Tracking: 2026-07-28 spec conformance #977

Epic tracking issue for reaching 100% conformance on the 2026-07-28 spec suite before the spec release on 2026-07-28.

Per-item status lives in the sub-issues below. The epic now links 31 work items: 28 dated-protocol implementation and conformance issues in the 2026-07-28 spec milestone, plus three extension work items tracked separately from the tier-scored core suite. All carry the 2026-07-28 label. The milestone adds the due date, while this epic provides context and discussion. Conformance-gap issues carry failing check IDs and a repro command. The public roadmap is ROADMAP.md.

Current snapshot

Measured by release CI on 2026-07-23 at main e660b80 (tagged rmcp-v3.0.0-beta.1) with @modelcontextprotocol/conformance@0.2.0-alpha.9:

• Server: 40/40 scenarios passing (114/114 checks)
• Client: 32/32 scenarios passing (380/380 checks)

Movement since the 2026-07-22 snapshot:

• ✅ The dated 2026-07-28 core suites remain 100% green on both server and client.
• ✅ feat: route SEP-2260 associated server requests to the originating SSE stream #1029 closed Implement SEP-2260: Server requests must associate with a client request #873 by enforcing SEP-2260 request association and routing associated server requests to the originating SSE stream.
• ✅ fix: use issuer for JWT client audience #1031 moved the informational auth/client-credentials-jwt extension scenario to 8/8 checks passing; auth/client-credentials-basic also passes 8/8.
• ✅ feat: add distributed Streamable HTTP event store #1024 added distributed Streamable HTTP event storage and cross-instance replay without changing the core conformance totals.
• 🚀 chore: release v3.0.0-beta.1 #964 published rmcp and rmcp-macros 3.0.0-beta.1; both release tags point at main e660b80.

For reference, the 2025-11-25 suite (0.1.16, npm latest) passes 100% on both server (30/30 + pending scenarios) and client (18/18 + legacy auth/2025-03-26-*).

Note that the 2026-07-28 suite is a per-version scenario set, not additive: 36 scenarios are shared with 2025-11-25, 36 are new, and 14 scenarios are dropped (initialize, ping, logging-set-level, resources-(un)subscribe, sse-retry, … — removals driven by SEP-2575/SEP-2577).

Extension coverage (informational)

Extension conformance is reported separately from the dated core 40-server / 32-client scenario suites. #1019 keeps these gaps visible in CI:

• ✅ Tasks Extension (SEP-2663): 9/9 runnable scenarios passing (35/35 checks); tasks-status-notifications is upstream-skipped (Implement SEP-2663: Tasks Extension #868 → feat: Implement SEP-2663 Tasks Extension #1020)
• ✅ Client authorization extensions: auth/client-credentials-basic 8/8 and auth/client-credentials-jwt 8/8; auth/enterprise-managed-authorization remains an expected 0/2 failure in the informational baseline (fix: use issuer for JWT client audience #1031)
• MCP Apps (SEP-1865): Implement SEP-1865: MCP Apps - Interactive User Interfaces for MCP #891
• Extensions framework (SEP-2133): Implement SEP-2133: Extensions framework for MCP #892

Full scenario matrix (snapshot, 2026-07-23)

Snapshot of the release CI run at main e660b80 with 0.2.0-alpha.9 — regenerate with the commands below rather than hand-editing. Live per-item status is in the sub-issues.

Running the suites

The 2026-07-28 suite uses the stateless discovery lifecycle for its server scenarios. Since #999, requests negotiating that version are served statelessly even when legacy session mode is enabled; STATELESS=1 remains useful to make the conformance harness intent explicit. Pass --suite all on the server run too — the default "active" suite skips scenarios including server-stateless and caching.

cargo build -p mcp-conformance
STATELESS=1 PORT=8002 ./target/debug/conformance-server &
npx -y @modelcontextprotocol/conformance@0.2.0-alpha.9 server \
  --url http://127.0.0.1:8002/mcp --suite all --spec-version 2026-07-28 -o results
npx -y @modelcontextprotocol/conformance@0.2.0-alpha.9 client \
  --command ./target/debug/conformance-client --suite all --spec-version 2026-07-28 -o results-client

The suite is still alpha; re-baseline (and diff conformance list --spec-version 2026-07-28) on each version bump.

