lines) {
-    if (line.startsWith("data:")) {
-      const content = line.slice(5);
-      currentData.push(content.startsWith(" ") ? content.slice(1) : content);
-    } else if (line.trim() === "") {
-      flushEvent();
-    }
-  }
-  flushEvent();
-  return firstJsonRpcResponse;
+var STDIO_INCOMPATIBLE_IDS = /* @__PURE__ */ new Set([
+  // Lifecycle tests that use raw undici for HTTP-specific checks
+  "lifecycle-string-id",
+  // Error tests that send hand-crafted malformed bytes via raw HTTP
+  // (JSON-RPC layer would reject them before they hit the wire). Could
+  // be reimplemented for stdio later by writing raw bytes to stdin.
+  "error-invalid-jsonrpc",
+  "error-invalid-json",
+  "error-parse-code",
+  "error-invalid-request-code",
+  // Security tests that are inherently HTTP-layer
+  "security-tls-required",
+  "security-oauth-metadata",
+  "security-token-in-uri",
+  "security-rate-limit",
+  "security-cors",
+  "security-origin-validation"
+]);
+function supportsTransport(def, kind) {
+  if (!def) return true;
+  if (def.transports) return def.transports.includes(kind);
+  if (kind === "http") return true;
+  if (def.category === "transport") return false;
+  if (STDIO_INCOMPATIBLE_IDS.has(def.id)) return false;
+  return true;
 }
-async function mcpRequest(backendUrl, method, params, nextId, extraHeaders, timeout) {
-  const id = nextId();
-  const body = JSON.stringify({
-    jsonrpc: "2.0",
-    id,
-    method,
-    params: params || {}
-  });
-  const headers = {
-    "Content-Type": "application/json",
-    Accept: "application/json, text/event-stream",
-    ...extraHeaders
-  };
-  const res = await request(backendUrl, {
-    method: "POST",
-    headers,
-    body,
-    signal: AbortSignal.timeout(timeout)
-  });
-  const text = await res.body.text();
-  const responseHeaders = {};
-  for (const [k, v] of Object.entries(res.headers)) {
-    if (typeof v === "string") responseHeaders[k] = v;
-  }
-  const contentType = (responseHeaders["content-type"] || "").toLowerCase();
-  if (contentType.includes("text/event-stream")) {
-    const parsed = parseSSEResponse(text);
-    if (parsed) {
-      return { statusCode: res.statusCode, body: parsed, headers: responseHeaders, requestId: id };
+function previewTests(opts = {}) {
+  const transport = opts.transport ?? "http";
+  return TEST_DEFINITIONS.filter((def) => {
+    if (!supportsTransport(def, transport)) return false;
+    if (opts.only?.length) {
+      if (!opts.only.includes(def.category) && !opts.only.includes(def.id)) return false;
     }
-    try {
-      return { statusCode: res.statusCode, body: JSON.parse(text), headers: responseHeaders, requestId: id };
-    } catch {
-      return { statusCode: res.statusCode, body: { _raw: text }, headers: responseHeaders, requestId: id };
+    if (opts.skip?.length) {
+      if (opts.skip.includes(def.category) || opts.skip.includes(def.id)) return false;
     }
-  }
-  try {
-    return { statusCode: res.statusCode, body: JSON.parse(text), headers: responseHeaders, requestId: id };
-  } catch {
-    return { statusCode: res.statusCode, body: { _raw: text }, headers: responseHeaders, requestId: id };
-  }
-}
-async function mcpNotification(backendUrl, method, params, extraHeaders, timeout) {
-  const headers = {
-    "Content-Type": "application/json",
-    Accept: "application/json, text/event-stream",
-    ...extraHeaders
-  };
-  const res = await request(backendUrl, {
-    method: "POST",
-    headers,
-    body: JSON.stringify({ jsonrpc: "2.0", method, ...params ? { params } : {} }),
-    signal: AbortSignal.timeout(timeout)
+    return true;
   });
-  await res.body.text();
-  const responseHeaders = {};
-  for (const [k, v] of Object.entries(res.headers)) {
-    if (typeof v === "string") responseHeaders[k] = v;
-  }
-  return { statusCode: res.statusCode, headers: responseHeaders };
 }
-async function runComplianceSuite(url, options = {}) {
-  try {
-    const parsed = new URL(url);
-    if (!["http:", "https:"].includes(parsed.protocol)) {
-      throw new Error("Only HTTP and HTTPS URLs are supported");
+async function runComplianceSuite(target, options = {}) {
