mcp-medic 1.2.4 → 1.2.5

package/dist/checks/index.d.ts

@@ -6,6 +6,7 @@ export { sampleCallSimulationCheck } from './sample-call-simulation.js';
 export { securityUntrustedRemoteCheck } from './security-untrusted-remote.js';
 export { securityOverbroadPermissionsCheck } from './security-overbroad-permissions.js';
 export { securityPromptInjectionRiskCheck } from './security-prompt-injection-risk.js';
+export { securityHiddenUnicodeTagsCheck } from './security-hidden-unicode-tags.js';
 export { qualityToolNamesCheck } from './quality-tool-names.js';
 export { qualityToolDescriptionsCheck } from './quality-tool-descriptions.js';
 export { qualityToolOutputSchemaCheck } from './quality-tool-output-schema.js';

package/dist/checks/index.js

@@ -6,6 +6,7 @@ export { sampleCallSimulationCheck } from './sample-call-simulation.js';
 export { securityUntrustedRemoteCheck } from './security-untrusted-remote.js';
 export { securityOverbroadPermissionsCheck } from './security-overbroad-permissions.js';
 export { securityPromptInjectionRiskCheck } from './security-prompt-injection-risk.js';
+export { securityHiddenUnicodeTagsCheck } from './security-hidden-unicode-tags.js';
 export { qualityToolNamesCheck } from './quality-tool-names.js';
 export { qualityToolDescriptionsCheck } from './quality-tool-descriptions.js';
 export { qualityToolOutputSchemaCheck } from './quality-tool-output-schema.js';
@@ -22,6 +23,7 @@ import { sampleCallSimulationCheck } from './sample-call-simulation.js';
 import { securityUntrustedRemoteCheck } from './security-untrusted-remote.js';
 import { securityOverbroadPermissionsCheck } from './security-overbroad-permissions.js';
 import { securityPromptInjectionRiskCheck } from './security-prompt-injection-risk.js';
+import { securityHiddenUnicodeTagsCheck } from './security-hidden-unicode-tags.js';
 import { qualityToolNamesCheck } from './quality-tool-names.js';
 import { qualityToolDescriptionsCheck } from './quality-tool-descriptions.js';
 import { qualityToolOutputSchemaCheck } from './quality-tool-output-schema.js';
@@ -40,6 +42,7 @@ export const allChecks = [
     securityUntrustedRemoteCheck,
     securityOverbroadPermissionsCheck,
     securityPromptInjectionRiskCheck,
+    securityHiddenUnicodeTagsCheck,
     qualityToolNamesCheck,
     qualityToolDescriptionsCheck,
     qualityToolOutputSchemaCheck,

package/dist/checks/quality-resources.d.ts

@@ -1,8 +1,8 @@
 import type { Check } from '../types.js';
 /**
- * Inspects only what `resources/list` already returned (see
- * MCPConnection.resources, populated passively in src/protocol/connect.ts).
- * Never calls `resources/read` — that would be real content retrieval, out
- * of scope for a passive `check`.
+ * Inspects only what `resources/list` and `resources/templates/list` already
+ * returned (see MCPConnection.resources/resourceTemplates, populated
+ * passively in src/protocol/connect.ts). Never calls `resources/read` —
+ * that would be real content retrieval, out of scope for a passive `check`.
  */
 export declare const qualityResourcesCheck: Check;