History

• 2026-07-13 baseline: server 37/40, client 24/32. Server gaps: tools-call-with-progress (Stateless streamable HTTP: tools/call with progress returns notification as response body #980), http-custom-header-server-validation (Implement SEP-2243: server-side custom header validation #979), server-stateless 2/28 (Implement SEP-2575: Make MCP Stateless #869).

• 2026-07-16: feat!: add server discovery and negotiation (SEP-2575) #973, feat: add modern client lifecycle modes (SEP-2575) #995, feat: accumulate client-side scopes during step-up authorization (SEP-2350) #888, fix(auth): validate discovered metadata issuer #996, and feat(conformance): add SEP-2243 header validation tool #997 merged. Server moved to 98/109 checks while remaining 37/40; client measured 15/32 because chore: update client conformance test scenarios #991 had orphaned eleven scenario mappings (Conformance client: auth scenarios unmapped since #991 dispatch change (blocks verifying SEP-2468/SEP-2352 fixes) #1001) and the legacy lifecycle lacked the required protocol-version header (Conformance client: legacy-lifecycle scenarios fail with -32020 missing MCP-Protocol-Version header at 2026-07-28 #1002).

• 2026-07-18: fix(auth): add an SDK path for pre-registered OAuth clients #994, feat(auth): bind DCR client credentials to issuing authorization server (SEP-2352) #998, and fix: enumerate conformance client scenarios #1008 merged; auth/pre-registration: new pre-registration-auth conformance check fails #984, Implement SEP-2352: Clarify authorization server binding and migration #879, and Conformance client: auth scenarios unmapped since #991 dispatch change (blocks verifying SEP-2468/SEP-2352 fixes) #1001 closed. Client moved 15/32 → 26/32. SEP-2468 now passes end-to-end; SEP-2352 is implemented but remains 15/16 because fix: enumerate conformance client scenarios #1008 shadows the dedicated migration harness path. Server remains 37/40.

• 2026-07-21: fix(server): serve draft-version requests statelessly per SEP-2567 #999, feat: add subscription listen streams (SEP-2575) #1000, fix: preserve negotiated progress responses #1005, chore: run full conformance CI suite #1010, fix: re-register after auth server change #1011, fix: pass SEP-2243 client conformance #1012, and fix: preserve JSON Schema 2020-12 keywords #1018 merged. Server reached 40/40 (114/114 checks); client reached 30/32 (360/363 checks, plus 1 warning). Only tools_call and auth/scope-step-up remain blocked by Conformance client: legacy-lifecycle scenarios fail with -32020 missing MCP-Protocol-Version header at 2026-07-28 #1002.

• 2026-07-22: fix: conformance tests for tools_call and auth/scope-step-up #1022 closed Conformance client: legacy-lifecycle scenarios fail with -32020 missing MCP-Protocol-Version header at 2026-07-28 #1002 and moved the client to 32/32 (380/380 checks), bringing both dated core suites to 100%. feat: Implement SEP-2663 Tasks Extension #1020 closed Implement SEP-2663: Tasks Extension #868 with 9/9 runnable Tasks-extension scenarios passing (35/35 checks); task status notifications remain upstream-skipped. feat: add client-side TTL-honoring response cache (SEP-2549) #1025 closed Implement client-side TTL-honoring cache (SEP-2549 follow-up) #974 with the SEP-2549 client response cache; conformance remains 100%.

• 2026-07-23: feat: route SEP-2260 associated server requests to the originating SSE stream #1029 closed the SEP-2260 gap (Implement SEP-2260: Server requests must associate with a client request #873), fix: use issuer for JWT client audience #1031 moved auth/client-credentials-jwt to 8/8 extension checks passing, and chore: release v3.0.0-beta.1 #964 published rmcp / rmcp-macros 3.0.0-beta.1 from main e660b80. Release CI kept the core suites at server 40/40 and client 32/32.

Out of scope here, tracked elsewhere

• Non-conformance Tier 1 requirements: VERSIONING.md, dependency update policy, documentation coverage (26/48 → 48/48) — see ROADMAP.md
• v3.0.0-beta.1 shipped via chore: release v3.0.0-beta.1 #964 on 2026-07-23. Stable v3.0.0 and the remaining non-conformance Tier 1 requirements are tracked separately. Migration guide: discussion Migrating to 3.0.0 #969.