MCP specification inventory

This page records the upstream material reviewed on 2026-10-08. Each reviewed source uses an immutable commit and SHA-256 digest. The exported MCP_EXTENSION_LATEST_REVIEWED manifest is an inventory for implementation planning; it does not promote a source into adapter support.

The established MCP_EXTENSION_SUPPORT aliases remain unchanged. They continue to select the existing codecs and fixtures. A later implementation may promote a reviewed record only after it adds behavior, tests, documentation, and examples.

Server Cards now expose top-level maturity: 'stable' in the support manifest. Their nested pinned version retains status: 'experimental' as historical metadata for the originally reviewed bytes. Filesystems has no identifier, protocol era, wire methods, schema, codec, or selector because its repository does not define an authoritative contract.

Toolchain and package inventoryCopy Anchor Link

All ten package manifests use their registry latest versions as reviewed on 2026-10-08. package.json covers the adapter and all eight Bun example workspaces; website/package.json has its independent website/bun.lock. The root bun.lock resolves the adapter and example graph. Workspace link: entries and Elysia peer ranges are compatibility declarations, so drift monitoring does not treat them as upgrade targets.

bun run extensions:check-drift reads every dependency and development dependency from these manifests, skips workspace and peer compatibility entries, and compares each registry package with its latest distribution tag. It also checks Bun, CI actions, Redis, specification repositories, source hashes, schema records, and published extension packages. An unavailable source or registry is a hard failure.

The website patches TypeScript 7's native semantic compiler channel because Bun streams do not expose the libuv handles that the compiler expects. The patch uses private POSIX FIFO descriptors, retains synchronous native compilation, closes every descriptor, and has a direct repeated-session test. Remove the patch when TypeScript supports Bun's process streams upstream; do not replace semantic API generation with a text parser or a fallback runtime.

Reviewed source recordsCopy Anchor Link

Action metadata and trust annotations define metadata semantics, not authorization. Their open-string enums remain preserved. Evidence references remain bounded and are never fetched. Content-block attachment behavior has no defined contract and remains unavailable.

Server requirement mapCopy Anchor Link

Each row names the final implementation, test, documentation, and runnable example evidence.

Host responsibilities and boundariesCopy Anchor Link

Hosts approve tools, skills, elicitation, sampling, roots, UI resources, and external calls. Hosts own user consent, sandboxing, display policy, credential storage, callback policy, and whether annotations are trusted. Servers must not infer host approval from a capability advertisement.

Servers own authorization, principal isolation, request validation, resource authorization, task retention, webhook verification, callback address validation, replay limits, and safe error mapping. Route-backed operations continue through app.handle(new Request(...)), preserving Elysia hooks, guards, parsing, validation, authentication, and response mapping.

The adapter will not automatically execute skills, retrieve evidence references, contact external interceptor services, or treat action and trust annotations as authorization. Those behaviors need a normative source and an explicit opt-in contract before implementation.

Drift and promotion rulesCopy Anchor Link

bun run extensions:check-drift walks both the compatibility manifest and the latest-reviewed inventory. It verifies each recorded source byte-for-byte, discovers every public MCP extension repository across paginated organization results, checks every reviewed repository default branch, and checks every package record that includes a package name and version. It reports drift without rewriting aliases. Network failures and unavailable inventory records are explicit failures.

Promote a reviewed record only after the owning work product adds protocol fixtures, affected-path tests, documentation, examples, and a compatibility decision. Keep the old source record when a new alias is added so existing clients retain their selected implementation.