+  const resolvedTarget = typeof target === "string" ? { type: "http", url: target, headers: options.headers } : target;
+  if (resolvedTarget.type === "http") {
+    try {
+      const parsed = new URL(resolvedTarget.url);
+      if (!["http:", "https:"].includes(parsed.protocol)) {
+        throw new Error("Only HTTP and HTTPS URLs are supported");
+      }
+    } catch (e) {
+      if (e instanceof Error && e.message.includes("Only HTTP")) throw e;
+      throw new Error(`Invalid URL: ${resolvedTarget.url}`);
     }
-  } catch (e) {
-    if (e instanceof Error && e.message.includes("Only HTTP")) throw e;
-    throw new Error(`Invalid URL: ${url}`);
+  } else if (!resolvedTarget.command) {
+    throw new Error("stdio target requires a command");
   }
-  const backendUrl = url;
+  const transport = resolvedTarget.type === "http" ? createHttpTransport({
+    url: resolvedTarget.url,
+    headers: resolvedTarget.headers ?? options.headers
+  }) : createStdioTransport({
+    command: resolvedTarget.command,
+    args: resolvedTarget.args,
+    env: resolvedTarget.env,
+    cwd: resolvedTarget.cwd,
+    verbose: resolvedTarget.verbose
+  });
+  const backendUrl = resolvedTarget.type === "http" ? resolvedTarget.url : "";
+  const userHeaders = resolvedTarget.type === "http" ? resolvedTarget.headers ?? options.headers ?? {} : {};
+  const displayUrl = resolvedTarget.type === "http" ? resolvedTarget.url : `stdio:${resolvedTarget.command}${resolvedTarget.args?.length ? ` ${resolvedTarget.args.join(" ")}` : ""}`;
   let serverReachable = true;
-  try {
-    const preflight = await request(backendUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        Accept: "application/json, text/event-stream",
-        ...options.headers
-      },
-      body: JSON.stringify({ jsonrpc: "2.0", id: 0, method: "ping" }),
-      signal: AbortSignal.timeout(Math.min(options.timeout || 15e3, 1e4))
-    });
-    await preflight.body.text();
-  } catch {
-    serverReachable = false;
+  if (resolvedTarget.type === "http") {
+    try {
+      const preflightTimeout = options.preflightTimeout ?? Math.min(options.timeout || 15e3, 1e4);
+      const preflight = await request2(resolvedTarget.url, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json, text/event-stream",
+          ...userHeaders
+        },
+        body: JSON.stringify({ jsonrpc: "2.0", id: 0, method: "ping" }),
+        signal: AbortSignal.timeout(preflightTimeout)
+      });
+      await preflight.body.text();
+    } catch {
+      serverReachable = false;
+    }
   }
   const tests = [];
   const warnings = [];
   if (!serverReachable) {
     warnings.push(
-      `Server at ${url} is unreachable \u2014 all tests will fail. Check the URL and ensure the server is running.`
+      `Server at ${displayUrl} is unreachable \u2014 all tests will fail. Check the URL or command and ensure the server is running.`
     );
   }
   const nextId = createIdCounter(1e3);
@@ -987,15 +1289,35 @@ async function runComplianceSuite(url, options = {}) {
   const retries = options.retries || 0;
   let sessionId = null;
   let negotiatedProtocolVersion = null;
-  const userHeaders = options.headers || {};
   function buildHeaders() {
     const h = { ...userHeaders };
     if (sessionId) h["mcp-session-id"] = sessionId;
     if (negotiatedProtocolVersion) h["mcp-protocol-version"] = negotiatedProtocolVersion;
     return h;
   }
+  async function mcpRequest(_backendUrl, method, params, idCounter, extraHeaders, timeoutMs) {
+    const res = await transport.request(method, params, idCounter, {
+      timeout: timeoutMs,
+      headers: extraHeaders
+    });
+    return {
+      statusCode: res.statusCode ?? 200,
+      body: res.body,
+      headers: res.headers ?? {},
+      requestId: res.requestId
+    };
+  }
+  async function mcpNotification(_backendUrl, method, params, extraHeaders, timeoutMs) {
+    const res = await transport.notify(method, params, {
+      timeout: timeoutMs,
+      headers: extraHeaders
+    });
+    return { statusCode: res.statusCode ?? 200, headers: res.headers ?? {} };
+  }
   const rpc = (method, params) => mcpRequest(backendUrl, method, params, nextId, buildHeaders(), timeout);
   function shouldRun(id, category) {
