feat: add client conformance testing by pcarleton · Pull Request #1360 · modelcontextprotocol/typescript-sdk

pcarleton · 2026-01-06T12:43:11Z

Adds client conformance testing support for the TypeScript SDK.

Once this is in, the plan will be to remove the typescript conformance example from the conformance repo, and have this be the source of truth for typescript-sdk conformance.

Changes

Add CIMD (Client-Initiated Metadata Discovery) URL support
Fix elicitation capability path (elicitation.form.applyDefaults)
Add client credentials auth scenario handlers (JWT and basic)
Add npm scripts for running conformance tests:
- pnpm run conformance:client - run client directly
- pnpm run test:conformance:client - run conformance tests (pass your own flags)
- pnpm run test:conformance:client:all - run all suites

Test Results

193 passed, 0 failed, 0 warnings across all 21 client scenarios.

This should be a test-only change so should not need a changeset / release.

Dependencies

Requires modelcontextprotocol/conformance#94 for --suite all support.

- Copy everything-client.ts and helpers from conformance repo - Add conformance:client npm script for running initialize scenario - Add GitHub Actions workflow (non-blocking with continue-on-error) - Use @modelcontextprotocol/client workspace package for imports

- Change tools-call to tools_call (underscore) - Change elicitation-defaults to elicitation-sep1034-client-defaults - Add sse-retry scenario handler - Update auth scenario names to match conformance suite: - auth/basic-dcr -> auth/basic-cimd - auth/basic-metadata-* -> auth/metadata-* - Add missing: auth/scope-retry-limit, auth/token-endpoint-auth-*, auth/client-credentials-* - Make tools_call handler actually call the add_numbers tool Test results: 188 passed, 9 failed, 1 warning (Known failures: elicitation defaults and client_credentials not yet supported) Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

Add dedicated handlers for auth/client-credentials-jwt and auth/client-credentials-basic scenarios using the SDK's ClientCredentialsProvider and PrivateKeyJwtProvider. These scenarios require special handling because they use the client_credentials OAuth grant type (machine-to-machine auth) instead of the authorization code flow used by other auth scenarios. The conformance runner passes context via MCP_CONFORMANCE_CONTEXT env var containing client_id, private_key_pem/client_secret as appropriate. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

changeset-bot · 2026-01-06T12:43:15Z

⚠️ No Changeset found

Latest commit: 038b773

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-01-06T12:43:48Z

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1360

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1360

commit: 038b773

bhosmer-ant

Review from Claude

Overall this looks good - clean architecture with the scenario handler registry pattern, good type safety with the Zod discriminated union for context parsing, and comprehensive coverage (193 tests across 21 scenarios). A few items to consider:

Issues

1. CI Workflow: Wrong cache type

.github/workflows/conformance.yml:21 uses cache: npm but the project uses pnpm:

 - uses: actions/setup-node@v4with:
node-version: 24cache: npm # Should be: cache: pnpm

This won't properly cache pnpm dependencies.

2. Lock file changes look suspicious

The pnpm-lock.yaml diff shows removal of entire catalog sections (runtimeClientOnly, partial runtimeServerOnly, vite-tsconfig-paths, etc.) that seem unrelated to adding two devDependencies. Worth verifying the lock file wasn't inadvertently regenerated in a way that removes needed entries.

3. Inconsistent error output

everything-client.ts mixes console.error (lines 398-406, 408-413) with logger.error/logger.debug. For consistency, consider using the logger throughout.

4. TODO comment should be tracked

withOAuthRetry.ts:30-31 has a TODO about incorporating retry logic into the SDK. Created #1370 to track this.

Minor Suggestions

The scripts use npx @modelcontextprotocol/conformance which downloads the package each run. For local development, consider adding it as a devDependency or documenting that first runs will be slower.

Nice work on getting all 21 scenarios passing!

bhosmer-ant

LGTM! idk if the claude comments are useful but fyi

- Change CI workflow cache from npm to pnpm - Use logger.error consistently instead of console.error - Regenerate pnpm-lock.yaml to fix spurious catalog deletions

This avoids downloading on every run and allows manual version bumps when new conformance tests are released.

The setup-node action with cache: pnpm requires pnpm to be installed first to locate the lockfile and cache directory.

pcarleton · 2026-01-08T18:18:55Z

1 more 1 more, sorry about that @bhosmer-ant

pcarleton · 2026-01-06T12:43:11Z

Adds client conformance testing support for the TypeScript SDK.

Once this is in, the plan will be to remove the typescript conformance example from the conformance repo, and have this be the source of truth for typescript-sdk conformance.

