Update README.md files and VALIDATION_RESULTS.md

Signed-off-by: Dariusz Jędrzejczyk <dariusz.jedrzejczyk@broadcom.com>

Author: chemicL

conformance-tests/VALIDATION_RESULTS.md

@@ -2,322 +2,81 @@
 
 ## Summary
 
-The Java SDK has been validated against the official MCP conformance test suite for both server and client implementations.
-
-### Server Tests
-Out of 40 total test checks in the "active" suite, **36 passed (90%)** and **4 failed (10%)**.
-
-### Client Tests
-The client conformance implementation supports 4 core scenarios (excluding auth):
-- ✅ initialize
-- ✅ tools_call
-- ✅ elicitation-sep1034-client-defaults
-- ✅ sse-retry
-
-## Client Test Results
-
-### ✅ Implemented Client Scenarios (4/4)
-
-#### 1. initialize
-**Status:** ✅ Implemented  
-**Description:** Tests the MCP client initialization handshake  
-**Validates:**
-- Protocol version negotiation
-- Client info (name and version)
-- Server capabilities handling
-- Proper connection establishment and closure
-
-#### 2. tools_call
-**Status:** ✅ Implemented  
-**Description:** Tests tool discovery and invocation  
-**Validates:**
-- Client initialization
-- Listing available tools from server
-- Calling the `add_numbers` tool with arguments (a=5, b=3)
-- Processing tool results
-
-#### 3. elicitation-sep1034-client-defaults
-**Status:** ✅ Implemented  
-**Description:** Tests that client applies default values for omitted elicitation fields (SEP-1034)  
-**Validates:**
-- Client properly applies default values from JSON schema
-- Supports string, integer, number, enum, and boolean defaults
-- Correctly handles elicitation requests from server
-- Sends complete responses with all required fields
-
-#### 4. sse-retry
-**Status:** ✅ Implemented  
-**Description:** Tests client respects SSE retry field timing and reconnects properly (SEP-1699)  
-**Validates:**
-- Client reconnects after SSE stream closure
-- Respects the retry field timing (waits specified milliseconds)
-- Sends Last-Event-ID header on reconnection
-- Handles graceful stream closure as reconnectable
-
-### Client Implementation Details
-
-The client conformance tests use:
-- **Transport:** `HttpClientStreamableHttpTransport` (JDK HTTP Client)
-- **Client Type:** `McpAsyncClient` with reactive (Reactor) API
-- **Configuration:** 30-second request timeout, test-client/1.0.0 identification
-- **Protocol:** Latest Streamable HTTP protocol (2025-03-26)
-
-### Running Client Tests
-
-Build the executable JAR:
-```bash
-cd conformance-tests/client-jdk-http-client
-../../mvnw clean package -DskipTests
-```
-
-Run with conformance framework:
-```bash
-npx @modelcontextprotocol/conformance client \
-  --command "java -jar conformance-tests/client-jdk-http-client/target/client-jdk-http-client-0.18.0-SNAPSHOT.jar" \
-  --scenario initialize
-
-npx @modelcontextprotocol/conformance client \
-  --command "java -jar conformance-tests/client-jdk-http-client/target/client-jdk-http-client-0.18.0-SNAPSHOT.jar" \
-  --scenario tools_call
-
-npx @modelcontextprotocol/conformance client \
-  --command "java -jar conformance-tests/client-jdk-http-client/target/client-jdk-http-client-0.18.0-SNAPSHOT.jar" \
-  --scenario elicitation-sep1034-client-defaults
-
-npx @modelcontextprotocol/conformance client \
-  --command "java -jar conformance-tests/client-jdk-http-client/target/client-jdk-http-client-0.18.0-SNAPSHOT.jar" \
-  --scenario sse-retry
-```
-
-### Excluded Scenarios
-
-**Auth Scenarios:** Authentication-related scenarios were excluded as per requirements. The conformance framework includes 15+ auth scenarios that test OAuth2, OIDC, and various authentication flows. These can be added in future iterations.
+**Server Tests:** 37/40 passed (92.5%)  
+**Client Tests:** 3/4 scenarios passed (9/10 checks passed)
 
