{
  "format": "agent-article-v0",
  "article_id": "EA-005",
  "canonical_url": "/tools/ea-005-mcp-model-context-protocol-server-client-host-transport-authoriz",
  "page_type": "guide",
  "claim_ids": [],
  "evidence_ids": [
    "EVD-EA-005-URL-3BEF6A91327C",
    "EVD-EA-005-URL-9D51D98E6998",
    "EVD-EA-005-URL-D4918DE39939",
    "EVD-EA-005-URL-72AF6CBDAF56",
    "EVD-EA-005-URL-BD5130D96D13",
    "EVD-EA-005-URL-400B06D259C9",
    "EVD-EA-005-URL-54D805517E84",
    "EVD-EA-005-URL-35069229A591",
    "EVD-EA-005-URL-B5B98B08F903",
    "EVD-EA-005-URL-FA87436DA61D",
    "EVD-EA-005-URL-18F418B2B4F1",
    "EVD-EA-005-URL-5FA1E9B17644",
    "EVD-EA-005-URL-B4A19A953D63",
    "EVD-EA-005-URL-89208F9D52EA",
    "EVD-EA-005-URL-94369677839C",
    "EVD-EA-005-URL-0AB174B3CFD6",
    "EVD-EA-005-URL-5BFAE04F1059",
    "EVD-EA-005-URL-0022ABD7CFC6",
    "EVD-EA-005-URL-254652FFF82C",
    "EVD-EA-005-URL-7785917FE59D",
    "EVD-EA-005-URL-CE3F141FA216",
    "EVD-EA-005-URL-97C7407A4E0D",
    "EVD-EA-005-URL-9C9AD7A793AF",
    "EA-005-CURRENT-APPROVAL",
    "EA-005-CURRENT-BODY-READBACK"
  ],
  "unknown_ids": [
    "EA-005-UNKNOWN-01",
    "EA-005-UNKNOWN-02",
    "EA-005-UNKNOWN-03"
  ],
  "operational_object_ids": [],
  "provider": [],
  "models": [],
  "plans": [],
  "surfaces": [],
  "regions": [],
  "current_status": "CURRENT",
  "observation_status": "SPEC_ONLY",
  "freshness": "CURRENT",
  "last_verified": "2026-10-11",
  "supersedes": [],
  "superseded_by": [],
  "provenance": [
    "V21-CANDIDATE-EA005-REFRESH-20261011-C2",
    "SRC-EA-005-URL-3BEF6A91327C",
    "SRC-EA-005-URL-9D51D98E6998",
    "SRC-EA-005-URL-D4918DE39939",
    "SRC-EA-005-URL-72AF6CBDAF56",
    "SRC-EA-005-URL-BD5130D96D13",
    "SRC-EA-005-URL-400B06D259C9",
    "SRC-EA-005-URL-54D805517E84",
    "SRC-EA-005-URL-35069229A591",
    "SRC-EA-005-URL-B5B98B08F903",
    "SRC-EA-005-URL-FA87436DA61D",
    "SRC-EA-005-URL-18F418B2B4F1",
    "SRC-EA-005-URL-5FA1E9B17644",
    "SRC-EA-005-URL-B4A19A953D63",
    "SRC-EA-005-URL-89208F9D52EA",
    "SRC-EA-005-URL-94369677839C",
    "SRC-EA-005-URL-0AB174B3CFD6",
    "SRC-EA-005-URL-5BFAE04F1059",
    "SRC-EA-005-URL-0022ABD7CFC6",
    "SRC-EA-005-URL-254652FFF82C",
    "SRC-EA-005-URL-7785917FE59D",
    "SRC-EA-005-URL-CE3F141FA216",
    "SRC-EA-005-URL-97C7407A4E0D",
    "SRC-EA-005-URL-9C9AD7A793AF",
    "BODY-SHA256:90481820f5d2a802601132c57d68b42aeaf602aa479d68e5964f653cb8319edc"
  ],
  "article_sources": [
    {
      "id": "EVD-EA-005-URL-3BEF6A91327C",
      "evidence_class": "RESEARCH",
      "title": "org: Model Context Protocol project; authors David Soria Parra / Den Delimarsky",
      "href": "https://blog.modelcontextprotocol.io/posts/2026-07-28/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-3BEF6A91327C"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://blog.modelcontextprotocol.io/posts/2026-07-28/"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-9D51D98E6998",
      "evidence_class": "RESEARCH",
      "title": "canonical URLs:",
      "href": "https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/architecture/index.mdx",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-9D51D98E6998"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URLs: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/architecture/index.mdx"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-D4918DE39939",
      "evidence_class": "RESEARCH",
      "title": "canonical URLs: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/architecture/index.mdx ;",
      "href": "https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/transports/streamable-http.mdx",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-D4918DE39939"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URLs: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/architecture/index.mdx ; https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/transports/streamable-http.mdx"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-72AF6CBDAF56",
      "evidence_class": "RESEARCH",
      "title": "org: Model Context Protocol project",
      "href": "https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/authorization/index.mdx",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-72AF6CBDAF56"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/authorization/index.mdx"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-BD5130D96D13",
      "evidence_class": "RESEARCH",
      "title": "canonical URLs:",
      "href": "https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/authorization/security-considerations.mdx",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-BD5130D96D13"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URLs: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/authorization/security-considerations.mdx"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-400B06D259C9",
      "evidence_class": "RESEARCH",
      "title": "canonical URLs: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/authorization/security-considerations.mdx ;",
