v1.27.0

Servers that publish Agent Skills are checked on eight more rules: two
MEDIUM rules for skills/get on unknown skills and for directory reads,
five LOW rules for limits, SKILL.md metadata and length, OpenAI import
limits and allowed-tools, and a HIGH readiness rule for caching hints on a
stateless skills/list. Their scores can fall where a check fails; every
other server skips these rules. Servers that only speak the 2026-07-28
stateless lifecycle now get the skills rules too, and the JSON report gains
an unscored skills section.

Added

• Two MEDIUM skills rules for the rest of the extension's required
  methods. Both apply only to servers that declare the Skills extension.

  • skills_get_unknown_rejected asks skills/get for a skill the server
    does not serve, next to a listed one, and expects JSON-RPC error
    -32602.
  • skills_directory_read applies when the server sets directoryRead: true. It reads a listed skill's root with resources/directory/read,
    which must list its direct children with SKILL.md among them, and
    expects -32602 for an unknown directory and for a file.

• Five LOW skills rules.

  • skills_within_limits: each skill stays within the extension's
    512 files and 16 MiB, counted from its file list.
  • skills_skill_file_metadata: SKILL.md is served and listed as
    text/markdown, with the frontmatter's name and description.
  • skills_openai_import_limits, a recommendation: each skill fits the
    limits ChatGPT and Codex import (100 files, SKILL.md 256 KiB, 1 MiB per
    file, 5 MiB per skill).
  • skills_skill_file_length, a recommendation: SKILL.md is under 500
    lines, as the Agent Skills specification advises.
  • skills_allowed_tools_valid: allowed-tools, when present, is a
    space-separated string.

• Modern-only servers get the skills rules. A server with no
  initialize handshake is asked skills/list, skills/get and
  resources/read on the 2026-07-28 stateless lifecycle, each request
  declaring the Skills extension; these servers skipped every skills rule
  before.

• readiness_2026_skills_list_cache_hints (HIGH, readiness): a stateless
  skills/list carries ttlMs and cacheScope. Dual-era HTTP servers get
  one extra stateless skills/list request for it.

• The JSON report gains skills: which skills request allowed-tools
  or bundle scripts, and whether the catalog fits one OpenAI import (at most
  five skills and 8 MiB per scan). The CLI prints it on one line. None of it
  is scored: hosts decide about these.

Changed

• skills_get_supported now asks skills/get for every listed skill
  (up to 32), not only the first, as the extension requires an answer for
  every skill the server serves. Calls that get no answer are not judged.
• Dependencies refreshed. No runtime package moved; the mcp==2.3.0 pin
  is the latest SDK release.

Fixed

• readiness_2026_cache_metadata judges ttlMs and cacheScope as JSON
  values. An integral ttlMs such as 0.0 now passes and true fails,
  and a cacheScope that is an array or object fails instead of stopping
  the audit with an error.