package/dist/checks/quality-resources.js

@@ -1,80 +1,135 @@
 /**
- * Inspects only what `resources/list` already returned (see
- * MCPConnection.resources, populated passively in src/protocol/connect.ts).
- * Never calls `resources/read` — that would be real content retrieval, out
- * of scope for a passive `check`.
+ * Inspects only what `resources/list` and `resources/templates/list` already
+ * returned (see MCPConnection.resources/resourceTemplates, populated
+ * passively in src/protocol/connect.ts). Never calls `resources/read` —
+ * that would be real content retrieval, out of scope for a passive `check`.
  */
 export const qualityResourcesCheck = {
     id: 'quality.resource',
-    description: 'Flags duplicate/empty resource URIs, missing required names, and other resources/list quality issues.',
+    description: 'Flags duplicate/empty resource(-template) URIs, missing required names, and other resources/list quality issues.',
     run(connection) {
         const results = [];
         try {
             const resources = connection.resources;
-            if (!resources || !Array.isArray(resources)) {
-                return results;
-            }
-            const byUri = new Map();
-            for (const resource of resources) {
-                const uri = resource.uri;
-                if (typeof uri !== 'string' || uri.trim() === '') {
-                    results.push({
-                        checkId: 'quality.resource',
-                        severity: 'error',
-                        message: 'Resource has an empty or invalid "uri" — the MCP spec requires resources to have a URI.',
-                        serverName: connection.server.name,
-                        category: 'schema',
-                        details: { resource },
-                    });
-                    continue;
-                }
-                byUri.set(uri, (byUri.get(uri) ?? 0) + 1);
-                // Per the MCP spec's Resource type (extends BaseMetadata), "name" is
-                // a required field, not optional.
-                if (!resource.name || resource.name.trim() === '') {
-                    results.push({
-                        checkId: 'quality.resource',
-                        severity: 'error',
-                        message: `Resource "${uri}" is missing a "name" — required by the MCP spec's Resource type.`,
-                        serverName: connection.server.name,
-                        category: 'schema',
-                        details: { uri },
-                        suggestedFix: { description: `Add a "name" field to the resource at "${uri}".` },
-                    });
+            if (Array.isArray(resources)) {
+                const byUri = new Map();
+                for (const resource of resources) {
+                    const uri = resource.uri;
+                    if (typeof uri !== 'string' || uri.trim() === '') {
+                        results.push({
+                            checkId: 'quality.resource',
+                            severity: 'error',
+                            message: 'Resource has an empty or invalid "uri" — the MCP spec requires resources to have a URI.',
+                            serverName: connection.server.name,
+                            category: 'schema',
+                            details: { resource },
+                        });
+                        continue;
+                    }
+                    byUri.set(uri, (byUri.get(uri) ?? 0) + 1);
+                    // Per the MCP spec's Resource type (extends BaseMetadata), "name" is
+                    // a required field, not optional.
+                    if (!resource.name || resource.name.trim() === '') {
+                        results.push({
+                            checkId: 'quality.resource',
+                            severity: 'error',
+                            message: `Resource "${uri}" is missing a "name" — required by the MCP spec's Resource type.`,
+                            serverName: connection.server.name,
+                            category: 'schema',
+                            details: { uri },
+                            suggestedFix: { description: `Add a "name" field to the resource at "${uri}".` },
+                        });
+                    }
+                    // description is optional per spec — absence is a quality
+                    // recommendation, not a violation.
+                    if (!resource.description || resource.description.trim() === '') {
+                        results.push({
+                            checkId: 'quality.resource',
+                            severity: 'info',
+                            message: `Resource "${uri}" has no description, making it harder for an agent to know when to read it.`,
+                            serverName: connection.server.name,
+                            category: 'quality',
+                            details: { uri },
+                        });
+                    }
+                    if (resource.size !== undefined && (typeof resource.size !== 'number' || resource.size < 0)) {
+                        results.push({
+                            checkId: 'quality.resource',
+                            severity: 'warning',
+                            message: `Resource "${uri}" declares an invalid "size" (${JSON.stringify(resource.size)}) — size must be a non-negative number.`,
+                            serverName: connection.server.name,
+                            category: 'schema',
+                            details: { uri, size: resource.size },
+                        });
+                    }
                 }
