test: tighten manifest wording and assertion conventions from review pass

- _provider.py docstrings now describe the provider, not its authoring history
- eight manifest behavior/divergence notes scoped to what the spec/SDK actually
  state (logging field-shape only, sse endpoint-event spec-only, scope-selection
  AS-fallback step, sampling result-balance ValueError, hosting:session:delete
  doesn't remove transport, low-level elicitation validation/restriction scope,
  progress no-token second clause)
- client-transport:http:reconnect-get deferred reason no longer claims the
  feature is unimplemented
- rename the sampling mixed-content rejection test to match what it asserts
- pagination cursor pass-through asserted by identity per the suite convention
- mcpserver:prompt:unknown-name docstring acknowledges the code-0 divergence
- test_bridge cancel_on_close test bounds the transport-close wait
- drop now-stale no-branch pragma at shared/auth.py:94

Author: maxisbey

src/mcp/shared/auth.py

@@ -91,7 +91,7 @@ def validate_scope(self, requested_scope: str | None) -> list[str] | None:
         requested_scopes = requested_scope.split(" ")
         allowed_scopes = [] if self.scope is None else self.scope.split(" ")
         for scope in requested_scopes:
-            if scope not in allowed_scopes:  # pragma: no branch
+            if scope not in allowed_scopes:
                 raise InvalidScopeError(f"Client was not registered with scope {scope}")
         return requested_scopes
 

tests/interaction/_requirements.py

@@ -424,10 +424,7 @@ def __post_init__(self) -> None:
     ),
     "protocol:progress:no-token": Requirement(
         source=f"{SPEC_BASE_URL}/basic/utilities/progress#progress-flow",
-        behavior=(
-            "Without a progress callback no token is attached, and a handler that reports progress anyway "
-            "sends nothing."
-        ),
+        behavior="Without a progress callback the request carries no progress token.",
     ),
     "protocol:progress:client-to-server": Requirement(
         source=f"{SPEC_BASE_URL}/basic/utilities/progress#progress-flow",
@@ -1079,7 +1076,7 @@ def __post_init__(self) -> None:
         source=f"{SPEC_BASE_URL}/server/utilities/logging#log-message-notifications",
         behavior=(
             "A log message sent by a server handler is delivered to the client's logging callback with its "
-            "severity level, logger name, and data, in the order the server sent them."
+            "severity level, logger name, and data."
         ),
     ),
     "logging:message:filtered": Requirement(
@@ -1219,7 +1216,8 @@ def __post_init__(self) -> None:
         source=f"{SPEC_BASE_URL}/client/sampling#tool-use-and-result-balance",
         behavior=(
             "Every assistant tool_use block in a sampling request must be matched by a tool_result with "
-            "the same id in the following user message; an unmatched tool_use is rejected with Invalid params."
+            "the same id in the following user message; an unmatched tool_use is rejected with a ValueError "
+            "before the request is sent."
         ),
     ),
     "sampling:tools:server-gated-by-capability": Requirement(
@@ -1331,8 +1329,9 @@ def __post_init__(self) -> None:
         ),
         divergence=Divergence(
             note=(
-                "Nothing restricts or validates the requested-schema shape on the sending side; a server "
-                "can send nested or non-primitive schemas and the SDK forwards them unchanged."
+                "ServerSession.elicit_form forwards an arbitrary dict[str, Any] schema unchanged; no shape "
+                "validation at the low-level session layer (the high-level Context.elicit / "
+                "elicit_with_validation helper enforces primitive-only fields before generating the schema)."
             ),
         ),
     ),
@@ -1343,7 +1342,11 @@ def __post_init__(self) -> None:
             "the response before sending and the server validates the content it receives."
         ),
         divergence=Divergence(
-            note="Accepted elicitation content passes through unvalidated on both sides.",
+            note=(
+                "The client never validates outbound content; ServerSession.elicit_form returns received "
+                "content unvalidated (the high-level Context.elicit / elicit_with_validation helper "
+                "validates server-side, but the low-level session API does not)."
+            ),
         ),
     ),
     "elicitation:url:action:accept-no-content": Requirement(
@@ -1788,18 +1791,15 @@ def __post_init__(self) -> None:
     ),
     "transport:sse:endpoint-event": Requirement(
         source=f"{SPEC_BASE_URL}/basic/transports#backwards-compatibility",
-        behavior=(
-            "Opening the SSE stream delivers an `endpoint` event naming the message-POST URL and a fresh "
-            "session identifier; the server registers the session before the event is sent and releases it "
-            "when the stream disconnects."
-        ),
+        behavior="Opening the SSE stream delivers an `endpoint` event naming the message-POST URL as the first event.",
         transports=("sse",),
     ),
     "transport:sse:post:session-routing": Requirement(
         source="sdk",
         behavior=(
-            "A POST to the SSE message endpoint that names no session id, a malformed session id, or an "
-            "unknown session id is rejected (400/400/404) instead of being forwarded."
+            "The endpoint URL carries a fresh session identifier; the server registers the session before "
+            "the endpoint event is sent and releases it when the stream disconnects, and a POST that names "
+            "no session id, a malformed session id, or an unknown session id is rejected (400/400/404)."
         ),
         transports=("sse",),
     ),
@@ -1830,7 +1830,7 @@ def __post_init__(self) -> None:
     ),
     "hosting:session:delete": Requirement(
         source=f"{SPEC_BASE_URL}/basic/transports#session-management",
-        behavior="DELETE with a valid Mcp-Session-Id terminates the session and removes its transport.",
+        behavior="DELETE with a valid Mcp-Session-Id terminates the session.",
         transports=("streamable-http",),
     ),
     "hosting:session:id-charset": Requirement(
@@ -2333,10 +2333,10 @@ def __post_init__(self) -> None:
         ),
         transports=("streamable-http",),
         deferred=(
-            "Not implemented in the SDK: the server's standalone GET stream emits no priming event or "
-            "retry hint, so the client's reconnection path always sleeps the hard-coded 1 s default; a "
-            "deterministic in-process test would require accepting that real-time wait. The POST-stream "
-            "reconnection path is covered by client-transport:http:reconnect-post-priming."
+            "The server's standalone GET stream emits no priming event or retry hint, so the client's "
+            "reconnection path always sleeps the hard-coded 1 s default; a deterministic in-process test "
+            "would require accepting that real-time wait. The POST-stream reconnection path is covered "
+            "by client-transport:http:reconnect-post-priming."
         ),
     ),
     "client-transport:http:reconnect-post-priming": Requirement(
@@ -2586,7 +2586,8 @@ def __post_init__(self) -> None:
         source=f"{SPEC_BASE_URL}/basic/authorization#scope-selection-strategy",
         behavior=(
             "The client selects the requested scope from WWW-Authenticate when present, then from the "
-            "protected-resource metadata, and otherwise omits scope."
+            "protected-resource metadata, then (as an SDK addition beyond the spec's chain) from the "
+            "AS metadata's scopes_supported, and otherwise omits scope."
         ),
         transports=("streamable-http",),
     ),

tests/interaction/auth/_provider.py

@@ -5,8 +5,7 @@
 values are unique without being predictable. The behaviour mirrors what the SDK's authorization
 handlers expect: `authorize` immediately mints a code and returns the redirect, `exchange_*`
 issue and rotate tokens, and `load_*` are simple lookups. Only the parts the auth interaction
-suite drives are implemented; methods the tests do not yet reach raise `NotImplementedError`
-and are filled in by the chunk that first exercises them.
+suite drives are implemented; methods the suite does not exercise raise `NotImplementedError`.
 """
 
 import secrets
@@ -183,5 +182,5 @@ async def exchange_refresh_token(
         )
 
     async def revoke_token(self, token: AccessToken | RefreshToken) -> None:
-        """Implemented when the bearer/lifecycle tests first exercise revocation."""
+        """Not exercised by this suite; revocation is out of scope for the interaction tests."""
         raise NotImplementedError

tests/interaction/lowlevel/test_pagination.py

@@ -32,6 +32,7 @@ async def test_next_cursor_round_trips_through_the_client(connect: Connect) -> N
     """The next_cursor a list handler returns reaches the client, and the cursor the client sends
     back on the following call reaches the handler verbatim.
     """
+    cursor = "page-2"
     seen_cursors: list[str | None] = []
 
     async def list_tools(ctx: ServerRequestContext, params: types.PaginatedRequestParams | None) -> ListToolsResult:
@@ -40,21 +41,20 @@ async def list_tools(ctx: ServerRequestContext, params: types.PaginatedRequestPa
         if params.cursor is None:
             return ListToolsResult(
                 tools=[Tool(name="alpha", input_schema={"type": "object"})],
-                next_cursor="page-2",
+                next_cursor=cursor,
             )
         return ListToolsResult(tools=[Tool(name="beta", input_schema={"type": "object"})])
 
     server = Server("paginated", on_list_tools=list_tools)
 
     async with connect(server) as client:
         first_page = await client.list_tools()
-        second_page = await client.list_tools(cursor="page-2")
+        second_page = await client.list_tools(cursor=first_page.next_cursor)
 
-    assert first_page == snapshot(
-        ListToolsResult(tools=[Tool(name="alpha", input_schema={"type": "object"})], next_cursor="page-2")
-    )
+    assert first_page.next_cursor == cursor
+    assert seen_cursors == [None, cursor]
+    assert [tool.name for tool in first_page.tools] == ["alpha"]
     assert second_page == snapshot(ListToolsResult(tools=[Tool(name="beta", input_schema={"type": "object"})]))
-    assert seen_cursors == snapshot([None, "page-2"])
 
 
 @requirement("pagination:exhaustion")
@@ -158,6 +158,7 @@ async def list_tools(ctx: ServerRequestContext, params: types.PaginatedRequestPa
 @requirement("resources:list:pagination")
 async def test_resources_list_supports_cursor_pagination(connect: Connect) -> None:
     """resources/list round-trips the cursor like every other list operation."""
+    cursor = "page-2"
     seen_cursors: list[str | None] = []
 
     async def list_resources(
@@ -166,25 +167,26 @@ async def list_resources(
         assert params is not None
         seen_cursors.append(params.cursor)
         if params.cursor is None:
-            return ListResourcesResult(resources=[Resource(uri="memo://1", name="first")], next_cursor="page-2")
+            return ListResourcesResult(resources=[Resource(uri="memo://1", name="first")], next_cursor=cursor)
         return ListResourcesResult(resources=[Resource(uri="memo://2", name="second")])
 
     server = Server("paginated", on_list_resources=list_resources)
 
     async with connect(server) as client:
         first_page = await client.list_resources()
-        second_page = await client.list_resources(cursor="page-2")
+        second_page = await client.list_resources(cursor=first_page.next_cursor)
 
-    assert seen_cursors == snapshot([None, "page-2"])
+    assert first_page.next_cursor == cursor
+    assert seen_cursors == [None, cursor]
     assert [resource.name for resource in first_page.resources] == ["first"]
-    assert first_page.next_cursor == "page-2"
     assert [resource.name for resource in second_page.resources] == ["second"]
     assert second_page.next_cursor is None
 
 
 @requirement("resources:templates:pagination")
 async def test_resource_templates_list_supports_cursor_pagination(connect: Connect) -> None:
     """resources/templates/list round-trips the cursor like every other list operation."""
+    cursor = "page-2"
     seen_cursors: list[str | None] = []
 
     async def list_resource_templates(
@@ -195,7 +197,7 @@ async def list_resource_templates(
         if params.cursor is None:
             return ListResourceTemplatesResult(
                 resource_templates=[ResourceTemplate(name="first", uri_template="users://{id}")],
-                next_cursor="page-2",
+                next_cursor=cursor,
             )
         return ListResourceTemplatesResult(
             resource_templates=[ResourceTemplate(name="second", uri_template="teams://{id}")]
@@ -205,35 +207,36 @@ async def list_resource_templates(
 
     async with connect(server) as client:
         first_page = await client.list_resource_templates()
-        second_page = await client.list_resource_templates(cursor="page-2")
+        second_page = await client.list_resource_templates(cursor=first_page.next_cursor)
 
-    assert seen_cursors == snapshot([None, "page-2"])
+    assert first_page.next_cursor == cursor
+    assert seen_cursors == [None, cursor]
     assert [template.name for template in first_page.resource_templates] == ["first"]
-    assert first_page.next_cursor == "page-2"
     assert [template.name for template in second_page.resource_templates] == ["second"]
     assert second_page.next_cursor is None
 
 
 @requirement("prompts:list:pagination")
 async def test_prompts_list_supports_cursor_pagination(connect: Connect) -> None:
     """prompts/list round-trips the cursor like every other list operation."""
+    cursor = "page-2"
     seen_cursors: list[str | None] = []
 
     async def list_prompts(ctx: ServerRequestContext, params: types.PaginatedRequestParams | None) -> ListPromptsResult:
         assert params is not None
         seen_cursors.append(params.cursor)
         if params.cursor is None:
-            return ListPromptsResult(prompts=[Prompt(name="first")], next_cursor="page-2")
+            return ListPromptsResult(prompts=[Prompt(name="first")], next_cursor=cursor)
         return ListPromptsResult(prompts=[Prompt(name="second")])
 
     server = Server("paginated", on_list_prompts=list_prompts)
 
     async with connect(server) as client:
         first_page = await client.list_prompts()
-        second_page = await client.list_prompts(cursor="page-2")
+        second_page = await client.list_prompts(cursor=first_page.next_cursor)
 
-    assert seen_cursors == snapshot([None, "page-2"])
+    assert first_page.next_cursor == cursor
+    assert seen_cursors == [None, cursor]
     assert [prompt.name for prompt in first_page.prompts] == ["first"]
-    assert first_page.next_cursor == "page-2"
     assert [prompt.name for prompt in second_page.prompts] == ["second"]
     assert second_page.next_cursor is None

tests/interaction/lowlevel/test_sampling.py

@@ -350,8 +350,8 @@ async def sampling_callback(
 
 
 @requirement("sampling:tool-result:no-mixed-content")
-async def test_create_message_with_unbalanced_tool_messages_is_rejected(connect: Connect) -> None:
-    """A sampling request whose messages mix tool results with other content never leaves the server.
+async def test_create_message_with_mixed_tool_result_content_is_rejected(connect: Connect) -> None:
+    """A sampling request whose user message mixes tool_result with other content never leaves the server.
 
     The message-structure validation runs inside create_message before the request is sent, even
     when no tools are passed, so the client callback is never invoked and the handler observes the

tests/interaction/mcpserver/test_prompts.py

@@ -75,7 +75,11 @@ def greet(name: str) -> str:
 
 @requirement("mcpserver:prompt:unknown-name")
 async def test_get_unknown_prompt_is_error(connect: Connect) -> None:
-    """Getting a prompt name that was never registered fails with a JSON-RPC error."""
+    """Getting a prompt name that was never registered fails with a JSON-RPC error.
+
+    The spec reserves -32602 for this case; the SDK reports code 0 (see the divergence note on
+    the requirement).
+    """
     mcp = MCPServer("prompter")
 
     @mcp.prompt()

tests/interaction/transports/test_bridge.py

@@ -86,8 +86,8 @@ async def lingering_app(scope: Scope, receive: Receive, send: Send) -> None:
         cleanup_ran.set()
 
     transport = StreamingASGITransport(lingering_app, cancel_on_close=False)
-    async with httpx.AsyncClient(transport=transport, base_url="http://bridge") as http:
-        with anyio.fail_after(5):
+    with anyio.fail_after(5):
+        async with httpx.AsyncClient(transport=transport, base_url="http://bridge") as http:
             async with http.stream("GET", "/linger") as response:
                 assert response.status_code == 200
             assert not cleanup_ran.is_set()