
Product
Introducing Reachability for PHP
Reachability analysis for PHP is now available in experimental, helping teams identify which vulnerabilities are actually exploitable.
@modelcontextprotocol/conformance
Advanced tools
A framework for testing MCP (Model Context Protocol) client and server implementations against the specification.
A framework for testing MCP (Model Context Protocol) client and server implementations against the specification.
[!WARNING] This repository is a work in progress and is unstable. Join the conversation in the #conformance-testing-wg in the MCP Contributors discord.
For SDK maintainers: See SDK Integration Guide for a streamlined guide on integrating conformance tests into your SDK repository.
# Using the everything-client (recommended)
npx @modelcontextprotocol/conformance client --command "tsx examples/clients/typescript/everything-client.ts" --scenario initialize
# Run an entire suite of tests
npx @modelcontextprotocol/conformance client --command "tsx examples/clients/typescript/everything-client.ts" --suite auth
# Run all server scenarios (default)
npx @modelcontextprotocol/conformance server --url http://localhost:3000/mcp
# Run a single scenario
npx @modelcontextprotocol/conformance server --url http://localhost:3000/mcp --scenario server-initialize
npx @modelcontextprotocol/conformance list
The conformance test framework validates MCP implementations by:
For Clients:
For Servers:
npx @modelcontextprotocol/conformance client --command "<client-command>" --scenario <scenario-name> [options]
Options:
--command - The command to run your MCP client (can include flags)--scenario - The test scenario to run (e.g., "initialize")--suite - Run a suite of tests in parallel (e.g., "auth")--expected-failures <path> - Path to YAML baseline file of known failures (see Expected Failures)--timeout - Timeout in milliseconds (default: 30000)--verbose - Show verbose outputThe framework appends <server-url> as an argument to your command and sets the MCP_CONFORMANCE_SCENARIO environment variable to the scenario name. For scenarios that require additional context (e.g., client credentials), the MCP_CONFORMANCE_CONTEXT environment variable contains a JSON object with scenario-specific data.
npx @modelcontextprotocol/conformance server --url <url> [--scenario <scenario>]
Options:
--url - URL of the server to test--scenario <scenario> - Test scenario to run (e.g., "server-initialize"). Runs all available scenarios by default--suite <suite> - Suite to run: "active" (default), "all", or "pending"--expected-failures <path> - Path to YAML baseline file of known failures (see Expected Failures)--verbose - Show verbose outputClient Testing - Results are saved to results/<scenario>-<timestamp>/:
checks.json - Array of conformance check results with pass/fail statusstdout.txt - Client stdout outputstderr.txt - Client stderr outputServer Testing - Results are saved to results/server-<scenario>-<timestamp>/:
checks.json - Array of conformance check results with pass/fail statusSDKs that don't yet pass all conformance tests can specify a baseline of known failures. This allows running conformance tests in CI without failing, while still catching regressions.
Create a YAML file listing expected failures by mode:
# conformance-baseline.yml
server:
- tools-call-with-progress
- resources-subscribe
client:
- sse-retry
Then pass it to the CLI:
npx @modelcontextprotocol/conformance server --url http://localhost:3000/mcp --expected-failures ./conformance-baseline.yml
Exit code behavior:
| Scenario Result | In Baseline? | Outcome |
|---|---|---|
| Fails | Yes | Exit 0 — expected failure |
| Fails | No | Exit 1 — unexpected regression |
| Passes | Yes | Exit 1 — stale baseline, remove the entry |
| Passes | No | Exit 0 — normal pass |
This ensures:
This repo provides a composite GitHub Action so SDK repos don't need to write their own conformance scripts.
steps:
- uses: actions/checkout@v4
# Start your server (SDK-specific)
- run: |
my-server --port 3001 &
timeout 15 bash -c 'until curl -s http://localhost:3001/mcp; do sleep 0.5; done'
- uses: modelcontextprotocol/conformance@v0.1.11
with:
mode: server
url: http://localhost:3001/mcp
expected-failures: ./conformance-baseline.yml # optional
steps:
- uses: actions/checkout@v4
- uses: modelcontextprotocol/conformance@v0.1.11
with:
mode: client
command: 'python tests/conformance/client.py'
expected-failures: ./conformance-baseline.yml # optional
| Input | Required | Description |
|---|---|---|
mode | Yes | server or client |
url | Server mode | URL of the server to test |
command | Client mode | Command to run the client under test |
expected-failures | No | Path to YAML baseline file |
suite | No | Test suite to run |
scenario | No | Run a single scenario by name |
timeout | No | Timeout in ms for client tests (default: 30000) |
verbose | No | Show verbose output (default: false) |
node-version | No | Node.js version (default: 20) |
examples/clients/typescript/everything-client.ts - Single client that handles all scenarios based on scenario name (recommended)examples/clients/typescript/test1.ts - Simple MCP client (for reference)examples/clients/typescript/auth-test.ts - Well-behaved OAuth client (for reference)Run npx @modelcontextprotocol/conformance list --server to see all available server scenarios, including:
The tier-check subcommand evaluates an MCP SDK repository against SEP-1730 (the SDK Tiering System):
# Without conformance tests (fastest)
gh auth login
npm run --silent tier-check -- --repo modelcontextprotocol/typescript-sdk --skip-conformance
# With conformance tests (start the everything server first)
npm run --silent tier-check -- \
--repo modelcontextprotocol/typescript-sdk \
--conformance-server-url http://localhost:3000/mcp
For a full AI-assisted assessment with remediation guide, use Claude Code:
/mcp-sdk-tier-audit <local-sdk-path> <conformance-server-url>
See .claude/skills/mcp-sdk-tier-audit/README.md for full documentation.
See src/runner/DESIGN.md for detailed architecture documentation.
src/runner/) - Orchestrates test execution and result generation
client.ts - Client testing implementationserver.ts - Server testing implementationutils.ts - Shared utilitiesindex.ts - Public API exportssrc/index.ts) - Command-line interface using Commander.jssrc/scenarios/) - Test scenarios with expected behaviorssrc/checks/) - Conformance validation functionssrc/types.ts) - Shared type definitionssrc/scenarios/<scenario-name>/Scenario interface with start(), stop(), and getChecks()src/scenarios/index.tsSee src/scenarios/initialize/ for a reference implementation.
FAQs
A framework for testing MCP (Model Context Protocol) client and server implementations against the specification.
The npm package @modelcontextprotocol/conformance receives a total of 2,748 weekly downloads. As such, @modelcontextprotocol/conformance popularity was classified as popular.
We found that @modelcontextprotocol/conformance demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Reachability analysis for PHP is now available in experimental, helping teams identify which vulnerabilities are actually exploitable.

Product
Export Socket alert data to your own cloud storage in JSON, CSV, or Parquet, with flexible snapshot or incremental delivery.

Research
/Security News
Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.