mcp-vet — lint your MCP server for 2026-07-28 spec breakage before you ship

[Booyaka101]

On July 28 the MCP 2026-07-28 spec locks — sessions and the initialize handshake are removed, -32002 → -32602, tasks/list and tasks/result are gone, and roots / sampling / logging are deprecated.

I built mcp-vet to catch those in your server before a client does:

npx @booyaka/mcp-vet .

It statically scans TypeScript, JavaScript, and Python MCP servers, and matches how servers are actually written — not just raw strings:

• SDK schema-constant registration — setRequestHandler(InitializeRequestSchema, …)
• the Python SDK's ClientCapabilities(roots=RootsCapability())
• sessionIdGenerator — flagged only when it's a real generator, not the migrated undefined

Every finding has a confidence score, an --fix handles the mechanical -32002 → -32602 (with a --dry-run preview), and it emits SARIF/JSON with CI-ready exit codes. It's also a typed library, not just a CLI. Run against the official reference servers (TS + Python), it produced 0 false positives.

Repo: https://github.com/Booyaka101/mcp-vet · npm @booyaka/mcp-vet · MIT.

Feedback and false-positive reports very welcome — especially edge cases in how your server registers handlers.