 ## Server Test Results
 
-### ✅ Passing Tests (36/40)
-
-#### Lifecycle & Utilities
-- ✅ server-initialize: Server initialization handshake
-- ✅ logging-set-level: Logging level configuration
-- ✅ ping: Server health check
-- ✅ completion-complete: Argument autocompletion
-
-#### Tools (10/11)
-- ✅ tools-list: List available tools
-- ✅ tools-call-simple-text: Simple text response
-- ✅ tools-call-image: Image content response
-- ✅ tools-call-audio: Audio content response
-- ✅ tools-call-embedded-resource: Embedded resource response
-- ✅ tools-call-mixed-content: Multiple content types
-- ✅ tools-call-with-logging: Log messages during execution
-- ✅ tools-call-error: Error handling
-- ❌ tools-call-with-progress: Progress notifications (FAILING)
-- ✅ tools-call-sampling: LLM sampling requests
-- ✅ tools-call-elicitation: User input requests
-
-#### Elicitation (10/10)
-- ✅ elicitation-sep1034-defaults: Default values for primitive types (5 checks)
-  - String defaults
-  - Integer defaults
-  - Number defaults
-  - Enum defaults
-  - Boolean defaults
-- ✅ elicitation-sep1330-enums: Enum schema improvements (5 checks)
-  - Untitled single-select
-  - Titled single-select
-  - Legacy enumNames
-  - Untitled multi-select
-  - Titled multi-select
-
-#### SSE Transport
-- ✅ server-sse-multiple-streams: Multiple SSE connections (2 checks)
-
-#### Resources (4/6)
-- ✅ resources-list: List available resources
-- ✅ resources-read-text: Read text resources
-- ✅ resources-read-binary: Read binary resources
-- ✅ resources-templates-read: Resource templates
-- ❌ resources-subscribe: Subscribe to resources (SDK LIMITATION)
-- ❌ resources-unsubscribe: Unsubscribe from resources (SDK LIMITATION)
-
-#### Prompts (4/4)
-- ✅ prompts-list: List available prompts
-- ✅ prompts-get-simple: Simple prompts
-- ✅ prompts-get-with-args: Parameterized prompts
-- ✅ prompts-get-embedded-resource: Prompts with embedded resources
-- ✅ prompts-get-with-image: Prompts with images
-
-#### Security (1/2)
-- ✅ dns-rebinding-protection: Localhost host validation
-- ❌ dns-rebinding-protection: Non-localhost host rejection (FAILING)
+### Passing (37/40)
 
-### ❌ Failing Tests (4/40)
+- **Lifecycle & Utilities (4/4):** initialize, ping, logging-set-level, completion-complete
+- **Tools (11/11):** All scenarios including progress notifications ✨
+- **Elicitation (10/10):** SEP-1034 defaults (5 checks), SEP-1330 enums (5 checks)
+- **Resources (4/6):** list, read-text, read-binary, templates-read
+- **Prompts (4/4):** list, simple, with-args, embedded-resource, with-image
+- **SSE Transport (2/2):** Multiple streams
+- **Security (1/2):** Localhost validation passes
 
-#### 1. tools-call-with-progress
-**Status:** Request timeout  
-**Issue:** Progress notifications are not being delivered correctly. The tool handler sends progress notifications but the client times out waiting for the response.  
-**Root Cause:** Potential issue with the Reactor Mono chain not properly handling progress notifications in the async exchange.  
-**Recommendation:** Requires investigation of the `McpAsyncServerExchange.progressNotification()` implementation and the underlying transport's notification delivery mechanism.
+### Failing (3/40)
 
-#### 2. resources-subscribe
-**Status:** Method not found  
-**Issue:** The `resources/subscribe` endpoint is not implemented in the Java SDK.  
-**Root Cause:** The MCP Java SDK does not currently implement server-side subscription handlers. The subscription capability can be advertised but the actual subscribe/unsubscribe request handlers are missing from `McpStatelessAsyncServer`.  
-**Recommendation:** This is a known SDK limitation. The subscription feature needs to be implemented at the SDK level to handle client subscription requests and track subscribed resources.
+1. **resources-subscribe** - Not implemented in SDK
+2. **resources-unsubscribe** - Not implemented in SDK  
+3. **dns-rebinding-protection** - Missing Host/Origin validation (1/2 checks)
 
