Complete the planned 2026-07-28 coverage: the final 27 tests

JSON Schema handling: prefixItems vocabulary enforcement, the 2020-12
default dialect (with a declared-dialect violation arm proving validation
follows the tag), falsy structured content reaching the validator, and
non-object outputs - plus the null structured-content divergence: a tool
legitimately returning JSON null is indistinguishable from one returning
nothing (the model collapses both to None and the dump drops them), so a
spec-legal value raises; pinned with the fix direction recorded
(absent-vs-null at the model layer, not a looser client check).

MRTR edges: a retry missing a requested key is re-prompted rather than
errored, unknown response keys are ignored, the resultType seam (absent
means complete, input_required is never masked, unrecognized values
rejected - flipping the deferred entry to a pinned divergence), and the
max-tokens pass-through. Auth: refresh tokens are not reused across an AS
change, CIMD documents are portable, the all-scopes single challenge, and
the bundled AS registration echo dropping application_type (pinned against
its ledger row). The scatter: list results are connection-independent and
deterministically ordered, an empty-string cursor is a valid cursor (a
2026 rule the changelog never mentioned), cancellation stops notification
delivery, SSE comment lines are ignored, legacy error codes pass through
opaquely, sampling messages are not retained across rounds, multi-content
reads, path-traversal rejection, and resource links in prompt content.

26 entries minted, one flipped, four divergences recorded. 946 -> 1009
cells, every node accounted; suite green three consecutive runs.

Author: maxisbey

tests/interaction/_requirements.py

@@ -16,10 +16,11 @@
 import httpx
 import pytest
 from inline_snapshot import snapshot
+from pydantic import AnyUrl
 
 from mcp.server import Server
 from mcp.server.auth.provider import ProviderTokenVerifier
-from mcp.shared.auth import OAuthClientInformationFull
+from mcp.shared.auth import OAuthClientInformationFull, OAuthClientMetadata
 from tests.interaction._connect import mounted_app
 from tests.interaction._requirements import requirement
 from tests.interaction.auth._harness import REDIRECT_URI, auth_settings, oauth_client_metadata
@@ -298,3 +299,34 @@ async def test_a_non_loopback_http_redirect_uri_is_accepted_at_registration(
     info = OAuthClientInformationFull.model_validate_json(response.content)
     assert [str(u) for u in (info.redirect_uris or [])] == ["http://evil.example/callback"]
     assert info.client_id in provider.clients
+
+
+@requirement("hosting:auth:as:register-echo-application-type")
+async def test_register_echoes_native_for_a_client_that_registered_application_type_web(
+    as_app: tuple[httpx.AsyncClient, InMemoryAuthorizationServerProvider],
+) -> None:
+    """A client registering `application_type: "web"` is told `"native"` in the registration echo.
+
+    Pins the known gap recorded on the requirement (divergence): the registration handler's
+    field-by-field passthrough omits `application_type`, so the model default fills the echo
+    where RFC 7591 §3.2.1 requires the registered value -- and the SDK OAuth client adopts the
+    echo into persisted storage, so the corruption is client-visible end to end. When the
+    one-line passthrough fix lands this test fails: re-pin the echo to `"web"`, delete the
+    Divergence, and add the echo assertion to
+    `test_dcr_sends_a_consumer_set_application_type_verbatim` (test_flow.py) per the
+    requirement's note.
+    """
+    http, _ = as_app
+    metadata = OAuthClientMetadata(
+        client_name="interaction-suite", redirect_uris=[AnyUrl(REDIRECT_URI)], application_type="web"
+    )
+
+    response = await http.post("/register", content=metadata.model_dump_json())
+
+    # Registration itself succeeds: the divergence is in the echo, not in acceptance.
+    assert response.status_code == 201
+    body = response.json()
+    # The request carried "web" (the metadata above); the echo says "native" -- the pinned gap.
+    assert body["application_type"] == "native"
+    # The omission is specific to application_type, not a generally lossy echo.
+    assert body["client_name"] == "interaction-suite"

tests/interaction/auth/test_as_handlers.py

@@ -156,6 +156,37 @@ async def test_a_token_missing_a_required_scope_is_answered_403_insufficient_sco
     assert "scope" not in parsed
 
