mcpprobe-scanner 0.2.0__py3-none-any.whl → 0.3.0__py3-none-any.whl

mcpprobe/__init__.py

@@ -13,7 +13,7 @@ The package is organised as follows:
 
 from __future__ import annotations
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 
 POLICY_URL = "https://mcpprobe.tech/scanning-policy"
 USER_AGENT = f"mcpprobe/{__version__} (+{POLICY_URL})"

mcpprobe/action.py

@@ -2,19 +2,40 @@
 
 GitHub passes action inputs as ``INPUT_<NAME>`` environment variables (name
 upper-cased, hyphens kept). This module turns them into a CLI invocation,
-always writes SARIF, records outputs in ``$GITHUB_OUTPUT`` and exits with the
-scanner's exit code (0 clean, 1 findings at or above ``fail-on``, 2 error).
+always writes SARIF, records outputs in ``$GITHUB_OUTPUT``, writes a job
+summary to ``$GITHUB_STEP_SUMMARY``, emits one workflow annotation that names
+the outcome, and exits with the scanner's exit code:
+
+- 0 clean (no finding at or above ``fail-on``)
+- 1 findings at or above ``fail-on``
+- 2 error (unreachable target, bad input, opt-out, authorisation refused)
+- 3 the target answered but is not an MCP server (wrong URL or path)
+
+For exit codes 2 and 3 the SARIF file contains no results. Uploading it to
+code scanning would close every open alert for the category, so workflows
+should upload only when ``result`` is ``clean`` or ``findings``.
 """
 
 from __future__ import annotations
 
+import json
 import os
 import shlex
 import sys
 from collections.abc import Mapping
 from pathlib import Path
+from typing import Any
 
-from mcpprobe.cli import EXIT_ERROR, main
+from mcpprobe.cli import EXIT_CLEAN, EXIT_ERROR, EXIT_FINDINGS, EXIT_NOT_MCP, main
+
+#: ``result`` output value for each exit code.
+RESULTS: dict[int, str] = {
+    EXIT_CLEAN: "clean",
+    EXIT_FINDINGS: "findings",
+    EXIT_ERROR: "error",
+    EXIT_NOT_MCP: "not-mcp",
+}
+_SEVERITIES = ("critical", "high", "medium", "low", "info")
 
 
 def _input(env: Mapping[str, str], name: str, default: str = "") -> str:
@@ -44,24 +65,110 @@ def build_argv(env: Mapping[str, str]) -> list[str]:
     return argv
 
 
+def _escape(text: str) -> str:
+    """Escape a workflow-command message (``%``, CR and LF must be encoded)."""
+    return text.replace("%", "%25").replace("\r", "%0D").replace("\n", "%0A")
+
+
+def _escape_property(text: str) -> str:
+    """Escape a workflow-command property value (also ``:`` and ``,``)."""
+    return _escape(text).replace(":", "%3A").replace(",", "%2C")
+
+
+def sarif_counts(path: Path) -> dict[str, int]:
+    """Count SARIF results per mcpprobe severity (empty when the file is missing or unreadable)."""
+    counts = dict.fromkeys(_SEVERITIES, 0)
+    try:
+        data: Any = json.loads(path.read_text(encoding="utf-8"))
+        for run in data.get("runs", []):
+            for result in run.get("results", []):
+                sev = str(result.get("properties", {}).get("severity", "info"))
+                counts[sev if sev in counts else "info"] += 1
+    except (OSError, ValueError, AttributeError):
+        return {}
+    return counts
+
+
+def describe(code: int, target: str, fail_on: str, counts: Mapping[str, int]) -> tuple[str, str, str]:
+    """Return (annotation level, title, message) for an exit code."""
+    total = sum(counts.values())
+    breakdown = ", ".join(f"{counts[s]} {s}" for s in _SEVERITIES if counts.get(s))
+    if code == EXIT_CLEAN:
+        found = f" ({breakdown} below the threshold)" if breakdown else ""
+        return "notice", "mcpprobe: passed", f"No finding at or above '{fail_on}' on {target}{found}."
+    if code == EXIT_FINDINGS:
+        return (
+            "error",
+            "mcpprobe: findings",
+            f"{total} finding(s) on {target} ({breakdown}); at least one is at or above '{fail_on}'. "
+            "See the job summary or the code scanning alerts.",
+        )
+    if code == EXIT_NOT_MCP:
+        return (
+            "error",
+            "mcpprobe: not an MCP server",
+            f"{target} answered, but not as an MCP server, so nothing was checked and nothing passed. "
+            "Check the URL and path (Streamable HTTP endpoints are usually /mcp) and that the "
+            "deployment is up. Do not upload this SARIF: it has no results and would close open alerts.",
+        )
+    return (
+        "error",
+        "mcpprobe: scan error",
+        f"The scan of {target} did not complete (exit {code}): the target was unreachable, an input "
+        "was invalid, the target opted out, or authorisation was refused. See the step log.",
+    )
+
+
+def _summary(code: int, target: str, fail_on: str, counts: Mapping[str, int], message: str) -> str:
+    lines = [
+        "## mcpprobe MCP security scan",
+        "",
+        f"**Target:** `{target}`  ",
+        f"**Result:** {RESULTS.get(code, 'error')} (exit {code}, fail-on `{fail_on}`)",
+        "",
+        message,
+        "",
+    ]
+    if code in (EXIT_CLEAN, EXIT_FINDINGS) and counts:
+        lines += ["| Severity | Findings |", "|---|---|"]
+        lines += [f"| {s} | {counts[s]} |" for s in _SEVERITIES]
+        lines.append("")
+    lines.append(
+        "Docs: https://mcpprobe.tech · checks: https://github.com/mcpprobe-dev/mcpprobe/blob/main/CHECKS.md"
+    )
+    return "\n".join(lines) + "\n"
+
+
 def run(env: Mapping[str, str] | None = None) -> int:
     env = os.environ if env is None else env
     try:
         argv = build_argv(env)
     except ValueError as exc:
-        print(f"::error::{exc}", file=sys.stderr)
+        print(
+            f"::error title={_escape_property('mcpprobe: bad input')}::{_escape(str(exc))}", file=sys.stderr
+        )
         return EXIT_ERROR
     code = EXIT_ERROR
     try:
         main(argv)
     except SystemExit as exc:
         code = exc.code if isinstance(exc.code, int) else EXIT_ERROR
+    target = argv[1]
+    fail_on = argv[argv.index("--fail-on") + 1]
+    sarif = argv[argv.index("--sarif") + 1]
+    counts = sarif_counts(Path(sarif))
+    level, title, message = describe(code, target, fail_on, counts)
+    print(f"::{level} title={_escape_property(title)}::{_escape(message)}", file=sys.stderr)
     out = env.get("GITHUB_OUTPUT")
     if out:
-        sarif = argv[argv.index("--sarif") + 1]
         with Path(out).open("a", encoding="utf-8") as fh:
-            fh.write(f"sarif-file={sarif}\n")
+            fh.write(f"sarif-file={sarif if Path(sarif).exists() else ''}\n")
             fh.write(f"exit-code={code}\n")
+            fh.write(f"result={RESULTS.get(code, 'error')}\n")
+    summary = env.get("GITHUB_STEP_SUMMARY")
+    if summary:
+        with Path(summary).open("a", encoding="utf-8") as fh:
+            fh.write(_summary(code, target, fail_on, counts, message))
     return code
 
 

mcpprobe/checks/__init__.py

@@ -31,7 +31,16 @@ from mcpprobe.checks.metadata import (
     Meta05SecretsInMetadata,
 )
 from mcpprobe.checks.poisoning import Meta01ToolDescriptionPoisoning
+from mcpprobe.checks.protocol_2026 import (
+    Auth05IssuerIdentification,
+    Auth06DynamicClientRegistration,
+    Trans06ServerDiscover,
+    Trans07UnadvertisedVersionAccepted,
+    Trans08HeaderBodyMismatch,
+    Trans09CachingHints,
+)
 from mcpprobe.checks.robustness import Dos01UnboundedConsumption, Err01VerboseErrors
+from mcpprobe.checks.tool_surface import Meta06ToolAnnotationLint, Meta07ToxicFlow
 from mcpprobe.checks.transport_conformance import (
     Trans01OriginValidation,
     Trans02ProtocolVersionHandling,
@@ -45,16 +54,24 @@ PASSIVE_CHECKS: list[type[Check]] = [
     Auth02MissingProtectedResourceMetadata,
     Auth03AuthorizationServerMetadata,
     Auth04TokenAudienceAndPassthrough,
+    Auth05IssuerIdentification,
+    Auth06DynamicClientRegistration,
     Trans01OriginValidation,
     Trans02ProtocolVersionHandling,
     Trans03SessionIdQuality,
     Trans04DeprecatedTransport,
     Trans05TlsAndHeaders,
+    Trans06ServerDiscover,
+    Trans07UnadvertisedVersionAccepted,
+    Trans08HeaderBodyMismatch,
+    Trans09CachingHints,
     Meta01ToolDescriptionPoisoning,
     Meta02RugPullBaseline,
     Meta03DangerousCapabilitySurface,
     Meta04SchemaHygiene,
     Meta05SecretsInMetadata,
+    Meta06ToolAnnotationLint,
+    Meta07ToxicFlow,
     Err01VerboseErrors,
     Dos01UnboundedConsumption,
 ]

mcpprobe/checks/auth.py

@@ -461,6 +461,10 @@ class Auth03AuthorizationServerMetadata(Check):
                 )
                 continue
             doc_proof = f"GET {doc_url} -> HTTP 200\n" + proof.indent(proof.pretty(doc))
+            # Shared with AUTH-05/AUTH-06, which read the same document and send nothing.
+            ctx.shared.setdefault("as_metadata", []).append(
+                {"issuer": issuer, "url": doc_url, "doc": doc, "evidence": responses[-1].evidence}
+            )
             methods = doc.get("code_challenge_methods_supported")
             if not isinstance(methods, list) or "S256" not in methods:
                 findings.append(
@@ -524,7 +528,8 @@ class Auth03AuthorizationServerMetadata(Check):
         if assessed == 0:
             raise NotApplicable(
                 "Every advertised authorization server is on a third-party host that was not "
-                "contacted (--no-follow-as or the host opted out); see scan notes."
+                "contacted (--no-follow-as or the host opted out); see scan notes.",
+                blocked=True,
             )
         return findings
 
@@ -690,7 +695,8 @@ class Auth04TokenAudienceAndPassthrough(Check):
             raise NotApplicable(
                 "The forged-token probes were answered with "
                 + ", ".join(f"HTTP {s}" if s else "no response" for s in statuses)
-                + " rather than 401/403, so token validation could not be observed."
+                + " rather than 401/403, so token validation could not be observed.",
+                blocked=True,
             )
         return findings
 

mcpprobe/checks/base.py

@@ -44,10 +44,13 @@ class NotApplicable(Exception):  # noqa: N818 - it is an outcome, not an error
     (e.g. ``"AUTH-01"``). A not-applicable check never counts as a pass.
     """
 
-    def __init__(self, reason: str, related_to: str | None = None) -> None:
+    def __init__(self, reason: str, related_to: str | None = None, *, blocked: bool = False) -> None:
         super().__init__(reason)
         self.reason = reason
         self.related_to = related_to
+        #: True when the behaviour exists but could not be observed (authentication,
+        #: rate limiting, a fetch the operator disabled), as opposed to being absent.
+        self.blocked = blocked
 
 
 @dataclass(slots=True)
@@ -140,9 +143,10 @@ class ScanContext:
                 "tools/list requires authentication and no credentials were supplied, so no tool "
                 "metadata could be read; re-run with --header 'Authorization: Bearer ...' to assess it.",
                 related_to=None,
+                blocked=True,
             )
         if inv.tools_error:
-            raise NotApplicable(f"the tool list could not be read ({inv.tools_error}).")
+            raise NotApplicable(f"the tool list could not be read ({inv.tools_error}).", blocked=True)
         raise NotApplicable(
             "the server lists no tools, prompts or resources, so there is no metadata to assess."
         )
@@ -166,6 +170,9 @@ class Check(abc.ABC):
     false_positive_notes: str = ""
     #: Default remediation text.
     fix: str = ""
+    #: When False (the default) a check that met an HTTP 429 the scanner could not wait
+    #: out is reported not applicable instead of drawing conclusions from it.
+    handles_rate_limit: bool = False
 
     @abc.abstractmethod
     async def run(self, ctx: ScanContext) -> list[Finding]:

mcpprobe/checks/capability.py

@@ -247,3 +247,109 @@ def arbitrary_capabilities(tool: dict[str, Any]) -> dict[str, str]:
 
 def classify_tools(tools: list[dict[str, Any]]) -> dict[str, Classification]:
     return {str(t.get("name", "")): classify_tool(t) for t in tools}
+
+
+# ----------------------------------------------------------------------------- toxic-flow roles (META-07)
+ROLE_PRIVATE = "private_data"
+ROLE_UNTRUSTED = "untrusted_content"
+ROLE_SEND = "external_send"
+
+#: Reading mail or messages: private data and, at the same time, content written by strangers.
+_INBOX_READ = re.compile(
+    r"\b(inbox|mailbox|unread|read\s*_?(e-?mails?|mail|messages?)|"
+    r"(list|get|search|fetch|retrieve)\s*_?(e-?mails?|mail|messages?))\b",
+    re.I,
+)
+#: Pulling content from the open web.
+_WEB_INTAKE = re.compile(
+    r"\b(fetch|browse|crawl|scrape|download|web\s*_?search|search\s*_?(the\s+)?web|"
+    r"(read|get|open|load)\s*_?(a\s+|the\s+)?(url|web\s*page|page|website)|rss|feed)\b",
+    re.I,
+)
+#: Moving data out of the server's own boundary.
+_SEND_OUT = re.compile(
+    r"\b(send|sends|post|posts|publish|tweet|webhook|notify|upload|transmit|forward|reply|"
+    r"smtp|share|e-?mail\s+(to|a|an)\b)",
+    re.I,
+)
+#: Verbs that make an e-mail or payment tool a write rather than a read.
+_MUTATING = re.compile(
+    r"\b(send|sends|post|charge|refund|pay|transfer|create|cancel|delete|update|write|forward|reply)\b",
+    re.I,
+)
+
+#: Classes that change or destroy state on their own (no verb needed).
+MUTATING_CLASSES: frozenset[str] = frozenset({"exec", "file_write", "database_write", "delete"})
+#: Classes that are writes only when a mutating verb is present.
+VERB_MUTATING_CLASSES: frozenset[str] = frozenset({"email", "payments"})
+_PRIVATE_LABEL = {
+    "file_read": "files",
+    "database_read": "a database",
+    "database_write": "a database",
+    "credentials": "credentials",
+}
+
+#: Classes that only read.
+READ_CLASSES: frozenset[str] = frozenset({"search", "file_read", "database_read"})
+
+
+def _plain_text(tool: dict[str, Any]) -> str:
+    """Name (with separators as spaces), title and description; parameter names excluded."""
+    name = str(tool.get("name", ""))
+    spaced = name.replace("_", " ").replace("-", " ").replace(".", " ")
+    return " ".join([name, spaced, str(tool.get("title") or ""), str(tool.get("description") or "")])
+
+
+def looks_mutating(tool: dict[str, Any], cls: Classification) -> bool:
+    """Whether the advertised capability changes state (used for annotation contradictions)."""
+    if ARBITRARY_EXEC in cls.arbitrary or ARBITRARY_FILE_WRITE in cls.arbitrary:
+        return True
+    if any(c in MUTATING_CLASSES for c in cls.classes):
+        return True
+    return any(c in VERB_MUTATING_CLASSES for c in cls.classes) and bool(_MUTATING.search(_plain_text(tool)))
+
+
+def looks_destructive(cls: Classification) -> bool:
+    """Execution, deletion and overwriting writes (destructiveHint:false would be wrong)."""
+    return (
+        ARBITRARY_EXEC in cls.arbitrary
+        or ARBITRARY_FILE_WRITE in cls.arbitrary
+        or any(c in MUTATING_CLASSES for c in cls.classes)
+    )
+
+
+def looks_read_only(tool: dict[str, Any], cls: Classification) -> bool:
+    """Only read classes matched and nothing suggests a write."""
+    return bool(cls.classes) and set(cls.classes) <= READ_CLASSES and not looks_mutating(tool, cls)
+
+
+def toxic_roles(tool: dict[str, Any], cls: Classification) -> dict[str, str]:
+    """Lethal-trifecta roles a tool can play, each with the reason (from its advertised metadata).
+
+    Arbitrary command execution plays all three (a shell reads local data, fetches
+    content and sends it anywhere); arbitrary file read is private data.
+    """
+    text = _plain_text(tool)
+    roles: dict[str, str] = {}
+    if ARBITRARY_EXEC in cls.arbitrary:
+        why = "arbitrary command execution (see META-03)"
+        return {ROLE_PRIVATE: why, ROLE_UNTRUSTED: why, ROLE_SEND: why}
+    classes = set(cls.classes)
+    if ARBITRARY_FILE_READ in cls.arbitrary:
+        roles[ROLE_PRIVATE] = "arbitrary file read (see META-03)"
+    elif classes & set(_PRIVATE_LABEL):
+        labels = sorted({_PRIVATE_LABEL[c] for c in classes & set(_PRIVATE_LABEL)})
+        roles[ROLE_PRIVATE] = "accesses " + " and ".join(labels)
+    inbox = _INBOX_READ.search(text) if "email" in classes else None
+    if inbox:
+        roles.setdefault(ROLE_PRIVATE, f"reads mail or messages ('{inbox.group(0)}')")
+        roles[ROLE_UNTRUSTED] = f"returns mail or messages written by others ('{inbox.group(0)}')"
+    if "network" in classes:
+        web = _WEB_INTAKE.search(text)
+        if web:
+            roles[ROLE_UNTRUSTED] = f"pulls content from the web ('{web.group(0)}')"
+    if classes & {"email", "network"}:
+        out = _SEND_OUT.search(text)
+        if out:
+            roles[ROLE_SEND] = f"sends data out ('{out.group(0).strip()}')"
+    return roles

