mcpengine/infra/factory-tools/mcp-validator/specification/specification-2025-03-26.csv

1	ID	Type	Section	Requirement	Tested	Notes
2	M001	MUST	1.1 JSON-RPC Message Format	All messages MUST follow JSON-RPC 2.0 specification
3	M002	MUST	1.1.1 Request Format	Requests MUST include a string or integer ID (not null)
4	M003	MUST	1.1.1 Request Format	Request IDs MUST NOT be null
5	M004	MUST	1.1.1 Request Format	Request IDs MUST NOT have been previously used by the requestor within the same session
6	M005	MUST	1.1.1 Request Format	Requests MUST include a method string
7	M006	MUST	1.1.2 Response Format	Responses MUST include the same ID as the corresponding request
8	M007	MUST	1.1.2 Response Format	Responses MUST include either a result or an error (not both)
9	M008	MUST	1.1.2 Response Format	Errors MUST include an error code and message
10	M009	MUST	1.1.3 Notification Format	Notifications MUST NOT include an ID
11	M010	MUST	1.1.3 Notification Format	Notifications MUST include a method string
12	M011	MUST	1.1.4 Batching	Implementations MUST support receiving JSON-RPC batches
13	M012	MUST	1.2.1 STDIO Transport	Client MUST launch the server as a subprocess
14	M013	MUST	1.2.1 STDIO Transport	Server MUST read from stdin and write to stdout
15	M014	MUST	1.2.1 STDIO Transport	Messages MUST be delimited by newlines
16	M015	MUST	1.2.1 STDIO Transport	Messages MUST NOT contain embedded newlines
17	M016	MUST	1.2.1 STDIO Transport	Server MUST NOT write anything to stdout that is not a valid MCP message
18	M017	MUST	1.2.1 STDIO Transport	Client MUST NOT write anything to stdin that is not a valid MCP message
19	M018	MUST	1.2.2 Streamable HTTP Transport	Server MUST provide a single HTTP endpoint supporting both POST and GET methods
20	M019	MUST	1.2.2 Streamable HTTP Transport	Client MUST use HTTP POST to send messages
21	M020	MUST	1.2.2 Streamable HTTP Transport	Client MUST include Accept header with both application/json and text/event-stream
22	M021	MUST	1.2.2 Streamable HTTP Transport	Request body MUST be a single JSON-RPC message or batch
23	M022	MUST	1.2.2 Streamable HTTP Transport	If sending only responses/notifications, server MUST return HTTP 202 Accepted with no body
24	M023	MUST	1.2.2 Streamable HTTP Transport	If sending requests, server MUST return either Content-Type: text/event-stream or Content-Type: application/json
25	M024	MUST	1.2.2 Streamable HTTP Transport	Client MUST include Accept header with text/event-stream for GET requests
26	M025	MUST	1.2.2 Streamable HTTP Transport	Server MUST either return text/event-stream or HTTP 405 Method Not Allowed for GET requests
27	M026	MUST	1.2.2 Streamable HTTP Transport	Server MUST NOT send responses on SSE stream unless resuming previous client request
28	M027	MUST	1.2.2 Streamable HTTP Transport	Server MUST send each message on only one connected stream
29	M028	MUST	1.2.3 Session Management	Session ID MUST only contain visible ASCII characters (0x21 to 0x7E)
30	M029	MUST	1.2.3 Session Management	Clients MUST include session ID in all subsequent requests if provided
31	M030	MUST	1.3.1 Authorization	Servers MUST return HTTP 401 Unauthorized when authorization is required
32	M031	MUST	1.3.2 OAuth Implementation	MCP auth implementations MUST implement OAuth 2.1 with appropriate security
33	M032	MUST	1.3.2 OAuth Implementation	Clients MUST implement OAuth 2.0 Authorization Server Metadata
34	M033	MUST	1.3.2 OAuth Implementation	Clients MUST follow the OAuth 2.0 Authorization Server Metadata protocol
35	M034	MUST	1.3.3 Authorization Server Discovery	Authorization base URL MUST be determined by discarding path components from MCP server URL