 
+@requirement("hosting:auth:scope-403:all-scopes")
+async def test_a_token_missing_two_required_scopes_is_challenged_with_only_the_first() -> None:
+    """A token missing both required scopes is challenged for one scope per round trip.
+
+    The spec says servers SHOULD include all scopes required for the current operation in a
+    single challenge; the bearer middleware instead checks required scopes in order and 403s on
+    the first missing one, naming only that scope in `error_description` (and emitting no
+    `scope` parameter at all -- the sibling `hosting:auth:scope-403` divergence). Pins the known
+    gap recorded on the requirement (divergence); when the middleware aggregates, this test
+    fails -- re-pin to a challenge naming both scopes and delete the Divergence. The two-scope
+    app is built inline: the file's `protected` fixture is single-scope, and a two-scope deficit
+    is this entry's distinct observable.
+    """
+    settings = auth_settings(required_scopes=["mcp:read", "mcp:write"])
+    verifier = StaticTokenVerifier(
+        {"tok-zeroscope": AccessToken(token="tok-zeroscope", client_id="c", scopes=["other:thing"], expires_at=_FUTURE)}
+    )
+
+    async with mounted_app(Server("rs"), auth=settings, token_verifier=verifier) as (http, _):
+        response = await post_mcp(http, bearer="tok-zeroscope")
+
+    assert response.status_code == 403
+    # Full-dict equality: only the FIRST missing scope (registration order) is named, and no
+    # `scope` key appears.
+    assert parse_www_authenticate(response.headers["www-authenticate"]) == {
+        "error": "insufficient_scope",
+        "error_description": "Required scope: mcp:read",
+        "resource_metadata": RESOURCE_METADATA_URL,
+    }
+
+
 @requirement("hosting:auth:aud-validation")
 async def test_a_token_with_a_mismatched_audience_is_accepted(protected: httpx.AsyncClient) -> None:
     """A token whose `resource` does not match the server's resource identifier is accepted.

tests/interaction/auth/test_bearer.py

@@ -21,7 +21,7 @@
 from mcp import MCPError
 from mcp.client.auth.extensions.client_credentials import ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider
 from mcp.server import Server, ServerRequestContext
-from mcp.shared.auth import OAuthClientInformationFull, OAuthMetadata
+from mcp.shared.auth import OAuthClientInformationFull, OAuthMetadata, OAuthToken
 from tests.interaction._connect import BASE_URL
 from tests.interaction._requirements import requirement
 from tests.interaction.auth._harness import (
@@ -319,6 +319,117 @@ async def test_credentials_bound_to_a_different_issuer_are_discarded_and_the_cli
     assert storage.client_info.issuer == f"{BASE_URL}/"
 