Changes

Add CIMD (Client-Initiated Metadata Discovery) URL support
Fix elicitation capability path (elicitation.form.applyDefaults)
Add client credentials auth scenario handlers (JWT and basic)
Add npm scripts for running conformance tests:
- pnpm run conformance:client - run client directly
- pnpm run test:conformance:client - run conformance tests (pass your own flags)
- pnpm run test:conformance:client:all - run all suites

Test Results

193 passed, 0 failed, 0 warnings across all 21 client scenarios.

This should be a test-only change so should not need a changeset / release.

Dependencies

Requires modelcontextprotocol/conformance#94 for --suite all support.

- Copy everything-client.ts and helpers from conformance repo - Add conformance:client npm script for running initialize scenario - Add GitHub Actions workflow (non-blocking with continue-on-error) - Use @modelcontextprotocol/client workspace package for imports

- Change tools-call to tools_call (underscore) - Change elicitation-defaults to elicitation-sep1034-client-defaults - Add sse-retry scenario handler - Update auth scenario names to match conformance suite: - auth/basic-dcr -> auth/basic-cimd - auth/basic-metadata-* -> auth/metadata-* - Add missing: auth/scope-retry-limit, auth/token-endpoint-auth-*, auth/client-credentials-* - Make tools_call handler actually call the add_numbers tool Test results: 188 passed, 9 failed, 1 warning (Known failures: elicitation defaults and client_credentials not yet supported) Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

Add dedicated handlers for auth/client-credentials-jwt and auth/client-credentials-basic scenarios using the SDK's ClientCredentialsProvider and PrivateKeyJwtProvider. These scenarios require special handling because they use the client_credentials OAuth grant type (machine-to-machine auth) instead of the authorization code flow used by other auth scenarios. The conformance runner passes context via MCP_CONFORMANCE_CONTEXT env var containing client_id, private_key_pem/client_secret as appropriate. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

changeset-bot · 2026-01-06T12:43:15Z

⚠️ No Changeset found

Latest commit: 038b773

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-01-06T12:43:48Z

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1360

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1360

commit: 038b773

bhosmer-ant

Review from Claude

Overall this looks good - clean architecture with the scenario handler registry pattern, good type safety with the Zod discriminated union for context parsing, and comprehensive coverage (193 tests across 21 scenarios). A few items to consider:

Issues

1. CI Workflow: Wrong cache type

.github/workflows/conformance.yml:21 uses cache: npm but the project uses pnpm:

 - uses: actions/setup-node@v4with:
node-version: 24cache: npm # Should be: cache: pnpm

This won't properly cache pnpm dependencies.

2. Lock file changes look suspicious

The pnpm-lock.yaml diff shows removal of entire catalog sections (runtimeClientOnly, partial runtimeServerOnly, vite-tsconfig-paths, etc.) that seem unrelated to adding two devDependencies. Worth verifying the lock file wasn't inadvertently regenerated in a way that removes needed entries.

3. Inconsistent error output

everything-client.ts mixes console.error (lines 398-406, 408-413) with logger.error/logger.debug. For consistency, consider using the logger throughout.

4. TODO comment should be tracked

withOAuthRetry.ts:30-31 has a TODO about incorporating retry logic into the SDK. Created #1370 to track this.

Minor Suggestions

The scripts use npx @modelcontextprotocol/conformance which downloads the package each run. For local development, consider adding it as a devDependency or documenting that first runs will be slower.

Nice work on getting all 21 scenarios passing!

bhosmer-ant

LGTM! idk if the claude comments are useful but fyi

- Change CI workflow cache from npm to pnpm - Use logger.error consistently instead of console.error - Regenerate pnpm-lock.yaml to fix spurious catalog deletions

This avoids downloading on every run and allows manual version bumps when new conformance tests are released.

The setup-node action with cache: pnpm requires pnpm to be installed first to locate the lockfile and cache directory.

pcarleton · 2026-01-08T18:18:55Z

1 more 1 more, sorry about that @bhosmer-ant

pcarleton · 2026-01-06T12:43:11Z

Adds client conformance testing support for the TypeScript SDK.

Once this is in, the plan will be to remove the typescript conformance example from the conformance repo, and have this be the source of truth for typescript-sdk conformance.

Changes

Add CIMD (Client-Initiated Metadata Discovery) URL support
Fix elicitation capability path (elicitation.form.applyDefaults)
Add client credentials auth scenario handlers (JWT and basic)
Add npm scripts for running conformance tests:
- pnpm run conformance:client - run client directly
- pnpm run test:conformance:client - run conformance tests (pass your own flags)
- pnpm run test:conformance:client:all - run all suites

Test Results

193 passed, 0 failed, 0 warnings across all 21 client scenarios.

