Tracking: 2026-07-28 spec conformance

[DaleSeo]

Epic tracking issue for reaching 100% conformance on the 2026-07-28 spec suite before the spec release on 2026-07-28.

Per-item status lives in the sub-issues below. The epic now links 31 work items: 28 dated-protocol implementation and conformance issues in the 2026-07-28 spec milestone, plus three extension work items tracked separately from the tier-scored core suite. All carry the 2026-07-28 label. The milestone adds the due date, while this epic provides context and discussion. Conformance-gap issues carry failing check IDs and a repro command. The public roadmap is ROADMAP.md.

Current snapshot

Measured by release CI on 2026-07-23 at main e660b80 (tagged rmcp-v3.0.0-beta.1) with @modelcontextprotocol/conformance@0.2.0-alpha.9:

• Server: 40/40 scenarios passing (114/114 checks)
• Client: 32/32 scenarios passing (380/380 checks)

Movement since the 2026-07-22 snapshot:

• ✅ The dated 2026-07-28 core suites remain 100% green on both server and client.
• ✅ feat: route SEP-2260 associated server requests to the originating SSE stream #1029 closed Implement SEP-2260: Server requests must associate with a client request #873 by enforcing SEP-2260 request association and routing associated server requests to the originating SSE stream.
• ✅ fix: use issuer for JWT client audience #1031 moved the informational auth/client-credentials-jwt extension scenario to 8/8 checks passing; auth/client-credentials-basic also passes 8/8.
• ✅ feat: add distributed Streamable HTTP event store #1024 added distributed Streamable HTTP event storage and cross-instance replay without changing the core conformance totals.
• 🚀 chore: release v3.0.0-beta.1 #964 published rmcp and rmcp-macros 3.0.0-beta.1; both release tags point at main e660b80.

For reference, the 2025-11-25 suite (0.1.16, npm latest) passes 100% on both server (30/30 + pending scenarios) and client (18/18 + legacy auth/2025-03-26-*).

Note that the 2026-07-28 suite is a per-version scenario set, not additive: 36 scenarios are shared with 2025-11-25, 36 are new, and 14 scenarios are dropped (initialize, ping, logging-set-level, resources-(un)subscribe, sse-retry, … — removals driven by SEP-2575/SEP-2577).

Extension coverage (informational)

Extension conformance is reported separately from the dated core 40-server / 32-client scenario suites. #1019 keeps these gaps visible in CI:

• ✅ Tasks Extension (SEP-2663): 9/9 runnable scenarios passing (35/35 checks); tasks-status-notifications is upstream-skipped (Implement SEP-2663: Tasks Extension #868 → feat: Implement SEP-2663 Tasks Extension #1020)
• ✅ Client authorization extensions: auth/client-credentials-basic 8/8 and auth/client-credentials-jwt 8/8; auth/enterprise-managed-authorization remains an expected 0/2 failure in the informational baseline (fix: use issuer for JWT client audience #1031)
• MCP Apps (SEP-1865): Implement SEP-1865: MCP Apps - Interactive User Interfaces for MCP #891
• Extensions framework (SEP-2133): Implement SEP-2133: Extensions framework for MCP #892

Full scenario matrix (snapshot, 2026-07-23)

Snapshot of the release CI run at main e660b80 with 0.2.0-alpha.9 — regenerate with the commands below rather than hand-editing. Live per-item status is in the sub-issues.