      "href": "https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/docs/2026-07-28/tutorials/security/security_best_practices.mdx",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-400B06D259C9"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URLs: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/authorization/security-considerations.mdx ; https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/docs/2026-07-28/tutorials/security/security_best_practices.mdx"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-54D805517E84",
      "evidence_class": "RESEARCH",
      "title": "org: Model Context Protocol project",
      "href": "https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/server/tools.mdx",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-54D805517E84"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/server/tools.mdx"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-35069229A591",
      "evidence_class": "RESEARCH",
      "title": "org: Model Context Protocol project",
      "href": "https://github.com/modelcontextprotocol/modelcontextprotocol/security",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-35069229A591"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://github.com/modelcontextprotocol/modelcontextprotocol/security"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-B5B98B08F903",
      "evidence_class": "RESEARCH",
      "title": "org: Model Context Protocol project + Google collaboration",
      "href": "https://github.com/modelcontextprotocol/go-sdk",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-B5B98B08F903"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://github.com/modelcontextprotocol/go-sdk"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-FA87436DA61D",
      "evidence_class": "RESEARCH",
      "title": "org: Model Context Protocol project",
      "href": "https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/docs/2026-07-28/tools/inspector.mdx",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-FA87436DA61D"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/docs/2026-07-28/tools/inspector.mdx"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-18F418B2B4F1",
      "evidence_class": "RESEARCH",
      "title": "org: Model Context Protocol project",
      "href": "https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/extensions/auth/enterprise-managed-authorization.mdx",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-18F418B2B4F1"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/extensions/auth/enterprise-managed-authorization.mdx"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-5FA1E9B17644",
      "evidence_class": "RESEARCH",
      "title": "org/authors: Charoes Huang et al.",
      "href": "https://arxiv.org/abs/2603.22489",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-5FA1E9B17644"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://arxiv.org/abs/2603.22489"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-B4A19A953D63",
      "evidence_class": "RESEARCH",
      "title": "org: OWASP Foundation",
      "href": "https://owasp.org/www-project-mcp-top-10/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-B4A19A953D63"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://owasp.org/www-project-mcp-top-10/"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-89208F9D52EA",
      "evidence_class": "RESEARCH",
      "title": "canonical URLs:",
      "href": "https://genai.owasp.org/resource/a-practical-guide-for-secure-mcp-server-development/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-89208F9D52EA"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URLs: https://genai.owasp.org/resource/a-practical-guide-for-secure-mcp-server-development/"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-94369677839C",
      "evidence_class": "RESEARCH",
      "title": "canonical URLs: https://genai.owasp.org/resource/a-practical-guide-for-secure-mcp-server-development/ ;",
      "href": "https://genai.owasp.org/resource/cheatsheet-a-practical-guide-for-securely-using-third-party-mcp-servers-1-0/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-94369677839C"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URLs: https://genai.owasp.org/resource/a-practical-guide-for-secure-mcp-server-development/ ; https://genai.owasp.org/resource/cheatsheet-a-practical-guide-for-securely-using-third-party-mcp-servers-1-0/"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-0AB174B3CFD6",
      "evidence_class": "RESEARCH",
      "title": "canonical URLs:",
      "href": "https://github.com/modelcontextprotocol/registry",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-0AB174B3CFD6"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URLs: https://github.com/modelcontextprotocol/registry"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-5BFAE04F1059",
      "evidence_class": "RESEARCH",
      "title": "canonical URLs: https://github.com/modelcontextprotocol/registry ;",
      "href": "https://github.com/modelcontextprotocol/registry/issues/1546",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-5BFAE04F1059"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URLs: https://github.com/modelcontextprotocol/registry ; https://github.com/modelcontextprotocol/registry/issues/1546"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-0022ABD7CFC6",