+    const def = TEST_DEFINITIONS_MAP.get(id);
+    if (!supportsTransport(def, transport.kind)) return false;
     if (options.only && options.only.length > 0) {
       return options.only.includes(category) || options.only.includes(id);
     }
@@ -1050,7 +1372,7 @@ async function runComplianceSuite(url, options = {}) {
     true,
     "basic/transports#streamable-http",
     async () => {
-      const res = await request(backendUrl, {
+      const res = await request2(backendUrl, {
         method: "POST",
         headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream", ...userHeaders },
         body: JSON.stringify({ jsonrpc: "2.0", id: 99901, method: "ping" }),
@@ -1082,7 +1404,7 @@ async function runComplianceSuite(url, options = {}) {
     true,
     "basic/transports#streamable-http",
     async () => {
-      const res = await request(backendUrl, {
+      const res = await request2(backendUrl, {
         method: "POST",
         headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream", ...userHeaders },
         body: JSON.stringify({ jsonrpc: "2.0", id: 99902, method: "ping" }),
@@ -1102,7 +1424,7 @@ async function runComplianceSuite(url, options = {}) {
     false,
     "basic/transports#streamable-http",
     async () => {
-      const res = await request(backendUrl, {
+      const res = await request2(backendUrl, {
         method: "POST",
         headers: { "Content-Type": "text/plain", Accept: "application/json, text/event-stream", ...userHeaders },
         body: JSON.stringify({ jsonrpc: "2.0", id: 99905, method: "ping" }),
@@ -1129,7 +1451,7 @@ async function runComplianceSuite(url, options = {}) {
     "basic/transports#streamable-http",
     async () => {
       const getHeaders = { Accept: "text/event-stream", ...buildHeaders() };
-      const res = await request(backendUrl, {
+      const res = await request2(backendUrl, {
         method: "GET",
         headers: getHeaders,
         signal: AbortSignal.timeout(timeout)
@@ -1166,7 +1488,7 @@ async function runComplianceSuite(url, options = {}) {
     true,
     "basic/transports#streamable-http",
     async () => {
-      const res = await request(backendUrl, {
+      const res = await request2(backendUrl, {
         method: "POST",
         headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream", ...userHeaders },
         body: JSON.stringify([
@@ -1206,8 +1528,14 @@ async function runComplianceSuite(url, options = {}) {
       serverInfo.version = result.serverInfo?.version || null;
       serverInfo.capabilities = result.capabilities || {};
       const sid = initRes.headers["mcp-session-id"];
-      if (sid) sessionId = sid;
-      if (result.protocolVersion) negotiatedProtocolVersion = result.protocolVersion;
+      if (sid) {
+        sessionId = sid;
+        transport.setSessionId(sid);
+      }
+      if (result.protocolVersion) {
+        negotiatedProtocolVersion = result.protocolVersion;
+        transport.setProtocolVersion(result.protocolVersion);
+      }
     }
   } catch {
   }
@@ -1215,6 +1543,9 @@ async function runComplianceSuite(url, options = {}) {
     await mcpNotification(backendUrl, "notifications/initialized", void 0, buildHeaders(), timeout);
   } catch {
   }
+  const hasTools = !!serverInfo.capabilities.tools;
+  const hasResources = !!serverInfo.capabilities.resources;
+  const hasPrompts = !!serverInfo.capabilities.prompts;
   await test(
     "lifecycle-init",
     "Initialize handshake",
@@ -1362,7 +1693,7 @@ async function runComplianceSuite(url, options = {}) {
   await test("lifecycle-string-id", "Supports string request IDs", "lifecycle", false, "basic", async () => {
     const stringId = "compliance-test-string-id";
     const body = JSON.stringify({ jsonrpc: "2.0", id: stringId, method: "ping", params: {} });
-    const res = await request(backendUrl, {
+    const res = await request2(backendUrl, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -1577,7 +1908,7 @@ async function runComplianceSuite(url, options = {}) {
         }
       });
       try {
-        const res = await request(backendUrl, {
+        const res = await request2(backendUrl, {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