Server — 40/40 passing

Scenario	New in 2026-07-28	Checks	Status	Tracking
completion-complete		1/1	✅
tools-list		2/2	✅
tools-call-simple-text		1/1	✅
tools-call-image		1/1	✅
tools-call-audio		1/1	✅
tools-call-embedded-resource		1/1	✅
tools-call-mixed-content		1/1	✅
tools-call-error		1/1	✅
tools-call-with-progress		1/1	✅	#980 → #1005
server-sse-multiple-streams		1/1	✅
resources-list		1/1	✅
resources-read-text		1/1	✅
resources-read-binary		1/1	✅
resources-templates-read		1/1	✅
prompts-list		1/1	✅
prompts-get-simple		1/1	✅
prompts-get-with-args		1/1	✅
prompts-get-embedded-resource		1/1	✅
prompts-get-with-image		1/1	✅
dns-rebinding-protection		2/2	✅
json-schema-2020-12		7/7	✅	#1003 → #1018
sep-2164-resource-not-found	🆕	3/3	✅
caching	🆕	7/7	✅
http-header-validation	🆕	13/13	✅
http-custom-header-server-validation	🆕	9/9	✅ (was 0/5)	#979 → #997
server-stateless	🆕	30/30	✅	#869 → #973/#995/#1000; #1004 closed
input-required-result-basic-elicitation	🆕	2/2	✅
input-required-result-basic-sampling	🆕	2/2	✅
input-required-result-basic-list-roots	🆕	2/2	✅
input-required-result-request-state	🆕	2/2	✅
input-required-result-multiple-input-requests	🆕	2/2	✅
input-required-result-multi-round	🆕	3/3	✅
input-required-result-missing-input-response	🆕	1/1	✅
input-required-result-non-tool-request	🆕	2/2	✅
input-required-result-result-type	🆕	1/1	✅
input-required-result-unsupported-methods	🆕	1/1	✅
input-required-result-tampered-state	🆕	1/1	✅
input-required-result-capability-check	🆕	1/1	✅
input-required-result-ignore-extra-params	🆕	1/1	✅
input-required-result-validate-input	🆕	2/2	✅

Client — 32/32 passing

Check counts vary slightly between runs (the mock emits some checks conditionally); statuses are stable.

Scenario	New in 2026-07-28	Checks	Status	Tracking
tools_call		1/1	✅	#1002 → #1022
request-metadata	🆕	5/5	✅	#981 → #995
auth/metadata-default		13/13	✅
auth/metadata-var1		14/14	✅
auth/metadata-var2		14/14	✅
auth/metadata-var3		13/13	✅
auth/basic-cimd		12/12	✅
auth/scope-from-www-authenticate		14/14	✅
auth/scope-from-scopes-supported		14/14	✅
auth/scope-omitted-when-undefined		14/14	✅
auth/scope-step-up		30/30	✅	#877 → #888/#1022
auth/scope-retry-limit		12/12	✅
auth/token-endpoint-auth-basic		18/18	✅
auth/token-endpoint-auth-post		18/18	✅
auth/token-endpoint-auth-none		18/18	✅
auth/pre-registration		10/10	✅ (was 5/6)	#984 → #994
auth/resource-mismatch	🆕	2/2	✅
auth/offline-access-scope	🆕	12/12	✅	#1001 → #1008
auth/offline-access-not-supported	🆕	14/14	✅	#1001 → #1008
auth/authorization-server-migration	🆕	31/31	✅	#879 → #998/#1011
auth/iss-supported	🆕	14/14	✅	#1001 → #1008
auth/iss-not-advertised	🆕	14/14	✅	#1001 → #1008
auth/iss-supported-missing	🆕	8/8	✅	#1001 → #1008
auth/iss-wrong-issuer	🆕	8/8	✅	#1001 → #1008
auth/iss-unexpected	🆕	8/8	✅	#1001 → #1008
auth/iss-normalized	🆕	8/8	✅	#1001 → #1008
auth/metadata-issuer-mismatch	🆕	3/3	✅ — #996 verified	#983 → #996/#1008
sep-2322-client-request-state	🆕	5/5	✅
http-standard-headers	🆕	3/3	✅	#978 → #1012
http-custom-headers	🆕	18/18	✅	#978 → #1012
http-invalid-tool-headers	🆕	11/11	✅	#978 → #1012
json-schema-ref-no-deref	🆕	1/1	✅ (was timeout)	#1001 → #1008

Running the suites

The 2026-07-28 suite uses the stateless discovery lifecycle for its server scenarios. Since #999, requests negotiating that version are served statelessly even when legacy session mode is enabled; STATELESS=1 remains useful to make the conformance harness intent explicit. Pass --suite all on the server run too — the default "active" suite skips scenarios including server-stateless and caching.

cargo build -p mcp-conformance
STATELESS=1 PORT=8002 ./target/debug/conformance-server &
npx -y @modelcontextprotocol/conformance@0.2.0-alpha.9 server \
 --url http://127.0.0.1:8002/mcp --suite all --spec-version 2026-07-28 -o results
npx -y @modelcontextprotocol/conformance@0.2.0-alpha.9 client \
 --command ./target/debug/conformance-client --suite all --spec-version 2026-07-28 -o results-client

The suite is still alpha; re-baseline (and diff conformance list --spec-version 2026-07-28) on each version bump.