      "evidence_class": "RESEARCH",
      "title": "https://plan.modelcontextprotocol.io/conformance",
      "href": "https://plan.modelcontextprotocol.io/conformance",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-0022ABD7CFC6"
      ],
      "supporting_locators": [
        "Current primary evidence",
        "- https://plan.modelcontextprotocol.io/conformance"
      ],
      "scope": "Current primary evidence",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-254652FFF82C",
      "evidence_class": "RESEARCH",
      "title": "https://ts.sdk.modelcontextprotocol.io/v2/",
      "href": "https://ts.sdk.modelcontextprotocol.io/v2/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-254652FFF82C"
      ],
      "supporting_locators": [
        "Current primary evidence",
        "- https://ts.sdk.modelcontextprotocol.io/v2/"
      ],
      "scope": "Current primary evidence",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-7785917FE59D",
      "evidence_class": "RESEARCH",
      "title": "https://ts.sdk.modelcontextprotocol.io/v2/protocol-versions",
      "href": "https://ts.sdk.modelcontextprotocol.io/v2/protocol-versions",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-7785917FE59D"
      ],
      "supporting_locators": [
        "Current primary evidence",
        "- https://ts.sdk.modelcontextprotocol.io/v2/protocol-versions"
      ],
      "scope": "Current primary evidence",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-CE3F141FA216",
      "evidence_class": "RESEARCH",
      "title": "https://ts.sdk.modelcontextprotocol.io/v2/migration/support-2026-07-28",
      "href": "https://ts.sdk.modelcontextprotocol.io/v2/migration/support-2026-07-28",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-CE3F141FA216"
      ],
      "supporting_locators": [
        "Current primary evidence",
        "- https://ts.sdk.modelcontextprotocol.io/v2/migration/support-2026-07-28"
      ],
      "scope": "Current primary evidence",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-97C7407A4E0D",
      "evidence_class": "RESEARCH",
      "title": "https://py.sdk.modelcontextprotocol.io/whats-new/",
      "href": "https://py.sdk.modelcontextprotocol.io/whats-new/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-97C7407A4E0D"
      ],
      "supporting_locators": [
        "Current primary evidence",
        "- https://py.sdk.modelcontextprotocol.io/whats-new/"
      ],
      "scope": "Current primary evidence",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-005-URL-9C9AD7A793AF",
      "evidence_class": "RESEARCH",
      "title": "https://github.com/modelcontextprotocol/typescript-sdk/releases",
      "href": "https://github.com/modelcontextprotocol/typescript-sdk/releases",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-005-URL-9C9AD7A793AF"
      ],
      "supporting_locators": [
        "Current primary evidence",
        "- https://github.com/modelcontextprotocol/typescript-sdk/releases"
      ],
      "scope": "Current primary evidence",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EA-005-CURRENT-APPROVAL",
      "evidence_class": "RESEARCH",
      "title": "現行本文の監査・revision対応",
      "supports": [
        "現行台帳のAUDIT_PASSと候補・revision・本文ハッシュの対応を確認しています。"
      ],
      "limit": "監査状態と来歴の記録です。外部根拠の最新性や本文の全主張を追加保証しません。",
      "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET",
      "source_or_experiment_ids": [
        "V21-CANDIDATE-EA005-REFRESH-20261011-C2"
      ],
      "supporting_locators": [
        "1KqhJtiSb2S84rWmeYVwKcT_76dBwZ_B0ZZuAWQqH0rQ",
        "EA_REVISION_LEDGER!A14:U14",
        "EA-005-R1-20261004"
      ],
      "provenance_status": "CURRENT_CANONICAL_APPROVAL_READBACK"
    },
    {
      "id": "EA-005-CURRENT-BODY-READBACK",
      "evidence_class": "IMPL",
      "title": "現行本文の収録照合",
      "supports": [
        "公開生成入力の本文SHA-256が、監査済み候補に結び付いたハッシュと一致しています。"
      ],
      "limit": "本文の同一性の検査です。外部システムの挙動や全主張の真偽を実証したものではありません。",
      "checked_at": "2026-10-12",
      "origin_class": "IMPLEMENTATION_READBACK",
      "source_or_experiment_ids": [
        "BODY-SHA256:90481820f5d2a802601132c57d68b42aeaf602aa479d68e5964f653cb8319edc"
      ],
      "supporting_locators": [
        "content/staging/EA-005.md",
        "90481820f5d2a802601132c57d68b42aeaf602aa479d68e5964f653cb8319edc",
        "EA-005-R1-20261004"
      ],
      "provenance_status": "CURRENT_APPROVED_BODY_HASH_MATCH"
    }
  ],
  "research_sections": [
    {
      "heading": "WHY_THIS_MATTERS_TO_UPDATE",
      "text": "台帳EA-005はMCPサーバー、クライアント、認証、権限、監査、ツール公開、安全境界を独立テーマ化する構想である。2026-07-28仕様でMCPはstateless coreへ大きく変更され、旧HTTP+SSE/session前提の解説はそのまま現行運用へ使えない。またprotocol-level OAuthが存在しても、tool descriptionの信頼、server/package provenance、downstream API authorization、human approval、runtime sandbox、audit completenessまでは自動的に解決しない。公開後版ではprotocol mechanicsとenterprise control planeを分離した実践辞典が必要である。"
    },
    {
      "heading": "SCOPE_ROUTING",