-#### 3. resources-unsubscribe
-**Status:** Method not found  
-**Issue:** The `resources/unsubscribe` endpoint is not implemented in the Java SDK.  
-**Root Cause:** Same as resources-subscribe above.  
-**Recommendation:** Same as resources-subscribe above.
-
-#### 4. dns-rebinding-protection (partial)
-**Status:** Security validation failure  
-**Issue:** The server accepts requests with non-localhost Host/Origin headers when it should reject them with HTTP 4xx.  
-**Root Cause:** The `HttpServletStreamableServerTransportProvider` does not validate Host/Origin headers to prevent DNS rebinding attacks.  
-**Recommendation:** Add Host/Origin header validation at the transport provider level. This is a security feature that should be implemented in the SDK core, not in individual server implementations.
-
-## Changes Made
-
-### Client Conformance Implementation
-
-#### 1. Base Client Scenarios
-- Implemented `initialize` scenario for basic handshake testing
-- Implemented `tools_call` scenario for tool discovery and invocation
-
-#### 2. Elicitation Defaults (SEP-1034)
-- Implemented `elicitation-sep1034-client-defaults` scenario
-- Tests client properly applies default values from JSON schema
-- Validates all primitive types: string, integer, number, enum, boolean
-
-#### 3. SSE Retry Handling (SEP-1699)
-- Implemented `sse-retry` scenario
-- Tests client respects retry field timing
-- Validates graceful reconnection with Last-Event-ID header
+## Client Test Results
 
-### Server Conformance Implementation
+### Passing (3/4 scenarios, 9/10 checks)
 
-#### 1. Added Completion Support
-- Enabled `completions` capability in server capabilities
-- Implemented completion handler for `test_prompt_with_arguments` prompt
-- Returns minimal completion with required `total` field set to 0
+- **initialize (1/1):** Protocol negotiation, clientInfo, capabilities
+- **tools_call (1/1):** Tool discovery and invocation
+- **elicitation-sep1034-client-defaults (5/5):** Default values for string, integer, number, enum, boolean
 
-#### 2. Added SEP-1034 Elicitation Defaults Tool
-- Implemented `test_elicitation_sep1034_defaults` tool
-- Supports default values for all primitive types:
-  - String: "John Doe"
-  - Integer: 30
-  - Number: 95.5
-  - Enum: "active" (from ["active", "inactive", "pending"])
-  - Boolean: true
+### Partially Passing (1/4 scenarios, 1/2 checks)
 
-#### 3. Added SEP-1330 Enum Schema Improvements Tool
-- Implemented `test_elicitation_sep1330_enums` tool
-- Supports all 5 enum variants:
-  - Untitled single-select (enum array)
-  - Titled single-select (oneOf with const/title)
-  - Legacy enumNames (deprecated)
-  - Untitled multi-select (array with items.enum)
-  - Titled multi-select (array with items.anyOf)
+- **sse-retry (1/2 + 1 warning):** 
+  - ✅ Reconnects after stream closure
+  - ❌ Does not respect retry timing
+  - ⚠️ Does not send Last-Event-ID header (SHOULD requirement)
 
-#### 4. Enabled Resources Capability
-- Added `resources(true, false)` to server capabilities
-- Enables subscribe capability (though not fully implemented in SDK)
+**Issue:** Client treats `retry:` SSE field as invalid instead of parsing it for reconnection timing.
 
