Fix: header-routed tools/list (2026-07-28) returns tools without initialize

Web-audit fix skill for the mcp-modern-tools-list check (MCP, MUST).

Goal

Answer a modern header-routed tools/list without requiring an initialize handshake.

Fix

Serve the modern MCP era (protocol revision 2026-07-28): answer a POST whose headers carry MCP-Protocol-Version: 2026-07-28 and Mcp-Method: tools/list with a result.tools array, with no prior initialize or notifications/initialized. Modern requests are per-request enveloped: params._meta carries io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientInfo, and io.modelcontextprotocol/clientCapabilities. The clientCapabilities key is mandatory on every modern request; reject a request that omits it with a well-formed -32602. Mcp-Name rides only tools/call (the tool name) and resources/read (the resource URI), never tools/list.

Resources

• MCP lifecycle (2026-07-28)
• MCP tools (2026-07-28)

Copy-paste prompt

Paste this into your coding agent. Your audit adds what it observed for this check:

Verify

Re-run the audit at https://anc.dev/audit or call the audit_website MCP tool; the mcp-modern-tools-list check should report pass.