      "text": "Enterprise AI Core: tool/action boundary、least privilege、identity/authorization、audit、supply-chain trust、failure isolation。\nInteroperability: MCP 2026-07-28 core、stdio / Streamable HTTP、OAuth/OIDC、EMA extension。\nImplementation: official SDKs、Inspector、registry、host/client/server implementation。\nGovernance: approved-server catalog、tool allowlist、change control、human approval、telemetry。\nSecurity: prompt/tool poisoning、token misuse、confused deputy、command injection、shadow servers、context oversharing。"
    },
    {
      "heading": "CLAIM_OR_RESEARCH_QUESTION",
      "text": "Q1. MCP準拠は安全なtool利用を意味するか、それともtransport/interoperabilityとtrust/authorization/action policyを分離すべきか。\nQ2. 2026-07-28仕様で旧MCP運用知の何が陳腐化したか。\nQ3. OAuth対応だけでleast privilegeとdownstream API権限分離は成立するか。\nQ4. tool metadata/schema/annotationを、実行権限や安全保証として信用してよいか。\nQ5. enterprise deploymentではserver discovery/registry、package provenance、tool inventory、change detection、human approval、auditをどこまで別controlとして持つべきか。"
    },
    {
      "heading": "EVIDENCE TABLE",
      "text": "1) source class: official specification release\nexact title: The 2026-07-28 Specification\norg: Model Context Protocol project; authors David Soria Parra / Den Delimarsky\ncanonical URL: https://blog.modelcontextprotocol.io/posts/2026-07-28/\npublication/access: 2026-07-28 / accessed 2026-09-11\nversion: MCP 2026-07-28\nlocator: stateless core; MRTR; header routing; cacheable lists; authorization; extensions; deprecations\nlabel: VERIFIED_SPEC + PRODUCT_VOLATILE\nrelation: support / temporal boundary\nestablished: 2026-07-28はprotocol coreをstateless request/responseへ変更し、各requestをself-describing化、Mcp-Method/Mcp-Name header、MRTR、authorization hardening、extension framework、12か月以上のdeprecation windowを導入した。旧session/bidirectional-stream前提をcurrent baselineにしない。\n\n\n2) source class: official architecture/transport specification\nexact titles: Architecture; Streamable HTTP\norg: Model Context Protocol project\ncanonical URLs: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/architecture/index.mdx ; https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/transports/streamable-http.mdx\npublication/access: MCP 2026-07-28 / accessed 2026-09-11\nversion: 2026-07-28\nlocator: host/client/server architecture; standard transports; backwards compatibility\nlabel: VERIFIED_SPEC\nrelation: support / migration limit\nestablished: hostは複数clientを持ちserverへ接続する。標準transportはstdioとStreamable HTTP。2026-07-28 Streamable HTTPはGET streamとprotocol-level sessionsを除去し、request-scoped POST/SSEへ変更した。HTTP+SSEは2025-03-26以降legacyである。\n\n\n3) source class: official authorization specification\nexact title: Authorization\norg: Model Context Protocol project\ncanonical URL: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/authorization/index.mdx\npublication/access: MCP 2026-07-28 / accessed 2026-09-11\nversion: 2026-07-28; OAuth 2.1 draft-13, RFC6750/8414/8707/9728/9207等を参照\nlocator: Purpose and Scope; Roles; discovery; scope minimization; resource parameter; token handling; step-up authorization\nlabel: VERIFIED_SPEC\nrelation: support / boundary\nestablished: authorizationはHTTP transportでOPTIONAL。HTTPで採用する場合、MCP serverはOAuth protected resourceとして振る舞い、Protected Resource Metadata、authorization-server discovery、resource indicator、audience-bound token validationを使う。stdioではこのauthorization specを使わずenvironment credentialを用いる。scopeはoperationに応じstep-up可能。\n\n\n4) source class: official authorization security specification/best practices\nexact titles: Security Considerations; Security Best Practices\norg: Model Context Protocol project\ncanonical URLs: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/basic/authorization/security-considerations.mdx ; https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/docs/2026-07-28/tutorials/security/security_best_practices.mdx\npublication/access: 2026-07-28 / accessed 2026-09-11\nversion: 2026-07-28\nlocator: token audience binding; PKCE; token theft; mix-up; token passthrough; confused deputy\nlabel: VERIFIED_SPEC\nrelation: support / security limit\nestablished: MCP clientはresource parameterを用い、serverは自分向けtokenだけを受け入れなければならない。clientから受けたtokenをdownstream APIへそのまま渡すtoken passthroughは禁止され、upstream API用tokenは別authorization contextで取得する必要がある。PKCE、issuer validation、secure token storage等も要求される。\n\n\n5) source class: official tool specification\nexact title: Tools\norg: Model Context Protocol project\ncanonical URL: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/specification/2026-07-28/server/tools.mdx\npublication/access: MCP 2026-07-28 / accessed 2026-09-11\nversion: 2026-07-28\nlocator: User Interaction Model; Capabilities; Tool Names; annotations; schemas\nlabel: VERIFIED_SPEC\nrelation: support / counter / trust boundary\nestablished: toolsはmodel-controlledで自動発見・呼出し可能だがprotocolはUI/approval方式を強制しない。仕様はhuman-in-the-loopでdeny可能にすること、tool exposure/invocationを明示するUIを推奨する。tool annotationsはtrusted server由来でない限りMUST be considered untrusted。tools/listはauthorizationに応じ異なるtool集合を返し得る。異なるserverをaggregateするとtool name collisionも起こり得る。\n\n\n6) source class: official security policy/trust model\nexact title: modelcontextprotocol/modelcontextprotocol Security — Intended Behaviors and Trust Model\norg: Model Context Protocol project\ncanonical URL: https://github.com/modelcontextprotocol/modelcontextprotocol/security\npublication/access: current page; accessed 2026-09-11\nversion: current trust model; security advisories current 2026\nlocator: Trust Model; client developer responsibilities; operator/user responsibilities; vulnerability scope\nlabel: VERIFIED_SPEC + PRODUCT_VOLATILE\nrelation: support / critical boundary\nestablished: MCP clientは接続serverを信頼する設計であり、local MCP serverは「インストールする他のsoftwareと同程度」に信用する必要がある。