Skip to content

MCP Rigor 1.0.0-rc.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@ashwin-kondapalli ashwin-kondapalli released this 28 Aug 23:15
· 14 commits to main since this release
v1.0.0-rc.1
8d43c72

MCP Rigor 1.0.0-rc.1

First public release candidate. Plain-language, deterministic, black-box testing for Model Context Protocol servers — funded and supported by LoopIQ, the AI-Native governance platform for software releases.

Install

npm install --save-dev mcprigor
npx mcprigor init tests/acceptance.mcpr
npx mcprigor test tests/acceptance.mcpr

No build from source required — the npm package ships compiled code.

Highlights

  • Plain-language .mcpr tests with full YAML feature parity — no code, no AI interpretation
  • stdio + Streamable HTTP transports, with transport-parity comparison
  • Contract locks with SHA-256 fingerprints and classified drift detection (breaking / potentially breaking / non-breaking)
  • Evidence bundles: sanitized traces, negotiated metadata, content fingerprints
  • Semantic snapshots with path-level diffs, and safe allowlisted replay
  • Data-driven tests: inline tables, CSV, JSON, YAML, Excel, REST, Google Sheets; typed columns, filters, joins, seeded sampling
  • MCP-native coverage: notifications, subscriptions, progress, cancellation, log levels, pagination, tasks
  • Guided no-code authoring against a live server
  • Local browser QA workspace (loopback-only, CSRF-protected)
  • Worker-isolated extension SDK with manifest permissions
  • Stable error taxonomy — 14 categories with actionable QA explanations

Security posture

  • npm audit: 0 vulnerabilities (production and dev)
  • Centralized secret redaction (raw/percent/base64 variants), ANSI/OSC terminal sanitization
  • SSRF protection for remote data (private-IP rejection, redirect caps, body limits)
  • Hostile-input limits for YAML/CSV/XLSX parsing
  • Remote data and custom code are opt-in (--allow-remote-data, --allow-custom-code)
  • Dedicated security-hardening and lifecycle test suites run in CI

Verification

  • 21 test files / 78 tests passing on Node 20/22 across Linux, macOS, Windows
  • Compatibility matrix: MCP protocol revisions 2024-11-05 / 2025-03-26 / 2025-06-18 × stdio / Streamable HTTP

Links

Release candidate: APIs may still receive minor changes before the final 1.0.

Assets 3
Loading