-                // description is optional per spec — absence is a quality
-                // recommendation, not a violation.
-                if (!resource.description || resource.description.trim() === '') {
-                    results.push({
-                        checkId: 'quality.resource',
-                        severity: 'info',
-                        message: `Resource "${uri}" has no description, making it harder for an agent to know when to read it.`,
-                        serverName: connection.server.name,
-                        category: 'quality',
-                        details: { uri },
-                    });
-                }
-                if (resource.size !== undefined && (typeof resource.size !== 'number' || resource.size < 0)) {
-                    results.push({
-                        checkId: 'quality.resource',
-                        severity: 'warning',
-                        message: `Resource "${uri}" declares an invalid "size" (${JSON.stringify(resource.size)}) — size must be a non-negative number.`,
-                        serverName: connection.server.name,
-                        category: 'schema',
-                        details: { uri, size: resource.size },
-                    });
+                for (const [uri, count] of byUri) {
+                    if (count > 1) {
+                        results.push({
+                            checkId: 'quality.resource',
+                            severity: 'error',
+                            message: `Resource URI "${uri}" is declared ${count} times — resource URIs must be unique.`,
+                            serverName: connection.server.name,
+                            category: 'schema',
+                            details: { uri, duplicateCount: count },
+                        });
+                    }
                 }
             }
-            for (const [uri, count] of byUri) {
-                if (count > 1) {
-                    results.push({
-                        checkId: 'quality.resource',
-                        severity: 'error',
-                        message: `Resource URI "${uri}" is declared ${count} times — resource URIs must be unique.`,
-                        serverName: connection.server.name,
-                        category: 'schema',
-                        details: { uri, duplicateCount: count },
-                    });
+            const templates = connection.resourceTemplates;
+            if (Array.isArray(templates)) {
+                const byUriTemplate = new Map();
+                for (const template of templates) {
+                    const uriTemplate = template.uriTemplate;
+                    if (typeof uriTemplate !== 'string' || uriTemplate.trim() === '') {
+                        results.push({
+                            checkId: 'quality.resource',
+                            severity: 'error',
+                            message: 'Resource template has an empty or invalid "uriTemplate" — the MCP spec requires resource templates to have one.',
+                            serverName: connection.server.name,
+                            category: 'schema',
+                            details: { template },
+                        });
+                        continue;
+                    }
+                    byUriTemplate.set(uriTemplate, (byUriTemplate.get(uriTemplate) ?? 0) + 1);
+                    // Per the MCP spec's ResourceTemplate type (extends BaseMetadata),
+                    // "name" is a required field, not optional.
+                    if (!template.name || template.name.trim() === '') {
+                        results.push({
+                            checkId: 'quality.resource',
+                            severity: 'error',
+                            message: `Resource template "${uriTemplate}" is missing a "name" — required by the MCP spec's ResourceTemplate type.`,
+                            serverName: connection.server.name,
+                            category: 'schema',
+                            details: { uriTemplate },
+                            suggestedFix: { description: `Add a "name" field to the resource template "${uriTemplate}".` },
+                        });
+                    }
+                    // description is optional per spec — absence is a quality
+                    // recommendation, not a violation.
+                    if (!template.description || template.description.trim() === '') {
+                        results.push({
+                            checkId: 'quality.resource',
+                            severity: 'info',
+                            message: `Resource template "${uriTemplate}" has no description, making it harder for an agent to know when to use it.`,
+                            serverName: connection.server.name,
+                            category: 'quality',
+                            details: { uriTemplate },
+                        });
+                    }
+                }
+                for (const [uriTemplate, count] of byUriTemplate) {
+                    if (count > 1) {
+                        results.push({
+                            checkId: 'quality.resource',
+                            severity: 'error',
+                            message: `Resource template "${uriTemplate}" is declared ${count} times — resource template URIs must be unique.`,
+                            serverName: connection.server.name,
+                            category: 'schema',
+                            details: { uriTemplate, duplicateCount: count },
+                        });
+                    }
                 }
             }
         }