 
+@requirement("client-auth:as-binding:no-token-reuse")
+async def test_tokens_from_the_previous_authorization_server_are_never_replayed_after_migration() -> None:
+    """Tokens from the previous authorization server are discarded with its credentials, never replayed.
+
+    Choreography twin of the as-binding discard test above, pinning the token half of the same
+    SEP-2352 branch: storage carries both an old-issuer client registration and that server's
+    tokens. The stale access token is presented once to the resource server (reload treats it
+    as live), the 401 triggers the binding check, and the discard drops tokens together with
+    the credentials -- so the stale refresh token reaches no endpoint of the new authorization
+    server and the only token exchange is the fresh authorization-code grant. The requirement's
+    note carries the refresh-ordering hazard this test is the regression net for.
+    """
+    recorded, on_request = record_requests()
+    provider = InMemoryAuthorizationServerProvider()
+    # Built directly rather than via `seeded_client`: the previous authorization server no
+    # longer exists, so its client must NOT be registered with the current provider.
+    stale = OAuthClientInformationFull.model_validate(
+        {
+            "client_id": "stale-as-client",
+            "token_endpoint_auth_method": "none",
+            "redirect_uris": [AnyUrl(REDIRECT_URI)],
+            "grant_types": ["authorization_code", "refresh_token"],
+            "scope": "mcp",
+            "issuer": "https://old-as.example.com",
+        }
+    )
+    storage = InMemoryTokenStorage(client_info=stale)
+    storage.tokens = OAuthToken(
+        access_token="stale-access-token",
+        token_type="Bearer",
+        expires_in=3600,
+        scope="mcp",
+        refresh_token="stale-refresh-token",
+    )
+    server = Server("guarded", on_list_tools=list_tools)
+
+    with anyio.fail_after(5):
+        async with connect_with_oauth(server, provider=provider, storage=storage, on_request=on_request) as (client, _):
+            result = await client.list_tools()
+
+    # The only token exchange is the fresh code grant: no refresh grant ever fired.
+    token_posts = find(recorded, "POST", "/token")
+    assert [form_body(r)["grant_type"] for r in token_posts] == snapshot(["authorization_code"])
+
+    # The MUST NOT, swept exhaustively: the stale refresh token reached no endpoint at all.
+    for r in recorded:
+        assert "stale-refresh-token" not in r.content.decode()
+        assert "stale-refresh-token" not in r.url.query.decode()
+
+    # Scenario non-vacuity: the stale access token WAS presented and refused -- to the resource
+    # server only, never to an authorization-server endpoint.
+    stale_bearer_paths = [r.path for r in recorded if r.headers.get("authorization") == "Bearer stale-access-token"]
+    assert stale_bearer_paths == ["/mcp"]
+
+    # The migration branch actually engaged: the discard forced one re-registration.
+    assert path_counts(recorded)[("POST", "/register")] == 1
+
+    # Fresh credentials and tokens are in place, and the flow completed on them.
+    assert result.tools[0].name == "echo"
+    assert storage.tokens is not None
+    assert storage.tokens.refresh_token != "stale-refresh-token"
+
+
+@requirement("client-auth:as-binding:cimd-portable")
+async def test_a_cimd_client_id_survives_an_authorization_server_change_without_reregistration() -> None:
+    """A CIMD client_id keeps working across an authorization-server change with no re-registration.
+
+    The spec's portability sentence: client IDs based on Client ID Metadata Documents are
+    self-hosted HTTPS URLs resolved by the authorization server on demand, so "no
+    re-registration is needed when the authorization server changes". Storage carries CIMD
+    credentials stamped with the OLD issuer -- the migration precondition -- and the provider is
+    pre-seeded with the URL client_id, the harness stand-in for on-demand resolution (the SDK
+    server has no CIMD-aware client lookup of its own). No AS-metadata shim: the
+    `client_id_metadata_document_supported` flag gates only the registration-path selection,
+    which pre-seeded credentials never reach.
+    """
+    recorded, on_request = record_requests()
+    provider = InMemoryAuthorizationServerProvider()
+    info = seeded_client(provider, client_id=CIMD_URL, issuer="https://old-as.example.com")
+    storage = InMemoryTokenStorage(client_info=info)
+    server = Server("guarded", on_list_tools=list_tools)
+
+    with anyio.fail_after(5):
+        async with connect_with_oauth(
+            server,
+            provider=provider,
+            storage=storage,
+            client_metadata_url=CIMD_URL,
+            on_request=on_request,
+        ) as (client, headless):
+            result = await client.list_tools()
+
+    # "No re-registration is needed when the authorization server changes" -- the sentence itself.
+    assert find(recorded, "POST", "/register") == []
+
+    # The SAME metadata-document URL is presented as client_id at the new authorization server.
+    assert headless.authorize_url is not None
+    assert authorize_params(headless.authorize_url)["client_id"] == CIMD_URL
+
+    # Portability is end to end, not a stalled flow: one fresh code exchange completed it.
+    assert result.tools[0].name == "echo"
+    assert [form_body(r)["grant_type"] for r in find(recorded, "POST", "/token")] == snapshot(["authorization_code"])
+
+    # The credentials survived untouched. The stale issuer stamp is informational on CIMD
+    # credentials and deliberately not re-stamped (see the requirement's note); a future
+    # re-stamp fails here consciously.
+    assert storage.client_info is not None
+    assert storage.client_info.client_id == CIMD_URL
+    assert storage.client_info.issuer == "https://old-as.example.com"
+
+
 @requirement("client-auth:as-binding:prereg-mismatch-error")
 async def test_preregistered_credentials_bound_to_a_different_issuer_are_silently_replaced_without_an_error() -> None:
     """Pre-registered credentials with a mismatched issuer are silently replaced rather than erroring.