36	M035	MUST	1.3.3 Authorization Server Discovery	For servers without metadata discovery, clients MUST use default endpoint paths
37	M036	MUST	1.3.4 Access Token Usage	MCP clients MUST use Authorization request header field for access tokens
38	M037	MUST	1.3.4 Access Token Usage	Access tokens MUST NOT be included in URI query string
39	M038	MUST	1.3.4 Access Token Usage	Resource servers MUST validate access tokens and respond with HTTP 401 for invalid tokens
40	M039	MUST	1.4.1 Initialization	Client MUST send initialize request as first interaction
41	M040	MUST	1.4.1 Initialization	Initialize request MUST include protocol version, client capabilities, and client info
42	M041	MUST	1.4.1 Initialization	Initialize request MUST NOT be part of a JSON-RPC batch
43	M042	MUST	1.4.1 Initialization	Server MUST respond with protocol version, server capabilities, and server info
44	M043	MUST	1.4.1 Initialization	After successful initialization, client MUST send initialized notification
45	M044	MUST	1.4.2 Version Negotiation	Client MUST send a protocol version it supports
46	M045	MUST	1.4.2 Version Negotiation	If server supports requested version, it MUST respond with same version
47	M046	MUST	1.4.2 Version Negotiation	Otherwise, server MUST respond with another supported version
48	M047	MUST	1.4.3 Capability Negotiation	Client and server MUST declare capabilities during initialization
49	M048	MUST	2.1.1 Resources Capabilities	Servers supporting resources MUST declare resources capability
50	M049	MUST	2.1.2 Resources List	Server response MUST include resources array
51	M050	MUST	2.1.2 Resources List	Each resource MUST include uri and name
52	M051	MUST	2.1.3 Resource Content	Server response MUST include contents array
53	M052	MUST	2.1.3 Resource Content	Each content item MUST include uri and either text or blob
54	M053	MUST	2.1.4 Resource Templates	Server response MUST include resourceTemplates array
55	M054	MUST	2.1.4 Resource Templates	Each template MUST include uriTemplate
56	M055	MUST	2.1.5 Resource Subscriptions	Server MUST send notifications/resources/updated when resource changes
57	M056	MUST	2.1.5 Resource Subscriptions	Server MUST support subscribe capability to use this feature
58	M057	MUST	2.1.6 List Changed Notification	Server MUST support listChanged capability to use this feature
59	M058	MUST	2.2.1 Prompts Capabilities	Servers supporting prompts MUST declare prompts capability
60	M059	MUST	2.2.2 Prompts List	Server response MUST include prompts array
61	M060	MUST	2.2.2 Prompts List	Each prompt MUST include name
62	M061	MUST	2.2.3 Get Prompt	Server response MUST include messages array
63	M062	MUST	2.2.3 Get Prompt	Each message MUST include role and content
64	M063	MUST	2.2.3 Get Prompt	Content MUST be one of: text, image, audio, or resource
65	M064	MUST	2.2.4 List Changed Notification	Server MUST support listChanged capability to use this feature
66	M065	MUST	2.3.1 Tools Capabilities	Servers supporting tools MUST declare tools capability
67	M066	MUST	2.3.2 Tools List	Server response MUST include tools array
68	M067	MUST	2.3.2 Tools List	Each tool MUST include name, description, inputSchema
69	M068	MUST	2.3.3 Tool Call	Server response MUST include content array and isError flag
70	M069	MUST	2.3.3 Tool Call	Each content item MUST be one of: text, image, audio, or resource
71	M070	MUST	2.3.4 List Changed Notification	Server MUST support listChanged capability to use this feature
72	M071	MUST	3.1.1 Roots Capabilities	Clients supporting roots MUST declare roots capability
73	M072	MUST	3.1.2 Roots List	Client response MUST include roots array
