
Research
5 Malicious Chrome Extensions Enable Session Hijacking in Enterprise HR and ERP Systems
Five coordinated Chrome extensions enable session hijacking and block security controls across enterprise HR and ERP platforms.
@modelcontextprotocol/conformance
Advanced tools
A framework for testing MCP (Model Context Protocol) client and server implementations against the specification.
A framework for testing MCP (Model Context Protocol) client and server implementations against the specification.
[!WARNING] This repository is a work in progress and is unstable. Join the conversation in the #conformance-testing-wg in the MCP Contributors discord.
npx @modelcontextprotocol/conformance client --command "tsx examples/clients/typescript/test1.ts" --scenario initialize
# Run all server scenarios (default)
npx @modelcontextprotocol/conformance server --url http://localhost:3000/mcp
# Run a single scenario
npx @modelcontextprotocol/conformance server --url http://localhost:3000/mcp --scenario server-initialize
npx @modelcontextprotocol/conformance list
The conformance test framework validates MCP implementations by:
For Clients:
For Servers:
npx @modelcontextprotocol/conformance client --command "<client-command>" --scenario <scenario-name> [options]
Options:
--command - The command to run your MCP client (can include flags)--scenario - The test scenario to run (e.g., "initialize")--timeout - Timeout in milliseconds (default: 30000)--verbose - Show verbose outputThe framework appends the server URL as the final argument to your command.
npx @modelcontextprotocol/conformance server --url <url> [--scenario <scenario>]
Options:
--url - URL of the server to test--scenario <scenario> - Test scenario to run (e.g., "server-initialize". Runs all available scenarios by defaultClient Testing - Results are saved to results/<scenario>-<timestamp>/:
checks.json - Array of conformance check results with pass/fail statusstdout.txt - Client stdout outputstderr.txt - Client stderr outputServer Testing - Results are saved to results/server-<scenario>-<timestamp>/:
checks.json - Array of conformance check results with pass/fail statusexamples/clients/typescript/test1.ts - Valid MCP client (passes all checks)examples/clients/typescript/test-broken.ts - Invalid client missing required fields (fails checks)Run npx @modelcontextprotocol/conformance list --server to see all available server scenarios, including:
See src/runner/DESIGN.md for detailed architecture documentation.
src/runner/) - Orchestrates test execution and result generation
client.ts - Client testing implementationserver.ts - Server testing implementationutils.ts - Shared utilitiesindex.ts - Public API exportssrc/index.ts) - Command-line interface using Commander.jssrc/scenarios/) - Test scenarios with expected behaviorssrc/checks/) - Conformance validation functionssrc/types.ts) - Shared type definitionssrc/scenarios/<scenario-name>/Scenario interface with start(), stop(), and getChecks()src/scenarios/index.tsSee src/scenarios/initialize/ for a reference implementation.
FAQs
A framework for testing MCP (Model Context Protocol) client and server implementations against the specification.
The npm package @modelcontextprotocol/conformance receives a total of 1,677 weekly downloads. As such, @modelcontextprotocol/conformance popularity was classified as popular.
We found that @modelcontextprotocol/conformance demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Five coordinated Chrome extensions enable session hijacking and block security controls across enterprise HR and ERP platforms.

Research
Node.js patched a crash bug where AsyncLocalStorage could cause stack overflows to bypass error handlers and terminate production servers.

Research
/Security News
A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal rights.