Run JSON-RPC 2.0 compliance suite (parse-error, invalid-request, method-not-found, invalid-params, internal-error) against a target MCP server.

Drive an initialize handshake and assert the target advertises the expected MCP spec version.

Verify the target's transport layer (stdio line-delimited JSON or Streamable HTTP).

Exercise OAuth 2.1 PKCE S256 flow against the target. Mock-AS by default; real-tenant when --oauth-mode=real.

Validate that every advertised tool has a well-formed JSON-Schema inputSchema. Optionally diff against an expected manifest.

Compare the capabilities the target advertises in initialize against what tools/list, resources/list, prompts/list actually return.

Perform one tools/call per advertised tool. Fails on JSON-RPC transport errors, warns on tool-level isError=true.

Apply the heuristic annotation rules (destructive name regex, readOnlyHint conflicts) to every advertised tool.

Run all (or selected) suites and produce a FullReport with summary + per-suite + per-check status.

Render a FullReport as JUnit XML, JSON, or human-readable terminal output.

Diff two tool manifests — added/removed/changed tools.

Compare a baseline FullReport against a current FullReport. Returns a list of breaking changes and warnings.