client developerはcapability表示・consent・tool/resource visibility・sandboxingを担い、operator/adminはserver選定・設定・access restrictionを担う。protocol準拠それ自体がserver/packageをtrustworthyにするわけではない。\n\n\n7) source class: official author-maintained SDK implementation\nexact title: modelcontextprotocol/go-sdk README / protocol docs\norg: Model Context Protocol project + Google collaboration\ncanonical URL: https://github.com/modelcontextprotocol/go-sdk\npublication/access: current repository / accessed 2026-09-11\nversion: Go SDK v1.7.0+ supports MCP 2026-07-28\nlocator: Version Compatibility; authorization/security implementation notes\nlabel: OSS_PRACTICE + PRODUCT_VOLATILE\nrelation: implementation / compatibility\nestablished: SDK versionとprotocol revisionは同義ではなく、v1.7.0+が2026-07-28をsupportする一方、older linesは2025-11-25等をtargetする。roots/sampling/loggingは2026-07-28でdeprecatedだがcompatibility windowでは残る。deployment inventoryにはSDK versionとnegotiated protocol versionの両方が必要。\n\n\n8) source class: official reference testing tool\nexact title: MCP Inspector\norg: Model Context Protocol project\ncanonical URL: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/docs/2026-07-28/tools/inspector.mdx\npublication/access: 2026-07-28 docs / accessed 2026-09-11\nversion: Inspector current; Node 22.19+ surface\nlocator: Web/CLI/TUI; shared transport/auth/protocol-era behavior\nlabel: OSS_PRACTICE + VERIFIED_SPEC + PRODUCT_VOLATILE\nrelation: implementation / test profile\nestablished: InspectorはWeb/CLI/TUIでserver接続・tool/resource等を検証するreference developer toolであり、legacy/current protocol negotiationとOAuth状態を共有する。安全なpre-production conformance/probeに使えるが、business authorization policyやmalicious-server safetyを自動保証するものではない。\n\n\n9) source class: official extension specification\nexact title: Enterprise-Managed Authorization\norg: Model Context Protocol project\ncanonical URL: https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/docs/extensions/auth/enterprise-managed-authorization.mdx\npublication/access: stable extension surface 2026 / accessed 2026-09-11\nversion: io.modelcontextprotocol/enterprise-managed-authorization\nlocator: centralized IdP access control; enterprise policy\nlabel: VERIFIED_SPEC + PRODUCT_VOLATILE\nrelation: support / enterprise availability\nestablished: EMAは各userが各serverで個別authorizationするだけのモデルを拡張し、organization IdPを用いた中央access policyを提供する。core authorizationとは独立versionのoptional additive extensionであり、client/server実装supportを別確認する必要がある。\n\n\n10) source class: independent security research\nexact title: Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning\norg/authors: Charoes Huang et al.\ncanonical URL: https://arxiv.org/abs/2603.22489 ; peer-reviewed version DOI 10.3390/jcp6030084\npublication/access: 2026-03-23 arXiv; 2026-05-05 journal / accessed 2026-09-11\nversion: study of seven major MCP clients\nlocator: abstract; STRIDE/DREAD threat modeling; tool poisoning empirical comparison\nlabel: RESEARCH\nrelation: counter / failure envelope\nestablished: client-side tool poisoningを主要riskとして分析し、複数clientでstatic validationやparameter visibilityが不十分なケースを報告する。protocol/tool schemaが存在することと、hostがmalicious metadataを安全に扱えることは同義でない。\n\n\n11) source class: security community framework\nexact title: OWASP MCP Top 10 v0.1 / 2025 categories\norg: OWASP Foundation\ncanonical URL: https://owasp.org/www-project-mcp-top-10/\npublication/access: beta status current 2026-09 / accessed 2026-09-11\nversion: v0.1 beta; next release planned Oct 2026\nlocator: MCP01–MCP10; roadmap\nlabel: SOURCE_REPORT + PRODUCT_VOLATILE\nrelation: context / risk taxonomy / limit\nestablished: current beta taxonomyはtoken/secret exposure、scope creep、tool poisoning、supply-chain tampering、command injection、intent/prompt subversion、weak auth、audit gaps、shadow MCP servers、context oversharingを別riskとして扱う。\nlimit: OWASP MCP Top 10は現在beta/community frameworkであり、normative MCP specificationや正式standardとして扱わない。\n\n\n12) source class: OWASP implementation guidance\nexact titles: A Practical Guide for Secure MCP Server Development; Practical Guide for Securely Using Third-Party MCP Servers 1.0\norg: OWASP GenAI Security Project\ncanonical URLs: https://genai.owasp.org/resource/a-practical-guide-for-secure-mcp-server-development/ ; https://genai.owasp.org/resource/cheatsheet-a-practical-guide-for-securely-using-third-party-mcp-servers-1-0/\npublication/access: 2026-02-16 / 2025-11-04; accessed 2026-09-11\nlabel: SOURCE_REPORT\nrelation: implementation guidance / defense-in-depth\nestablished: server側はstrong auth、strict validation、session isolation/hardened deployment、third-party server利用側はserver discovery、sandboxing、least privilege、human oversight等を多層controlとして推奨する。\n\n\n13) source class: official registry implementation + issue evidence\nexact titles: modelcontextprotocol/registry README; Registry accepts server.json with empty repository despite schema\norg: Model Context Protocol project\ncanonical URLs: https://github.com/modelcontextprotocol/registry ; https://github.com/modelcontextprotocol/registry/issues/1546\npublication/access: registry preview/API freeze history; issue reproduced 2026-08-19 / accessed 2026-09-11\nversion: registry v0.1 preview lineage\nlocator: development status; issue #1546 live reproduction\nlabel: OSS_PRACTICE + SOURCE_REPORT + PRODUCT_VOLATILE\nrelation: support / counter / supply-chain limit\nestablished: official Registryはserver discovery/publishingのmetadata layerとして実在するが、preview lineageであり、2026-08にはschema-required repository metadataを欠くentryがlive APIで受理されたissueが報告されている。registry掲載をsecurity approval/provenance guaranteeとみなさず、組織内allowlist・artifact verificationを別controlにする必要がある。"
