← Back to search

io.github.CSOAI-ORG/mcp-spec-compliance-mcp

CSOAI-ORG streamable_http Scanned 20d ago

MCP Spec Compliance MCP — audits any MCP server.json against the official Model Context Protocol

B
85.7 / 100

Versions

1.0.1latest
first seen Jun 30, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 6

audit_server_json
annotations: none low

Full conformity audit of an MCP server.json. Args: server_json: The contents of an MCP server.json file. spec_version: Target spec revision. Defaults to latest. Returns: {pass, score_0_100, errors, warnings, recommendations, spec_version}

server_json dict spec_version str
check_required_fields
annotations: none low

Fast gate: only check required fields. Args: server_json: server.json contents. spec_version: target spec version. Returns: {pass, missing}

server_json dict spec_version str
check_naming_conventions
annotations: none low

Lint the slug, version, and tool names. Args: server_json: server.json contents. tool_names: Optional list of tool names to validate against snake_case convention. Returns: {pass, issues}

tool_names string server_json dict
list_spec_versions
annotations: none low

Return the supported MCP spec revisions + which fields are required for each.

generate_passing_template
annotations: none low

Generate a minimal-but-passing server.json template. Args: org: GitHub org slug. slug: Package slug (must end in -mcp by convention). Returns: {template}

org str slug str
sign_conformity_report
annotations: none low

HMAC-sign a conformity report so authors can publish it as evidence. Args: audit_result: Output of audit_server_json(). Returns: {signed, signature, sealed_at, cert_id}

audit_result dict

Permissions 3

network medium
Server uses network capabilities via: urllib
filesystem low
Server uses filesystem capabilities via: open(), os
env_vars low
Server uses env_vars capabilities via: os.environ

Scan Findings 23

low
Tool 'audit_server_json' has no annotations annotation_checker · 100%
low
Tool 'check_required_fields' has no annotations annotation_checker · 100%
low
Tool 'check_naming_conventions' has no annotations annotation_checker · 100%
low
Tool 'list_spec_versions' has no annotations annotation_checker · 100%
low
Tool 'generate_passing_template' has no annotations annotation_checker · 100%
low
Tool 'sign_conformity_report' has no annotations annotation_checker · 100%
high
Remote transport without authentication auth_checker · 70%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: audit_server_json manifest_parser · 90%
info
Tool: check_required_fields manifest_parser · 90%
info
Tool: check_naming_conventions manifest_parser · 90%
info
Tool: list_spec_versions manifest_parser · 90%
info
Tool: generate_passing_template manifest_parser · 90%
info
Tool: sign_conformity_report manifest_parser · 90%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (2) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
low
Permission: filesystem access detected permission_analyzer · 80%
low
Permission: env_vars access detected permission_analyzer · 90%
info
No dependency files found for SBOM generation sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%