mcp-proofDelivery report

modern-target

✓ SHIP-READY — all MUST checks pass, no blocking security findings, no behavioural drift

Server under test: .venv/bin/python tests/modern_target_server.py
Generated: 2026-08-21 19:50 UTC · mcp-proof v0.7.2
Protocol: selected 2026-07-28 · modern era (server/discover)
Behaviour fingerprint: sha256:f3f65b7c4ba8bfd11470d004e568d43f18f2001e4959704982b8c3cb735fd950

Conformance

23/23

MUST checks passed · 8/8 SHOULD

Security

findings · 0 blocking · 0 advisory

Behaviour regression

2/2

replays clean · gate PASS

Evidence scope. This report proves what was observed on the wire: protocol conformance of the served surface, static analysis of advertised tool metadata, and behavioural equality against the recorded fixture baseline. It does not assess deployment, source code, process controls or authorization/OAuth flows — MSSS controls that need such evidence are marked manual review (or partial), never assumed.

Protocol conformance

Check	Level	Result	Details
DISC-01	MUST	✓ PASS	server/discover advertises supportedVersions and capabilities supportedVersions=['2026-07-28'], capabilities: prompts, resources, tools, identity: modern-target
LIST-01	MUST	✓ PASS	tools/list pagination terminates (no cursor loop) single page, no pagination cursor
RPC-01	MUST	✓ PASS	unknown method gets a JSON-RPC error response unknown method rejected with error code -32601
RPC-02	SHOULD	✓ PASS	unknown method error code is -32601 (method not found) expected -32601, got -32601
RPC-03	MUST	✓ PASS	malformed tools/call params are rejected with an error malformed params rejected with error code -32602
ENV-01	MUST	✓ PASS	requests without the _meta protocol envelope are rejected request without _meta envelope rejected (code -32602)
VER-01	MUST	✓ PASS	unsupported protocol versions are rejected with -32022 version 1999-01-01 rejected with -32022, supported=['2026-07-28']
HTTP-01	SHOULD	– SKIP	mismatched Mcp-Method routing headers are rejected with -32020 routing headers only apply to the Streamable HTTP transport
TOOL-01	MUST	✓ PASS	every tool has a non-empty name and an inputSchema all 2 tools have a name and an inputSchema
TOOL-02	SHOULD	✓ PASS	every tool has a non-empty description all 2 tools carry a description
TOOL-03	MUST	✓ PASS	every tool inputSchema compiles as JSON Schema all 2 inputSchemas compile as JSON Schema draft 2020-12
TOOL-04	MUST	✓ PASS	calling a nonexistent tool is rejected rejected as JSON-RPC error (code -32602)
TOOL-05	MUST	✓ PASS	a call missing required arguments is rejected echo with empty args rejected as JSON-RPC error (code -32602)
TOOL-06	MUST	✓ PASS	declared outputSchemas compile as JSON Schema all 1 declared outputSchema(s) compile
TOOL-08	MUST	✓ PASS	observed structuredContent matches the declared outputSchema price structuredContent validates against its outputSchema
TOOL-07	SHOULD	✓ PASS	declared input constraints are enforced 4 schema-violating input(s) across 2 tool(s), all rejected
ORD-01	SHOULD	✓ PASS	tools/list returns tools in a deterministic order two full walks returned 2 tool(s) in identical order
RES-01	MUST	✓ PASS	advertised resources capability serves resources/list resources/list returned 1 resource(s)
RES-02	MUST	✓ PASS	every resource carries a uri and a name all 1 resource(s) carry a uri and a name
RES-03	MUST	✓ PASS	resources/read returns contents for an advertised resource read demo://readme: 1 content entr(y/ies), uri echoed
RES-04	MUST	✓ PASS	resources/list pagination terminates (no cursor loop) single page, no pagination cursor
PROMPT-01	MUST	✓ PASS	advertised prompts capability serves prompts/list prompts/list returned 1 prompt(s)
PROMPT-02	MUST	✓ PASS	every prompt has a name and well-formed argument metadata all 1 prompt(s) carry valid metadata
PROMPT-03	MUST	✓ PASS	prompts/get rejects a call missing required arguments summarize with empty args rejected (code -32602)
PROMPT-04	MUST	✓ PASS	prompts/list pagination terminates (no cursor loop) single page, no pagination cursor
CAP-02	SHOULD	✓ PASS	declared capabilities match served features (resources) capabilities.resources declared and resources/list served
CAP-03	SHOULD	✓ PASS	declared capabilities match served features (prompts) capabilities.prompts declared and prompts/list served
CACHE-01	MUST	✓ PASS	tools/list results carry the required ttlMs and cacheScope all 5 cacheable result(s) carry ttlMs and cacheScope (prompts/list, resources/list, resources/read, tools/list)
RTYPE-01	MUST	✓ PASS	every result carries the required resultType field all 7 observed results carry resultType
META-01	SHOULD	✓ PASS	results identify the server via _meta serverInfo all 7 results carry _meta serverInfo
HYG-01	MUST	✓ PASS	stdout carries only JSON-RPC messages no non-JSON-RPC stdout lines observed
CAP-01	SHOULD	✓ PASS	declared capabilities match served features (tools) capabilities.tools declared and tools/list served

