[compliance] Specification Version Mismatch in Health Endpoint (1.5.0 vs 1.8.0)

[github-actions]

MCP Gateway Compliance Review - 2026-02-18

Summary

Found 1 critical compliance issue during daily review of commit 1b48a11.

Recent Changes Reviewed

• Commit SHA: 1b48a11c4368c667f4d317d6f2cea65ea288f415
• Changes: Added comprehensive tests for parseJSONRPCResponseWithSSE ([test] Add comprehensive tests for parseJSONRPCResponseWithSSE #1047)
• Modified Files: Test files only (no implementation changes)

Critical Issues (MUST violations)

Issue: Specification Version Mismatch in Health Endpoint

Specification Section: 8.1.1 General Health (/health)
Deep Link: https://github.com/github/gh-aw/blob/main/docs/src/content/docs/reference/mcp-gateway.md#811-general-health-health

Requirement:

"The gateway MUST include the following version information in the /health endpoint response:

1. specVersion: The version of this MCP Gateway Specification that the implementation conforms to. This field MUST use semantic versioning (MAJOR.MINOR.PATCH format)."

Current State:

• Specification Version: 1.8.0 (per spec header: "Version: 1.8.0")
• Implemented Version: 1.5.0 (in internal/server/unified.go:31)

// Current implementation
const MCPGatewaySpecVersion = "1.5.0"

Gap:
The implementation reports specVersion: "1.5.0" in health responses, but the official specification is now at version 1.8.0. This is a MUST violation because the spec explicitly requires the specVersion field to reflect "the version of this MCP Gateway Specification that the implementation conforms to."

Impact:

• Clients cannot accurately determine specification compliance level
• Prevents proper feature detection based on spec version
• Violates specification conformance requirement from Section 2 (Conformance)
• Fails compliance test T-HLT-006: "Health response includes specVersion field"

Severity: Critical (MUST violation)

File References:

• internal/server/unified.go:31 - Constant definition
• internal/server/health.go:43 - Used in health response
• Specification: Line 9 - "Version: 1.8.0"

Suggested Fix:

// internal/server/unified.go:31
const MCPGatewaySpecVersion = "1.8.0"  // Updated to match spec version

Verification Steps:

1. Update the constant to "1.8.0"
2. Run health endpoint tests: make test-unit
3. Verify health endpoint returns correct version: curl (localhost/redacted) | jq .specVersion

---

Compliance Status Summary

Section	Status	Notes
✅ 3.2.1 Containerization	Compliant	TOML validation enforces command="docker"
✅ 4.1 Configuration Format	Compliant	JSON schema rejects command field for stdio
✅ 4.2 Variable Expansion	Compliant	Fail-fast on undefined variables
✅ 5. Protocol Behavior	Compliant	JSON-RPC 2.0, proper routing
✅ 6. Server Isolation	Compliant	Container-based isolation
✅ 7. Authentication	Compliant	Authorization header validation
❌ 8.1 Health Monitoring	Non-compliant	specVersion mismatch (1.5.0 vs 1.8.0)
✅ 9. Error Handling	Compliant	Proper exit codes and error formatting
⚠️ 10. Compliance Testing	Partial	Some test IDs referenced, coverage incomplete

---

Positive Findings

Strong Compliance Areas

1. Configuration Validation (Section 4)

   • Variable expansion properly fails on undefined variables
   • JSON schema correctly rejects unsupported command field
   • TOML validation enforces Docker containerization requirement
   • Comprehensive validation test suite with 21+ test cases

2. Containerization Enforcement (Section 3.2.1)

   • validateTOMLStdioContainerization() ensures stdio servers use Docker
   • No direct command execution paths found in launcher code
   • Clear error messages reference specification section

3. Authentication (Section 7)

   • Authorization header parsing supports spec-compliant format
   • Proper 401/400 error responses
   • Health endpoint correctly exempted from authentication

4. Error Handling (Section 9)

   • Startup failures exit with code 1 (internal/cmd/root.go:496)
   • JSON-RPC error format matches specification
   • Detailed error logging with context

---

Recommendations

Immediate Action Required

1. Update spec version constant to 1.8.0 in internal/server/unified.go:31

Good Practices Observed

• Recent PR [test] Add comprehensive tests for parseJSONRPCResponseWithSSE #1047 adds comprehensive test coverage for JSON-RPC parsing
• Code includes specification references in comments (e.g., Section 3.2.1)
• Validation rules centralized in internal/config/rules/ package
• Health endpoint implementation matches spec format

Future Improvements

1. Test ID Mapping: Continue adding compliance test IDs (T-CFG-, T-PTL-) to test comments
2. Spec Version Automation: Consider automating spec version updates or adding a CI check
3. Compliance Test Coverage: Expand test coverage for remaining T-* test cases from Section 10

---

References

• MCP Gateway Specification v1.8.0
• Health Monitoring Section 8.1.1
• Last review: N/A (first automated review)
• Commit reviewed: 1b48a11c4368c667f4d317d6f2cea65ea288f415

Generated by Daily Compliance Checker

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster

[github-actions]

🍪 Issue Monster has assigned this to Copilot!

I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

The Copilot agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster