docs: scope aligning imcp2 with MCP revision 2026-07-28 - #126
Draft
aterga wants to merge 2 commits into
Draft
Conversation
Add a scoping/analysis doc that reads the MCP 2026-07-28 specification against the current imcp2 codebase and ranks the design improvements the revision enables. Headline finding: imcp2's deliberately stateless, plain-JSON, no-session design is exactly the shape the revision now mandates (it removes protocol sessions, `initialize`, and `Mcp-Session-Id`), so most transport work is deletion gated on rmcp shipping a modern path. The two immediate, imcp2-only wins are RFC 9207 `iss` (already shipped as its own PR) and adopting Client ID Metadata Documents to replace open Dynamic Client Registration, which also gives the client-branding work a non-spoofable key. The doc includes what imcp2 already gets right, a ranked list of thirteen opportunities with impact/effort/tractability and spec-strength labels, a deprecations table, a sequencing plan, and a record of the corrections the verification pass applied. Analysis only; no code changes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014T9N8USDfNK5yzznPGg7Ym
There was a problem hiding this comment.
Pull request overview
Adds a scoping document assessing imcp2 against MCP revision 2026-07-28.
Changes:
- Ranks thirteen alignment opportunities.
- Proposes sequencing for OAuth, transport, caching, and extensions.
- Documents deprecations and verification corrections.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Address the review pass on the scoping doc: * Fix stale code citations to the current snapshot: get_info (tools.rs:1883), oql_needs_origin_error (1495), err (2287), the resource-not-found calls (2067/2078), and the skill:// resource generation loop (2033-2045). * Replace the reference to a non-existent `scoping-client-branding.md` with the client-branding scoping proposal (PR #103). * Correct the CIMD SSRF note: `markdown_url_for_base` is NOT a reusable SSRF guard (host-string compare only, ignores ports, no private-IP rejection; its 169.254 rejection is incidental to the fixed skills origin). A dedicated SSRF-safe fetcher is needed; the closest building block is discover.rs's ip_is_global. * Drop `oql-schema://` from the public-cacheable resources: it is caller-gated (requires derivation_origin/account, runs under the user's delegated agent), so a public cache keyed only by canister ID could leak one identity's schema to another. Keep it a tool or an identity-keyed private resource. * Fix the x-mcp-header section: there is no top-level `network` field or destructive-op discriminator to mirror into Mcp-Param-*; annotating absent fields would fail the mandated header/body validation. Use Mcp-Name for per-operation policy; scope any new param separately. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add a scoping/analysis document (
docs/scoping-mcp-2026-07-28-alignment.md) that reads the MCP 2026-07-28 specification against the current imcp2 codebase and ranks the design improvements the revision enables. Analysis and sequencing only; no code changes.The headline finding is that imcp2's deliberately stateless, plain-JSON, no-session design is exactly the shape the revision now mandates: 2026-07-28 removes protocol sessions,
initialize, andMcp-Session-Id, so most of the transport work ahead is deletion, gated on rmcp shipping a "modern" per-request path. The two immediate, imcp2-only wins are RFC 9207issand adopting Client ID Metadata Documents (CIMD) to replace open Dynamic Client Registration; CIMD also gives thescoping-client-branding.mdwork a DNS/TLS-authenticated, non-spoofable key.The spec-strength labels (MUST / SHOULD / MAY) and repo citations were cross-checked by an adversarial verification pass; the doc records the corrections that pass applied.
Related issues
Follows up the MCP 2026-07-28 spec review. The first sequenced item, RFC 9207
iss, is implemented in a separate PR (branchclaude/oauth-iss-rfc9207).Changes
docs/scoping-mcp-2026-07-28-alignment.md, matching the repo'sdocs/scoping-*.mdconvention (status header, goal, ranked opportunities, sequencing).file:linecitations), a deprecations table, a sequencing plan (issfirst, CIMD next, then rmcp-gated items), and a corrections-applied section.Testing
cargo build --locked --all-targets— n/a, docs-only changecargo test --locked --all-targets— n/a, docs-only changecargo fmt --all/cargo clippy --all-targets— n/a, docs-only changenpm test --prefix monitoring/mcp-status— n/a, dashboard unchangedChecklist
🤖 Generated with Claude Code
https://claude.ai/code/session_014T9N8USDfNK5yzznPGg7Ym
Generated by Claude Code