Interoperability

Interoperability

This page lists the foreign programs that the tests of the SDK use as peers, and where each test runs. Every foreign program is the official conformance suite, a tool that the GitHub runners already have, or @grpc/grpc-js with @grpc/proto-loader. The CI job installs these two packages from npm at pinned versions. The repository has no third-party code, except the licensed test fixtures in test/fixtures/.

Applies to: zig-sdk 0.1.0. The RSA and X25519MLKEM768 tests and the results of the authorization extensions apply to zig-sdk 0.2.0. The tests of AEGIS, record padding, the CA names, RSA-PSS keys, OCSP staples and the HelloRetryRequest cookie apply to the same release. The unscored scenarios in CI, the authorization server scenarios, the typed gRPC binding and WebSocket apply to the same release. The scripted HTTP/2 peer with a dynamic HPACK table applies to zig-sdk 0.4.0.

Protocol

Peer	What is checked	Where
@modelcontextprotocol/conformance 0.2.0-alpha.11	37 scored server scenarios and 32 scored client scenarios. The 20 unscored scenarios run one at a time: the Tasks extension, the pending server scenarios, the authorization extensions and the JSON Schema preservation scenario.	CI job conformance, see Conformance
@modelcontextprotocol/conformance 0.2.0-alpha.11, the authorization command	The 2 authorization server scenarios against the authorization server of the SDK	CI job conformance, see Conformance

TLS

Peer	What is checked	Where
Zig standard library TLS client	Handshake and echo with each key type except Ed25519, RSA 2048 and RSA 3072 included, and each cipher suite, the AEGIS suites included. X25519MLKEM768 negotiates. The client removes the record padding of the SDK server.	zig build test
openssl s_client	Chain verification, ALPN, a HelloRetryRequest with X448:P-384. An RSA 2048 server with each RSA-PSS hash, and the refusal of an offer with only PKCS#1 v1.5 schemes. An id-RSASSA-PSS server key with each rsa_pss_pss hash. The cookie of a HelloRetryRequest and record padding. The CA names in both directions, and a stapled OCSP response.	zig build test when OpenSSL is installed, not LibreSSL
openssl s_client 3.5 or later	X25519MLKEM768 with an RSA 3072 server, in the first flight and after a HelloRetryRequest	zig build test when OpenSSL 3.5 or later is installed
openssl s_server	The SDK client verifies the chain and negotiates ALPN. Record padding and the chain for the CA names of the server. id-RSASSA-PSS keys on both sides, and a stapled OCSP response.	zig build test when OpenSSL is installed, not LibreSSL
openssl s_server 3.5 or later	The SDK client with an RSA 3072 server: RSA-PSS with SHA-384 and SHA-512, and X25519MLKEM768 in the first flight and after a HelloRetryRequest	zig build test when OpenSSL 3.5 or later is installed
curl	A JSON and an SSE request over HTTPS	zig build test when a curl with TLS 1.3 is installed

gRPC

Peer	What is checked	Where
Node http2 module (.github/interop/h2_peer.mjs)	Discovery, tools/list, the error trailers and a listen stream with gRPC framing	CI job grpc-interop
curl --http2-prior-knowledge	One raw call to server/discover	CI job grpc-interop
@grpc/grpc-js 1.14.5 with @grpc/proto-loader 0.8.1 (.github/interop/grpc_typed_peer.mjs)	All eight RPCs of the typed service with the vendored proto files, the error trailers, and elicitation, sampling and roots in multi round-trip calls	CI job grpc-interop

WebSocket

Peer	What is checked	Where
The global WebSocket client of Node 22 (.github/interop/ws_peer.mjs)	The subprotocol mcp, discovery, tools/list, a tool call with progress, an error and the close handshake against the everything server with --ws-port	CI job websocket-interop
curl	The server refuses an upgrade without the subprotocol mcp with status 400	CI job websocket-interop

Known gaps

• No test against a gRPC implementation with a dynamic HPACK table on the peer side. The SDK decoder supports it. The encoder never uses it. The HTTP/2 tests of the SDK use a scripted peer that adds entries to its table, also after a size error of the decoder.
• The hybrid key exchange has interop tests with OpenSSL only when OpenSSL 3.5 or later is installed. Older runners skip them. The test with the Zig standard library client always runs.
• The official suite has no scenarios for the Skills and Apps extensions. The unit tests use the examples of the specifications.
• The Unix socket transport has no foreign peer in the tests. The tests use the SDK client and the SDK server.
• The curl on macOS runners has no TLS 1.3, so the HTTPS test with curl does not run there.
• The official conformance suite has no stdio server mode. The stdio tests of the SDK start the stdio_server example as a child process and use the SDK client.
• VS Code and other hosts of revision 2025-11-25 cannot use a zig-sdk server directly. They start with initialize, and the server answers with -32601. The bridge of zig-bridge-sdk serves these hosts. See VS Code on its wiki.