This should be a test-only change so should not need a changeset / release.

Dependencies

Requires modelcontextprotocol/conformance#94 for --suite all support.

- Copy everything-client.ts and helpers from conformance repo - Add conformance:client npm script for running initialize scenario - Add GitHub Actions workflow (non-blocking with continue-on-error) - Use @modelcontextprotocol/client workspace package for imports

- Change tools-call to tools_call (underscore) - Change elicitation-defaults to elicitation-sep1034-client-defaults - Add sse-retry scenario handler - Update auth scenario names to match conformance suite: - auth/basic-dcr -> auth/basic-cimd - auth/basic-metadata-* -> auth/metadata-* - Add missing: auth/scope-retry-limit, auth/token-endpoint-auth-*, auth/client-credentials-* - Make tools_call handler actually call the add_numbers tool Test results: 188 passed, 9 failed, 1 warning (Known failures: elicitation defaults and client_credentials not yet supported) Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

Add dedicated handlers for auth/client-credentials-jwt and auth/client-credentials-basic scenarios using the SDK's ClientCredentialsProvider and PrivateKeyJwtProvider. These scenarios require special handling because they use the client_credentials OAuth grant type (machine-to-machine auth) instead of the authorization code flow used by other auth scenarios. The conformance runner passes context via MCP_CONFORMANCE_CONTEXT env var containing client_id, private_key_pem/client_secret as appropriate. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

changeset-bot · 2026-01-06T12:43:15Z

⚠️ No Changeset found

Latest commit: 038b773

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-01-06T12:43:48Z

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1360

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1360

commit: 038b773

bhosmer-ant

Review from Claude

Overall this looks good - clean architecture with the scenario handler registry pattern, good type safety with the Zod discriminated union for context parsing, and comprehensive coverage (193 tests across 21 scenarios). A few items to consider:

Issues

1. CI Workflow: Wrong cache type

.github/workflows/conformance.yml:21 uses cache: npm but the project uses pnpm:

 - uses: actions/setup-node@v4with:
node-version: 24cache: npm # Should be: cache: pnpm

This won't properly cache pnpm dependencies.

2. Lock file changes look suspicious

The pnpm-lock.yaml diff shows removal of entire catalog sections (runtimeClientOnly, partial runtimeServerOnly, vite-tsconfig-paths, etc.) that seem unrelated to adding two devDependencies. Worth verifying the lock file wasn't inadvertently regenerated in a way that removes needed entries.

3. Inconsistent error output

everything-client.ts mixes console.error (lines 398-406, 408-413) with logger.error/logger.debug. For consistency, consider using the logger throughout.

4. TODO comment should be tracked

withOAuthRetry.ts:30-31 has a TODO about incorporating retry logic into the SDK. Created #1370 to track this.

Minor Suggestions

The scripts use npx @modelcontextprotocol/conformance which downloads the package each run. For local development, consider adding it as a devDependency or documenting that first runs will be slower.

Nice work on getting all 21 scenarios passing!

bhosmer-ant

LGTM! idk if the claude comments are useful but fyi

- Change CI workflow cache from npm to pnpm - Use logger.error consistently instead of console.error - Regenerate pnpm-lock.yaml to fix spurious catalog deletions

This avoids downloading on every run and allows manual version bumps when new conformance tests are released.

The setup-node action with cache: pnpm requires pnpm to be installed first to locate the lockfile and cache directory.

pcarleton · 2026-01-08T18:18:55Z

1 more 1 more, sorry about that @bhosmer-ant

pcarleton · 2026-01-06T12:43:11Z

Adds client conformance testing support for the TypeScript SDK.

Once this is in, the plan will be to remove the typescript conformance example from the conformance repo, and have this be the source of truth for typescript-sdk conformance.

Changes

Add CIMD (Client-Initiated Metadata Discovery) URL support
Fix elicitation capability path (elicitation.form.applyDefaults)
Add client credentials auth scenario handlers (JWT and basic)
Add npm scripts for running conformance tests:
- pnpm run conformance:client - run client directly
- pnpm run test:conformance:client - run conformance tests (pass your own flags)
- pnpm run test:conformance:client:all - run all suites

Test Results

193 passed, 0 failed, 0 warnings across all 21 client scenarios.

This should be a test-only change so should not need a changeset / release.

Dependencies

Requires modelcontextprotocol/conformance#94 for --suite all support.

