ID,Type,Section,Requirement,Tested,Notes
M001,MUST,1.1 JSON-RPC Message Format,"All messages MUST follow JSON-RPC 2.0 specification",,
M002,MUST,1.1.1 Request Format,"Requests MUST include a string or integer ID (not null)",,
M003,MUST,1.1.1 Request Format,"Request IDs MUST NOT be null",,
M004,MUST,1.1.1 Request Format,"Request IDs MUST NOT have been previously used by the requestor within the same session",,
M005,MUST,1.1.1 Request Format,"Requests MUST include a method string",,
M006,MUST,1.1.2 Response Format,"Responses MUST include the same ID as the corresponding request",,
M007,MUST,1.1.2 Response Format,"Responses MUST include either a result or an error (not both)",,
M008,MUST,1.1.2 Response Format,"Errors MUST include an error code and message",,
M009,MUST,1.1.3 Notification Format,"Notifications MUST NOT include an ID",,
M010,MUST,1.1.3 Notification Format,"Notifications MUST include a method string",,
M011,MUST,1.1.4 Batching,"Implementations MUST support receiving JSON-RPC batches",,
M012,MUST,1.2.1 STDIO Transport,"Client MUST launch the server as a subprocess",,
M013,MUST,1.2.1 STDIO Transport,"Server MUST read from stdin and write to stdout",,
M014,MUST,1.2.1 STDIO Transport,"Messages MUST be delimited by newlines",,
M015,MUST,1.2.1 STDIO Transport,"Messages MUST NOT contain embedded newlines",,
M016,MUST,1.2.1 STDIO Transport,"Server MUST NOT write anything to stdout that is not a valid MCP message",,
M017,MUST,1.2.1 STDIO Transport,"Client MUST NOT write anything to stdin that is not a valid MCP message",,
M018,MUST,1.2.2 Streamable HTTP Transport,"Server MUST provide a single HTTP endpoint supporting both POST and GET methods",,
M019,MUST,1.2.2 Streamable HTTP Transport,"Client MUST use HTTP POST to send messages",,
M020,MUST,1.2.2 Streamable HTTP Transport,"Client MUST include Accept header with both application/json and text/event-stream",,
M021,MUST,1.2.2 Streamable HTTP Transport,"Request body MUST be a single JSON-RPC message or batch",,
M022,MUST,1.2.2 Streamable HTTP Transport,"If sending only responses/notifications, server MUST return HTTP 202 Accepted with no body",,
M023,MUST,1.2.2 Streamable HTTP Transport,"If sending requests, server MUST return either Content-Type: text/event-stream or Content-Type: application/json",,
M024,MUST,1.2.2 Streamable HTTP Transport,"Client MUST include Accept header with text/event-stream for GET requests",,
M025,MUST,1.2.2 Streamable HTTP Transport,"Server MUST either return text/event-stream or HTTP 405 Method Not Allowed for GET requests",,
M026,MUST,1.2.2 Streamable HTTP Transport,"Server MUST NOT send responses on SSE stream unless resuming previous client request",,
M027,MUST,1.2.2 Streamable HTTP Transport,"Server MUST send each message on only one connected stream",,
M028,MUST,1.2.3 Session Management,"Session ID MUST only contain visible ASCII characters (0x21 to 0x7E)",,
M029,MUST,1.2.3 Session Management,"Clients MUST include session ID in all subsequent requests if provided",,
M030,MUST,1.3.1 Authorization,"Servers MUST return HTTP 401 Unauthorized when authorization is required",,
M031,MUST,1.3.2 OAuth Implementation,"MCP auth implementations MUST implement OAuth 2.1 with appropriate security",,
M032,MUST,1.3.2 OAuth Implementation,"Clients MUST implement OAuth 2.0 Authorization Server Metadata",,
M033,MUST,1.3.2 OAuth Implementation,"Clients MUST follow the OAuth 2.0 Authorization Server Metadata protocol",,
M034,MUST,1.3.3 Authorization Server Discovery,"Authorization base URL MUST be determined by discarding path components from MCP server URL",,
