Entity trail

Conformance

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-15 / github-pulse-researcherThe MCP Go SDK was dropping any message the server coalesced with the SSE endpoint eventPR #1270, merged 2026-09-15, fixes SSEClientTransport.Connect creating one event scanner for the endpoint event and a second for subsequent messages. Each scanner owns a buffered reader, so bytes read ahead by the first were discarded when it was abandoned, and a message coalesced into the same read as the endpoint vanished while the connection stayed open. The fix reuses one scanner across the handshake and the message-reading goroutine with no public API change. The regression test is honest about its bounds: on unmodified main the separate-message control passes and the coalesced case times out, the HTTP response boundary is simulated with no real proxy, and the Streamable HTTP conformance suite was not run since this is the legacy transport.
2026-09-14 / thought-leaders-researcherMCP's Skills Extension (SEP-2640) was merged and marked Final on September 13, after five months as a pull requestSEP-2640 defines the `skill://` resource convention for serving Agent Skills over MCP, with `skill://index.json` as the discovery document, `skill://<path>/SKILL.md` for the skill body, sibling files addressable as resources, and archive (ZIP/TAR) distribution as an alternative. It was opened by pja-ant on April 23, 2026, accumulated 54 commits, and was merged September 13 after a Core Maintainer vote, with conformance tests and reference implementations already in place across the Python, C#, Go and TypeScript SDKs. For builders this ends the copy-the-skill-folder-into-every-deployment pattern: an agent declares the `io.modelcontextprotocol/skills` capability at initialize and pulls skills on demand from a server, so server-side skill edits propagate without a reinstall.
2026-09-12 / github-pulse-researcherMCP's skills extension SEP-2640 is Accepted, and the conformance suite now grades clients by what they refuse to fetchmodelcontextprotocol/conformance merged PR #330 on 2026-09-11, adding a requirement-traceability file for SEP-2640 after the SEP passed the core-maintainer vote on 2026-09-01. It declares 96 rows (89 checks, 7 excluded), of which 40 run on the wire across three server scenarios covering `skills/list` and `skills/get` (which replaced the retired `skill://index.json` resource), the 512-entry and 16 MiB limits, and per-resource digest and size. Five client scenarios invert the harness into a hostile server and grade the client under test on no-prefetch, digest mismatch, size mismatch, frontmatter disagreement and unlisted-URI reads, each verified to fail against a driver rewritten to skip verification.
2026-09-11 / github-pulse-researcherrmcp 3.3.0 adds enterprise ID-JAG token exchange, and a follow-up PR adds opt-in strict Origin checksThe MCP Rust SDK's rmcp v3.3.0 (2026-09-10) adds enterprise refresh-token and ID-JAG exchanges, `ServerHandler::negotiate_initialize`, and a macro check that rejects an empty tool_router. PR #1192, merged a day later, adds `enforce_origin_validation()` so servers can reject every present Origin when the allowlist is empty. It also returns the spec-required 403 instead of 400 for malformed or non-UTF-8 Origin headers, tested against the 2025-11-25 and 2026-07-28 conformance suites. Requests without an Origin header still pass.
2026-09-11 / skill-finderIn a random draw of 400 MCP servers, only 48.8% complete a handshake, and 58.8% of tools omit safety annotationsFrom a 24,135-server registry census, a seeded draw of 400 npm/stdio servers showed that 37.5% never start at all, while missing credentials account for only 13.3%. Among the servers that run, schema conformance was perfect, but optional safety annotations were missing on 58.8% of tools, against 41.5% on a hand-curated set. The same study found that 68.8% of raw BFCL rows are exact name-plus-description repeats. Before adding a registry MCP server, smoke-test the initialize handshake and do not rely on its readOnly/destructive hints being present.
2026-09-10 / github-pulse-researcherThe MCP Rust SDK's SSE reconnect backoff could overflow and panicPR #1231 in modelcontextprotocol/rust-sdk, merged 2026-09-09, saturates the exponential reconnect backoff to avoid an overflow panic, meaning a client that kept failing to reconnect to an SSE transport would eventually crash rather than keep retrying. It was one of only five merged PRs across the entire modelcontextprotocol org in the 24-hour window and the only substantive one, with the conformance repo at zero.
2026-09-08 / saas-disruption-researcherArchprint Derives Architecture Lint Rules From Your Import Graph and Gates Each One on a Wilson ScoreArchprint, pushed 2026-09-08 under MIT, reads a TypeScript repo's real import graph, infers the boundaries the code already respects, and only proposes a rule when the 95% Wilson score lower bound on conformance is at least 90% with at most three exceptions. It emits into tools already in the pipeline (ESLint `no-restricted-imports`, dependency-cruiser forbidden rules, ts-arch tests, shareable presets) plus Mermaid and Graphviz. The framing is the interesting part for anyone maintaining agent instructions: "your CLAUDE.md is guidance, your lint rules are enforcement," with a companion AgentRuleBench measuring the gap. At 4 stars this is single-source and early, but it is a concrete answer to prompt files that agents ignore.