@@ -1625,7 +1956,7 @@ async function runComplianceSuite(url, options = {}) {
     false,
     "basic/transports#streamable-http",
     async () => {
-      const res = await request(backendUrl, {
+      const res = await request2(backendUrl, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
@@ -1717,7 +2048,7 @@ async function runComplianceSuite(url, options = {}) {
       if (!sessionId) {
         return { passed: true, details: "No session ID \u2014 server-initiated messages not applicable" };
       }
-      const res = await request(backendUrl, {
+      const res = await request2(backendUrl, {
         method: "GET",
         headers: { Accept: "text/event-stream", ...buildHeaders() },
         signal: AbortSignal.timeout(Math.min(timeout, 3e3))
@@ -1752,7 +2083,7 @@ async function runComplianceSuite(url, options = {}) {
     async () => {
       const ids = [createIdCounter(99930)(), createIdCounter(99931)(), createIdCounter(99932)()];
       const promises = ids.map(
-        (id) => request(backendUrl, {
+        (id) => request2(backendUrl, {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
@@ -1798,7 +2129,7 @@ async function runComplianceSuite(url, options = {}) {
     false,
     "basic/transports#streamable-http",
     async () => {
-      const res = await request(backendUrl, {
+      const res = await request2(backendUrl, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
@@ -1827,7 +2158,6 @@ async function runComplianceSuite(url, options = {}) {
       return { passed: true, details: "SSE response empty or no data fields \u2014 check not applicable" };
     }
   );
-  const hasTools = !!serverInfo.capabilities.tools;
   let cachedToolsList = null;
   await test(
     "tools-list",
@@ -2071,8 +2401,8 @@ async function runComplianceSuite(url, options = {}) {
       }
     );
   }
-  const hasResources = !!serverInfo.capabilities.resources;
-  const hasSubscribe = !!serverInfo.capabilities.resources?.subscribe;
+  const resourcesCap = serverInfo.capabilities.resources;
+  const hasSubscribe = !!(typeof resourcesCap === "object" && resourcesCap !== null && "subscribe" in resourcesCap && resourcesCap.subscribe);
   if (hasResources) {
     let cachedResourcesList = null;
     await test(
@@ -2234,7 +2564,6 @@ async function runComplianceSuite(url, options = {}) {
       );
     }
   }
-  const hasPrompts = !!serverInfo.capabilities.prompts;
   if (hasPrompts) {
     let cachedPromptsList = null;
     await test(
@@ -2349,7 +2678,7 @@ async function runComplianceSuite(url, options = {}) {
     }
   );
   await test("error-invalid-jsonrpc", "Handles malformed JSON-RPC", "errors", true, "basic", async () => {
-    const res = await request(backendUrl, {
+    const res = await request2(backendUrl, {
       method: "POST",
       headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream", ...buildHeaders() },
       body: JSON.stringify({ not: "a valid jsonrpc message" }),
@@ -2372,7 +2701,7 @@ async function runComplianceSuite(url, options = {}) {
     return { passed: false, details: `HTTP ${res.statusCode} \u2014 expected JSON-RPC error or 4xx status` };
   });
   await test("error-invalid-json", "Handles invalid JSON body", "errors", false, "basic", async () => {
-    const res = await request(backendUrl, {
+    const res = await request2(backendUrl, {
       method: "POST",
       headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream", ...buildHeaders() },
       body: "{this is not valid json!!!",
@@ -2410,7 +2739,7 @@ async function runComplianceSuite(url, options = {}) {
     }
   );
   await test("error-parse-code", "Returns -32700 for invalid JSON", "errors", false, "basic", async () => {
-    const res = await request(backendUrl, {
+    const res = await request2(backendUrl, {
       method: "POST",
       headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream", ...buildHeaders() },
       body: "<<<not json>>>",
@@ -2433,7 +2762,7 @@ async function runComplianceSuite(url, options = {}) {
     return { passed: false, details: `HTTP ${res.statusCode} \u2014 expected error code -32700` };
   });
   await test("error-invalid-request-code", "Returns -32600 for invalid request", "errors", false, "basic", async () => {