    },
    {
      "heading": "FINDINGS",
      "text": "EA-005は高い採用価値があり、実践辞典は「MCPを使うか否か」ではなく次の七層に分けると安全である。\nA. Protocol/version plane: negotiated MCP revision、SDK version、deprecated features、transport。2026-07-28を現行baselineとし旧session/HTTP+SSE知識をversion付けする。\nB. Server trust/supply-chain plane: server owner、source repository、package/image provenance、release/hash/signature、registry source、approved catalog。protocol conformanceとtrustを分離する。\nC. Identity/authorization plane: user/workload identity、MCP resource token、scope、resource/audience、step-up auth、downstream API token。token passthroughは禁止。\nD. Capability/tool plane: tools/resources/prompts、input/output schema、read/write/destructive/open-world性、dynamic tool list、tool-name collision。annotationはsecurity enforcementではなくuntrusted metadataとして扱う。\nE. Decision/approval plane: modelがtoolを選ぶことと、policyが許可することと、人間が承認することを三分離する。high-impact actionはmodel decisionだけで実行しない。\nF. Runtime/isolation plane: stdio subprocess/local filesystem/env credential、remote HTTP endpoint、network egress、sandbox、resource limit、secret store。local serverは単なるdata connectorではなくlocal software execution boundaryである。\nG. Audit/change-control plane: server/version、tool catalog hash/diff、auth subject/scope、tool call、argumentsの機密mask、result/error、approval actor、side effect、downstream target、policy decision、latencyを相関可能にする。\n\n\n最重要境界は「MCPはinteroperability protocolであって、server・toolの安全性証明ではない」である。OAuthが正しくてもmalicious trusted server、poisoned tool description、過大scope、unsafe command construction、untrusted package、missing auditは別問題として残る。また2026-07-28ではstateless化によりgateway/routing/scale設計は改善されるが、per-request identity/capability/policy enforcementを省略してよい意味ではない。"
    },
    {
      "heading": "LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE",
      "text": "- MCP準拠やofficial Registry掲載をsecurity certificationとして扱わない。\n- OAuth/OIDC導入をleast privilege完了とみなさない。scope設計、resource/audience validation、downstream token分離、operation-level authorizationが必要。\n- tool annotationのreadOnly/destructive等はtrusted server由来でない限り信用しない。side-effect controlはserver実装・policy・approvalで検証する。\n- modelが「安全そう」と判断したtool callをauthorization decisionにしない。prompt/tool poisoningでsemantic decisionが操作され得る。\n- local stdio serverはnetwork authがないから安全なのではない。起動package/commandにlocal process相当の権限を与えるため、provenance・sandbox・env secret・filesystem/network scopeが重要。\n- remote serverはHTTPS/OAuthだけで安全とは限らない。server自身とdownstream APIが別trust boundary。\n- dynamic tools/list変更、server update、registry metadata driftによりapproval後のcapabilityが変わり得る。tool catalog/versionを継続観測する。\n- 2026-07-28移行中はclient/SDKごとのprotocol supportが揃わない。deprecated featureが互換目的で残る期間を「current recommended design」と混同しない。\n- OWASP MCP Top 10はbetaでありrisk taxonomyとして有用だがnormative standardではない。\n- tool-poisoning研究は特定client/version/configの結果であり全MCP clientへ一般化しない。"
    },
    {
      "heading": "AVAILABILITY_GATES",
      "text": "Protocol: client/server双方の2026-07-28 support、SDK version、transport、extension negotiation。\nRemote auth: HTTPS、Protected Resource Metadata、authorization server metadata、client registration method、PKCE、resource/audience support、requested scope、IdP policy。\nEMA: organization IdP、EMA-capable client/server/authorization server、enterprise policy/configuration。\nTool access: user/workload scope、tools/list filtering、server-side authorization、downstream API permission、organization allowlist。\nLocal server: executable/package availability、OS/runtime、filesystem/network/env permission、secret injection、sandbox/container policy。\nRegistry/discovery: registry/version/source、package registry availability、organization approval; public listing alone is not approval。"
    },
    {
      "heading": "IMPLEMENTATION_STATE",
      "text": "MCP core 2026-07-28: released current protocol revision as of this RUN。\nOfficial Tier-1 SDKs: current release lines differ; Go SDK v1.7.0+ evidence supports 2026-07-28。SDK/protocol compatibility must be recorded per implementation。\nInspector: maintained reference test/debug tooling with modern/legacy negotiation。\nEMA: stable extension specification exists; actual client/server support is product/implementation-specific and PRODUCT_VOLATILE。\nRegistry: operational public discovery infrastructure, but preview/v0.1 lineage and current data-quality issues mean it is not a security trust anchor by itself。\nEnterprise policy gateway/central audit: not guaranteed by core MCP; host/provider/product or organization must implement it。"
    },
    {