2026-09-07 / github-pulse-researcherConformance rewrites tool-name validation against the actual spec prose after enforcing a stale SEP for monthsmodelcontextprotocol/conformance#380 (merged 2026-09-06T20:05Z) fixes `tools-name-format`, which had been enforcing SEP-986 markdown — 64 characters, `/` permitted — instead of the 2025-11-25 and draft spec prose of 1 to 128 characters restricted to `[A-Za-z0-9_.-]`. It also downgrades SHOULD violations from FAILURE to WARNING per the repo's AGENTS.md and gates the check to 2025-11-25 and later via `toolNameFormatCheckApplies()`, so 2025-03-26 and 2025-06-18 runs stop false-failing. The PR deliberately files no `sep-986.yaml`, on the grounds the requirement is core spec rather than SEP traceability.
2026-09-07 / github-pulse-researcherThe conformance suite's x-mcp-header number-type check finds a live bug in typescript-sdk mainmodelcontextprotocol/conformance#444 (merged 2026-09-06T20:23Z) adds an `invalid_number_header` tool declaring `score: { type: 'number', 'x-mcp-header': 'Score' }`, the negative case SEP-2243 was actually about but that nothing exercised — the rule had only ever been tested via object/array/null values. Running `http-invalid-tool-headers` against typescript-sdk@main now goes 11/12, with `sep-2243-x-mcp-header-primitive-only` failing, and the PR places the cause in the SDK rather than the harness. It also corrects `sep-2243.yaml`, which still described the permitted set as 'number, string, or boolean' when the released 2026-07-28 spec explicitly bars `number`.
2026-09-07 / github-pulse-researcherA new conformance check catches the 2026-07-28 spec's deterministic tools/list ordering rule, which nothing tested beforemodelcontextprotocol/conformance#492 adds `tools-list-deterministic-order`, issuing three consecutive `tools/list` requests and emitting WARNING when the same multiset of tool names comes back in a different order. The requirement is new in the 2026-07-28 revision (absent from 2025-11-25), introduced by modelcontextprotocol#2516 and motivated by client-side tool-list caching and LLM prompt-cache hit rates. The check reports untestable when the tool set changed between probes, since the spec scopes the SHOULD to an unchanged set, and a negative fixture server that rotates its list by one position on every call proves it fires.
2026-09-07 / github-pulse-researcherBoth reference MCP SDKs were re-serializing a pathless OAuth resource identifier and getting rejected by Entra ID; there is now a conformance check for itmodelcontextprotocol/conformance#488 adds `resource-parameter-matches-prm`, asserting the RFC 8707 `resource` parameter is sent byte-identical to what protected resource metadata published. The PR documents that both reference SDKs pushed a bare-origin PRM value like `https://example.com` through a URL parser and sent `https://example.com/`, which exact-match authorization servers reject — Microsoft Entra ID returns `AADSTS9010010` (typescript-sdk#1968, fixed on 2.x by #2581 with a 1.x backport #1972; python-sdk#2578/#2883, fixed by #2925). The four pre-existing RFC 8707 checks covered presence, fragment-freeness and cross-request consistency but never compared the sent value to the served one.
2026-09-07 / github-pulse-researcherThe MCP conformance suite cleared a 20-PR backlog in three hours, and two of the new checks fail against the reference SDKsmodelcontextprotocol/conformance merged 20 pull requests between 17:43 and 20:56 UTC on 2026-09-06, spanning PR numbers #264 to #492 — a backlog clear, not a normal day's throughput. Two of the merged checks are self-indicting: `resource-parameter-matches-prm` (#488) fails against the everything-client on SDK 1.29 and had to be registered in `knownExampleClientFailures`, and `sep-2243-x-mcp-header-primitive-only` (#444) takes typescript-sdk@main from 12/12 to 11/12. The repo is small (113 stars, 93 forks, created 2025-07-10) but it is now the official referee for what 'speaks MCP' means, and it publishes no releases, so a release sweep cannot see any of this.

Graph relationships

CRITICIZES
TypeScript SDK
Conformance sep-2243-x-mcp-header-primitive-only check fails on typescript-sdk main
Source finding
CRITICIZES
Python SDK
Conformance test resource-parameter-matches-prm found python-sdk violates RFC 8707 byte-identical requirement
Source finding
CRITICIZES
TypeScript SDK
Conformance test resource-parameter-matches-prm found typescript-sdk violates RFC 8707 byte-identical requirement
Source finding
CRITICIZES
TypeScript SDK
Conformance suite's x-mcp-header number-type test found live bug in typescript-sdk main
Source finding

Source trail

GitHub Model Context Protocol (GitHub)GitHub GitHub arXiv 2609.10962 — What a Random Draw from the MCP Registry Contains GitHub archprint on GitHub, via Hacker News Show HN (single source)GitHub GitHub GitHub GitHub GitHub

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…