History

• 2026-07-13 baseline: server 37/40, client 24/32. Server gaps: tools-call-with-progress (Stateless streamable HTTP: tools/call with progress returns notification as response body #980), http-custom-header-server-validation (Implement SEP-2243: server-side custom header validation #979), server-stateless 2/28 (Implement SEP-2575: Make MCP Stateless #869).

• 2026-07-16: feat!: add server discovery and negotiation (SEP-2575) #973, feat: add modern client lifecycle modes (SEP-2575) #995, feat: accumulate client-side scopes during step-up authorization (SEP-2350) #888, fix(auth): validate discovered metadata issuer #996, and feat(conformance): add SEP-2243 header validation tool #997 merged. Server moved to 98/109 checks while remaining 37/40; client measured 15/32 because chore: update client conformance test scenarios #991 had orphaned eleven scenario mappings (Conformance client: auth scenarios unmapped since #991 dispatch change (blocks verifying SEP-2468/SEP-2352 fixes) #1001) and the legacy lifecycle lacked the required protocol-version header (Conformance client: legacy-lifecycle scenarios fail with -32020 missing MCP-Protocol-Version header at 2026-07-28 #1002).

• 2026-07-18: fix(auth): add an SDK path for pre-registered OAuth clients #994, feat(auth): bind DCR client credentials to issuing authorization server (SEP-2352) #998, and fix: enumerate conformance client scenarios #1008 merged; auth/pre-registration: new pre-registration-auth conformance check fails #984, Implement SEP-2352: Clarify authorization server binding and migration #879, and Conformance client: auth scenarios unmapped since #991 dispatch change (blocks verifying SEP-2468/SEP-2352 fixes) #1001 closed. Client moved 15/32 → 26/32. SEP-2468 now passes end-to-end; SEP-2352 is implemented but remains 15/16 because fix: enumerate conformance client scenarios #1008 shadows the dedicated migration harness path. Server remains 37/40.

• 2026-07-21: fix(server): serve draft-version requests statelessly per SEP-2567 #999, feat: add subscription listen streams (SEP-2575) #1000, fix: preserve negotiated progress responses #1005, chore: run full conformance CI suite #1010, fix: re-register after auth server change #1011, fix: pass SEP-2243 client conformance #1012, and fix: preserve JSON Schema 2020-12 keywords #1018 merged. Server reached 40/40 (114/114 checks); client reached 30/32 (360/363 checks, plus 1 warning). Only tools_call and auth/scope-step-up remain blocked by Conformance client: legacy-lifecycle scenarios fail with -32020 missing MCP-Protocol-Version header at 2026-07-28 #1002.

• 2026-07-22: fix: conformance tests for tools_call and auth/scope-step-up #1022 closed Conformance client: legacy-lifecycle scenarios fail with -32020 missing MCP-Protocol-Version header at 2026-07-28 #1002 and moved the client to 32/32 (380/380 checks), bringing both dated core suites to 100%. feat: Implement SEP-2663 Tasks Extension #1020 closed Implement SEP-2663: Tasks Extension #868 with 9/9 runnable Tasks-extension scenarios passing (35/35 checks); task status notifications remain upstream-skipped. feat: add client-side TTL-honoring response cache (SEP-2549) #1025 closed Implement client-side TTL-honoring cache (SEP-2549 follow-up) #974 with the SEP-2549 client response cache; conformance remains 100%.

• 2026-07-23: feat: route SEP-2260 associated server requests to the originating SSE stream #1029 closed the SEP-2260 gap (Implement SEP-2260: Server requests must associate with a client request #873), fix: use issuer for JWT client audience #1031 moved auth/client-credentials-jwt to 8/8 extension checks passing, and chore: release v3.0.0-beta.1 #964 published rmcp / rmcp-macros 3.0.0-beta.1 from main e660b80. Release CI kept the core suites at server 40/40 and client 32/32.

Out of scope here, tracked elsewhere

• Non-conformance Tier 1 requirements: VERSIONING.md, dependency update policy, documentation coverage (26/48 → 48/48) — see ROADMAP.md
• v3.0.0-beta.1 shipped via chore: release v3.0.0-beta.1 #964 on 2026-07-23. Stable v3.0.0 and the remaining non-conformance Tier 1 requirements are tracked separately. Migration guide: discussion Migrating to 3.0.0 #969.