 ## Known Limitations
 
-### 1. Resource Subscriptions Not Implemented
-The Java SDK does not implement the server-side handlers for:
-- `resources/subscribe`
-- `resources/unsubscribe`
-
-These methods return "Method not found" errors. This is a gap in the SDK that needs to be addressed at the framework level.
-
-### 2. Progress Notifications Issue
-There appears to be an issue with how progress notifications are delivered in the async tool execution flow. The test times out even though the tool handler attempts to send progress notifications correctly.
-
-### 3. DNS Rebinding Protection Missing
-The HTTP transport does not validate Host/Origin headers, making localhost servers vulnerable to DNS rebinding attacks. This security feature should be implemented in the SDK's transport layer.
-
-## Recommendations
-
-### For SDK Maintainers
-
-1. **Implement Resource Subscriptions**: Add handlers for `resources/subscribe` and `resources/unsubscribe` methods in `McpStatelessAsyncServer` and `McpAsyncServer`. Track subscribed resources and implement notification mechanisms.
-
-2. **Fix Progress Notifications**: Investigate why progress notifications sent via `exchange.progressNotification()` are not being delivered correctly in the SSE transport. The Reactor chain may need adjustment.
-
-3. **Add DNS Rebinding Protection**: Implement Host/Origin header validation in `HttpServletStreamableServerTransportProvider` to reject requests with non-localhost headers (return HTTP 403).
+1. **Resource Subscriptions:** SDK doesn't implement `resources/subscribe` and `resources/unsubscribe` handlers
+2. **Client SSE Retry:** Client doesn't parse or respect the `retry:` field, reconnects immediately, and doesn't send Last-Event-ID header
+3. **DNS Rebinding Protection:** Missing Host/Origin header validation in server transport
 
-4. **Document Limitations**: Update SDK documentation to clearly state which MCP features are fully implemented and which have known limitations.
-
-### For Server Implementations
-
-1. **Use Latest SDK**: Ensure you're using the latest version of the Java SDK as features are being actively developed.
-
-2. **Handle Timeouts**: Be aware of the 30-second default request timeout and adjust if needed for long-running operations.
-
-3. **Security**: If deploying localhost servers, be aware of the DNS rebinding vulnerability until it's addressed in the SDK.
-
-## Testing Instructions
-
-### Server Tests
-
-To reproduce server tests:
+## Running Tests
 
+### Server
 ```bash
-# Start the conformance server
+# Start server
 cd conformance-tests/server-servlet
 ../../mvnw compile exec:java -Dexec.mainClass="io.modelcontextprotocol.conformance.server.ConformanceServlet"
 
-# In another terminal, run conformance tests
+# Run tests (in another terminal)
 npx @modelcontextprotocol/conformance server --url http://localhost:8080/mcp --suite active
 ```
 
-To test individual server scenarios:
-
-```bash
-npx @modelcontextprotocol/conformance server --url http://localhost:8080/mcp --scenario tools-call-with-progress --verbose
-```
-
-### Client Tests
-
-To test client scenarios:
-
+### Client
 ```bash
-# Build the client JAR first
+# Build
 cd conformance-tests/client-jdk-http-client
 ../../mvnw clean package -DskipTests
 
-# Run individual scenarios
-npx @modelcontextprotocol/conformance client \
-  --command "java -jar target/client-jdk-http-client-0.18.0-SNAPSHOT.jar" \
-  --scenario initialize \
-  --verbose
-
-# Test all client scenarios
+# Run all scenarios
 for scenario in initialize tools_call elicitation-sep1034-client-defaults sse-retry; do
   npx @modelcontextprotocol/conformance client \
     --command "java -jar target/client-jdk-http-client-0.18.0-SNAPSHOT.jar" \
     --scenario $scenario
 done
 ```
 
-## Conclusion
-
-The Java SDK conformance implementation demonstrates strong compatibility with the MCP specification, achieving 90% test pass rate. The failing tests represent known limitations that require SDK-level fixes rather than implementation issues in the conformance server itself.
+## Recommendations
 
-The implementation successfully covers:
-- ✅ All core protocol features (initialization, ping, logging)
-- ✅ Complete tools API (11 different tool scenarios)
-- ✅ Complete prompts API (4 scenarios)
-- ✅ Basic resources API (4/6 scenarios)
-- ✅ Advanced elicitation features (2 SEPs with 10 sub-tests)
-- ✅ Completion/autocompletion support
-- ✅ SSE transport with multiple streams
+### High Priority
+1. Fix client SSE retry field handling in `HttpClientStreamableHttpTransport`
+2. Implement resource subscription handlers in `McpStatelessAsyncServer`
 
-Priority areas for improvement:
-1. Resource subscription mechanism (SDK gap)
-2. Progress notification delivery (SDK bug)
-3. DNS rebinding protection (security feature)
+### Medium Priority
+3. Add Host/Origin validation in `HttpServletStreamableServerTransportProvider` for DNS rebinding protection