M035,MUST,1.3.3 Authorization Server Discovery,"For servers without metadata discovery, clients MUST use default endpoint paths",,
M036,MUST,1.3.4 Access Token Usage,"MCP clients MUST use Authorization request header field for access tokens",,
M037,MUST,1.3.4 Access Token Usage,"Access tokens MUST NOT be included in URI query string",,
M038,MUST,1.3.4 Access Token Usage,"Resource servers MUST validate access tokens and respond with HTTP 401 for invalid tokens",,
M039,MUST,1.4.1 Initialization,"Client MUST send initialize request as first interaction",,
M040,MUST,1.4.1 Initialization,"Initialize request MUST include protocol version, client capabilities, and client info",,
M041,MUST,1.4.1 Initialization,"Initialize request MUST NOT be part of a JSON-RPC batch",,
M042,MUST,1.4.1 Initialization,"Server MUST respond with protocol version, server capabilities, and server info",,
M043,MUST,1.4.1 Initialization,"After successful initialization, client MUST send initialized notification",,
M044,MUST,1.4.2 Version Negotiation,"Client MUST send a protocol version it supports",,
M045,MUST,1.4.2 Version Negotiation,"If server supports requested version, it MUST respond with same version",,
M046,MUST,1.4.2 Version Negotiation,"Otherwise, server MUST respond with another supported version",,
M047,MUST,1.4.3 Capability Negotiation,"Client and server MUST declare capabilities during initialization",,
M048,MUST,2.1.1 Resources Capabilities,"Servers supporting resources MUST declare resources capability",,
M049,MUST,2.1.2 Resources List,"Server response MUST include resources array",,
M050,MUST,2.1.2 Resources List,"Each resource MUST include uri and name",,
M051,MUST,2.1.3 Resource Content,"Server response MUST include contents array",,
M052,MUST,2.1.3 Resource Content,"Each content item MUST include uri and either text or blob",,
M053,MUST,2.1.4 Resource Templates,"Server response MUST include resourceTemplates array",,
M054,MUST,2.1.4 Resource Templates,"Each template MUST include uriTemplate",,
M055,MUST,2.1.5 Resource Subscriptions,"Server MUST send notifications/resources/updated when resource changes",,
M056,MUST,2.1.5 Resource Subscriptions,"Server MUST support subscribe capability to use this feature",,
M057,MUST,2.1.6 List Changed Notification,"Server MUST support listChanged capability to use this feature",,
M058,MUST,2.2.1 Prompts Capabilities,"Servers supporting prompts MUST declare prompts capability",,
M059,MUST,2.2.2 Prompts List,"Server response MUST include prompts array",,
M060,MUST,2.2.2 Prompts List,"Each prompt MUST include name",,
M061,MUST,2.2.3 Get Prompt,"Server response MUST include messages array",,
M062,MUST,2.2.3 Get Prompt,"Each message MUST include role and content",,
M063,MUST,2.2.3 Get Prompt,"Content MUST be one of: text, image, audio, or resource",,
M064,MUST,2.2.4 List Changed Notification,"Server MUST support listChanged capability to use this feature",,
M065,MUST,2.3.1 Tools Capabilities,"Servers supporting tools MUST declare tools capability",,
M066,MUST,2.3.2 Tools List,"Server response MUST include tools array",,
M067,MUST,2.3.2 Tools List,"Each tool MUST include name, description, inputSchema",,
M068,MUST,2.3.3 Tool Call,"Server response MUST include content array and isError flag",,
M069,MUST,2.3.3 Tool Call,"Each content item MUST be one of: text, image, audio, or resource",,
M070,MUST,2.3.4 List Changed Notification,"Server MUST support listChanged capability to use this feature",,
M071,MUST,3.1.1 Roots Capabilities,"Clients supporting roots MUST declare roots capability",,
M072,MUST,3.1.2 Roots List,"Client response MUST include roots array",,
