Protocol compliance matrix

Every MCP method, server-initiated request, transport, and auth mode, and the mcpal verb (or flag) that drives it. Unmarked rows are wired in. pending rows are not.

Methods

Methodmcpal verbStatus
initializeevery command (handshake)implicit
pingserver ping <ref>via initialize handshake
tools/listtool list <ref>
tools/calltool call <ref> <name> --key value
resources/listresource list <ref>
resources/readresource read <ref> <uri>
resources/templates/listresource template list <ref>
resources/subscriberesource subscribe <ref> <uri>
resources/unsubscriberesource unsubscribe <ref> <uri>
prompts/listprompt list <ref>
prompts/getprompt get <ref> <name> --key value
completion/completeprompt complete <ref> <name> --arg F=P / resource complete <ref> --template <uri> --arg F=P
logging/setLevellogging set-level <ref> <level>
any other / future methodraw <ref> <method> --params …passthrough

Server-initiated requests

MethodDefault handlerOverride
roots/listreturns --root <path> paths--root flag
elicitation/create (form)TTY prompt → Accept; non-TTY → Decline--no-interactive to always decline
elicitation/create (url)prints URL → Acceptn/a
sampling/createMessageMethodNotFound--sampling-handler <CMD>
logging/messagerouted via tracing; emitted from mcpal watchRUST_LOG=…
notifications/progressemitted by mcpal watchn/a
notifications/resources/updatedemitted by mcpal watchn/a
notifications/{tools,prompts,resources}/list_changedemitted by mcpal watchn/a
notifications/cancelledemitted by mcpal watchn/a

Transports

TransportStatus
stdio (child process)
Streamable HTTP (rustls)
SSE (legacy 2024-11-05)not enabled
WebSocketnot enabled

Auth

ModeStatus
Bearer (inline / env / keyring)
OAuth 2.1 + PKCE + DCR (RFC 7591)
OAuth 2.1 + CIMD (client metadata URL, SEP-991)pending
Custom HTTP headersvia ServerSpec::Http { headers }
mTLSpending

Spec 2026-07-28 release candidate

The next protocol revision changes enough on the wire that adopting it is a planned upgrade, not a free ride. mcpal tracks rmcp's support for it; the column below records where each delta lands on the mcpal side.

Change (SEP)Where it lands in mcpal
Handshake removed: no more initialize / initialized (SEP-2575)client.rs connect path; rmcp upgrade required
Session header Mcp-Session-Id deprecated (SEP-2567)HTTP transport; rmcp upgrade required
Required routing headers Mcp-Method, Mcp-Name, MCP-Protocol-Version (SEP-2243)HTTP transport; rmcp upgrade required
Client info, version, capabilities move to per-request _metaclient.rs; rmcp upgrade required
W3C Trace Context in _meta (traceparent, tracestate, baggage, SEP-414)follow-up after rmcp upgrade
server/discover methodnew verb under mcpal server …, post-upgrade
ttlMs / cacheScope on list and resource read results (SEP-2549)enables local catalogue cache (see Why a CLI for MCP)
Full JSON Schema 2020-12 in inputSchema (SEP-2106)jsonschema crate already on 2020-12; verify --skip-validation path
outputSchema unrestricted; structuredContent any JSONoutput rendering; small change in output.rs
Resource-missing error: -32002 → -32602 (SEP-2164)exit.rs classifier table
OAuth iss validation per RFC 9207 (SEP-2468)rmcp AuthorizationManager; verify on upgrade
OIDC application_type in DCR (SEP-837)rmcp DCR call; verify on upgrade
Credentials bound to issuer (SEP-2352)keyring key naming under review
Roots / Sampling / Logging deprecated (SEP-2577)matrix above will mark deprecated when 2026-07-28 lands
Tasks extension (tasks/get, tasks/update, tasks/cancel)new verb group, scoped after rmcp upgrade
Extensions framework (reverse-DNS IDs, extensions map)raw already covers ad-hoc calls