tests/interaction/auth/test_lifecycle.py

@@ -87,6 +87,75 @@ async def call_and_capture_error() -> None:
     assert errors == snapshot([ErrorData(code=0, message="Request cancelled")])
 
 
+@requirement("protocol:cancel:no-further-notifications")
+async def test_no_notifications_for_a_request_arrive_after_its_cancellation(connect: Connect) -> None:
+    """After a request is cancelled, no further notifications for it reach the wire (spec-mandated).
+
+    The 2026-07-28 stdio page says the receiver of a cancellation MUST NOT send any further
+    messages for the cancelled request. The response half of "any further messages" is the
+    divergence pinned on protocol:cancel:in-flight (both seats answer with a code-0 error); this
+    test pins the notifications half. The handler attempts a progress send during its cancellation
+    unwind so the negative is proved enforced, not merely unexercised: the attempt itself is
+    cancelled before transmitting, and the caller's progress callback saw only the
+    pre-cancellation notification.
+    """
+    started = anyio.Event()
+    handler_cancelled = anyio.Event()
+    request_ids: list[types.RequestId] = []
+    attempted: list[str] = []
+    progress_updates: list[tuple[float, float | None, str | None]] = []
+
+    async def collect(progress: float, total: float | None, message: str | None) -> None:
+        progress_updates.append((progress, total, message))
+
+    async def call_tool(ctx: ServerRequestContext, params: types.CallToolRequestParams) -> CallToolResult:
+        assert params.name == "block"
+        assert ctx.request_id is not None
+        request_ids.append(ctx.request_id)
+        # Proves the progress channel is live before the cancellation arrives.
+        await ctx.session.report_progress(1.0, total=2.0, message="started")
+        started.set()
+        try:
+            await anyio.Event().wait()  # blocks until cancelled; nothing ever sets this event
+        except anyio.get_cancelled_exc_class():
+            handler_cancelled.set()
+            try:
+                # The MUST NOT under test: a send attempted during the cancellation unwind.
+                await ctx.session.report_progress(2.0, total=2.0, message="too late")
+            except anyio.get_cancelled_exc_class():
+                attempted.append("send-cancelled")
+                raise
+            raise NotImplementedError  # unreachable: the unwind cancels the send before it transmits
+        raise NotImplementedError  # unreachable: the wait above never completes normally
+
+    server = Server("blocker", on_call_tool=call_tool)
+
+    async with connect(server) as client:
+        with anyio.fail_after(5):
+            async with anyio.create_task_group() as task_group:
+
+                async def call_and_swallow_cancellation_error() -> None:
+                    # The error shape (code 0, "Request cancelled") is protocol:cancel:in-flight's
+                    # pinned divergence and is deliberately not re-asserted here.
+                    with pytest.raises(MCPError):
+                        await client.call_tool("block", {}, progress_callback=collect)
+
+                task_group.start_soon(call_and_swallow_cancellation_error)
+                await started.wait()
+                await client.session.send_notification(
+                    types.CancelledNotification(
+                        params=types.CancelledNotificationParams(request_id=request_ids[0], reason="user aborted")
+                    )
+                )
+
+            await handler_cancelled.wait()
+
+    # Request-scoped progress rides the same ordered stream as the error response that unblocked
+    # the call, so a transmitted "too late" notification would already have been delivered.
+    assert progress_updates == [(1.0, 2.0, "started")]
+    assert attempted == ["send-cancelled"]
+
+
 @requirement("protocol:cancel:server-survives")
 async def test_session_serves_requests_after_cancellation(connect: Connect) -> None:
     """A request cancelled mid-flight does not poison the session: the next request succeeds."""