v0.5.0 — the runtime-probe release

The static scan proves legacy patterns are absent from your source. mcp-vet probe proves your running server actually speaks the 2026-07-28 wire contract — the runtime half the tool was previously honest about not covering.

• mcp-vet probe [options] <url | command...> — connects to a running MCP server over stdio (a command it spawns) or Streamable HTTP (a URL) and checks the two 2026-07-28 violations that only exist at runtime:
  • requires-initialize-handshake — sends a stateless first request (capabilities in per-request _meta, no handshake); if the server rejects/hangs, 2026-07-28 clients won't be able to talk to it.
  • json-schema-dialect — inspects live tools/list schemas for draft-07 forms that aren't valid JSON Schema 2020-12.
• Dual-version aware — --spec-version 2025-11-25 (default) checks the current path; --spec-version 2026-07-28 checks the new one, so you can keep both in your rollout matrix.
• CI-safe exit codes — 0 clean, 1 runtime violation found, 2 couldn't connect.
• Runtime rules join the SARIF driver metadata; new test/probe-fixtures/ real servers back 18 new tests (55 total, all passing).

The default mcp-vet . scan stays fully local and network-free — probe is the one command that talks to a server, and only the one you point it at.

npx @booyaka/mcp-vet .                        # static scan (local)
npx @booyaka/mcp-vet probe node ./server.js   # runtime probe (opt-in)