--- title: "Conformance" url: https://recursiveai.org/onemodelcontext/docs/conformance/ description: "OneModelContext is checked against the protocol's official conformance suite, run as a black box: it is installed from its published package and driven…" version: "1.0.1" source: https://github.com/recursive-ai-oss/onemodelcontext-csharp/blob/d72d78c39c934697857be92dd8514efd4c415a88/conformance/README.md --- # Conformance OneModelContext is checked against the protocol's official conformance suite, run as a black box: it is installed from its published package and driven through its command line. Its files are never read or copied into this repository. | | | |---|---| | Suite | `@modelcontextprotocol/conformance` **0.2.0-alpha.12** (npm) | | Licence | MIT (from the package's npm metadata) | | Revisions with scenarios | 2025-11-25 and 2026-07-28 as requirement sets (`--requirements`), plus scenarios that apply to 2025-03-26, 2025-06-18 and extensions | | Not covered by the suite | 2024-11-05 has no scenarios | The newest stable release, 0.1.16, has no 2026-07-28 scenarios, which is why an alpha is pinned. A newer suite does not retroactively change what a released version of this library was checked against. ## How the suite tests - **Servers** are tested over HTTP only: `server --url `. The suite connects as a client; there is no stdio server mode. - **Clients** are tested by running them: `client --command ""`. The suite starts a test server, appends its URL to the command and sets `MCP_CONFORMANCE_SCENARIO` (and `MCP_CONFORMANCE_PROTOCOL_VERSION` when a version is requested). - `--scenario ` runs one scenario; `--requirements ` runs what a revision requires, frozen at its release. ## Running it ```sh export ONEMODELCONTEXT_CONFORMANCE_CACHE=/some/directory/outside/the/repository conformance/run.sh install # once; installs the pinned suite there conformance/run.sh list # the suite's scenarios conformance/run.sh server --url http://127.0.0.1:PORT/mcp --out results --scenario tools-list conformance/run.sh client --command "dotnet run --project ..." --out results --requirements 2026-07-28 conformance/run.sh regression --out results --url http://127.0.0.1:PORT/mcp --command "..." ``` `regression` runs the scenarios named in [scenarios.txt](https://github.com/recursive-ai-oss/onemodelcontext-csharp/blob/d72d78c39c934697857be92dd8514efd4c415a88/conformance/scenarios.txt), which is what continuous integration runs. Each line names the revision whose variant of the scenario runs (`--spec-version`). Servers must bind a loopback address and a free port; read the port back instead of fixing one. ## The conformance server `conformance/Server` is a small program that serves a `ContextServer` full of the tools, resources and prompts the scenarios call. It ships in no package. ```sh dotnet run --project conformance/Server -- --http --port 0 # Streamable HTTP on 127.0.0.1; prints the URL dotnet run --project conformance/Server -- --stdio # newline-delimited JSON-RPC on stdin and stdout ``` The suite has no 2024-11-05 scenarios, and `--requirements` exists only for 2025-11-25 and 2026-07-28; the 2025-03-26 and 2025-06-18 variants run with `--scenario ... --spec-version`, or `--spec-version` alone for every applicable scenario. ## Results (suite 0.2.0-alpha.12, every scenario the suite lists) Server, run by `gate-server.sh` on both hosts (`listener` and `aspnetcore`), with the same result on each: | Revision | Scenarios | Result | |---|---|---| | 2026-07-28 | 35 | all pass | | 2025-11-25 | 34 | all pass | | 2025-06-18 | 27 | all pass | | 2025-03-26 | 1 | all pass | | extensions (Tasks, Skills) | 13 | all pass; the suite itself skips `tasks-status-notifications` | Client, run by `gate-client.sh` with the conformance client: | Revision | Scenarios | Result | |---|---|---| | 2026-07-28 | 33 | all pass | | 2025-11-25 | 19 | all pass | | 2025-06-18 | 5 | all pass | | 2025-03-26 | 2 | all pass | | extensions | 10 | 7 pass; 3 disputed / out of scope (below) | The suite lists no scenarios for 2024-11-05; that