74	M073	MUST	3.1.2 Roots List	Each root MUST include uri
75	M074	MUST	3.1.3 List Changed Notification	Client MUST send notifications/roots/list_changed when root list changes
76	M075	MUST	3.1.3 List Changed Notification	Client MUST support listChanged capability to use this feature
77	M076	MUST	3.2.1 Sampling Capabilities	Clients supporting sampling MUST declare sampling capability
78	M077	MUST	3.2.2 Create Message	Client response MUST include role, content, model, stopReason
79	M078	MUST	3.2.2 Create Message	Content MUST be one of: text, image, or audio
80	M079	MUST	4.1.1 Ping Request/Response	Receiver MUST respond promptly with empty response
81	M080	MUST	4.2.1 Cancellation Notification	Notification MUST include requestId of request to cancel
82	M081	MUST	4.2.1 Cancellation Notification	Cancellation notifications MUST only reference previously issued requests
83	M082	MUST	4.2.1 Cancellation Notification	Initialize request MUST NOT be cancelled by clients
84	M083	MUST	4.3.1 Progress Request	Progress tokens MUST be unique across active requests
85	M084	MUST	4.3.2 Progress Notification	Progress notifications MUST include progressToken and progress value
86	M085	MUST	4.3.2 Progress Notification	Progress value MUST increase with each notification
87	M086	MUST	4.3.2 Progress Notification	Progress notifications MUST only reference active requests
88	M087	MUST	4.4.1 Logging Capabilities	Servers supporting logging MUST declare logging capability
89	M088	MUST	4.5.1 Completion Capabilities	Servers supporting completions MUST declare completions capability
90	M089	MUST	4.5.2 Complete Request	Server response MUST include completion values
91	S001	SHOULD	1.2.1 STDIO Transport	For the stdio transport, the client SHOULD initiate shutdown by closing the input stream
92	S002	SHOULD	1.2.2 Streamable HTTP Transport	SSE stream SHOULD eventually include one JSON-RPC response per request
93	S003	SHOULD	1.2.2 Streamable HTTP Transport	Server SHOULD NOT close SSE stream before sending all responses
94	S004	SHOULD	1.2.2 Streamable HTTP Transport	Server messages SHOULD be unrelated to concurrent client requests
95	S005	SHOULD	1.2.3 Session Management	Session ID SHOULD be globally unique and cryptographically secure
96	S006	SHOULD	1.2.3 Session Management	Servers SHOULD respond with HTTP 400 to requests without session ID if required
97	S007	SHOULD	1.2.3 Session Management	Clients SHOULD explicitly terminate sessions they no longer need
98	S008	SHOULD	1.3.1 Authorization	HTTP-based transports SHOULD follow the OAuth 2.1 authorization flow
99	S009	SHOULD	1.3.1 Authorization	STDIO transport SHOULD NOT use this authorization mechanism
100	S010	SHOULD	1.3.2 OAuth Implementation	MCP auth implementations SHOULD support OAuth 2.0 Dynamic Client Registration
101	S011	SHOULD	1.3.2 OAuth Implementation	Servers SHOULD follow the OAuth 2.0 Authorization Server Metadata protocol
102	S012	SHOULD	1.3.3 Authorization Server Discovery	Clients SHOULD include MCP-Protocol-Version header during discovery
103	S013	SHOULD	1.4.1 Initialization	Client SHOULD NOT send requests other than pings before server responds to initialize
104	S014	SHOULD	1.4.1 Initialization	Server SHOULD NOT send requests other than pings and logging before initialized notification
105	S015	SHOULD	1.4.2 Version Negotiation	Client version SHOULD be the latest version supported by the client
106	S016	SHOULD	1.4.2 Version Negotiation	Server version SHOULD be the latest version supported by the server
107	S017	SHOULD	1.4.2 Version Negotiation	If client doesn't support server's version, it SHOULD disconnect