- Copy everything-client.ts and helpers from conformance repo - Add conformance:client npm script for running initialize scenario - Add GitHub Actions workflow (non-blocking with continue-on-error) - Use @modelcontextprotocol/client workspace package for imports

- Change tools-call to tools_call (underscore) - Change elicitation-defaults to elicitation-sep1034-client-defaults - Add sse-retry scenario handler - Update auth scenario names to match conformance suite: - auth/basic-dcr -> auth/basic-cimd - auth/basic-metadata-* -> auth/metadata-* - Add missing: auth/scope-retry-limit, auth/token-endpoint-auth-*, auth/client-credentials-* - Make tools_call handler actually call the add_numbers tool Test results: 188 passed, 9 failed, 1 warning (Known failures: elicitation defaults and client_credentials not yet supported) Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

Add dedicated handlers for auth/client-credentials-jwt and auth/client-credentials-basic scenarios using the SDK's ClientCredentialsProvider and PrivateKeyJwtProvider. These scenarios require special handling because they use the client_credentials OAuth grant type (machine-to-machine auth) instead of the authorization code flow used by other auth scenarios. The conformance runner passes context via MCP_CONFORMANCE_CONTEXT env var containing client_id, private_key_pem/client_secret as appropriate. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

changeset-bot · 2026-01-06T12:43:15Z

⚠️ No Changeset found

Latest commit: 038b773

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-01-06T12:43:48Z

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1360

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1360

commit: 038b773

bhosmer-ant

Review from Claude

Overall this looks good - clean architecture with the scenario handler registry pattern, good type safety with the Zod discriminated union for context parsing, and comprehensive coverage (193 tests across 21 scenarios). A few items to consider:

Issues

1. CI Workflow: Wrong cache type

.github/workflows/conformance.yml:21 uses cache: npm but the project uses pnpm:

 - uses: actions/setup-node@v4with:
node-version: 24cache: npm # Should be: cache: pnpm

This won't properly cache pnpm dependencies.

2. Lock file changes look suspicious

The pnpm-lock.yaml diff shows removal of entire catalog sections (runtimeClientOnly, partial runtimeServerOnly, vite-tsconfig-paths, etc.) that seem unrelated to adding two devDependencies. Worth verifying the lock file wasn't inadvertently regenerated in a way that removes needed entries.

3. Inconsistent error output

everything-client.ts mixes console.error (lines 398-406, 408-413) with logger.error/logger.debug. For consistency, consider using the logger throughout.

4. TODO comment should be tracked

withOAuthRetry.ts:30-31 has a TODO about incorporating retry logic into the SDK. Created #1370 to track this.

Minor Suggestions

The scripts use npx @modelcontextprotocol/conformance which downloads the package each run. For local development, consider adding it as a devDependency or documenting that first runs will be slower.

Nice work on getting all 21 scenarios passing!

bhosmer-ant

LGTM! idk if the claude comments are useful but fyi

- Change CI workflow cache from npm to pnpm - Use logger.error consistently instead of console.error - Regenerate pnpm-lock.yaml to fix spurious catalog deletions

This avoids downloading on every run and allows manual version bumps when new conformance tests are released.

The setup-node action with cache: pnpm requires pnpm to be installed first to locate the lockfile and cache directory.

pcarleton · 2026-01-08T18:18:55Z

1 more 1 more, sorry about that @bhosmer-ant

pcarleton · 2026-01-06T12:43:11Z

Adds client conformance testing support for the TypeScript SDK.

Once this is in, the plan will be to remove the typescript conformance example from the conformance repo, and have this be the source of truth for typescript-sdk conformance.

Changes

Add CIMD (Client-Initiated Metadata Discovery) URL support
Fix elicitation capability path (elicitation.form.applyDefaults)
Add client credentials auth scenario handlers (JWT and basic)
Add npm scripts for running conformance tests:
- pnpm run conformance:client - run client directly
- pnpm run test:conformance:client - run conformance tests (pass your own flags)
- pnpm run test:conformance:client:all - run all suites

Test Results

193 passed, 0 failed, 0 warnings across all 21 client scenarios.

This should be a test-only change so should not need a changeset / release.

Dependencies

Requires modelcontextprotocol/conformance#94 for --suite all support.

