MCP spec conformance: 10 requirements violated (via @hasmcp/mcp-spec-test) — spec 2026-07-28

Running `npx -y @google-cloud/cloud-run-mcp` (stdio transport, no Google Cloud credentials configured in the test environment) starts up and logs "Cloud Run MCP server stdio transport connected", but several protocol-level checks fail: `server/discover` returns a JSON-RPC `-32601 Method not found` (the method doesn't appear to be implemented at all), and requests sent without a session/handshake or without a protocol version get no response within the timeout, which the harness reports as the process having exited. This was tested against spec revision **2026-07-28**; a companion issue covers revision 2025-11-25, where the same server shows far fewer failures (3 vs. 10) since fewer checks require server/discover. Note that this test container has no Google Cloud Application Default Credentials configured, which the server itself warns about on startup — it's possible some of this behavior is influenced by that missing credential rather than being a pure protocol bug, so please treat the credential-adjacent items with that caveat in mind.

## Conformance report

# MCP 2026-07-28 conformance report

**Verdict: not conformant** — 10 requirements violated.

| | |
| --- | --- |
| Target | `npx -y @google-cloud/cloud-run-mcp` |
| Transport | stdio |
| Revision tested | 2026-07-28 |
| Revisions supported | 2026-07-28, 2025-11-25 |
| Passed | 4 |
| Failed | 10 |
| Not verified | 22 |
| Cases applied | 36 |
| Duration | 25335ms |
| Tool | @hasmcp/mcp-spec-test 0.1.1 |

## Failed (10)

_the server deviates from the spec here_

### server/discover

- **server/discover is answered without a session or handshake**
expected 200, got 0: {"_raw":"server exited"}

0 !== 200

- **server/discover advertises the versions the server can serve**
Cannot read properties of undefined (reading 'supportedVersions')
- **server/discover is a CacheableResult with usable cache hints**
Cannot read properties of undefined (reading 'ttlMs')
- **server/discover reports server identity and capabilities**
Cannot read properties of undefined (reading 'capabilities')
- **server/discover is stable across calls within its own TTL**
Cannot read properties of undefined (reading 'supportedVersions')
- **server/discover advertises a revision this suite supports**
server/discover unexpected JSON-RPC error: {"code":-32601,"message":"Method not found"}

### Version negotiation

- **a request with no version at all is served on the default**
a version-less request must be served, got 0: {"_raw":"server exited"}

0 !== 200

### Official SDK interop

- **a stock official-SDK client completes the handshake**
MCP error -32000: Connection closed
- **the handshake settles on a revision inside the supported window**
initialize must return a protocolVersion, got undefined
- **a stock official-SDK client can list tools**
MCP error -32000: Connection closed

## Not verified (22)

_skipped; a skip is not a pass_

### Capability methods

- tools/list returns schema-conformant tools — cannot determine what the target supports (server/discover returned no result, status 0)
- tools/call on an unknown tool is an error, not a crash — same reason
- tools/call returns a schema-conformant CallToolResult — same reason
- prompts/list returns schema-conformant prompts — same reason
- prompts/get returns messages with a role and content — same reason
- resources/list returns schema-conformant resources — same reason
- resources/templates/list returns schema-conformant templates — same reason
- resources/read returns contents for every sampled resource — same reason
- resources/read on an unknown uri is an error — same reason
- following nextCursor terminates and does not repeat a page — same reason
- an invalid pagination cursor is rejected (SHOULD) — same reason

### Version negotiation

- a version declared in _meta is accepted — same reason
- an unsupported version is rejected with the supported list — same reason
- clientInfo is optional (SHOULD, not MUST) — same reason

### Result envelope

- every result carries the required resultType — same reason
- cacheable list results carry the schema-required cache hints — same reason
- results identify the server in _meta — same reason
- a client on an older version receives no newer-revision fields — same reason

### subscriptions/listen

- subscriptions/listen acknowledges only the opted-in notification types — same reason
- the acknowledgment carries the subscription id for correlation — same reason
- a listen requesting no notification types is not a subscription to everything — same reason
- a cancelled subscription ends with a conformant teardown result, if it sends one — same reason

## Passed (4)

_checked and conformant_

### server/discover

- the suite is reading a schema that matches the features it selected

### Result envelope

- schema sanity: the envelope fields match the features selected

### Official SDK interop

- the official SDK does not yet implement the newest revision

### subscriptions/listen

- schema sanity: SubscriptionsListenResult requires _meta and resultType

## How to reproduce

**With Docker:**
```
docker pull hasmcp/mcp-spec-test:latest
docker run --rm hasmcp/mcp-spec-test -c "npx -y @google-cloud/cloud-run-mcp" --spec-version 2026-07-28
```
(on arm64/Apple Silicon, add `--platform linux/amd64`; or build locally: `git clone https://github.com/hasmcp/mcp-spec-test && cd mcp-spec-test && docker build -t mcp-spec-test . && docker run --rm mcp-spec-test -c ""`)

**Without Docker (npx):**
```
npx @hasmcp/mcp-spec-test@latest -c "npx -y @google-cloud/cloud-run-mcp" --spec-version 2026-07-28
```

---

This issue was generated by an automated MCP spec conformance sweep using @hasmcp/mcp-spec-test. If this turns out to be an environment-specific false positive (e.g. tied to the missing ADC credentials in the test container) rather than a real bug, feel free to close it — happy to help clarify if useful.

Run the documented @hasmcp/mcp-spec-test command against `npx -y @google-cloud/cloud-run-mcp`, first with the credential caveat in mind. Trace the server/discover and initialize entry points, then verify tools/list and version-less requests; done means the 2026-07-28 conformance failures no longer occur and the official SDK handshake completes.

Written by the indexing model from the issue text.