temrel-agentic-toolkit/tools/mcp-spec-audit at main · Temrel/temrel-agentic-toolkit · GitHub
//files/disambiguate" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
//files/disambiguate;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading. Please reload this page.
Temrel
temrel-agentic-toolkit
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
FilesExpand file tree
main
/mcp-spec-audit<br>Copy path
Directory actions
More options<br>More options
Directory actions
More options<br>More options
Latest commit
History<br>History<br>History
main
/mcp-spec-audit<br>Copy path
Top
Folders and files<br>NameNameLast commit message<br>Last commit date<br>parent directory<br>..<br>src
src
test
test
.gitignore
.gitignore
README.md
README.md
package-lock.json
package-lock.json
package.json
package.json
rules.json
rules.json
tsconfig.json
tsconfig.json
View all files
README.md<br>Outline<br>mcp-spec-audit (CLI)
Audit an MCP server codebase before the MCP 2026-07-28 spec revision lands. mcp-spec-audit statically scans the code, classifies every finding as BREAKS , DEPRECATED , or ADVISORY , and writes a markdown migration checklist with file:line references, each finding linking to the relevant spec material.
It pairs with the mcp-spec-audit skill: the skill lets an agent run the audit for you and summarize the findings; the CLI is the scanner itself, usable standalone or in CI.
Guarantees: pure static analysis. No network calls, no code execution, and it never modifies the scanned codebase.
Why: the stateless core
The 2026-07-28 release candidate reshapes MCP around a stateless core. The initialize handshake and the Mcp-Session-Id header are gone, so any request can land on any server instance and sticky routing or shared session stores are no longer needed. The experimental 2025-11-25 Tasks API graduates with a changed lifecycle (tasks/get, tasks/update, tasks/cancel; tasks/list is removed). Roots, Sampling, and protocol-level Logging are deprecated with a 12-month window. Authorization is hardened around OAuth 2.1, and tools/list responses gain ttlMs and cacheScope so clients can cache. Servers written against earlier revisions or SDK v1 will keep working for a while, but the migration is real work, and it is cheaper to find the sites now than after the window closes.
What it checks
Severity<br>Meaning<br>Rules cover
BREAKS<br>Will not work against 2026-07-28; exit code 1<br>Experimental 2025-11-25 Tasks API usage: tasks/result, tasks/list, notifications/tasks/status, CreateTaskResult, taskSupport, io.modelcontextprotocol/related-task and model-immediate-response _meta keys
DEPRECATED<br>12-month window; plan the replacement<br>Roots (roots/list, list_roots, listRoots), Sampling (sampling/createMessage, create_message, createMessage), protocol-level Logging (logging/setLevel, notifications/message, send_log_message, sendLoggingMessage)
ADVISORY<br>Review; the stateless revision replaces or obsoletes these<br>Mcp-Session-Id handling, sessionIdGenerator, initialize-handshake hooks, sticky sessions and session stores, API-key auth where OAuth 2.1 is now mandated, mcp.server.fastmcp imports (renamed MCPServer in Python SDK v2), CommonJS require() of the TypeScript SDK (v2 is ESM-only), monolithic @modelcontextprotocol/sdk imports and dependencies (v2 splits into @modelcontextprotocol/server and @modelcontextprotocol/client), uncached tools/list calls that could honor ttlMs
Python and TypeScript/JavaScript get language-specific rules. Go and C# files are scanned too, but only by the language-agnostic protocol-string rules (JSON-RPC method names, headers, _meta keys).
Install
cd tools/mcp-spec-audit<br>npm install<br>npm run build<br>npm link # optional: puts `mcp-spec-audit` on your PATH
Requires Node 20+. During development, npm run dev -- runs from source via tsx.
Usage
[--json] [--report ] [--no-report] [--rules ]">mcp-spec-audit path> [--json] [--report file>] [--no-report] [--rules file>]
is the root of the MCP server codebase (or a single file).
--json switches the terminal output to machine-readable JSON.
--report sets the markdown report path (default mcp-spec-audit-report.md in the current directory);...