mcpprobe/checks/metadata.py

@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import json
 import re
 from typing import Any
 
@@ -14,7 +13,6 @@ from mcpprobe.checks.capability import (
     ARBITRARY_FILE_READ,
     ARBITRARY_FILE_WRITE,
     DANGEROUS_CLASSES,
-    Classification,
     classify_tools,
 )
 from mcpprobe.checks.poisoning import collect_text_items
@@ -39,10 +37,13 @@ _CAPABILITY_LABEL = {
 def _tools_verify(ctx: ScanContext, jq: str, expect: str, check_id: str) -> str:
     if ctx.http is None:
         return proof.rescan(ctx.target, check_id, stdio=True)
+    modern = ctx.fingerprint.flavour == "stateless-2026"
     return proof.curl_rpc(
         ctx.target,
         "tools/list",
-        {},
+        proof.modern_params() if modern else {},
+        protocol_version="2026-07-28" if modern else "2025-11-25",
+        headers={"Mcp-Method": "tools/list"} if modern else None,
         include_headers=False,
         auth_placeholder=ctx.fingerprint.credentials_supplied,
         jq=jq,
@@ -58,7 +59,7 @@ def _require_tools(ctx: ScanContext) -> None:
 
 class Meta03DangerousCapabilitySurface(Check):
     id = "META-03"
-    title = "Dangerous tool capability exposed or annotations contradict it"
+    title = "Dangerous tool capability exposed"
     severity = Severity.HIGH
     standards = Standards(
         mcp=["MCP02:2025", "MCP05:2025"],
@@ -71,9 +72,9 @@ class Meta03DangerousCapabilitySurface(Check):
         "Tools that advertise arbitrary command execution, arbitrary file read or arbitrary file "
         "write (a shell/file capability selected by a free-form string argument with no enum, "
         "const or pattern) are rated high on their own and critical when the remote endpoint "
-        "needs no authentication. Declared annotations are cross-checked (a command tool marked "
-        "readOnlyHint:true is reported), and the remaining high-impact surface (network, e-mail, "
-        "credentials, payments) is summarised at low severity. Passive scanning sees the "
+        "needs no authentication. The remaining high-impact surface (network, e-mail, "
+        "credentials, payments) is summarised at low severity. Annotations that contradict the "
+        "capability are reported by META-06 (until 0.2 they were reported here). Passive scanning sees the "
         "advertised capability, not whether the implementation really executes: the rating is "
         "based on the name, description and schema, and no tool is called."
     )
@@ -87,8 +88,7 @@ class Meta03DangerousCapabilitySurface(Check):
     fix = (
         "For arbitrary command execution or file access: remove the tool, or sandbox it and "
         "replace the free-form argument with an allow-list (enum) of commands or files. "
-        "Annotations come after that. Make annotations truthful (destructiveHint:true for "
-        "anything that executes or deletes); they help a careful client warn the user but do "
+        "Annotations come after that (META-06); they help a careful client warn the user but do "
         "nothing about the risk."
     )
 
@@ -193,78 +193,7 @@ class Meta03DangerousCapabilitySurface(Check):
                 )
             )
 