-    const res = await request(backendUrl, {
+    const res = await request2(backendUrl, {
       method: "POST",
       headers: { "Content-Type": "application/json", Accept: "application/json, text/event-stream", ...buildHeaders() },
       body: JSON.stringify({ jsonrpc: "2.0", id: 99999 }),
@@ -2598,13 +2927,13 @@ async function runComplianceSuite(url, options = {}) {
     }
   );
   await test("security-tls-required", "Enforces HTTPS/TLS", "security", false, "basic/authorization", async () => {
-    const parsedUrl = new URL(url);
+    const parsedUrl = new URL(backendUrl);
     if (parsedUrl.protocol !== "https:") {
       return { passed: false, details: `Server URL uses ${parsedUrl.protocol} \u2014 production servers should use HTTPS` };
     }
-    const httpUrl = url.replace(/^https:/, "http:");
+    const httpUrl = backendUrl.replace(/^https:/, "http:");
     try {
-      const res = await request(httpUrl, {
+      const res = await request2(httpUrl, {
         method: "POST",
         headers: { "Content-Type": "application/json", Accept: "application/json" },
         body: JSON.stringify({ jsonrpc: "2.0", id: 99950, method: "ping" }),
@@ -2697,10 +3026,10 @@ async function runComplianceSuite(url, options = {}) {
       if (!hasAuth) {
         return { passed: true, details: "Skipped: server does not require auth" };
       }
-      const parsedUrl = new URL(url);
+      const parsedUrl = new URL(backendUrl);
       const prmUrl = `${parsedUrl.protocol}//${parsedUrl.host}/.well-known/oauth-protected-resource`;
       try {
-        const res = await request(prmUrl, {
+        const res = await request2(prmUrl, {
           method: "GET",
           headers: { Accept: "application/json" },
           signal: AbortSignal.timeout(Math.min(timeout, 5e3))
@@ -2725,7 +3054,7 @@ async function runComplianceSuite(url, options = {}) {
         }
         const legacyUrl = `${parsedUrl.protocol}//${parsedUrl.host}/.well-known/oauth-authorization-server`;
         try {
-          const legacyRes = await request(legacyUrl, {
+          const legacyRes = await request2(legacyUrl, {
             method: "GET",
             headers: { Accept: "application/json" },
             signal: AbortSignal.timeout(Math.min(timeout, 5e3))
@@ -2772,7 +3101,7 @@ async function runComplianceSuite(url, options = {}) {
       if (!token) {
         return { passed: true, details: "Skipped: could not extract token from auth header" };
       }
-      const uriWithToken = `${url}${url.includes("?") ? "&" : "?"}access_token=${encodeURIComponent(token)}`;
+      const uriWithToken = `${backendUrl}${backendUrl.includes("?") ? "&" : "?"}access_token=${encodeURIComponent(token)}`;
       try {
         const noAuthHeaders = {};
         if (sessionId) noAuthHeaders["mcp-session-id"] = sessionId;
@@ -2800,7 +3129,7 @@ async function runComplianceSuite(url, options = {}) {
     "basic/transports#streamable-http",
     async () => {
       try {
-        const res = await request(backendUrl, {
+        const res = await request2(backendUrl, {
           method: "OPTIONS",
           headers: {
             Origin: "https://evil.example.com",
@@ -2837,7 +3166,7 @@ async function runComplianceSuite(url, options = {}) {
     "basic/transports#streamable-http",
     async () => {
       try {
-        const res = await request(backendUrl, {
+        const res = await request2(backendUrl, {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
@@ -3007,7 +3336,7 @@ async function runComplianceSuite(url, options = {}) {
     async () => {
       const largeValue = "A".repeat(1048576);
       try {
-        const res = await request(backendUrl, {
+        const res = await request2(backendUrl, {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
@@ -3209,7 +3538,7 @@ async function runComplianceSuite(url, options = {}) {
       ];
       for (const payload of errorPayloads) {
         try {
-          const res = await request(backendUrl, {
+          const res = await request2(backendUrl, {
             method: "POST",
             headers: {
               "Content-Type": "application/json",
@@ -3248,7 +3577,7 @@ async function runComplianceSuite(url, options = {}) {
