CONF-010: input_required results are well formed and only used where allowed

Severity	Applies to	Spec section
error	modern era, stdio, http	2026-07-28/basic/patterns/mrtr#server-requirements-basic-workflow

Checks that server/discover and tools/list never return input_required (only prompts/get, resources/read and tools/call may). Then calls each safe tool declaring elicitation, sampling and roots, answers every round with harmless inputs and retries with inputResponses and the echoed requestState, up to three rounds. Every input_required result MUST carry inputRequests or requestState, and every input request MUST be elicitation/create, sampling/createMessage or roots/list. Servers MAY keep asking, so a round trip that never completes is not a failure. Tools are called only if marked readOnlyHint: true or destructiveHint: false (all tools with --allow-destructive), never if openWorldHint: true, with the minimal valid arguments built from their inputSchema. Skipped when no called tool exercises the rule.

From the command line: mcpprobe checks explain CONF-010. To leave it out of a run, add "CONF-010" to [checks] disable in mcpprobe.toml; to change how much it counts, use severity_overrides.