How do you test a server that can change independently and return adversarial content?

2026-07-28 core · deterministic JSON-RPC fixtures

Atlas Release Evidence Server. Read-only evidence, deterministic scoring, and an explicit evaluation Task across replicas and protocol eras.

01 · Smallest useful mechanism

Combine protocol conformance with product policy and hostile-content testing.

MCP tests must cover version and capability behavior, schemas, transports, authorization, tenant isolation, tool effects, content injection, handle security, caching, retries, and observable outcomes.

A conformant server can still be unsafe for your product, principal, or data.

02 · Experiment

Test the prediction

Deterministic protocol fixture

This workbench uses inspectable JSON-RPC fixtures and injected failures. It does not make live calls or execute external effects.

Protocol workbench · atlas-assurance-v2

Choose the release gate for a third-party MCP server.

Injected failure

The server passes JSON-RPC tests but changes descriptions, follows a redirect, and returns injected instructions.

Choose the implementation

Gate on successful connectionApprove when discovery and one tool call work.Gate on protocol conformance onlyRun the official inspector and schema checks.Use layered acceptanceAdd identity, scope, semantic, adversarial, fault, and outcome gates.

The trace has not run.

Commit to an implementation, then inject the failure and inspect the actual state transitions.

03 · Implementation brief

Build it, break it, prove the outcome.

Implement: Create a compatibility, auth, hostile-content, fault, load, and prohibited-effect test matrix.
Break it on purpose: Try token passthrough, malicious redirect, SSRF URI, injected result, stale cache, handle replay, and timeout after dispatch.
Completion evidence: Every threat is denied or bounded, potential effects reconcile, and changes produce explicit review evidence.

Your learning artifact

Write the argument you would defend

Stored only in this browser. No account required; course reset does not delete it.

Your response

04 · Check your understanding

What does protocol conformance establish?

Primary sources · verified 2026-08-02

What the fixture does not prove

Servers evolve independently, and their descriptions or results enter model context. A small metadata change can alter model tool selection even when the method remains protocol-conformant.

Common mistake: Passing the MCP inspector proves a server is production-safe. Protocol tools can verify conformance; product safety still depends on trust, permissions, semantics, deployment, and representative adversarial tests.

Transfer exercise: Change a tool description without changing its schema and measure whether the host exposes, approves, or selects it differently.

Model Context Protocol — 2026-07-28 specificationThe authoritative modern MCP protocol: stateless requests, per-request metadata, capabilities, and server features.MCP — ToolsNormative tool discovery and invocation contract, input and output schemas, errors, annotations, and safety requirements.OAuth 2.0 Security Best Current PracticeStandards-track security guidance for authorization flows, token handling, redirects, clients, and authorization servers.OpenTelemetry — Trace APIVendor-neutral specification for spans, context propagation, links, events, status, and trace lifecycle.

Optional referenceDeep dive / reference chapterOpen the complete essay, diagrams, mathematics, exercises, glossary, and sources when you want more depth.on demand

Next: The capstone now asks you to ship a modern stateless server with a dual-era strategy and an evidence-backed host integration.