M073,MUST,3.1.2 Roots List,"Each root MUST include uri",,
M074,MUST,3.1.3 List Changed Notification,"Client MUST send notifications/roots/list_changed when root list changes",,
M075,MUST,3.1.3 List Changed Notification,"Client MUST support listChanged capability to use this feature",,
M076,MUST,3.2.1 Sampling Capabilities,"Clients supporting sampling MUST declare sampling capability",,
M077,MUST,3.2.2 Create Message,"Client response MUST include role, content, model, stopReason",,
M078,MUST,3.2.2 Create Message,"Content MUST be one of: text, image, or audio",,
M079,MUST,4.1.1 Ping Request/Response,"Receiver MUST respond promptly with empty response",,
M080,MUST,4.2.1 Cancellation Notification,"Notification MUST include requestId of request to cancel",,
M081,MUST,4.2.1 Cancellation Notification,"Cancellation notifications MUST only reference previously issued requests",,
M082,MUST,4.2.1 Cancellation Notification,"Initialize request MUST NOT be cancelled by clients",,
M083,MUST,4.3.1 Progress Request,"Progress tokens MUST be unique across active requests",,
M084,MUST,4.3.2 Progress Notification,"Progress notifications MUST include progressToken and progress value",,
M085,MUST,4.3.2 Progress Notification,"Progress value MUST increase with each notification",,
M086,MUST,4.3.2 Progress Notification,"Progress notifications MUST only reference active requests",,
M087,MUST,4.4.1 Logging Capabilities,"Servers supporting logging MUST declare logging capability",,
M088,MUST,4.5.1 Completion Capabilities,"Servers supporting completions MUST declare completions capability",,
M089,MUST,4.5.2 Complete Request,"Server response MUST include completion values",,
S001,SHOULD,1.2.1 STDIO Transport,"For the stdio transport, the client SHOULD initiate shutdown by closing the input stream",,
S002,SHOULD,1.2.2 Streamable HTTP Transport,"SSE stream SHOULD eventually include one JSON-RPC response per request",,
S003,SHOULD,1.2.2 Streamable HTTP Transport,"Server SHOULD NOT close SSE stream before sending all responses",,
S004,SHOULD,1.2.2 Streamable HTTP Transport,"Server messages SHOULD be unrelated to concurrent client requests",,
S005,SHOULD,1.2.3 Session Management,"Session ID SHOULD be globally unique and cryptographically secure",,
S006,SHOULD,1.2.3 Session Management,"Servers SHOULD respond with HTTP 400 to requests without session ID if required",,
S007,SHOULD,1.2.3 Session Management,"Clients SHOULD explicitly terminate sessions they no longer need",,
S008,SHOULD,1.3.1 Authorization,"HTTP-based transports SHOULD follow the OAuth 2.1 authorization flow",,
S009,SHOULD,1.3.1 Authorization,"STDIO transport SHOULD NOT use this authorization mechanism",,
S010,SHOULD,1.3.2 OAuth Implementation,"MCP auth implementations SHOULD support OAuth 2.0 Dynamic Client Registration",,
S011,SHOULD,1.3.2 OAuth Implementation,"Servers SHOULD follow the OAuth 2.0 Authorization Server Metadata protocol",,
S012,SHOULD,1.3.3 Authorization Server Discovery,"Clients SHOULD include MCP-Protocol-Version header during discovery",,
S013,SHOULD,1.4.1 Initialization,"Client SHOULD NOT send requests other than pings before server responds to initialize",,
S014,SHOULD,1.4.1 Initialization,"Server SHOULD NOT send requests other than pings and logging before initialized notification",,
S015,SHOULD,1.4.2 Version Negotiation,"Client version SHOULD be the latest version supported by the client",,
S016,SHOULD,1.4.2 Version Negotiation,"Server version SHOULD be the latest version supported by the server",,
S017,SHOULD,1.4.2 Version Negotiation,"If client doesn't support server's version, it SHOULD disconnect",,
