Check catalog

Every check cites the section of the MCP specification it enforces. error checks enforce a MUST and fail the run; warn checks enforce a SHOULD or flag a heuristic; info checks are advice. Crashes and hangs fail the run whatever the check's severity.

Conformance (CONF)

ID	Severity	Applies to	Check
CONF-001	error	modern era, stdio, http	server/discover exists and lists supported versions and capabilities
CONF-002	error	modern era, stdio, http	Requests missing required _meta fields are rejected with -32602
CONF-003	error	modern era, stdio, http	Unsupported protocol version returns -32022 with data.supported
CONF-004	error	modern era, stdio, http	Every result carries resultType
CONF-005	error	both eras, stdio, http	Request ids: null is rejected and responses echo the id exactly
CONF-006	error	modern era, http	HTTP headers that disagree with the body are rejected with -32020
CONF-007	error	both eras, http	Origin header is validated on Streamable HTTP
CONF-008	info	both eras, stdio, http	Unknown tools get a JSON-RPC error, not a tool result
CONF-009	error	modern era, stdio, http	Undeclared client capabilities are never relied on
CONF-010	error	modern era, stdio, http	input_required results are well formed and only used where allowed
CONF-011	error	both eras, stdio, http	structuredContent matches the tool's outputSchema
CONF-012	warn	modern era, stdio, http	tools/list returns tools in a deterministic order
CONF-013	error	legacy era, stdio, http	Legacy initialize handshake and version negotiation
CONF-014	warn	modern era, stdio, http	Initialize-era versions listed in supportedVersions really work
CONF-015	error	both eras, stdio	stdio: stdout carries only newline-delimited JSON-RPC messages
CONF-016	warn	modern era, stdio, http	Deprecated logging capability is declared
CONF-017	warn	modern era, stdio, http	Results identify the server in _meta serverInfo
CONF-018	error	modern era, stdio, http	Cacheable results carry ttlMs and cacheScope
CONF-020	error	modern era, stdio	Protocol version is read from each request, not remembered
CONF-021	warn	legacy era, stdio, http	initialize answers an unsupported version with a supported one
CONF-022	info	legacy era, stdio, http	Server negotiates an outdated initialize-era revision

Schema fuzzing (FUZZ)

ID	Severity	Applies to	Check
FUZZ-001	error	both eras, stdio, http	Fuzzed tool arguments never crash the server or go unanswered
FUZZ-002	error	both eras, stdio, http	Invalid tool arguments are rejected cleanly, not with an internal error
FUZZ-003	warn	both eras, stdio, http	Invalid tool arguments are not accepted as a success
FUZZ-004	warn	both eras, stdio, http	Schema-valid tool arguments are not rejected as invalid params

Robustness (ROB)

ID	Severity	Applies to	Check
ROB-001	warn	both eras, stdio, http	Malformed JSON gets a -32700 Parse error
ROB-002	warn	both eras, stdio, http	Invalid JSON-RPC envelopes are rejected, not executed
ROB-003	error	both eras, stdio, http	Unknown methods get -32601 Method not found
ROB-004	warn	both eras, stdio, http	tools/call with non-object arguments is rejected without an internal error
ROB-005	error	both eras, stdio, http	1 MB and 10 MB requests are answered or rejected, never dropped
ROB-006	error	both eras, stdio, http	Cancellation is handled gracefully
ROB-007	error	both eras, stdio, http	Concurrent requests each get their own response
ROB-008	error	both eras, stdio, http	Deeply nested or invalid-Unicode requests are answered or rejected, never dropped

Security (SEC)

ID	Severity	Applies to	Check
SEC-001	warn	both eras, stdio, http	Tool schemas do not depend on a network $ref
SEC-002	warn	both eras, stdio, http	Errors carry no stack traces
SEC-003	warn	both eras, stdio, http	Responses carry no secrets
SEC-004	warn	both eras, http	A local HTTP server listens on loopback only
SEC-005	error	both eras, http	Authorization is discoverable and invalid tokens are rejected
SEC-006	warn	both eras, stdio, http	Tool metadata holds no injection-style instructions
SEC-007	error	modern era, stdio, http	The tool list does not change between connections or after a call