-        # 2. Annotation contradictions (one finding listing every affected tool).
-        contradictions: dict[str, list[str]] = {}
-        for tool in ctx.inventory.tools:
-            name = str(tool.get("name", "?"))
-            cls: Classification = classes.get(name) or Classification(name=name)
-            ann = tool.get("annotations")
-            if not isinstance(ann, dict):
-                continue
-            problems: list[str] = []
-            looks = "command execution" if cls.arbitrary.get(ARBITRARY_EXEC) else cls.primary
-            if ann.get("readOnlyHint") is True and (cls.writes or ARBITRARY_EXEC in cls.arbitrary):
-                problems.append(f"readOnlyHint=true but tool looks like {looks}")
-            if ann.get("destructiveHint") is False and (
-                any(c in {"exec", "delete", "file_write", "database_write"} for c in cls.classes)
-                or ARBITRARY_EXEC in cls.arbitrary
-            ):
-                problems.append(f"destructiveHint=false but tool looks like {looks}")
-            if ann.get("openWorldHint") is False and "network" in cls.classes:
-                problems.append("openWorldHint=false but tool appears to make network requests")
-            if problems:
-                contradictions[name] = problems
-        if contradictions:
-            names = sorted(contradictions)
-            findings.append(
-                self.finding(
-                    title="Tool annotations contradict the tool's apparent capability",
-                    description="; ".join(f"Tool '{n}': " + "; ".join(contradictions[n]) for n in names)
-                    + ". Clients that trust annotations may skip the user's approval for these tools.",
-                    severity=Severity.MEDIUM,
-                    confidence=Confidence.MEDIUM,
-                    confidence_reason=(
-                        "The capability is inferred from keywords in the name, description and "
-                        "parameter names, which can misclassify a narrowly scoped tool."
-                    ),
-                    evidence=ev,
-                    excerpt=evidence_summary(
-                        ev, "; ".join(f"{n}: annotations={by_name[n].get('annotations')}" for n in names)
-                    ),
-                    location="tools[*].annotations",
-                    details={
-                        "tools": {
-                            n: {
-                                "problems": contradictions[n],
-                                "annotations": by_name[n].get("annotations"),
-                                "classes": classes[n].classes,
-                                "matched_terms": classes[n].matched_terms,
-                            }
-                            for n in names
-                        }
-                    },
-                    fix=(
-                        "Make annotations truthful: readOnlyHint only for tools with no side effects, "
-                        "destructiveHint:true for anything that deletes or executes, openWorldHint:true "
-                        "for tools that reach the network."
-                    ),
-                    affected=names,
-                    proof="\n\n".join(
-                        f"tools[{n}]:\n  description: {by_name[n].get('description', '')}\n"
-                        f"  annotations: {json.dumps(by_name[n].get('annotations'))}\n"
-                        + "\n".join(f"  - {p}" for p in contradictions[n])
-                        for n in names
-                    ),
-                    verify=_tools_verify(
-                        ctx,
-                        ".result.tools[] | {name, annotations}",
-                        "annotations that match each tool's behaviour",
-                        self.id,
-                    ),
-                )
-            )
-
-        # 3. Remaining high-impact surface (informational review prompt).
+        # 2. Remaining high-impact surface (informational review prompt).
         rest = {n: c.classes for n, c in classes.items() if c.dangerous and n not in arbitrary}
         by_class: dict[str, list[str]] = {}
         for n, cl in rest.items():

mcpprobe/checks/poisoning.py

@@ -595,10 +595,13 @@ def _verify(ctx: ScanContext, item: TextItem) -> str:
         return proof.rescan(ctx.target, "META-01", stdio=True)
     if item.kind in {"tool", "tool_param"}:
         jq = f'.result.tools[] | select(.name=="{item.owner}") | {{description, inputSchema}}'
+        modern = ctx.fingerprint.flavour == "stateless-2026"
         return proof.curl_rpc(
             ctx.target,
             "tools/list",
-            {},
+            proof.modern_params() if modern else {},
+            protocol_version="2026-07-28" if modern else "2025-11-25",
+            headers={"Mcp-Method": "tools/list"} if modern else None,
             include_headers=False,
             auth_placeholder=ctx.fingerprint.credentials_supplied,
             jq=jq,

mcpprobe/checks/proof.py

@@ -144,6 +144,15 @@ def curl_rpc(
     return line
 
 
+def modern_params(version: str = "2026-07-28", **extra: Any) -> dict[str, Any]:
+    """Params for a 2026-07-28 request: the required ``_meta`` plus ``extra``."""
+    meta = {
+        "io.modelcontextprotocol/protocolVersion": version,
+        "io.modelcontextprotocol/clientCapabilities": {},
+    }
+    return {**extra, "_meta": meta}
+
+
 def initialize_params(version: str = "2025-11-25") -> dict[str, Any]:
     return {"protocolVersion": version, "capabilities": {}, "clientInfo": VERIFY_CLIENT}