package/dist/checks/security-hidden-unicode-tags.d.ts

@@ -0,0 +1,2 @@
+import type { Check } from '../types.js';
+export declare const securityHiddenUnicodeTagsCheck: Check;

package/dist/checks/security-hidden-unicode-tags.js

@@ -0,0 +1,106 @@
+/**
+ * Unicode "Tags" block (U+E0000–U+E007F): originally drafted for invisible
+ * language tagging, deprecated, and now documented in the wild as a way to
+ * hide prompt-injection payloads inside MCP tool/resource/prompt metadata —
+ * the characters render as nothing in virtually every UI, but many LLM
+ * tokenizers still see and act on them. See e.g. "Unicode TAG-Block
+ * Concealment of Tool-Metadata Payloads in the Model Context Protocol"
+ * (arXiv:2607.05744).
+ *
+ * Unlike security.prompt-injection-risk's keyword matching (which only
+ * catches instructions written in plain, visible text), this check flags
+ * the mere PRESENCE of any codepoint in this block — there is no legitimate
+ * reason for it to appear in tool/resource/prompt metadata a human is
+ * meant to review, so this is treated as an error, not a heuristic
+ * judgment call.
+ */
+const HIDDEN_TAG_CHARACTERS = /[\u{E0000}-\u{E007F}]/u;
+function checkField(text, fieldLabel) {
+    if (typeof text !== 'string' || !HIDDEN_TAG_CHARACTERS.test(text))
+        return undefined;
+    const visible = text.replace(HIDDEN_TAG_CHARACTERS, '');
+    return { snippet: `${fieldLabel}: "${visible}" (+ ${[...text].filter((c) => HIDDEN_TAG_CHARACTERS.test(c)).length} hidden tag character(s))` };
+}
+export const securityHiddenUnicodeTagsCheck = {
+    id: 'security.hidden-unicode-tags',
+    description: 'Flags tool/resource/prompt names or descriptions containing invisible Unicode "Tag" characters (U+E0000-U+E007F) — a known technique for concealing prompt-injection payloads from human review.',
+    run(connection) {
+        const results = [];
+        try {
+            for (const tool of connection.tools ?? []) {
+                for (const [field, value] of [
+                    ['name', tool.name],
+                    ['title', tool.title],
+                    ['description', tool.description],
+                ]) {
+                    const found = checkField(value, field);
+                    if (found) {
+                        results.push({
+                            checkId: 'security.hidden-unicode-tags',
+                            severity: 'error',
+                            message: `Tool "${tool.name}" ${field} contains hidden Unicode tag characters — likely a concealed prompt-injection payload. ${found.snippet}`,
+                            serverName: connection.server.name,
+                            toolName: tool.name,
+                            category: 'security',
+                            confidence: 'high',
+                            details: { field },
+                            suggestedFix: { description: `Remove the hidden Unicode tag characters from this tool's ${field}, or treat this server as untrusted.` },
+                        });
+                    }
+                }
+            }
+            for (const resource of connection.resources ?? []) {
+                for (const [field, value] of [
+                    ['name', resource.name],
+                    ['title', resource.title],
+                    ['description', resource.description],
+                ]) {
+                    const found = checkField(value, field);
+                    if (found) {
+                        results.push({
+                            checkId: 'security.hidden-unicode-tags',
+                            severity: 'error',
+                            message: `Resource "${resource.uri}" ${field} contains hidden Unicode tag characters — likely a concealed prompt-injection payload. ${found.snippet}`,
+                            serverName: connection.server.name,
+                            category: 'security',
+                            confidence: 'high',
+                            details: { field, uri: resource.uri },
+                            suggestedFix: { description: `Remove the hidden Unicode tag characters from this resource's ${field}, or treat this server as untrusted.` },
+                        });
+                    }
+                }
+            }
+            for (const prompt of connection.prompts ?? []) {
+                for (const [field, value] of [
+                    ['name', prompt.name],
+                    ['title', prompt.title],
+                    ['description', prompt.description],
+                ]) {
+                    const found = checkField(value, field);
+                    if (found) {
+                        results.push({
+                            checkId: 'security.hidden-unicode-tags',
+                            severity: 'error',
+                            message: `Prompt "${prompt.name}" ${field} contains hidden Unicode tag characters — likely a concealed prompt-injection payload. ${found.snippet}`,
+                            serverName: connection.server.name,
+                            category: 'security',
+                            confidence: 'high',
+                            details: { field },
+                            suggestedFix: { description: `Remove the hidden Unicode tag characters from this prompt's ${field}, or treat this server as untrusted.` },
+                        });
+                    }
+                }
+            }
+        }
+        catch (err) {
+            results.push({
+                checkId: 'security.hidden-unicode-tags',
+                severity: 'error',
+                message: `check failed internally: ${err instanceof Error ? err.message : String(err)}`,
+                serverName: connection.server.name,
+                category: 'security',
+            });
+        }
+        return results;
+    },
+};