      "heading": "BENCHMARK_OR_EVAL",
      "text": "MCP評価を「接続できた」で終えない。最低profileは (1) protocol conformance/version negotiation, (2) auth audience/scope negative tests, (3) unauthorized tool absence/denial, (4) read-only vs side-effect behavior, (5) tool catalog drift, (6) malformed/poisoned description handling, (7) downstream token separation, (8) timeout/retry/idempotency, (9) audit completeness/correlation, (10) sandbox/egress boundary とする。\nInspector/conformance testはprotocol behavior確認用。semantic security、business authorization、supply-chain trustは別testを要求する。"
    },
    {
      "heading": "SECURITY / PRIVACY / AUDIT / COST / OPERABILITY",
      "text": "Security: server/package provenance、token audience、least scope、downstream credential separation、tool schema validation、policy enforcement、human approval、sandbox/egress controlを多層化。\nPrivacy: tool arguments/results/resource dataはmodel context・host logs・server logs・downstream APIへ別々に移動し得る。MCP接続という一語でretention/training/data residencyを表現しない。\nAudit: protocol loggingだけでなくidentity→authorization→model/tool selection→approval→side effect→downstream resourceまでcorrelation IDで追跡する。secret/PIIはmasking policyを持つ。\nCost: MCP自体のprotocol costではなく、host model tokens、tool API billing、server compute、gateway/observability、human approval、failure/retry costをend-to-endで計測する。\nOperability: protocol/SDK/server/tool catalogをversion inventory化し、upgrade時にcontract testとpermission regressionを行う。public Registryはdiscovery、organization catalogはapprovalという役割分離が安全。"
    },
    {
      "heading": "SAFE_WORDING_FOR_FUTURE_BOOK",
      "text": "「MCPは、AIアプリケーションと外部のデータやツールを共通形式で接続するためのprotocolであり、接続先やツールの安全性を自動的に保証する仕組みではない。2026-07-28仕様ではstateless化とOAuthのhardeningが進み、HTTP接続ではresource-bound tokenや段階的scope取得を扱える。しかし、どのMCP serverを信用するか、どのtoolをmodelへ見せるか、実行をpolicyや人間が許可するか、downstream APIへどの権限で接続するか、local processをどこまでsandboxするか、何を監査するかは別の運用判断である。MCP導入ではprotocol version、server provenance、identity、scope、tool capability、approval、runtime isolation、auditを分けて設計する。」"
    },
    {
      "heading": "UPDATE_WORK_HANDOFF",
      "text": "1. EA-005は七層（protocol/version, server trust/supply chain, identity/auth, capability/tool, decision/approval, runtime/isolation, audit/change control）を章骨格候補にする。\n2. 公開直前にlatest MCP spec revision、Tier-1 SDK compatibility、deprecated feature status、EMA/other auth extensions、Registry GA/versionを再採集する。\n3. EA-157 MCP protocol項とは編集境界を分ける。EA-157はnormative protocol仕様、EA-005はenterprise deployment/runbook・安全境界・監査を主とする。\n4. EA-162 OAuth/OIDC × Agentへauthorization detailsをcross-referenceし、EA-005ではresource/audience/PKCE/step-up/token passthrough禁止の運用要点を残す。\n5. EA-317 Tool Capability Contractへtool schema/side-effect/read-only/idempotency/approval contractを接続する。annotationをsecurity truth sourceにはしない。\n6. EA-054/055へworkload identity/multi-agent delegation、EA-021/036へpermission-aware data access、EA-063/159へMCP gateway、EA-007/160へconnector/OpenAPI comparisonを接続する。\n7. public Registryとorganization-approved catalogを別物として設計する。server entryにowner/repository/package/image/version/hash/signature/license/last review/tool catalog hash/risk classを持つ案を検討する。\n8. TEST_PROFILE（未実施）: official Inspector/conformance harnessで2026-07-28 negotiation・tools/list/call・auth failureを安全なsample serverで確認。さらにsynthetic read/write toolsを用い、scope不足、tool list filtering、description poisoning、tool-name collision、catalog change、timeout/retry、audit correlationを検証する。外部tenant・課金・秘密情報は使用しない。\n9. security evidenceはOWASP beta taxonomyだけで閉じず、MCP official security requirements、SDK advisories、peer-reviewed/primary attack research、実装incidentをclaim-levelで並べる。\n10. 2026-07-28 migration guideを追加採集し、2025-11-25/2025-06-18 clientとの互換条件を具体的に表へ落とす。"
    },
    {
      "heading": "OPEN_UNKNOWN",
      "text": "/ STOP_CONDITION"
    },
    {
      "heading": "OPEN_UNKNOWN",
      "text": "- TypeScript/Python/C#/Java/Rust等各official SDKの2026-07-28完全support versionと未実装差分のcurrent matrix。\n- EMAの主要enterprise hosts/servers/IdPでの実運用採用率とconfiguration evidence。\n- public MCP Registryの2026-09-11時点の正式GA判定、artifact verification/signature/provenance semanticsの完全仕様。\n- 主要MCP hostsがtool descriptions/annotations変更をどのように表示・再承認するかのcross-product matrix。\n- tool poisoningに対する各current hostのstatic/runtime defenseとversion別独立再現。\n- audit event schemaのprovider横断標準化状況。core MCP自体がenterprise audit completenessを保証する範囲。\n- local stdio serverのsandbox/default egress/filesystem isolationが主要clientごとにどう異なるか。\n- x-mcp-header等2026-07-28 tool-routing機能のproduction gateway採用とsecret leakage対策実測。"
    },
    {
      "heading": "STOP_CONDITION",
      "text": "EA-005の更新章に必要な現行protocol revision、旧仕様との差、authorization/token境界、tool metadataの非信頼性、server/supply-chain trust、local/remote runtime差、registry限界、独立tool-poisoning evidence、enterprise運用七層まで確立した。各SDK/host全製品matrixをここで固定するとPRODUCT_VOLATILEかつEA-157/162/317と重複するためbounded closeする。次の未調査最小番号はEA-006「Agent-to-Agent／マルチエージェント編」。\n。"
    },
    {
      "heading": "Refresh lineage",
      "text": "This candidate advances the existing refresh revision `EA-005-R1-20261004`. It does not create a second independent base candidate. The rescued base lineage `EA-005-V21-LEGACY-MIGRATION-20261011-R1` remains historical provenance and converges into this active refresh."
