| Check | Level | Result | Details |
|---|---|---|---|
| LIFE-01 | MUST | ✓ PASS |
initialize returns protocolVersion, capabilities and serverInfo
protocolVersion, capabilities and serverInfo all present
|
| LIFE-02 | SHOULD | ✓ PASS |
server negotiates the newest handshake revision (2025-11-25)
negotiated 2025-11-25, the newest revision the initialize handshake carries
|
| LIFE-03 | MUST | ✓ PASS |
server answers tools/list after the initialized notification
tools/list returned 4 tool(s) across 1 page(s) after initialized
|
| LIST-01 | MUST | ✓ PASS |
tools/list pagination terminates (no cursor loop)
single page, no pagination cursor
|
| RPC-01 | MUST | ✓ PASS |
unknown method gets a JSON-RPC error response
unknown method rejected with error code -32602
|
| RPC-02 | SHOULD | ✗ FAIL |
unknown method error code is -32601 (method not found)
expected -32601, got -32602
Fix: Use JSON-RPC 2.0 code -32601 when rejecting unknown methods.
|
| RPC-03 | MUST | ✓ PASS |
malformed tools/call params are rejected with an error
malformed params rejected with error code -32602
|
| TOOL-01 | MUST | ✓ PASS |
every tool has a non-empty name and an inputSchema
all 4 tools have a name and an inputSchema
|
| TOOL-02 | SHOULD | ✓ PASS |
every tool has a non-empty description
all 4 tools carry a description
|
| TOOL-03 | MUST | ✓ PASS |
every tool inputSchema compiles as JSON Schema
all 4 inputSchemas compile as JSON Schema draft 2020-12
|
| TOOL-04 | MUST | ✓ PASS |
calling a nonexistent tool is rejected
rejected as tool result with isError=true
|
| TOOL-05 | MUST | ✓ PASS |
a call missing required arguments is rejected
save_note with empty args rejected via isError=true
|
| TOOL-06 | MUST | ✓ PASS |
declared outputSchemas compile as JSON Schema
all 4 declared outputSchema(s) compile
|
| TOOL-08 | MUST | ✓ PASS |
observed structuredContent matches the declared outputSchema
save_note structuredContent validates against its outputSchema
|
| TOOL-07 | SHOULD | ✓ PASS |
declared input constraints are enforced
6 schema-violating input(s) across 3 tool(s), all rejected
|
| RES-01 | MUST | ✓ PASS |
advertised resources capability serves resources/list
resources/list returned 0 resource(s)
|
| RES-02 | MUST | ✓ PASS |
every resource carries a uri and a name
all 0 resource(s) carry a uri and a name
|
| RES-03 | MUST | – SKIP |
resources/read returns contents for an advertised resource
no listed resource to read
|
| RES-04 | MUST | ✓ PASS |
resources/list pagination terminates (no cursor loop)
single page, no pagination cursor
|
| PROMPT-01 | MUST | ✓ PASS |
advertised prompts capability serves prompts/list
prompts/list returned 0 prompt(s)
|
| PROMPT-02 | MUST | ✓ PASS |
every prompt has a name and well-formed argument metadata
all 0 prompt(s) carry valid metadata
|
| PROMPT-03 | MUST | – SKIP |
prompts/get rejects a call missing required arguments
no prompt declares required arguments
|
| PROMPT-04 | MUST | ✓ PASS |
prompts/list pagination terminates (no cursor loop)
single page, no pagination cursor
|
| CAP-02 | SHOULD | ✓ PASS |
declared capabilities match served features (resources)
capabilities.resources declared and resources/list served
|
| CAP-03 | SHOULD | ✓ PASS |
declared capabilities match served features (prompts)
capabilities.prompts declared and prompts/list served
|
| HYG-01 | MUST | ✓ PASS |
stdout carries only JSON-RPC messages
no non-JSON-RPC stdout lines observed
|
| CAP-01 | SHOULD | ✓ PASS |
declared capabilities match served features (tools)
capabilities.tools declared and tools/list served
|
| Check | Domain | Result | Details |
|---|---|---|---|
| SEC-01 | MCP-INPUT-01 | ✓ PASS |
no prompt-injection patterns in tool descriptions
0 matches across 4 tools
|
| SEC-02 | MCP-INPUT-01 | ✓ PASS |
no invisible or bidi control characters in tool metadata
0 invisible characters across 4 tools
|
| SEC-03 | MCP-LOG-02 | ✓ PASS |
no secret-looking strings in tool metadata
0 secret-like strings across 4 tools
|
| SEC-04 | MCP-INPUT-02 | ✓ PASS |
injection-surface string params carry constraints
0 unconstrained injection-surface params across 4 tools
|
| SEC-05 | MCP-INPUT-01 | ✓ PASS |
tool descriptions stay under 2000 chars
longest description 63 chars across 4 tools
|
| SEC-06 | MCP-EXEC-01,MCP-EXEC-02 | ✓ PASS |
no tool advertises unconstrained arbitrary execution
0 exec-style tools with free-form params across 4 tools
|
L1: 1/2 auto-assessable controls met · 1 partial · 4 require manual review. Mapped against MSSS v0.1 (control-level mapping v2.0 (2026-01-20)): 3 of 24 controls are auto-assessable from this audit's deterministic checks (partial = evidence ran clean but cannot prove the control on its own); the remaining 21 need deployment, code or process evidence and are marked manual review — never assessed by this tool.
