# MCP 2025-11-25 Compliance Matrix

This matrix tracks `infra-lens-mcp` against the current stable Model Context Protocol specification: **2025-11-25**.

Status legend:

- **Supported**: implemented and covered by existing tests or release checks.
- **Partial**: implemented for the current scope, but missing spec behavior, tests, or production hardening.
- **Delegated**: intentionally handled by an external gateway, client, or deployment control.
- **Unsupported**: not implemented in this package.

## Summary

| Area | Status | Evidence | Follow-up |
| --- | --- | --- | --- |
| stdio transport | Supported | `src/mcp.ts`, package `bin`, README quick start, unit/integration tests | None |
| Streamable HTTP transport | Partial | Stateless POST transport, request policy, progress-capable tool handlers, and integration tests are implemented | Future product decision for stateful GET/SSE and DELETE lifecycle |
| HTTP single endpoint path | Supported | Default canonical endpoint is `/mcp`, configurable with `MCP_HTTP_ENDPOINT_PATH`, and covered by unit tests | None |
| HTTP POST JSON-RPC handling | Supported | POST is restricted to the canonical endpoint with required Accept, Content-Type, and protocol-version guards before body parsing | None |
| HTTP GET/SSE behavior | Unsupported | GET returns 405 because a standalone server-to-client SSE stream is intentionally not exposed | Future issue only if stateful streaming becomes product scope |
| HTTP DELETE session termination | Unsupported | HTTP is intentionally stateless; DELETE returns 405 because no server-side session lifecycle exists today | Future issue only if stateful HTTP becomes scope |
| MCP-Protocol-Version header | Supported | Unsupported versions are rejected with 400 and current/backward-compatible versions are accepted by tests | None |
| MCP-Session-Id | Supported as stateless | Session IDs are not issued and client-provided `MCP-Session-Id` headers are rejected before body parsing | None |
| Origin validation | Supported | `src/http-security.ts` validates allowed origins for guarded HTTP profiles | None |
| Localhost-first binding | Supported | Default HTTP host is loopback and non-loopback startup fails closed without the required controls | None |
| Bearer token mode | Supported for local/dev | Constant-time local bearer validation is implemented and tested; production identity is delegated to an OAuth-aware gateway | None |
| OAuth protected resource metadata | Delegated | ADR 0006 selects external OAuth gateway mode; metadata advertises the configured resource and authorization servers | None |
| Token validation / audience binding | Delegated | Native token validation is intentionally out of scope; the trusted gateway owns issuer, audience, scope, and expiry checks | Future ADR only if strategy changes |
| Tools/list and tools/call | Supported | Runtime tool definitions are registered through MCP SDK and checked against `mcp.json` by metadata validation | None |
| Tool input schemas | Supported | Zod schemas exist for all current tools | None |
| Tool output schemas / structuredContent | Supported | Every current tool declares an output schema and returns matching structured content while preserving readable JSON text | None |
| Long-running tool cancellation/progress | Supported | `analyze_server` propagates MCP cancellation through sampling and SSH cleanup, emits token-bound progress, and never persists partial runs; `analyze_server_snapshot` provides the fast path | None |
| Resources | Unsupported | This server is tool-only today | Future issue if resources become product scope |
| Prompts | Unsupported | This server is tool-only today | Future issue if prompt templates become product scope |
| Logging over stderr for stdio | Supported | Logger writes operational messages outside stdout JSON-RPC | None |
| Security threat model | Supported | Machine-readable threat register, accepted-risk records, and the executable `test:abuse` suite | None |
| Remote-safe SSH credential boundaries | Supported | Remote-safe profiles reject inline SSH secrets, require host allowlists, and are covered by schema/runtime regression tests | None |
| Connector documentation | Supported | Client recipes cover ChatGPT, Claude, Cursor, VS Code, local stdio, and guarded HTTP deployment | Public connector publication still requires a verified external OAuth/HTTPS deployment |

## Required P0 follow-ups

No P0 MCP compliance follow-ups remain open in this matrix. Stateful HTTP streaming/session lifecycle remains a future product decision, not a current compliance blocker.

## Current publication stance

The npm package artifact can be internally consistent while public connector publication remains blocked. `pnpm run check:metadata` therefore reports two separate concepts:

- `packageReady: true` for package, manifest, repository, file-list, and optional `dist` consistency.
- `connectorPublishReady: false` with an explicit `publishBlocker` while production OAuth/HTTPS gateway requirements remain outside this package.

This is intentional. Do not change `connector_readiness.publishReady` to `true` until the external production OAuth/HTTPS gateway is deployed and verified, and no `accepted-blocker` threat remains.

## Verification commands

```bash
pnpm run lint
pnpm run test:coverage
pnpm run test:e2e
pnpm run docs:api:check
pnpm run check:metadata
node scripts/release-state.mjs --dry-run
```