package/dist/protocol/connect.js

@@ -16,6 +16,13 @@ const CLIENT_INFO = { name: 'mcp-medic', version: readOwnVersion() };
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/** JSON-RPC -32601 ("Method not found"): many servers that declare the
+ * `resources` capability (for concrete resources/list) simply don't
+ * implement the optional `resources/templates/list` RPC — that's spec-
+ * compliant, not a capability error, so it must never be reported as one. */
+function isMethodNotFound(error) {
+    return messageOf(error).includes('(-32601)');
+}
 function logVerbose(options, message) {
     if (options?.onLog) {
         options.onLog(message);
@@ -55,6 +62,41 @@ function withTimeout(promise, timeoutMs, label) {
         });
     });
 }
+/** Defends against a misbehaving/malicious server that never stops returning
+ * a `nextCursor`, which would otherwise hang a passive `check` forever. No
+ * real MCP server should need anywhere near this many pages for a single
+ * `list` call. */
+const MAX_PAGINATION_PAGES = 1000;
+/**
+ * MCP's `tools/list`/`resources/list`/`resources/templates/list`/`prompts/list`
+ * all extend `PaginatedRequest`/`PaginatedResult` (optional `cursor` param,
+ * optional `nextCursor` in the response) — present since the client's
+ * earliest supported protocol version, not something new in 2026-07-28.
+ * A server with a large catalog can legitimately split it across pages;
+ * without this, mcp-medic would silently see only page 1 and under-report
+ * (or mis-score) everything after it. Fetches every page with the same
+ * request/response validation as a single call, then hands the merged
+ * `{ [arrayKey]: allItems }` to the existing per-item `normalize*` function
+ * unchanged.
+ */
+async function requestAllPages(transport, method, arrayKey, timeoutMs, nextId) {
+    const merged = [];
+    let cursor;
+    for (let page = 0; page < MAX_PAGINATION_PAGES; page++) {
+        const id = nextId();
+        const params = cursor !== undefined ? { cursor } : undefined;
+        const result = validateResponse(await withTimeout(transport.request(method, params), timeoutMs, method), id);
+        if (!Array.isArray(result[arrayKey])) {
+            throw new Error(`${method} response has no ${arrayKey} array`);
+        }
+        merged.push(...result[arrayKey]);
+        cursor = typeof result.nextCursor === 'string' ? result.nextCursor : undefined;
+        if (cursor === undefined) {
+            return { [arrayKey]: merged };
+        }
+    }
+    throw new Error(`${method} did not terminate pagination after ${MAX_PAGINATION_PAGES} pages`);
+}
 function validateResponse(response, expectedId) {
     if (!response || response.jsonrpc !== '2.0' || response.id !== expectedId) {
         throw new Error('invalid JSON-RPC response');
@@ -120,6 +162,26 @@ function normalizeResources(result) {
         };
     });
 }
+function normalizeResourceTemplates(result) {
+    if (!Array.isArray(result.resourceTemplates)) {
+        throw new Error('resources/templates/list response has no resourceTemplates array');
+    }
+    return result.resourceTemplates.map((template, index) => {
+        if (!template ||
+            typeof template !== 'object' ||
+            typeof template.uriTemplate !== 'string') {
+            throw new Error(`resources/templates/list returned an invalid template at index ${index}`);
+        }
+        const value = template;
+        return {
+            uriTemplate: value.uriTemplate,
+            ...(typeof value.name === 'string' ? { name: value.name } : {}),
+            ...(typeof value.title === 'string' ? { title: value.title } : {}),
+            ...(typeof value.description === 'string' ? { description: value.description } : {}),
+            ...(typeof value.mimeType === 'string' ? { mimeType: value.mimeType } : {}),
+        };
+    });
+}
 function normalizePromptArgument(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         return {};
@@ -488,12 +550,20 @@ export async function connect(config, timeoutMs, options) {
         let nextExpectedId = 1;
         let initialize;
         try {
+            // The id must be captured *before* the request settles, not as a
