mcp server checklist Shipped
What this lens looks for
Pre-merge review of an MCP server (pin spec rev 2025-06-18 tools/primitives, 2025-11-25 authz). Primitive-by-purpose: resources = read-only context, prompts = user-initiated templates, tools = model-controlled side-effecting actions (reject a tool that only returns static data). Tool contracts: unique/stable action-oriented names (rename = breaking, call out in PR), grounded descriptions with no hidden instructions/credentials, typed inputSchema with required, outputSchema + structuredContent for structured data, correct error channel (execution failures -> result isError:true; protocol failures -> JSON-RPC errors), honest behavior annotations. Security: server-side arg re-validation + per-call authz, injection-safe (parameterize shell/SQL/path/URL), audience-validated OAuth 2.1 resource server (RFC 8707/9068), no token passthrough, RFC 9728 resource metadata, rug-pull hash binding, HTTPS + Bearer (no token in query string).
What its verifier checks
Each capability uses the purpose-matched primitive (static-data "tools" rejected); tool names unique/stable with renames flagged as breaking; descriptions free of hidden instructions/embedded credentials; every tool has a typed inputSchema with a required list (no free-form string bags); structured tools declare outputSchema and return conforming structuredContent; execution errors returned with isError:true and protocol errors as JSON-RPC (not swallowed into a 200); behavior annotations set honestly; arguments re-validated server-side AND per-call authorization enforced; shell/SQL/path/URL inputs parameterized/escaped; HTTP tokens audience-validated (401 on mismatch) with no client-token passthrough upstream; RFC 9728 protected-resource metadata served with WWW-Authenticate on 401; tool definitions hash-bound or version-bumped (no silent edits); HTTPS-only with Authorization: Bearer and no query-string tokens. Items that cannot be verified are blocking, not passes.