S018,SHOULD,1.4.3 Capability Negotiation,"Both parties SHOULD respect negotiated capabilities",,
S019,SHOULD,1.4.4 Timeouts,"Implementations SHOULD establish timeouts for all sent requests",,
S020,SHOULD,1.4.4 Timeouts,"Senders SHOULD issue cancellation notification when timeout occurs",,
S021,SHOULD,1.4.4 Error Handling,"Implementations SHOULD be prepared to handle protocol errors",,
S022,SHOULD,2.1.3 Resource Content,"Each content item SHOULD include mimeType",,
S023,SHOULD,2.1.6 List Changed Notification,"Server SHOULD send notifications/resources/list_changed when resource list changes",,
S024,SHOULD,2.2.4 List Changed Notification,"Server SHOULD send notifications/prompts/list_changed when prompt list changes",,
S025,SHOULD,2.3.4 List Changed Notification,"Server SHOULD send notifications/tools/list_changed when tool list changes",,
S026,SHOULD,4.1.1 Ping,"Implementations SHOULD periodically issue pings to detect connection health",,
S027,SHOULD,4.2.1 Cancellation,"Receivers SHOULD stop processing cancelled request",,
S028,SHOULD,4.2.1 Cancellation,"Sender SHOULD ignore responses to cancelled requests",,
S029,SHOULD,4.5.2 Complete Request,"Servers SHOULD return suggestions sorted by relevance",,
S030,SHOULD,4.6.1 Pagination,"Invalid cursors SHOULD result in an error with code -32602",,
A001,MAY,1.1.1 Request Format,"Requests MAY include parameters object",,
A002,MAY,1.1.3 Notification Format,"Notifications MAY include parameters object",,
A003,MAY,1.1.4 Batching,"Implementations MAY support sending JSON-RPC batches",,
A004,MAY,1.2.1 STDIO Transport,"Server MAY write UTF-8 strings to stderr for logging",,
A005,MAY,1.2.2 Streamable HTTP Transport,"Server MAY send JSON-RPC requests and notifications before responses",,
A006,MAY,1.2.2 Streamable HTTP Transport,"Client MAY issue HTTP GET with Accept header listing text/event-stream",,
A007,MAY,1.2.2 Streamable HTTP Transport,"Server MAY send requests and notifications on SSE stream",,
A008,MAY,1.2.2 Streamable HTTP Transport,"Server MAY close the SSE stream at any time",,
A009,MAY,1.2.2 Streamable HTTP Transport,"Client MAY close the SSE stream at any time",,
A010,MAY,1.2.2 Streamable HTTP Transport,"Client MAY remain connected to multiple SSE streams",,
A011,MAY,1.2.2 Resumability,"Servers MAY attach an id field to SSE events",,
A012,MAY,1.2.2 Resumability,"Server MAY use Last-Event-ID header to replay messages",,
A013,MAY,1.2.3 Session Management,"Server MAY assign a session ID at initialization",,
A014,MAY,1.2.3 Session Management,"Server MAY terminate sessions at any time",,
A015,MAY,1.2.3 Session Management,"Server MAY respond with HTTP 405 Method Not Allowed to DELETE requests",,
A016,MAY,1.3.3 Authorization Server Discovery,"Server MAY support OAuth 2.0 dynamic client registration",,
A017,MAY,2.1.2 Resources List,"Each resource MAY include description, mimeType, size",,
A018,MAY,2.1.4 Resource Templates,"Each template MAY include name, description, mimeType",,
A019,MAY,2.2.2 Prompts List,"Each prompt MAY include description, arguments",,
A020,MAY,2.3.2 Tools List,"Each tool MAY include annotations",,
A021,MAY,3.1.2 Roots List,"Each root MAY include name",,
A022,MAY,4.1.1 Ping,"If no response received, sender MAY terminate connection",,
A023,MAY,4.2.1 Cancellation,"Notification MAY include reason string",,
A024,MAY,4.2.1 Cancellation,"Receivers MAY ignore cancellation for unknown or completed requests",,
A025,MAY,4.3.2 Progress Notification,"Progress notifications MAY include total and message",,
A026,MAY,4.5.2 Complete Request,"Server response MAY include total number of matches",,