+            // trailing call argument evaluated after an `await` — if the awaited
+            // call throws (timeout, transport error), a trailing `nextExpectedId++`
+            // never runs at all, desyncing this counter from the ids the
+            // transport actually assigned to later requests. See the
+            // resources/templates/list addition in DECISIONS.md for how this
+            // surfaced.
+            const initializeId = nextExpectedId++;
             const response = await withTimeout(transport.request('initialize', {
                 protocolVersion: requestedVersion,
                 capabilities: {},
                 clientInfo: CLIENT_INFO,
             }), timeoutMs, 'initialize handshake');
-            initialize = validateResponse(response, nextExpectedId++);
+            initialize = validateResponse(response, initializeId);
             if (!initialize.capabilities || typeof initialize.capabilities !== 'object') {
                 throw new Error('initialize response has no capabilities object');
             }
@@ -529,7 +599,7 @@ export async function connect(config, timeoutMs, options) {
         }
         let tools;
         try {
-            tools = normalizeTools(validateResponse(await withTimeout(transport.request('tools/list'), timeoutMs, 'tools/list'), nextExpectedId++));
+            tools = normalizeTools(await requestAllPages(transport, 'tools/list', 'tools', timeoutMs, () => nextExpectedId++));
         }
         catch (error) {
             return failed(config, messageOf(error).includes('timed out') ? 'timeout' : 'failed', 'list-tools', messageOf(error), error, { protocolVersion, serverInfo });
@@ -542,19 +612,32 @@ export async function connect(config, timeoutMs, options) {
         // capability mcp-medic requires, so a broken resources/prompts listing
         // is reported alongside a still-successful connection.
         let resources;
+        let resourceTemplates;
         let prompts;
         const capabilityErrors = {};
         if (capabilities.resources && typeof capabilities.resources === 'object') {
             try {
-                resources = normalizeResources(validateResponse(await withTimeout(transport.request('resources/list'), timeoutMs, 'resources/list'), nextExpectedId++));
+                resources = normalizeResources(await requestAllPages(transport, 'resources/list', 'resources', timeoutMs, () => nextExpectedId++));
             }
             catch (error) {
                 capabilityErrors.resources = messageOf(error);
             }
+            // resources/templates/list is a distinct RPC governed by the same
+            // capability flag, but genuinely optional in practice — most servers
+            // that only expose concrete resources never implement it, and a
+            // "method not found" response for it is spec-compliant, not a defect.
+            try {
+                resourceTemplates = normalizeResourceTemplates(await requestAllPages(transport, 'resources/templates/list', 'resourceTemplates', timeoutMs, () => nextExpectedId++));
+            }
+            catch (error) {
+                if (!isMethodNotFound(error)) {
+                    capabilityErrors.resourceTemplates = messageOf(error);
+                }
+            }
         }
         if (capabilities.prompts && typeof capabilities.prompts === 'object') {
             try {
-                prompts = normalizePrompts(validateResponse(await withTimeout(transport.request('prompts/list'), timeoutMs, 'prompts/list'), nextExpectedId++));
+                prompts = normalizePrompts(await requestAllPages(transport, 'prompts/list', 'prompts', timeoutMs, () => nextExpectedId++));
             }
             catch (error) {
                 capabilityErrors.prompts = messageOf(error);
@@ -566,6 +649,7 @@ export async function connect(config, timeoutMs, options) {
             capabilities,
             tools,
             ...(resources !== undefined ? { resources } : {}),
+            ...(resourceTemplates !== undefined ? { resourceTemplates } : {}),
             ...(prompts !== undefined ? { prompts } : {}),
             ...(Object.keys(capabilityErrors).length > 0 ? { capabilityErrors } : {}),
             protocolVersion,