| Control | Domain | Level | Result | Title |
|---|---|---|---|---|
| MCP-EXEC-01 | Execution | L1 | – manual review |
Prohibition of Shell Execution
SEC-06 flags advertised arbitrary-exec tools, but proving the absence of shell invocation requires source review.
|
| MCP-FS-01 | Filesystem | L1 | – manual review |
Path Allowlisting and Canonical Resolution
|
| MCP-FS-02 | Filesystem | L1 | – manual review |
Symlink Resolution Validation
|
| MCP-NET-01 | Network | L1 | – manual review |
URL Validation and SSRF Mitigation
|
| MCP-INPUT-01 | Input Validation | L1 | ✓ met |
JSON Schema Validation
Evidence checks: TOOL-01, TOOL-03, RPC-03, TOOL-05, SEC-01, SEC-02, SEC-05
Auto-assessed from advertised schemas (present and valid), live rejection probes, and the tool-metadata poisoning scan.
|
| MCP-LOG-02 | Logging | L1 | ◐ partial |
Secret Redaction in Logs
Evidence checks: SEC-03
Supporting evidence only: SEC-03 scans advertised tool metadata for secret-like strings; server log output is not inspected, so a clean scan cannot prove log redaction (a leak still proves a gap).
|
| MCP-SUPPLY-02 | Supply Chain | L2 | – manual review |
Trusted Package Sources
|
| MCP-INPUT-02 | Input Validation | L2 | ✓ met |
Input Bounds Enforcement
Evidence checks: SEC-04
Auto-assessed from advertised schema constraints (enum/pattern/maxLength); runtime payload limits are not probed.
|
| MCP-INPUT-03 | Input Validation | L2 | – manual review |
Timeout Enforcement
|
| MCP-NET-03 | Network | L2 | – manual review |
TLS Enforcement
MSSS marks this N/A for stdio-only deployments with no network access.
|
| MCP-EXEC-02 | Execution | L2 | – manual review |
Command Allowlisting
See the SEC-06 advisory for advertised command tools; allowlist verification requires source review.
|
| MCP-EXEC-03 | Execution | L2 | – manual review |
Argument Separator Usage
|
| MCP-AUTHZ-01 | Authorization | L3 | – manual review |
OAuth Token Delegation
MSSS marks this N/A for stdio transport with OS-level user isolation.
|
| MCP-AUTHZ-02 | Authorization | L3 | – manual review |
Per-Tool Scope Definition
|
| MCP-AUTHZ-03 | Authorization | L3 | – manual review |
Least Privilege Tool Design
|
| MCP-AUTHZ-04 | Authorization | L3 | – manual review |
Resource-Based Access Control
|
| MCP-LOG-01 | Logging | L3 | – manual review |
Comprehensive Audit Logging
|
| MCP-DEPLOY-01 | Deployment | L3 | – manual review |
Container Hardening
|
| MCP-FS-03 | Filesystem | L4 | – manual review |
Filesystem Sandboxing
|
| MCP-SUPPLY-01 | Supply Chain | L4 | – manual review |
Package Integrity Verification
|
| MCP-DEPLOY-03 | Deployment | L4 | – manual review |
Resource Limits and Rate Limiting
|
| MCP-NET-02 | Network | L4 | – manual review |
Egress Traffic Filtering
|
| MCP-DEPLOY-02 | Deployment | L4 | – manual review |
System Call Filtering (seccomp/AppArmor)
|
| MCP-DEPLOY-04 | Deployment | L4 | – manual review |
Runtime Integrity Monitoring
Future control in MSSS v0.1 — implementation details TBD upstream.
|
Control taxonomy from the MCP Server Security Standard (MSSS), CC BY-SA 4.0, mcp-security-standard.org.
| Fixture | Tool | Verdict | Detail |
|---|---|---|---|
| 0001__save_note__4ba8cbdc.json | save_note | OK | |
| 0002__save_note__54555856.json | save_note | OK | |
| 0003__save_note__e7d4dc7b.json | save_note | OK | |
| 0004__save_note__aaceaae6.json | save_note | OK | |
| 0005__get_note__d8a17f15.json | get_note | OK | |
| 0006__get_note__52187cd4.json | get_note | OK | |
| 0007__get_note__cbfd3c9d.json | get_note | OK | |
| 0008__get_note__593a2b6d.json | get_note | OK | |
| 0009__calc_sum__54cb1b7a.json | calc_sum | OK | |
| 0010__search_docs__38e762cf.json | search_docs | OK | |
| 0011__search_docs__450fd5d6.json | search_docs | OK | |
| 0012__search_docs__b90f0eb6.json | search_docs | OK | |
| 0013__search_docs__fa61e7db.json | search_docs | OK |
The recorded fixtures (demo/fixtures-good, suite fingerprint sha256:e65620e7252a2b6eaf0d36b78149b1d07ab9b86beb14cc687e5edd039086b1a1) are the behavioural contract of this server. Keep them in the repository and run the workflow below in CI — any breaking or value drift fails the build before it reaches your users.
# The recorded fixtures in demo/fixtures-good are the behavioral contract: any drift fails this job.
name: mcp-proof regression gate
on:
push:
pull_request:
jobs:
replay:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: "3.11"
- name: Install mcp-proof
run: pip install git+https://github.com/YuCPbit/mcp-proof
- name: Replay golden fixtures against the live server
run: mcp-proof replay --fixtures demo/fixtures-good -- .venv/bin/python demo/good_server.py