- Copy everything-client.ts and helpers from conformance repo - Add conformance:client npm script for running initialize scenario - Add GitHub Actions workflow (non-blocking with continue-on-error) - Use @modelcontextprotocol/client workspace package for imports

- Change tools-call to tools_call (underscore) - Change elicitation-defaults to elicitation-sep1034-client-defaults - Add sse-retry scenario handler - Update auth scenario names to match conformance suite: - auth/basic-dcr -> auth/basic-cimd - auth/basic-metadata-* -> auth/metadata-* - Add missing: auth/scope-retry-limit, auth/token-endpoint-auth-*, auth/client-credentials-* - Make tools_call handler actually call the add_numbers tool Test results: 188 passed, 9 failed, 1 warning (Known failures: elicitation defaults and client_credentials not yet supported) Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

Add dedicated handlers for auth/client-credentials-jwt and auth/client-credentials-basic scenarios using the SDK's ClientCredentialsProvider and PrivateKeyJwtProvider. These scenarios require special handling because they use the client_credentials OAuth grant type (machine-to-machine auth) instead of the authorization code flow used by other auth scenarios. The conformance runner passes context via MCP_CONFORMANCE_CONTEXT env var containing client_id, private_key_pem/client_secret as appropriate. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

changeset-bot · 2026-01-06T12:43:15Z

⚠️ No Changeset found

Latest commit: 038b773

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-01-06T12:43:48Z

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1360

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1360

commit: 038b773

bhosmer-ant

Review from Claude

Overall this looks good - clean architecture with the scenario handler registry pattern, good type safety with the Zod discriminated union for context parsing, and comprehensive coverage (193 tests across 21 scenarios). A few items to consider:

Issues

1. CI Workflow: Wrong cache type

.github/workflows/conformance.yml:21 uses cache: npm but the project uses pnpm:

 - uses: actions/setup-node@v4with:
node-version: 24cache: npm # Should be: cache: pnpm

This won't properly cache pnpm dependencies.

2. Lock file changes look suspicious

The pnpm-lock.yaml diff shows removal of entire catalog sections (runtimeClientOnly, partial runtimeServerOnly, vite-tsconfig-paths, etc.) that seem unrelated to adding two devDependencies. Worth verifying the lock file wasn't inadvertently regenerated in a way that removes needed entries.

3. Inconsistent error output

everything-client.ts mixes console.error (lines 398-406, 408-413) with logger.error/logger.debug. For consistency, consider using the logger throughout.

4. TODO comment should be tracked

withOAuthRetry.ts:30-31 has a TODO about incorporating retry logic into the SDK. Created #1370 to track this.

Minor Suggestions

The scripts use npx @modelcontextprotocol/conformance which downloads the package each run. For local development, consider adding it as a devDependency or documenting that first runs will be slower.

Nice work on getting all 21 scenarios passing!

bhosmer-ant

LGTM! idk if the claude comments are useful but fyi

- Change CI workflow cache from npm to pnpm - Use logger.error consistently instead of console.error - Regenerate pnpm-lock.yaml to fix spurious catalog deletions

This avoids downloading on every run and allows manual version bumps when new conformance tests are released.

The setup-node action with cache: pnpm requires pnpm to be installed first to locate the lockfile and cache directory.

pcarleton · 2026-01-08T18:18:55Z

1 more 1 more, sorry about that @bhosmer-ant

pcarleton · 2026-01-06T12:43:11Z

Adds client conformance testing support for the TypeScript SDK.

Once this is in, the plan will be to remove the typescript conformance example from the conformance repo, and have this be the source of truth for typescript-sdk conformance.

Changes

Add CIMD (Client-Initiated Metadata Discovery) URL support
Fix elicitation capability path (elicitation.form.applyDefaults)
Add client credentials auth scenario handlers (JWT and basic)
Add npm scripts for running conformance tests:
- pnpm run conformance:client - run client directly
- pnpm run test:conformance:client - run conformance tests (pass your own flags)
- pnpm run test:conformance:client:all - run all suites

Test Results

193 passed, 0 failed, 0 warnings across all 21 client scenarios.

This should be a test-only change so should not need a changeset / release.

Dependencies

Requires modelcontextprotocol/conformance#94 for --suite all support.

