MCP SDK Tier Audit: modelcontextprotocol/rust-sdk

Date: 2026-07-31
Branch: main (commit 1cf6deb)
Version: rmcp v3.0.1 · crates.io/crates/rmcp/3.0.1
Requested tier: Tier 1
Tool: @modelcontextprotocol/conformance tier-check

Tier Assessment: Tier 1

All Tier 1 requirements are met. Conformance is 100% across every tier-scored server and client scenario, all repository-health and governance requirements clear the Tier 1 bar, a stable 3.0.1 release is published with a documented breaking-change policy, and every implemented non-experimental feature is documented with runnable examples.

Requirements Summary

Tier Determination

• Tier 1: PASS — 8/8 requirements met
• Tier 2: PASS — 7/7 requirements met
• Final Tier: 1

Server Conformance Details

Pass rate: 100% (30/30). Tested against spec revisions 2025-06-18 and 2025-11-25 using the conformance test suite.

Client Conformance Details

Full-suite pass rate (tier-scored): 100% (20/20).

Suite breakdown: Core: 4/4 (100%), Auth: 16/16 (100%).
Tier scoring covers date-versioned spec revisions (2025-03-26, 2025-06-18, 2025-11-25). Draft (2026-07-28) and extension scenarios are informational and are not counted toward tier advancement, per the conformance testing rules.

Conformance Matrix

* Unique scenarios; a scenario may apply to multiple spec versions. Columns show scenarios by the revision that introduced them.

Informational (not scored for tier):

The two informational failures — auth/wif-jwt-bearer (draft 2026-07-28) and auth/enterprise-managed-authorization (extension) — target the in-progress draft revision and an off-timeline protocol extension. Neither affects tier classification.

Core Scenarios (scored)

Auth Scenarios (scored)

Issue Triage Details

Analysis period: last 18 issues.
Labels: all 12 present — bug, enhancement, question, needs confirmation, needs repro, ready for work, good first issue, help wanted, P0, P1, P2, P3.

P0 resolution: 1 P0 closed within 7 days; 0 currently open.

Spec tracking: latest spec release 2026-07-28; latest SDK release 2026-07-28 (0-day gap).

Stable release: rmcp v3.0.1 — published 2026-07-29, not a pre-release, semantic version 3.0.1 (>= 1.0.0), with a documented breaking-change policy in VERSIONING.md.

Documentation Coverage

Documentation locations: root README.md (1832 lines, per-feature prose + rust snippets), crates/rmcp/README.md, crates/rmcp-macros/README.md, docs/OAUTH_SUPPORT.md, docs/DEVCONTAINER.md, and runnable examples/ (servers, clients, transport, wasi, simple-chat-client).

Summary: 46/46 implemented non-experimental features documented with examples (100%); core features 36/36 (100%).

#39 / #40 — Legacy HTTP+SSE transport (2024-11-05). The standalone two-endpoint HTTP+SSE transport from protocol revision 2024-11-05 was replaced by Streamable HTTP in the 2025-03-26 revision and is not represented in the tier-scored conformance suite. rmcp targets current spec revisions (2025-11-25, 2026-07-28) and deliberately does not ship the legacy transport; equivalent SSE streaming semantics are provided by the fully implemented and documented Streamable HTTP transport (#37/#38). The README (lines 1642-1666) explicitly documents this decision and directs users to Streamable HTTP. These items are scoped N/A — a deprecated, out-of-current-spec transport that is a documented non-goal — rather than a documentation gap.

Policy Evaluation

1. Dependency Update Policy — PASS

Verdict: PASS — a substantive written policy and a working Dependabot configuration are present and consistent.

2. Roadmap — PASS

Verdict (Tier 1): PASS — ROADMAP.md explicitly tracks the path to SEP-1730 Tier 1 with concrete work items mapped to named MCP spec components and issue references (e.g. SEP-2567 #870, SEP-2260 #873, SEP-2549 follow-up #974), per-suite conformance tables, a completed spec-implementation list (SEP-2322, SEP-2575, SEP-2164, SEP-2549, SEP-2243), and an ongoing-conformance tracking epic (#977).

3. Versioning Policy — PASS

Verdict (Tier 1): PASS — documents the versioning scheme (SemVer 2.0.0), a clear definition of what constitutes a breaking change (public API removal/rename, signature/trait changes, MSRV bumps), and how breaking changes are communicated (release-plz + Conventional Commits feat!:/fix!:/BREAKING CHANGE:, tagged GitHub Releases with generated notes, and migration guides).

Reproduce This Assessment

# From the conformance repo, with the rmcp conformance server running on :8001
npm run --silent tier-check -- \
  --repo modelcontextprotocol/rust-sdk \
  --branch main \
  --conformance-server-url http://127.0.0.1:8001/mcp \
  --client-cmd '/path/to/rust-sdk/target/release/conformance-client' \
  --output json

# Verify the stable release metadata directly
gh release view rmcp-v3.0.1 --repo modelcontextprotocol/rust-sdk