108	S018	SHOULD	1.4.3 Capability Negotiation	Both parties SHOULD respect negotiated capabilities
109	S019	SHOULD	1.4.4 Timeouts	Implementations SHOULD establish timeouts for all sent requests
110	S020	SHOULD	1.4.4 Timeouts	Senders SHOULD issue cancellation notification when timeout occurs
111	S021	SHOULD	1.4.4 Error Handling	Implementations SHOULD be prepared to handle protocol errors
112	S022	SHOULD	2.1.3 Resource Content	Each content item SHOULD include mimeType
113	S023	SHOULD	2.1.6 List Changed Notification	Server SHOULD send notifications/resources/list_changed when resource list changes
114	S024	SHOULD	2.2.4 List Changed Notification	Server SHOULD send notifications/prompts/list_changed when prompt list changes
115	S025	SHOULD	2.3.4 List Changed Notification	Server SHOULD send notifications/tools/list_changed when tool list changes
116	S026	SHOULD	4.1.1 Ping	Implementations SHOULD periodically issue pings to detect connection health
117	S027	SHOULD	4.2.1 Cancellation	Receivers SHOULD stop processing cancelled request
118	S028	SHOULD	4.2.1 Cancellation	Sender SHOULD ignore responses to cancelled requests
119	S029	SHOULD	4.5.2 Complete Request	Servers SHOULD return suggestions sorted by relevance
120	S030	SHOULD	4.6.1 Pagination	Invalid cursors SHOULD result in an error with code -32602
121	A001	MAY	1.1.1 Request Format	Requests MAY include parameters object
122	A002	MAY	1.1.3 Notification Format	Notifications MAY include parameters object
123	A003	MAY	1.1.4 Batching	Implementations MAY support sending JSON-RPC batches
124	A004	MAY	1.2.1 STDIO Transport	Server MAY write UTF-8 strings to stderr for logging
125	A005	MAY	1.2.2 Streamable HTTP Transport	Server MAY send JSON-RPC requests and notifications before responses
126	A006	MAY	1.2.2 Streamable HTTP Transport	Client MAY issue HTTP GET with Accept header listing text/event-stream
127	A007	MAY	1.2.2 Streamable HTTP Transport	Server MAY send requests and notifications on SSE stream
128	A008	MAY	1.2.2 Streamable HTTP Transport	Server MAY close the SSE stream at any time
129	A009	MAY	1.2.2 Streamable HTTP Transport	Client MAY close the SSE stream at any time
130	A010	MAY	1.2.2 Streamable HTTP Transport	Client MAY remain connected to multiple SSE streams
131	A011	MAY	1.2.2 Resumability	Servers MAY attach an id field to SSE events
132	A012	MAY	1.2.2 Resumability	Server MAY use Last-Event-ID header to replay messages
133	A013	MAY	1.2.3 Session Management	Server MAY assign a session ID at initialization
134	A014	MAY	1.2.3 Session Management	Server MAY terminate sessions at any time
135	A015	MAY	1.2.3 Session Management	Server MAY respond with HTTP 405 Method Not Allowed to DELETE requests
136	A016	MAY	1.3.3 Authorization Server Discovery	Server MAY support OAuth 2.0 dynamic client registration
137	A017	MAY	2.1.2 Resources List	Each resource MAY include description, mimeType, size
138	A018	MAY	2.1.4 Resource Templates	Each template MAY include name, description, mimeType
139	A019	MAY	2.2.2 Prompts List	Each prompt MAY include description, arguments
140	A020	MAY	2.3.2 Tools List	Each tool MAY include annotations
141	A021	MAY	3.1.2 Roots List	Each root MAY include name
142	A022	MAY	4.1.1 Ping	If no response received, sender MAY terminate connection
143	A023	MAY	4.2.1 Cancellation	Notification MAY include reason string
144	A024	MAY	4.2.1 Cancellation	Receivers MAY ignore cancellation for unknown or completed requests
145	A025	MAY	4.3.2 Progress Notification	Progress notifications MAY include total and message
146	A026	MAY	4.5.2 Complete Request	Server response MAY include total number of matches