     "basic",
     async () => {
       try {
-        const res = await request(backendUrl, {
+        const res = await request2(backendUrl, {
           method: "POST",
           headers: {
             "Content-Type": "application/json",
@@ -3312,7 +3641,7 @@ async function runComplianceSuite(url, options = {}) {
     "basic/transports#streamable-http",
     async () => {
       const deleteHeaders = { ...buildHeaders() };
-      const res = await request(backendUrl, {
+      const res = await request2(backendUrl, {
         method: "DELETE",
         headers: deleteHeaders,
         signal: AbortSignal.timeout(timeout)
@@ -3353,17 +3682,81 @@ async function runComplianceSuite(url, options = {}) {
       return { passed: false, details: `HTTP ${res.statusCode}` };
     }
   );
-  const MAX_WARNINGS = 50;
+  await test(
+    "stdio-framing",
+    "Newline-delimited JSON framing",
+    "transport",
+    true,
+    "basic/transports#stdio",
+    async () => {
+      const results = await Promise.all(
+        Array.from({ length: 5 }, () => rpc("ping").catch((e) => ({ _err: e.message })))
+      );
+      const failed = results.filter((r) => "_err" in r);
+      if (failed.length) {
+        return { passed: false, details: `${failed.length}/5 rapid pings failed \u2014 framing likely broken` };
+      }
+      return { passed: true, details: "5/5 rapid pings returned cleanly" };
+    }
+  );
+  await test("stdio-unicode", "UTF-8 unicode roundtrip", "transport", false, "basic/transports#stdio", async () => {
+    const probe = "h\xE9llo \u4E16\u754C \u{1F680}";
+    if (hasTools && toolNames.length > 0) {
+      try {
+        const res2 = await rpc("tools/call", {
+          name: toolNames[0],
+          arguments: { message: probe, text: probe, input: probe, query: probe }
+        });
+        const serialized = JSON.stringify(res2.body);
+        if (serialized.includes(probe)) {
+          return { passed: true, details: "Unicode string round-tripped through tool call" };
+        }
+        return { passed: true, details: "Tool echoed something, but not the exact probe \u2014 likely still UTF-8-safe" };
+      } catch (err) {
+        return { passed: false, details: `tools/call threw \u2014 ${err instanceof Error ? err.message : String(err)}` };
+      }
+    }
+    const res = await rpc("tools/list");
+    if (res.body.error) {
+      return { passed: false, details: "tools/list returned error" };
+    }
+    return { passed: true, details: "tools/list returned successfully (no tools to probe with unicode)" };
+  });
+  await test(
+    "stdio-unknown-method-recovers",
+    "Recovers after unknown method",
+    "transport",
+    false,
+    "basic/transports#stdio",
+    async () => {
+      const errRes = await rpc("this/method/does/not/exist-xyzzy");
+      const errBody = errRes.body;
+      if (!errBody.error) {
+        return { passed: false, details: "Unknown method did not produce a JSON-RPC error" };
+      }
+      const okRes = await rpc("ping");
+      const okBody = okRes.body;
+      if (okBody.error) {
+        return {
+          passed: false,
+          details: "Server responded with error to ping after unknown method \u2014 may have desynced"
+        };
+      }
+      return { passed: true, details: "Unknown method returned JSON-RPC error; subsequent ping succeeded" };
+    }
+  );
+  const MAX_WARNINGS = 100;
   if (warnings.length > MAX_WARNINGS) {
     const truncated = warnings.length - MAX_WARNINGS;
     warnings.splice(MAX_WARNINGS, truncated, `... and ${truncated} more warning(s) suppressed`);
   }
   const { score, grade, overall, summary, categories } = computeScore(tests);
-  const badge = generateBadge(url);
+  const badge = generateBadge(displayUrl);
+  await transport.close();
   return {
     specVersion: SPEC_VERSION,
     toolVersion: TOOL_VERSION,
-    url,
+    url: displayUrl,
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     score,
     grade,
@@ -3387,9 +3780,10 @@ export {
   generateBadge,
   computeGrade,
   computeScore,
+  parseSSEResponse,
   TEST_DEFINITIONS,
   SPEC_VERSION,
   SPEC_BASE,
-  parseSSEResponse,
+  previewTests,
   runComplianceSuite
 };