revision is covered by the interop harness (`interop/`). ### Disputed / out of scope These scenarios fail because they test authorization extensions this library does not implement. They are listed here rather than hidden, and they are not in the regression list. | Scenario | Why it is out of scope | |---|---| | `auth/dpop` | DPoP for MCP (SEP-1932, RFC 9449) is an Experimental extension (`ext-auth/specification/experimental/`). The extensions overview says the Experimental stage guarantees nothing and the design may change or disappear. This library ships Stable extensions only. | | `auth/dpop-nonce` | Same as `auth/dpop`. | | `auth/wif-jwt-bearer` | Workload Identity Federation (SEP-1933) is a proposal, not yet an extension at any stage. | The Stable authorization extensions (`modelcontextprotocol.io/extensions/auth/overview`) are Client Credentials and Enterprise-Managed Authorization; both are implemented and their client scenarios pass. DPoP will be added in a minor release once it reaches Beta or Stable. ## The authorization server The suite's `authorization` command tests an authorization server. `conformance/AuthorizationServer` is a small host for `AuthorizationServer` that approves every request for one client, because the suite plays the user's browser, and `conformance/authorization-server.sh` runs the suite against it, answering the "open this URL in your browser" step itself with curl: ```sh export ONEMODELCONTEXT_CONFORMANCE_CACHE=/some/directory/outside/the/repository export ONEMODELCONTEXT_AS_PORT=PORT ONEMODELCONTEXT_CALLBACK_PORT=OTHER_PORT conformance/authorization-server.sh --out results --spec-version 2026-07-28 ``` The suite has two authorization-server scenarios, `authorization-server-metadata-endpoint` and `authorization-code-grant`. The second needs the first to have run in the same process, which is what the command does without `--scenario`. Both pass at every `--spec-version` they apply to (2025-03-26: 2 of 2 checks; 2025-06-18: 2 of 2; 2025-11-25 and 2026-07-28: 3 of 3, including the check that the metadata advertises `client_id_metadata_document_supported`). ## The suite's scenario list (`list` output, 0.2.0-alpha.12) Bracketed revisions are where a scenario applies. ```text Server scenarios (test against a server): - server-initialize [2025-06-18,2025-11-25] - server-session-lifecycle [2025-03-26,2025-06-18,2025-11-25] - server-stateless [2026-07-28] - logging-set-level [2025-06-18,2025-11-25] - ping [2025-06-18,2025-11-25] - completion-complete [2025-06-18,2025-11-25,2026-07-28] - tools-list [2025-06-18,2025-11-25,2026-07-28] - tools-call-simple-text [2025-06-18,2025-11-25,2026-07-28] - tools-call-image [2025-06-18,2025-11-25,2026-07-28] - tools-call-audio [2025-06-18,2025-11-25,2026-07-28] - tools-call-embedded-resource [2025-06-18,2025-11-25,2026-07-28] - tools-call-mixed-content [2025-06-18,2025-11-25,2026-07-28] - tools-call-with-logging [2025-06-18,2025-11-25] - tools-call-error [2025-06-18,2025-11-25,2026-07-28] - tools-call-with-progress [2025-06-18,2025-11-25,2026-07-28] - tools-call-sampling [2025-06-18,2025-11-25] - tools-call-elicitation [2025-06-18,2025-11-25] - json-schema-2020-12 [2025-11-25,2026-07-28] - elicitation-sep1034-defaults [2025-11-25] - server-sse-polling [2025-11-25] - server-sse-multiple-streams [2025-11-25,2026-07-28] - elicitation-sep1330-enums [2025-11-25] - resources-list [2025-06-18,2025-11-25,2026-07-28] - resources-read-text [2025-06-18,2025-11-25,2026-07-28] - resources-read-binary [2025-06-18,2025-11-25,2026-07-28] - resources-templates-read [2025-06-18,2025-11-25,2026-07-28] - resources-subscribe [2025-06-18,2025-11-25] - resources-unsubscribe [2025-06-18,2025-11-25] - sep-2164-resource-not-found [2026-07-28] - sep-2640-skills-directory [extension] - sep-2640-skills-enumeration [extension] - sep-2640-skills-manifest [extension] - prompts-list [2025-06-18,2025-11-25,2026-07-28] - prompts-get-simple [2025-06-18,2025-11-25,2026-07-28] - prompts-get-with-args [2025-06-18,2025-11-25,2026-07-28] - prompts-get-embedded-resource [2025-06-18,2025-11-25,2026-07-28] - prompts-get-with-image [2025-06-18,2025-11-25,2026-07-28] - dns-rebinding-protection [2025-11-25,2026-07-28] - caching [2026-07-28] - http-header-validation [2026-07-28] - http-custom-header-server-validation [2026-07-28] - tasks-lifecycle [extension] - tasks-capability-negotiation [extension] - tasks-wire-fields [extension] - tasks-request-state-removal [extension] - tasks-mrtr-input [extension] - tasks-request-headers [extension] - tasks-dispatch-and-envelope [extension] - tasks-status-notifications [extension] - tasks-required-task-error [extension] - tasks-mrtr-composition [extension] - input-required-result-basic-elicitation [2026-07-28] - input-required-result-basic-sampling [2026-07-28] - input-required-result-basic-list-roots [2026-07-28] - input-required-result-request-state [2026-07-28] - input-required-result-multiple-input-requests [2026-07-28] - input-required-result-multi-round [2026-07-28] - input-required-result-missing-input-response [2026-07-28] - input-required-result-non-tool-request [2026-07-28] - input-required-result-result-type [2026-07-28] - input-required-result-unsupported-methods [2026-07-28] - input-required-result-tampered-state [2026-07-28] - input-required-result-capability-check [2026-07-28] - input-required-result-ignore-extra-params [2026-07-28] - input-required-result-validate-input [2026-07-28] Client scenarios (test against a client): - initialize [2025-06-18,2025-11-25] - tools_call [2025-06-18,2025-11-25,2026-07-28] - elicitation-sep1034-client-defaults [2025-11-25] - sse-retry [2025-11-25] - request-metadata [2026-07-28] - auth/metadata-default [2025-11-25,2026-07-28] - auth/metadata-var1 [2025-11-25,2026-07-28] - auth/metadata-var2 [2025-11-25,2026-07-28] - auth/metadata-var3 [2025-11-25,2026-07-28] - auth/basic-cimd [2025-11-25,2026-07-28] - auth/scope-from-www-authenticate [2025-11-25,2026-07-28] - auth/scope-from-scopes-supported [2025-11-25,2026-07-28] - auth/scope-omitted-when-undefined [2025-11-25,2026-07-28] - auth/scope-step-up [2025-11-25,2026-07-28] - auth/scope-retry-limit [2025-11-25,2026-07-28] - auth/token-endpoint-auth-basic [2025-06-18,2025-11-25,2026-07-28] - auth/token-endpoint-auth-post [2025-06-18,2025-11-25,2026-07-28] - auth/token-endpoint-auth-none [2025-06-18,2025-11-25,2026-07-28] - auth/pre-registration [2025-11-25,2026-07-28] - auth/2025-03-26-oauth-metadata-backcompat [2025-03-26] - auth/2025-03-26-oauth-endpoint-fallback [2025-03-26] - auth/resource-mismatch [2026-07-28] - auth/offline-access-scope [2026-07-28] - auth/offline-access-not-supported [2026-07-28] - auth/authorization-server-migration [2026-07-28] - auth/iss-supported [2026-07-28] - auth/iss-not-advertised [2026-07-28] - auth/iss-supported-missing [2026-07-28] - auth/iss-wrong-issuer [2026-07-28] - auth/iss-unexpected [2026-07-28] - auth/iss-normalized [2026-07-28] - auth/metadata-issuer-mismatch [2026-07-28] - auth/client-credentials-jwt [extension] - auth/client-credentials-basic [extension] - auth/enterprise-managed-authorization [extension] - auth/dpop [extension] - auth/dpop-nonce [extension] - auth/wif-jwt-bearer [extension] - sep-2322-client-request-state [2026-07-28] - http-standard-headers [2026-07-28] - http-custom-headers [2026-07-28] - http-invalid-tool-headers [2026-07-28] - json-schema-ref-no-deref [2026-07-28] - json-schema-2020-12-preservation [2025-11-25,2026-07-28] - sep-2640-client-no-prefetch [extension] - sep-2640-client-verify-digest [extension] - sep-2640-client-verify-size [extension] - sep-2640-client-verify-frontmatter [extension] Authorization server scenarios (test against an authorization server): - authorization-server-metadata-endpoint [2025-03-26,2025-06-18,2025-11-25,2026-07-28] - authorization-code-grant [2025-03-26,2025-06-18,2025-11-25,2026-07-28] ``` Model Context Protocol® is a registered trademark of LF Projects, LLC. OneModelContext is an independent project and is not affiliated with or endorsed by LF Projects, LLC or the Model Context Protocol project.