Add regression tests gating the mcp-go to go-sdk migration

[JAORMX]

Summary

#5729 migrates ToolHive from mark3labs/mcp-go to the go-sdk-backed mcpcompat shim (toolhive-core v0.0.27). An audit found functional regressions in the shim — tracked with fixes in stacklok/toolhive-core#156. To guarantee the migration lands with zero functional loss, ToolHive needs regression tests that pin the current (mcp-go) behavior: they should fail against shim v0.0.27 and pass once #5729 bumps to the fixed toolhive-core release.

These tests are the acceptance gate for toolhive-core#156 and merge-blocking evidence for #5729.

Test matrix

1. stdio bridge notification forwarding (end-to-end)

Backend emits → client of the bridge receives, over pkg/transport/bridge.go:

• notifications/progress (with progressToken correlation)
• notifications/message (logging)
• notifications/tools/list_changed — and a subsequent tools/list through the bridge reflects the changed tool set
• notifications/resources/list_changed, notifications/prompts/list_changed

Currently ALL of these are dropped end-to-end under the shim (client half never registers progress/logging handlers; server half cannot send list_changed).

2. vMCP session lifecycle

• Per-request session validation: terminate a session out-of-band (auth-failure path or cross-pod Terminate via shared Redis storage), then verify the origin pod rejects the next request on that Mcp-Session-Id (today the shim skips Validate for local sessions).
• DELETE termination still evicts cache, closes backend connections, and returns the spec status.
• Session identity binding: a second principal reusing a session ID is rejected.

3. Per-session tool projection (security-relevant)

Runtime validation that the shim's per-session go-sdk Server + live tool reconciliation preserves vMCP behavior:

• Two concurrent sessions with different authz outcomes see different tools/list results.
• A tool filtered for session A cannot be invoked by session A via tools/call while remaining callable in session B.
• SetSessionTools reconciliation mid-session is reflected in the next tools/list.

4. SSE keep-alive

• An idle long-lived text/event-stream response from the vMCP server carries periodic keep-alive bytes (SSE comments or pings) at the configured WithHeartbeatInterval cadence (currently a silent no-op under the shim).

5. Pagination behavior

• A vMCP server exposing >1000 tools: verify downstream clients receive the complete set (go-sdk paginates at 1000; mcp-go returned everything). Either the server page size is raised or the test documents/exercises cursor-following.

6. Local proxy Host-header behavior

• Localhost-bound proxy accessed with a non-localhost Host header behaves as before the migration (go-sdk's DNS-rebinding protection defaults on and returns 403; decide and pin the intended behavior).

7. Remote auth error mapping

• 401 from a remote backend surfaces ErrUnauthorized/ErrAuthorizationRequired sentinels consumed by pkg/vmcp/client auth discovery.
• 403-on-initialize maps to the legacy-SSE fallback path as it did under mcp-go.

Notes

• Prefer e2e tests where the behavior crosses process/transport boundaries (bridge, sessions), unit/integration where a fake backend suffices (Ginkgo/Gomega per repo conventions; t.Context() in unit tests).
• Land the tests before or together with the toolhive-core bump in feat: migrate from mark3labs/mcp-go to toolhive-core/mcpcompat (go-sdk) #5729 so the fixes are demonstrably verified.
• Related: Close mcpcompat functional gaps vs mcp-go for a loss-free migration toolhive-core#156 (shim fixes), feat: migrate from mark3labs/mcp-go to toolhive-core/mcpcompat (go-sdk) #5729 (migration PR).

Generated with Claude Code

[JAORMX]

Additional test cases from the second verification pass

The independent second audit (see stacklok/toolhive-core#156, second-pass comment) found further regressions; extend the matrix:

8. Capability advertisement (CRITICAL — U1)

• A real spec-compliant client (not the shim's own client) initializes against vMCP and receives capabilities.tools and capabilities.resources in the initialize result. Under shim v0.0.27 vMCP advertises only {logging} because per-session tools register after initialize — clients that gate tools/list on capabilities see zero tools. Test must assert on the raw initialize response, not call ListTools unconditionally.

9. Concurrent-request context isolation (security — U3)

• Two concurrent tools/call POSTs on the same Mcp-Session-Id each get audited/attributed with their own request context (no bleed of identity/BackendInfo between them).
• Race hardening: identity binding must not evaluate against another request's bridged context (per-request keying of the shim's pending-context bridge).

10. Backend session continuity (U2)

• vMCP reconnecting to a session-hint-honoring backend (after cache evict / cross-pod restore) replays the stored Mcp-Session-Id and the backend resumes the session rather than minting a new one.

11. Mid-call elicitation delivery (U4)

• A composite-workflow elicitation issued mid-tools/call reaches a client that has NOT opened a standalone GET stream (or the documented requirement is enforced with a fail-fast, not a hang-to-timeout).
• Behavior is identical on the session's origin pod and on a rehydrated (cross-pod) session — response mode (JSON vs SSE) and elicitation capability gating must not differ by pod.

12. Tool schema fidelity (U6)

• A backend tool whose input schema lacks a top-level "type":"object" (e.g. only properties/required, or oneOf) is projected through vMCP with its schema intact — not replaced by a bare {"type":"object"}.

13. Auth-error classification precision (U7)

• A backend JSON-RPC tool error whose message merely contains "401"/"unauthorized" is NOT classified as an auth failure (no spurious auth-aware health handling).
• A backend returning 403 on initialize classifies the same way it did under mcp-go (legacy-SSE fallback path).

14. Sliding session TTL (U5 refinement of §2)

• A session kept alive only by tools/list traffic does not expire while active (per-request Validate/GETEX semantics restored for local sessions).