Skip to content

SEP-2091: Server Capability Signatures#2091

Closed
SamMorrowDrums wants to merge 16 commits intomodelcontextprotocol:mainfrom
SamMorrowDrums:sep/signature-method
Closed

SEP-2091: Server Capability Signatures#2091
SamMorrowDrums wants to merge 16 commits intomodelcontextprotocol:mainfrom
SamMorrowDrums:sep/signature-method

Conversation

@SamMorrowDrums
Copy link
Contributor

@SamMorrowDrums SamMorrowDrums commented Jan 15, 2026

SEP: Server Capability Signature

Summary

This SEP proposes a new signature method that enables MCP servers to declare their complete set of possible capabilities upfront, including all tools, prompts, resources, and resource templates that the server could offer.

Rendered: link

Problem Statement

Several MCP client implementations have adopted "schema freezing" approaches, capturing initial tools/list results and treating subsequent changes as policy violations. While motivated by legitimate security concerns, this approach conflates security (constraining what is possible) with availability (what is currently offered).

This creates friction with legitimate server capabilities:

  • User-specific tools: GitHub Copilot hides agent tools from users who cannot access them. Freezing would still expose tools destined to fail or fail to provide them for everyone.
  • Dynamic availability: tools/list_changed notifications exist precisely for runtime changes
  • Context efficiency: Always advertising every possible tool wastes context window budget

Proposed Solution

A new signature method that returns the complete universe of capabilities a server could offer:

interface SignatureResult extends Result {
  tools?: Tool[];
  prompts?: Prompt[];
  resources?: Resource[];
  resourceTemplates?: ResourceTemplate[];
}

Key behavioral requirements:

  1. Completeness: Signature includes everything that could appear in list responses
  2. Immutability: Signature is stable for session duration
  3. Subsets permitted: List responses may return any subset of signature
  4. list_changed compatible: Dynamic changes remain valid within signature bounds

Relationship to Other SEPs

  • SEP-1881 (Scope-Filtered Discovery): Signature provides what could exist when filtered
  • SEP-1913 (Trust and Sensitivity Annotations): Combined with signatures, enables complete trust policies upfront
  • SEP-1862 (Tool Resolution): Signatures can declare all possible tool behaviors via resolvedVariants
  • SEP-1821 (Dynamic Tool Discovery): Signature provides trust boundary for filtering
  • SEP-1442 (Stateless MCP): Signature can be cached across stateless requests

Additional Use Cases

Registry Fingerprinting

Signatures enable registries to fingerprint servers for identification, change detection, and compatibility matching.

Tool Resolution Integration

When combined with SEP-1862, signatures can declare all possible resolvedVariants upfront, enabling hosts to pre-compute permission sets and optimize authorization flows.

Backward Compatibility

Fully backward compatible:

  • signature capability is opt-in
  • Clients can fall back to schema freezing or no constraints
  • List methods unchanged

Status: Draft
Type: Standards Track
Author: @SamMorrowDrums
Seeking Sponsor

This SEP proposes a new 'signature' method that enables MCP servers to
declare their complete set of possible capabilities upfront, allowing
clients to establish trust boundaries based on the full scope of server
behavior while preserving dynamic list filtering within those bounds.

Key points:
- New signature endpoint returns all possible tools/prompts/resources
- Enables security constraining without prohibiting dynamic behavior
- Backwards compatible with existing schema freezing approaches
- Separates 'what is possible' from 'what is currently available'
- Add 'Relationship to Other SEPs' section linking to SEP-1881
  (Scope-Filtered Tool Discovery), SEP-1821 (Dynamic Tool Discovery),
  and SEP-1442 (Make MCP Stateless)
- Replace underscore emphasis with asterisks for consistency
- Remove em dash from capability example
- Replace contractions (don't -> do not)
- Rename title to 'Server Capability Signature' for clarity
- Link to SEP-1862 (Tool Resolution) in related SEPs section
- Add 'Registry Fingerprinting' rationale section explaining how
  signatures enable server identification, change detection, and
  compatibility matching for registries and discovery services
- Add 'Signature and Tool Resolution' section showing how signatures
  can declare all possible tool behaviors upfront via resolvedVariants
- Add open question about whether resolvedVariants should be part of
  the core signature spec
- Update hashing question to mention registry fingerprinting value
- Link to SEP-1913 (Trust and Sensitivity Annotations) in related SEPs
- Clarify that schema freezing either exposes failing tools or fails
  to provide them for everyone
- Fix author name to Sam Morrow
- Document the alternative approach of servers exposing all tools
  and clients filtering based on annotations/scopes
- Explain why this was not chosen (less dynamic, privacy concerns,
  annotation limitations, wasted context, error-prone)
- Note that client-side filtering remains complementary
- Add Tadas Antanavicius (PulseMCP) to acknowledgments
- Add SEP-1649 (Server Cards) to related SEPs as primary overlap
- Add major section evaluating Server Cards and InitializeResult as alternatives
- Update Open Questions to include method vs existing mechanism question
- Recommendation to potentially refocus SEP toward Server Card integration
- Major editorial revision reducing length from ~530 to ~385 lines
- Removed redundant sections and trimmed verbose explanations
- Fixed caching approach: HTTP headers (ETag, Cache-Control) for Server Cards
- Removed etag field from ServerSignature (HTTP handles this)
- Fixed worst-case annotation example (destructiveHint: true, readOnlyHint: false)
- Updated SignatureResource to clarify resource vs template type distinction
- Clarified behavioral requirements section
- Improved precision throughout document
@SamMorrowDrums SamMorrowDrums changed the title SEP: Server Capability Signature SEP-2091: Server Capability Signatures Jan 15, 2026
Clarifies that tools in signature may not appear in initial tools/list,
but can appear later via list_changed. Provides example flow and lists
supported patterns (progressive disclosure, conditional access, etc.)
Servers can advertise tools that are not yet active but could be enabled,
supporting marketplace integrations, optional features, and tiered service
levels where users choose which tools to activate.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant