feat: add MCP 2025-11 conformance validation

[Esquetta]

Summary

• add deterministic, version-aware MCP 2025-11 conformance evaluation
• add explicit read-only runtime probing with bounded tasks/list pagination
• extend scorecards, reports, rule catalog, output contract, and public docs
• harden runtime cwd containment and redact task/error data

Verification

• npm test: 655 passed, 6 skipped
• npm run build
• npm run release-check
• git diff --check
• privacy and prohibited-method scans

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 617c13717e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Skip required task tools during plain probes

When a 2025-11 server exposes only tools with execution.taskSupport: "required", that declaration is accepted by the new conformance evaluator when capabilities.tasks.requests.tools.call is present, but this path still sends a normal tools/call containing only name and arguments. Servers that require task augmentation are allowed to reject that non-task call, so the doctor will report plugin.runtime.tool_call.invalid for an otherwise valid task-only tool; skip required tools for the plain safe probe or use only an optional/non-task tool here.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Validate task entries before passing tasks/list

When a declared tasks/list returns tasks: [{}] or entries with non-string taskId/invalid status, this condition still treats the page as valid because it only checks that each entry is an object. The new conformance scorecard will report tasksList: pass, so malformed task catalogs slip through the 2025-11 validation; validate the required Task fields and status values before incrementing the counts.

Useful? React with 👍 / 👎.