Security & hygiene

Check	Domain	Result	Details
SEC-01	MCP-INPUT-01	✓ PASS	no prompt-injection patterns in tool descriptions 0 matches across 2 tools
SEC-02	MCP-INPUT-01	✓ PASS	no invisible or bidi control characters in tool metadata 0 invisible characters across 2 tools
SEC-03	MCP-LOG-02	✓ PASS	no secret-looking strings in tool metadata 0 secret-like strings across 2 tools
SEC-04	MCP-INPUT-02	✓ PASS	injection-surface string params carry constraints 0 unconstrained injection-surface params across 2 tools
SEC-05	MCP-INPUT-01	✓ PASS	tool descriptions stay under 2000 chars longest description 27 chars across 2 tools
SEC-06	MCP-EXEC-01,MCP-EXEC-02	✓ PASS	no tool advertises unconstrained arbitrary execution 0 exec-style tools with free-form params across 2 tools

MSSS compliance

L1: 1/2 auto-assessable controls met · 1 partial · 4 require manual review. Mapped against MSSS v0.1 (control-level mapping v2.0 (2026-01-20)): 3 of 24 controls are auto-assessable from this audit's deterministic checks (partial = evidence ran clean but cannot prove the control on its own); the remaining 21 need deployment, code or process evidence and are marked manual review — never assessed by this tool.

Control	Domain	Level	Result	Title
MCP-EXEC-01	Execution	L1	– manual review	Prohibition of Shell Execution SEC-06 flags advertised arbitrary-exec tools, but proving the absence of shell invocation requires source review.
MCP-FS-01	Filesystem	L1	– manual review	Path Allowlisting and Canonical Resolution
MCP-FS-02	Filesystem	L1	– manual review	Symlink Resolution Validation
MCP-NET-01	Network	L1	– manual review	URL Validation and SSRF Mitigation
MCP-INPUT-01	Input Validation	L1	✓ met	JSON Schema Validation Evidence checks: TOOL-01, TOOL-03, RPC-03, TOOL-05, SEC-01, SEC-02, SEC-05 Auto-assessed from advertised schemas (present and valid), live rejection probes, and the tool-metadata poisoning scan.
MCP-LOG-02	Logging	L1	◐ partial	Secret Redaction in Logs Evidence checks: SEC-03 Supporting evidence only: SEC-03 scans advertised tool metadata for secret-like strings; server log output is not inspected, so a clean scan cannot prove log redaction (a leak still proves a gap).
MCP-SUPPLY-02	Supply Chain	L2	– manual review	Trusted Package Sources
MCP-INPUT-02	Input Validation	L2	✓ met	Input Bounds Enforcement Evidence checks: SEC-04 Auto-assessed from advertised schema constraints (enum/pattern/maxLength); runtime payload limits are not probed.
MCP-INPUT-03	Input Validation	L2	– manual review	Timeout Enforcement
MCP-NET-03	Network	L2	– manual review	TLS Enforcement MSSS marks this N/A for stdio-only deployments with no network access.
MCP-EXEC-02	Execution	L2	– manual review	Command Allowlisting See the SEC-06 advisory for advertised command tools; allowlist verification requires source review.
MCP-EXEC-03	Execution	L2	– manual review	Argument Separator Usage
MCP-AUTHZ-01	Authorization	L3	– manual review	OAuth Token Delegation MSSS marks this N/A for stdio transport with OS-level user isolation.
MCP-AUTHZ-02	Authorization	L3	– manual review	Per-Tool Scope Definition
MCP-AUTHZ-03	Authorization	L3	– manual review	Least Privilege Tool Design
MCP-AUTHZ-04	Authorization	L3	– manual review	Resource-Based Access Control
MCP-LOG-01	Logging	L3	– manual review	Comprehensive Audit Logging
MCP-DEPLOY-01	Deployment	L3	– manual review	Container Hardening
MCP-FS-03	Filesystem	L4	– manual review	Filesystem Sandboxing
MCP-SUPPLY-01	Supply Chain	L4	– manual review	Package Integrity Verification
MCP-DEPLOY-03	Deployment	L4	– manual review	Resource Limits and Rate Limiting
MCP-NET-02	Network	L4	– manual review	Egress Traffic Filtering
MCP-DEPLOY-02	Deployment	L4	– manual review	System Call Filtering (seccomp/AppArmor)
MCP-DEPLOY-04	Deployment	L4	– manual review	Runtime Integrity Monitoring Future control in MSSS v0.1 — implementation details TBD upstream.

Control taxonomy from the MCP Server Security Standard (MSSS), CC BY-SA 4.0, mcp-security-standard.org.

Behaviour regression

Fixture	Tool	Verdict	Detail
0001__echo__88dfa77a.json	echo	OK
0002__price__9b815a00.json	price	OK

Leave-behind: your regression gate

The recorded fixtures (demo/fixtures-modern, suite fingerprint sha256:148a7604db8d311f8810750bd1d69cae6581dcaaf57a9c08d02632c50ad13c09) are the behavioural contract of this server. Keep them in the repository and run the workflow below in CI — any breaking or value drift fails the build before it reaches your users.

# The recorded fixtures in demo/fixtures-modern are the behavioral contract: any drift fails this job.
name: mcp-proof regression gate
on:
  push:
  pull_request:
jobs:
  replay:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Install mcp-proof
        run: pip install git+https://github.com/YuCPbit/mcp-proof
      - name: Replay golden fixtures against the live server
        run: mcp-proof replay --fixtures demo/fixtures-modern -- .venv/bin/python tests/modern_target_server.py

Recommended next steps

KEEPCommit the fixtures directory and the CI workflow above — behavioural drift will then fail the build before users see it.
KEEPRe-audit after the next MCP spec revision or any SDK upgrade; identical behaviour reproduces the same fingerprint, so before/after is provable.