- Copy everything-client.ts and helpers from conformance repo - Add conformance:client npm script for running initialize scenario - Add GitHub Actions workflow (non-blocking with continue-on-error) - Use @modelcontextprotocol/client workspace package for imports

- Change tools-call to tools_call (underscore) - Change elicitation-defaults to elicitation-sep1034-client-defaults - Add sse-retry scenario handler - Update auth scenario names to match conformance suite: - auth/basic-dcr -> auth/basic-cimd - auth/basic-metadata-* -> auth/metadata-* - Add missing: auth/scope-retry-limit, auth/token-endpoint-auth-*, auth/client-credentials-* - Make tools_call handler actually call the add_numbers tool Test results: 188 passed, 9 failed, 1 warning (Known failures: elicitation defaults and client_credentials not yet supported) Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

Add dedicated handlers for auth/client-credentials-jwt and auth/client-credentials-basic scenarios using the SDK's ClientCredentialsProvider and PrivateKeyJwtProvider. These scenarios require special handling because they use the client_credentials OAuth grant type (machine-to-machine auth) instead of the authorization code flow used by other auth scenarios. The conformance runner passes context via MCP_CONFORMANCE_CONTEXT env var containing client_id, private_key_pem/client_secret as appropriate. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

changeset-bot · 2026-01-06T12:43:15Z

⚠️ No Changeset found

Latest commit: 038b773

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-01-06T12:43:48Z

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1360

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1360

commit: 038b773

bhosmer-ant

Review from Claude

Overall this looks good - clean architecture with the scenario handler registry pattern, good type safety with the Zod discriminated union for context parsing, and comprehensive coverage (193 tests across 21 scenarios). A few items to consider:

Issues

1. CI Workflow: Wrong cache type

.github/workflows/conformance.yml:21 uses cache: npm but the project uses pnpm:

 - uses: actions/setup-node@v4with:
node-version: 24cache: npm # Should be: cache: pnpm

This won't properly cache pnpm dependencies.

2. Lock file changes look suspicious

The pnpm-lock.yaml diff shows removal of entire catalog sections (runtimeClientOnly, partial runtimeServerOnly, vite-tsconfig-paths, etc.) that seem unrelated to adding two devDependencies. Worth verifying the lock file wasn't inadvertently regenerated in a way that removes needed entries.

3. Inconsistent error output

everything-client.ts mixes console.error (lines 398-406, 408-413) with logger.error/logger.debug. For consistency, consider using the logger throughout.

4. TODO comment should be tracked

withOAuthRetry.ts:30-31 has a TODO about incorporating retry logic into the SDK. Created #1370 to track this.

Minor Suggestions

The scripts use npx @modelcontextprotocol/conformance which downloads the package each run. For local development, consider adding it as a devDependency or documenting that first runs will be slower.

Nice work on getting all 21 scenarios passing!

bhosmer-ant

LGTM! idk if the claude comments are useful but fyi

- Change CI workflow cache from npm to pnpm - Use logger.error consistently instead of console.error - Regenerate pnpm-lock.yaml to fix spurious catalog deletions

This avoids downloading on every run and allows manual version bumps when new conformance tests are released.

The setup-node action with cache: pnpm requires pnpm to be installed first to locate the lockfile and cache directory.

pcarleton · 2026-01-08T18:18:55Z

1 more 1 more, sorry about that @bhosmer-ant

pcarleton · 2026-01-06T12:43:11Z

Adds client conformance testing support for the TypeScript SDK.

Once this is in, the plan will be to remove the typescript conformance example from the conformance repo, and have this be the source of truth for typescript-sdk conformance.

Changes

Add CIMD (Client-Initiated Metadata Discovery) URL support
Fix elicitation capability path (elicitation.form.applyDefaults)
Add client credentials auth scenario handlers (JWT and basic)
Add npm scripts for running conformance tests:
- pnpm run conformance:client - run client directly
- pnpm run test:conformance:client - run conformance tests (pass your own flags)
- pnpm run test:conformance:client:all - run all suites

Test Results

193 passed, 0 failed, 0 warnings across all 21 client scenarios.

This should be a test-only change so should not need a changeset / release.

Dependencies

Requires modelcontextprotocol/conformance#94 for --suite all support.

- Copy everything-client.ts and helpers from conformance repo - Add conformance:client npm script for running initialize scenario - Add GitHub Actions workflow (non-blocking with continue-on-error) - Use @modelcontextprotocol/client workspace package for imports

- Change tools-call to tools_call (underscore) - Change elicitation-defaults to elicitation-sep1034-client-defaults - Add sse-retry scenario handler - Update auth scenario names to match conformance suite: - auth/basic-dcr -> auth/basic-cimd - auth/basic-metadata-* -> auth/metadata-* - Add missing: auth/scope-retry-limit, auth/token-endpoint-auth-*, auth/client-credentials-* - Make tools_call handler actually call the add_numbers tool Test results: 188 passed, 9 failed, 1 warning (Known failures: elicitation defaults and client_credentials not yet supported) Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

