MCP spec conformance: 8 requirement(s) violated (via @hasmcp/mcp-spec-test) — spec 2026-07-28

When a client negotiates the newer 2026-07-28 MCP spec revision against the hosted gitmcp.io/idosal/git-mcp server (via mcp-remote), the server/discover calls fail with Bad Request: Mcp-Session-Id header is required, and separately, a fresh handshake offering 2025-11-25 gets answered with 2025-03-26 — a revision outside the server's own advertised supported window (2026-07-28, 2025-11-25). Because server/discover never succeeds, every downstream capability check has to be skipped as unverifiable. Note that on the older 2025-11-25 revision the same server is fully conformant on what could be checked (0 failures) — this is specific to the newer revision's handling.

Conformance report

MCP 2026-07-28 conformance report

Verdict: not conformant — 8 requirements violated.

Failed (8)

the server deviates from the spec here

server/discover

• server/discover is answered without a session or handshake expected 200, got 0: {"_raw":"no response within 10000ms"}

0 !== 200

• server/discover advertises the versions the server can serve server/discover unexpected JSON-RPC error: {"code":-32001,"message":"mcp-remote: Streamable HTTP error: Error POSTing to endpoint: {"jsonrpc":"2.0","error":{"code":-32000,"message":"Bad Request: Mcp-Session-Id header is required"},"id":null}"}
• server/discover is a CacheableResult with usable cache hints server/discover unexpected JSON-RPC error: {"code":-32001,"message":"mcp-remote: Streamable HTTP error: Error POSTing to endpoint: {"jsonrpc":"2.0","error":{"code":-32000,"message":"Bad Request: Mcp-Session-Id header is required"},"id":null}"}
• server/discover reports server identity and capabilities server/discover unexpected JSON-RPC error: {"code":-32001,"message":"mcp-remote: Streamable HTTP error: Error POSTing to endpoint: {"jsonrpc":"2.0","error":{"code":-32000,"message":"Bad Request: Mcp-Session-Id header is required"},"id":null}"}
• server/discover is stable across calls within its own TTL server/discover unexpected JSON-RPC error: {"code":-32001,"message":"mcp-remote: Streamable HTTP error: Error POSTing to endpoint: {"jsonrpc":"2.0","error":{"code":-32000,"message":"Bad Request: Mcp-Session-Id header is required"},"id":null}"}
• server/discover advertises a revision this suite supports server/discover unexpected JSON-RPC error: {"code":-32001,"message":"mcp-remote: Streamable HTTP error: Error POSTing to endpoint: {"jsonrpc":"2.0","error":{"code":-32000,"message":"Bad Request: Mcp-Session-Id header is required"},"id":null}"}

Version negotiation

• a request with no version at all is served on the default a version-less tools/list must be served, not refused: {"code":-32001,"message":"mcp-remote: Streamable HTTP error: Error POSTing to endpoint: {"jsonrpc":"2.0","error":{"code":-32000,"message":"Bad Request: Mcp-Session-Id header is required"},"id":null}"}

Official SDK interop

• the handshake settles on a revision inside the supported window a client offering 2025-11-25 was answered with 2025-03-26, outside the supported window (2026-07-28, 2025-11-25)

Not verified (22)

skipped; a skip is not a pass

Capability methods

• tools/list returns schema-conformant tools cannot determine what the target supports — server/discover returned no result (status 0)
• tools/call on an unknown tool is an error, not a crash cannot determine what the target supports — server/discover returned no result (status 0)
• tools/call returns a schema-conformant CallToolResult cannot determine what the target supports — server/discover returned no result (status 0)
• prompts/list returns schema-conformant prompts cannot determine what the target supports — server/discover returned no result (status 0)
• prompts/get returns messages with a role and content cannot determine what the target supports — server/discover returned no result (status 0)
• resources/list returns schema-conformant resources cannot determine what the target supports — server/discover returned no result (status 0)
• resources/templates/list returns schema-conformant templates cannot determine what the target supports — server/discover returned no result (status 0)
• resources/read returns contents for every sampled resource cannot determine what the target supports — server/discover returned no result (status 0)
• resources/read on an unknown uri is an error cannot determine what the target supports — server/discover returned no result (status 0)
• following nextCursor terminates and does not repeat a page cannot determine what the target supports — server/discover returned no result (status 0)
• an invalid pagination cursor is rejected (SHOULD) cannot determine what the target supports — server/discover returned no result (status 0)

Version negotiation

• a version declared in _meta is accepted cannot determine what the target supports — server/discover returned no result (status 0)
• an unsupported version is rejected with the supported list cannot determine what the target supports — server/discover returned no result (status 0)
• clientInfo is optional (SHOULD, not MUST) cannot determine what the target supports — server/discover returned no result (status 0)

Result envelope

• every result carries the required resultType cannot determine what the target supports — server/discover returned no result (status 0)
• cacheable list results carry the schema-required cache hints cannot determine what the target supports — server/discover returned no result (status 0)
• results identify the server in _meta cannot determine what the target supports — server/discover returned no result (status 0)
• a client on an older version receives no newer-revision fields cannot determine what the target supports — server/discover returned no result (status 0)

subscriptions/listen

• subscriptions/listen acknowledges only the opted-in notification types cannot determine what the target supports — server/discover returned no result (status 0)
• the acknowledgment carries the subscription id for correlation cannot determine what the target supports — server/discover returned no result (status 0)
• a listen requesting no notification types is not a subscription to everything cannot determine what the target supports — server/discover returned no result (status 0)
• a cancelled subscription ends with a conformant teardown result, if it sends one cannot determine what the target supports — server/discover returned no result (status 0)

Passed (6)

checked and conformant

server/discover

• the suite is reading a schema that matches the features it selected

Result envelope

• schema sanity: the envelope fields match the features selected

Official SDK interop

• the official SDK does not yet implement the newest revision
• a stock official-SDK client completes the handshake
• a stock official-SDK client can list tools

subscriptions/listen

• schema sanity: SubscriptionsListenResult requires _meta and resultType

How to reproduce

With Docker:

docker pull hasmcp/mcp-spec-test:latest
docker run --rm hasmcp/mcp-spec-test -c "npx -y mcp-remote https://gitmcp.io/idosal/git-mcp" --spec-version 2026-07-28

Without Docker (npx):

npx @hasmcp/mcp-spec-test@latest -c "npx -y mcp-remote https://gitmcp.io/idosal/git-mcp" --spec-version 2026-07-28

This issue was filed as part of an automated MCP conformance sweep. Since gitmcp.io is a hosted, live service, this could also reflect transient behavior at the time of the test rather than a permanent bug — please feel free to close if it doesn't reproduce on your end. The older 2025-11-25 revision passed with 0 failures, so this looks specific to how the newer revision's server/discover/session handling is implemented.