| Stateless Streamable HTTP | Live | No Mcp-Session-Id, no handshake required; a fresh server per request. |
server/discover | Live | Both endpoints; lists 2026-07-28 and 2025-11-25. |
Mcp-Method / Mcp-Name headers | Live | Required on 2026-07-28 requests; a mismatch returns -32020. |
ttlMs / cacheScope | Live | On all list results and resources/read; 60 s, public on /api/public/mcp, private on /api. |
resultType, error -32022 | Live | Every 2026-07-28 result carries resultType; unsupported versions get -32022. |
subscriptions/listen | Not offered | Catalogs are static (listChanged: false); the method returns -32601. |
| Origin validation | Log-only | Unlisted origins are logged, not blocked; auth is key or bearer, never cookies. |
| OAuth 2.1, PKCE S256 | Live | RFC 8414 and RFC 9728 metadata, RFC 7591 registration, refresh-token rotation, audience check. |
| Client ID Metadata Documents | Open | Dynamic client registration works today. |
Tool annotations, outputSchema, icons | Live | All public tools carry title, annotations, outputSchema and light/dark category icons. |
| Resource templates | Live | glossary://, comparison://, guide://, industry://, role://, use-case://, company-type:// + {slug}. |
completion/complete | Live | Slug suggestions for every template, locales for prompt arguments. |
| Audit trail | Live | Every call is logged with a hashed credential fingerprint and redacted arguments. |