package/dist/report.js

@@ -58,6 +58,8 @@ export function formatReportHuman(report, options = {}) {
             const parts = [`${conn.tools.length} tool(s)`];
             if (conn.resources)
                 parts.push(`${conn.resources.length} resource(s)`);
+            if (conn.resourceTemplates)
+                parts.push(`${conn.resourceTemplates.length} resource template(s)`);
             if (conn.prompts)
                 parts.push(`${conn.prompts.length} prompt(s)`);
             lines.push(`  Capabilities: ${parts.join(', ')}`);
@@ -65,6 +67,9 @@ export function formatReportHuman(report, options = {}) {
         if (conn.capabilityErrors?.resources) {
             lines.push(`  resources/list: ${conn.capabilityErrors.resources}`);
         }
+        if (conn.capabilityErrors?.resourceTemplates) {
+            lines.push(`  resources/templates/list: ${conn.capabilityErrors.resourceTemplates}`);
+        }
         if (conn.capabilityErrors?.prompts) {
             lines.push(`  prompts/list: ${conn.capabilityErrors.prompts}`);
         }

package/dist/types.d.ts

@@ -43,6 +43,21 @@ export interface MCPResourceDefinition {
     mimeType?: string;
     size?: number;
 }
+/** MCP's `ResourceTemplate` (spec 2025-06-18+): a URI template (RFC 6570) a
+ * client can fill in to construct concrete resource URIs — a distinct RPC
+ * (`resources/templates/list`) from `resources/list`'s concrete instances,
+ * but governed by the same `capabilities.resources` flag. Common for
+ * servers that expose parameterized resources (e.g. `file://{path}`)
+ * rather than (or in addition to) a fixed list. */
+export interface MCPResourceTemplate {
+    uriTemplate: string;
+    /** Required by the spec's `BaseMetadata` — kept optional here for the
+     * same reason as `MCPResourceDefinition.name`. */
+    name?: string;
+    title?: string;
+    description?: string;
+    mimeType?: string;
+}
 export interface MCPPromptArgument {
     /** Required by the MCP spec's `PromptArgument` (extends `BaseMetadata`) —
      * kept optional here for the same reason as `MCPResourceDefinition.name`. */
@@ -76,12 +91,20 @@ export interface MCPConnection {
     tools?: MCPToolDefinition[];
     /** Populated only if the server's `initialize` response declared a `resources` capability. */
     resources?: MCPResourceDefinition[];
+    /** Populated only if the server's `initialize` response declared a `resources` capability
+     * (same flag as `resources` — the spec has no separate templates sub-capability) AND the
+     * server actually returned any templates. `resources/templates/list` is optional in
+     * practice: many servers only expose concrete resources, so an empty/absent result here
+     * is normal, not an error. */
+    resourceTemplates?: MCPResourceTemplate[];
     /** Populated only if the server's `initialize` response declared a `prompts` capability. */
     prompts?: MCPPromptDefinition[];
-    /** Best-effort failures from optional capability inspection (resources/prompts) — these
-     * never fail the overall connection, since `tools` is the one capability mcp-medic requires. */
+    /** Best-effort failures from optional capability inspection (resources/prompts/resource
+     * templates) — these never fail the overall connection, since `tools` is the one
+     * capability mcp-medic requires. */
     capabilityErrors?: {
         resources?: string;
+        resourceTemplates?: string;
         prompts?: string;
     };
     /** Set once an `initialize` response was received, even if negotiation was incompatible or a later stage failed. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-medic",
-  "version": "1.2.4",
+  "version": "1.2.5",
   "description": "Diagnose broken MCP (Model Context Protocol) server configs before they break your agent silently.",
   "type": "module",
   "main": "dist/index.js",