Add dedicated handlers for auth/client-credentials-jwt and auth/client-credentials-basic scenarios using the SDK's ClientCredentialsProvider and PrivateKeyJwtProvider. These scenarios require special handling because they use the client_credentials OAuth grant type (machine-to-machine auth) instead of the authorization code flow used by other auth scenarios. The conformance runner passes context via MCP_CONFORMANCE_CONTEXT env var containing client_id, private_key_pem/client_secret as appropriate. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

changeset-bot · 2026-01-06T12:43:15Z

⚠️ No Changeset found

Latest commit: 038b773

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-01-06T12:43:48Z

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1360

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1360

commit: 038b773

bhosmer-ant

Review from Claude

Overall this looks good - clean architecture with the scenario handler registry pattern, good type safety with the Zod discriminated union for context parsing, and comprehensive coverage (193 tests across 21 scenarios). A few items to consider:

Issues

1. CI Workflow: Wrong cache type

.github/workflows/conformance.yml:21 uses cache: npm but the project uses pnpm:

 - uses: actions/setup-node@v4with:
node-version: 24cache: npm # Should be: cache: pnpm

This won't properly cache pnpm dependencies.

2. Lock file changes look suspicious

The pnpm-lock.yaml diff shows removal of entire catalog sections (runtimeClientOnly, partial runtimeServerOnly, vite-tsconfig-paths, etc.) that seem unrelated to adding two devDependencies. Worth verifying the lock file wasn't inadvertently regenerated in a way that removes needed entries.

3. Inconsistent error output

everything-client.ts mixes console.error (lines 398-406, 408-413) with logger.error/logger.debug. For consistency, consider using the logger throughout.

4. TODO comment should be tracked

withOAuthRetry.ts:30-31 has a TODO about incorporating retry logic into the SDK. Created #1370 to track this.

Minor Suggestions

The scripts use npx @modelcontextprotocol/conformance which downloads the package each run. For local development, consider adding it as a devDependency or documenting that first runs will be slower.

Nice work on getting all 21 scenarios passing!

bhosmer-ant

LGTM! idk if the claude comments are useful but fyi

- Change CI workflow cache from npm to pnpm - Use logger.error consistently instead of console.error - Regenerate pnpm-lock.yaml to fix spurious catalog deletions

This avoids downloading on every run and allows manual version bumps when new conformance tests are released.

The setup-node action with cache: pnpm requires pnpm to be installed first to locate the lockfile and cache directory.

pcarleton · 2026-01-08T18:18:55Z

1 more 1 more, sorry about that @bhosmer-ant

pcarleton · 2026-01-06T12:43:11Z

Adds client conformance testing support for the TypeScript SDK.

Once this is in, the plan will be to remove the typescript conformance example from the conformance repo, and have this be the source of truth for typescript-sdk conformance.

Changes

Add CIMD (Client-Initiated Metadata Discovery) URL support
Fix elicitation capability path (elicitation.form.applyDefaults)
Add client credentials auth scenario handlers (JWT and basic)
Add npm scripts for running conformance tests:
- pnpm run conformance:client - run client directly
- pnpm run test:conformance:client - run conformance tests (pass your own flags)
- pnpm run test:conformance:client:all - run all suites

Test Results

193 passed, 0 failed, 0 warnings across all 21 client scenarios.

This should be a test-only change so should not need a changeset / release.

Dependencies

Requires modelcontextprotocol/conformance#94 for --suite all support.

- Copy everything-client.ts and helpers from conformance repo - Add conformance:client npm script for running initialize scenario - Add GitHub Actions workflow (non-blocking with continue-on-error) - Use @modelcontextprotocol/client workspace package for imports

- Change tools-call to tools_call (underscore) - Change elicitation-defaults to elicitation-sep1034-client-defaults - Add sse-retry scenario handler - Update auth scenario names to match conformance suite: - auth/basic-dcr -> auth/basic-cimd - auth/basic-metadata-* -> auth/metadata-* - Add missing: auth/scope-retry-limit, auth/token-endpoint-auth-*, auth/client-credentials-* - Make tools_call handler actually call the add_numbers tool Test results: 188 passed, 9 failed, 1 warning (Known failures: elicitation defaults and client_credentials not yet supported) Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

Add dedicated handlers for auth/client-credentials-jwt and auth/client-credentials-basic scenarios using the SDK's ClientCredentialsProvider and PrivateKeyJwtProvider. These scenarios require special handling because they use the client_credentials OAuth grant type (machine-to-machine auth) instead of the authorization code flow used by other auth scenarios. The conformance runner passes context via MCP_CONFORMANCE_CONTEXT env var containing client_id, private_key_pem/client_secret as appropriate. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0

changeset-bot · 2026-01-06T12:43:15Z

⚠️ No Changeset found

Latest commit: 038b773

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

pkg-pr-new · 2026-01-06T12:43:48Z

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1360

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1360

commit: 038b773

bhosmer-ant

Review from Claude

Overall this looks good - clean architecture with the scenario handler registry pattern, good type safety with the Zod discriminated union for context parsing, and comprehensive coverage (193 tests across 21 scenarios). A few items to consider:

Issues

1. CI Workflow: Wrong cache type

.github/workflows/conformance.yml:21 uses cache: npm but the project uses pnpm:

 - uses: actions/setup-node@v4with:
node-version: 24cache: npm # Should be: cache: pnpm

This won't properly cache pnpm dependencies.

2. Lock file changes look suspicious

The pnpm-lock.yaml diff shows removal of entire catalog sections (runtimeClientOnly, partial runtimeServerOnly, vite-tsconfig-paths, etc.) that seem unrelated to adding two devDependencies. Worth verifying the lock file wasn't inadvertently regenerated in a way that removes needed entries.

3. Inconsistent error output

everything-client.ts mixes console.error (lines 398-406, 408-413) with logger.error/logger.debug. For consistency, consider using the logger throughout.

4. TODO comment should be tracked

withOAuthRetry.ts:30-31 has a TODO about incorporating retry logic into the SDK. Created #1370 to track this.

Minor Suggestions

The scripts use npx @modelcontextprotocol/conformance which downloads the package each run. For local development, consider adding it as a devDependency or documenting that first runs will be slower.

Nice work on getting all 21 scenarios passing!

bhosmer-ant

LGTM! idk if the claude comments are useful but fyi

- Change CI workflow cache from npm to pnpm - Use logger.error consistently instead of console.error - Regenerate pnpm-lock.yaml to fix spurious catalog deletions

This avoids downloading on every run and allows manual version bumps when new conformance tests are released.

The setup-node action with cache: pnpm requires pnpm to be installed first to locate the lockfile and cache directory.

pcarleton · 2026-01-08T18:18:55Z

1 more 1 more, sorry about that @bhosmer-ant

pcarleton added 5 commits January 6, 2026 12:29

fix: add CIMD URL support and correct elicitation capability path
261cbde

feat: add npm scripts for client conformance testing
27ca0a6

pcarleton requested a review from a team as a code owner January 6, 2026 12:43

github-advanced-securityAI found potential problems Jan 6, 2026
View reviewed changes

Comment thread.github/workflows/conformance.yml Fixed

pcarleton added 2 commits January 6, 2026 12:49

fix: add permissions block and use correct conformance test command
c181f76

fix: rename conformance scripts and remove devDependency
ce94b64

pcarleton requested review from KKonstantinov and bhosmer-ant January 6, 2026 16:05

bhosmer-ant reviewed Jan 8, 2026
View reviewed changes

bhosmer-ant mentioned this pull request Jan 8, 2026
Incorporate OAuth retry logic from conformance helpers into SDK #1370
Closed

bhosmer-ant previously approved these changes Jan 8, 2026
View reviewed changes

fix: address PR review comments
404374b
- Change CI workflow cache from npm to pnpm - Use logger.error consistently instead of console.error - Regenerate pnpm-lock.yaml to fix spurious catalog deletions

pcarleton dismissed bhosmer-ant’s stale review via 404374bJanuary 8, 2026 17:08

pcarleton requested a review from bhosmer-ant January 8, 2026 17:08

bhosmer-ant previously approved these changes Jan 8, 2026
View reviewed changes

fix: add conformance as pinned devDependency
e540a72
This avoids downloading on every run and allows manual version bumps when new conformance tests are released.

pcarleton dismissed bhosmer-ant’s stale review via e540a72January 8, 2026 18:15

fix: install pnpm before setup-node with cache
8ebf0b6
The setup-node action with cache: pnpm requires pnpm to be installed first to locate the lockfile and cache directory.

pcarleton enabled auto-merge (squash) January 8, 2026 18:18

pcarleton assigned bhosmer-ant Jan 8, 2026

bhosmer-ant approved these changes Jan 8, 2026
View reviewed changes

Merge branch 'main' into client-conformance-testing
038b773

pcarleton merged commit 1014d9f into mainJan 9, 2026
12 checks passed

pcarleton deleted the client-conformance-testing branch January 9, 2026 17:49

mozmo15 pushed a commit to mozmo15/typescript-sdk that referenced this pull request Mar 30, 2026
feat: add client conformance testing (modelcontextprotocol#1360)
2a9dd89