    },
    {
      "heading": "Currentness findings",
      "text": "- The MCP `2026-07-28` specification remains the current FINAL revision in the official conformance matrix as of 2026-10-11; the next listed revision is not ready.\n- The TypeScript SDK v2 is now the stable line implementing the 2026-07-28 spec. Its documentation explicitly separates the modern 2026-07-28 era from legacy 2025-era protocol behavior.\n- TypeScript v1 remains a maintenance line and does not implement the 2026-07-28 revision; therefore SDK package major version and negotiated protocol revision must be recorded separately.\n- The Python SDK v2 is likewise the stable line for the 2026-07-28 revision.\n- The 2026-07-28 TypeScript migration documentation makes support an explicit opt-in/compatibility concern rather than something inferred from package presence.\n- The official conformance matrix still shows implementation differences by SDK and SEP. “Official SDK” therefore does not imply complete parity across every feature.\n- None of this changes the canonical enterprise boundary: protocol interoperability, server/package trust, authorization, downstream API permission, human/policy approval, runtime isolation, supply-chain provenance, and audit completeness remain distinct controls."
    },
    {
      "heading": "Current primary evidence",
      "text": "- https://plan.modelcontextprotocol.io/conformance — official conformance matrix; 2026-07-28 FINAL.\n- https://ts.sdk.modelcontextprotocol.io/v2/ — TypeScript SDK v2 stable line for 2026-07-28.\n- https://ts.sdk.modelcontextprotocol.io/v2/protocol-versions — modern/legacy protocol-era separation.\n- https://ts.sdk.modelcontextprotocol.io/v2/migration/support-2026-07-28 — explicit 2026-07-28 support/migration behavior.\n- https://py.sdk.modelcontextprotocol.io/whats-new/ — Python SDK v2 and 2026-07-28 protocol move.\n- https://github.com/modelcontextprotocol/typescript-sdk/releases — TypeScript SDK current release history."
    },
    {
      "heading": "Counterevidence / failure envelope retained",
      "text": "- MCP compliance, official SDK use, or public Registry listing is not a security certification.\n- OAuth support does not by itself establish least privilege or safe downstream authorization.\n- Tool annotations and descriptions are not security truth when server trust is not established.\n- SDK support is version- and feature-specific; cross-SDK parity must not be assumed.\n- Host behavior, tool-change reapproval, local sandbox defaults, and organization-specific controls remain product/runtime specific.\n- No live tenant, paid API, secret-bearing environment, destructive tool, or production host was exercised in this rescue."
    },
    {
      "heading": "SAFE_WORDING",
      "text": "MCP is an interoperability protocol and an implementation ecosystem, not a complete enterprise trust boundary. Record the protocol revision and SDK version separately, and design server provenance, identity and scope, tool capability, approval, downstream authorization, runtime isolation, and audit as separate controls."
    },
    {
      "heading": "OPEN_UNKNOWN",
      "text": "- current product-by-product support for EMA and other optional extensions;\n- cross-host behavior for changed tool descriptions/annotations and reapproval;\n- public Registry provenance/signature semantics and enterprise approval mapping;\n- host-specific sandbox/default egress/filesystem behavior for local servers;\n- cross-product audit schema completeness."
    },
    {
      "heading": "Research Gate decision",
      "text": "`PASS_FOR_EXISTING_REFRESH_REVISION`. The 2026-10-04 refresh already recorded `RESEARCH_GATE_PASS`; 2026-10-11 currentness confirms the core protocol/SDK boundary and adds no contradiction requiring full re-research."
    },
    {
      "heading": "Candidate implementation overlay",
      "text": "- target: `content/staging/EA-005.md`\n- base repository commit: `97d3d104ae0b16a95e7dffddc3a8cb327795a796`\n- path precondition: `ABSENT`\n- revision: `EA-005-R1-20261004`\n- candidate: `V21-CANDIDATE-EA005-REFRESH-20261011-C1`\n- READY: NOT_CREATED\n- AUDIT_PASS: NOT_CLAIMED\n- GIT_WRITE: NOT_PERFORMED"
    }
  ],
  "human_url": "/tools/ea-005-mcp-model-context-protocol-server-client-host-transport-authoriz",
  "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-005-mcp-model-context-protocol-server-client-host-transport-authoriz",
  "json_url": "/agent/article.json?path=%2Ftools%2Fea-005-mcp-model-context-protocol-server-client-host-transport-authoriz"
}