Strengthen scoped MCP 2026 core interoperability

[MaazAhmed47]

Scope

This draft strengthens Interlock's scoped MCP 2026-07-28 core tools profile. It does not claim full MCP conformance and does not add optional protocol features.

Findings and implementation

• Pinned the stable MCP 2026-07-28 release at 5f5440bb26a62e2cf3440b92da5a667efa03b267 and mapped applicable normative requirements to tests.
• Added strict JSON, JSON Schema 2020-12 input/output validation, bounded modern JSON/SSE response handling, duplicate-header and envelope validation, and fail-closed protocol error behavior.
• Added valid x-mcp-header support only for explicit modern upstreams: statically reachable string/boolean/safe-integer values are validated inbound and rebuilt from the approved schema/body outbound. Raw client headers are never forwarded.
• Preserved the existing legacy upstream request shape and explicit no-downgrade behavior.
• Continued to reject every upstream nextCursor, including empty or null, rather than baseline a partial tool surface.

Pinned interoperability evidence

• Official Python SDK: mcp==2.0.0, commit 6f69a3758ebf2ee55ce050f58b470ce11af71133, wheel SHA-256 1cb4c75d2d2c7b8c1d756355e5d82a39f2822cc7f13e22a2051d7ca3592349d6.
• Official TypeScript client/server: 2.0.0, commit cc4b41617ce3601b1290d67216ea0b194a3cd9ac; npm integrity values are recorded in docs/mcp-2026-compatibility.md.
• Official alpha conformance tool: 0.2.0-alpha.10, commit a9896553900a2ef61787b57adfcbbe936a8ab1f9, used only as supporting evidence.

Verified directions:

• Python and TypeScript SDK clients -> Interlock: server/discover, tools/list, tools/call, no legacy handshake/fallback, identity metadata, cache hints, required headers and per-request _meta, and valid parameter headers.
• Interlock -> official TypeScript 2.0.0 strict server: discovery/list/call over forced JSON and forced SSE with legacy: reject.

Explicit exclusions

No pagination aggregation, MRTR / input_required, resources, prompts, elicitation, progress delivery, cancellation streams, subscriptions, Tasks, MCP Apps, standard OAuth framework, inbound SSE responses, resumability, or legacy session lifecycle was added. Direct upstream connections still bypass Interlock.

Verification

• Focused MCP core/SDK gate: 90 passed, 1 skipped (the skip is the separately invoked alpha conformance test).
• Official alpha conformance evidence test: 1 passed; its underlying scenario result remains 21 successes, 4 failures for absent diagnostic tools, and 5 subscription skips, so this is not a conformance-suite pass.
• Gateway/drift/receipt/security gate: 458 passed, 1 skipped, 6 xfailed, reproduced with:

python -m pytest -q tests/test_mcp_2026_core_profile.py tests/test_mcp_upstream_profiles.py tests/test_streamable_mcp_2026_eligibility.py tests/test_streamable_mcp_integration.py tests/test_mcp_gateway.py tests/test_mcp_gateway_upstream_errors.py tests/test_mcp_drift.py tests/test_chain_drift.py tests/test_chain_drift_route.py tests/test_drift_evidence.py tests/test_drift_description_exfil.py tests/test_drift_depth.py tests/test_drift_adversarial.py tests/test_drift_record_schema.py tests/test_effect_drift.py tests/test_effect_drift_runtime.py tests/test_response_drift.py tests/test_response_drift_runtime.py tests/test_external_reach_drift.py tests/test_security_receipt.py tests/test_receipt_replay.py tests/test_receipt_claims.py

• All-collected pytest: 1837 passed, 127 skipped, 6 xfailed; 126 skips are PostgreSQL-gated tests and one is the separately run alpha conformance test.
• Disposable PostgreSQL 16.14 exact gated selection: 131 passed, 0 skipped before this follow-up; persistence schema and write paths were unchanged by the follow-up.
• Black 26.3.1: PASS, 9 changed Python files.
• Ruff 0.15.22: PASS, 9 changed Python files.
• Targeted mypy 2.3.0: PASS, 4 source modules.
• Node syntax and Prettier 3.8.2: PASS, 2 JavaScript probe fixtures.
• compileall: PASS.
• git diff --check: PASS.
• Diff secret/path scan: PASS; no private-key, common token, bearer, or Windows user-path matches.

PostgreSQL reproduction command:

INTERLOCK_TEST_DATABASE_URL=postgresql://postgres:...@127.0.0.1:55432/postgres python -m pytest -q tests/test_policy_postgres_boolean.py tests/test_audit_chain_concurrency.py::test_concurrent_replica_appends_cannot_fork_the_chain tests/test_postgres_api_key_revocation.py tests/test_postgres_audit_v3.py tests/test_postgres_ci_boundary_review_gate.py tests/test_postgres_obsolete_api_key_credential_compatibility.py tests/test_postgres_rebaseline_cas.py tests/test_postgres_registry_migration.py tests/test_postgres_usage_boolean.py

Fresh-clone evidence

A public-URL clone of branch agent/mcp-2026-core-profile resolved to 755130e20dbd4d9747f08e70c87970fd77a30159. A clean Python virtualenv installed repository requirements in 107.07 seconds. The published focused command then completed in 66.08 seconds with 90 passed, 1 skipped; the clone remained clean. Timing is machine/network/cache dependent.

No production deployment occurred. A Vercel preview was automatically created for this branch; main and the production backend remain unchanged. No production dependency, runtime configuration, UI, release, or deployment setting changed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
interlock-web	Ready	Preview	Jul 29, 2026 7:58pm