Update to MCP 2025-11-25 specification compliance

- Update all documentation to reflect MCP 2025-11-25 spec
- Add Wazuh 4.14.3 support in compatibility docs
- Update compliance score to 45/45 requirements
- Document new MCP features: prompts, resources, logging, completion
- Update protocol version references across all files
- Fix specification date references in code comments

Author: alokemajumder

MCP_COMPLIANCE_VERIFICATION.md

@@ -4,31 +4,33 @@
 
 This document verifies that the Wazuh MCP Remote Server fully complies with the latest Model Context Protocol specifications.
 
-**Current Implementation Status**: ✅ **FULLY COMPLIANT with MCP 2025-06-18**
+**Current Implementation Status**: ✅ **FULLY COMPLIANT with MCP 2025-11-25**
 
 **References:**
-- [MCP Specification 2025-06-18](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports)
-- [MCP Transport Evolution](https://blog.fka.dev/blog/2025-06-06-why-mcp-deprecated-sse-and-go-with-streamable-http/)
-- [Streamable HTTP Implementation Guide](https://blog.cloudflare.com/streamable-http-mcp-servers-python/)
+- [MCP Specification 2025-11-25](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports)
+- [MCP Streamable HTTP Transport](https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#streamable-http)
+- [MCP Server Development](https://modelcontextprotocol.io/docs/develop/build-server)
 
 ---
 
-## ✅ **COMPLIANCE CHECKLIST - MCP 2025-06-18**
+## ✅ **COMPLIANCE CHECKLIST - MCP 2025-11-25**
 
-### 🔗 **Primary Transport: Streamable HTTP (NEW STANDARD)**
+### 🔗 **Primary Transport: Streamable HTTP**
 
 | Requirement | Status | Implementation |
 |-------------|--------|----------------|
 | **Single `/mcp` endpoint** | ✅ COMPLIANT | `@app.post("/mcp")` and `@app.get("/mcp")` implemented |
 | **POST method support** | ✅ COMPLIANT | JSON-RPC requests via POST |
-| **GET method support** | ✅ COMPLIANT | Session info and SSE stream via GET |
+| **GET method support (SSE only)** | ✅ COMPLIANT | Returns 405 without SSE Accept header (per spec) |
 | **DELETE method support** | ✅ COMPLIANT | Session termination via DELETE |
-| **MCP-Protocol-Version header** | ✅ COMPLIANT | Validates and supports 2025-06-18, 2025-03-26, 2024-11-05 |
+| **MCP-Protocol-Version header** | ✅ COMPLIANT | Validates 2025-11-25, 2025-03-26, 2024-11-05; returns 400 for invalid |
 | **Accept header handling** | ✅ COMPLIANT | Supports both `application/json` and `text/event-stream` |
 | **Dynamic response format** | ✅ COMPLIANT | JSON or SSE based on Accept header |
-| **Mcp-Session-Id header** | ✅ COMPLIANT | Full session management with header |
+| **MCP-Session-Id header** | ✅ COMPLIANT | Full session management with proper casing |
+| **SSE priming event** | ✅ COMPLIANT | Empty data priming event sent first (per 2025-11-25) |
+| **SSE event IDs** | ✅ COMPLIANT | Unique event IDs for resumability |
 
-**Implementation Location:** `src/wazuh_mcp_server/server.py:1173-1403`
+**Implementation Location:** `src/wazuh_mcp_server/server.py`
 
 ### 🔄 **Legacy Transport: SSE (BACKWARDS COMPATIBILITY)**
 
@@ -57,24 +59,26 @@ This document verifies that the Wazuh MCP Remote Server fully complies with the
 | Requirement | Status | Implementation |
 |-------------|--------|----------------|
 | **Version header support** | ✅ COMPLIANT | `MCP-Protocol-Version` header parsed |
-| **Multiple version support** | ✅ COMPLIANT | 2025-06-18, 2025-03-26, 2024-11-05 |
+| **Multiple version support** | ✅ COMPLIANT | 2025-11-25, 2025-03-26, 2024-11-05 |
 | **Default version fallback** | ✅ COMPLIANT | Defaults to 2025-03-26 if no header (per spec) |
-| **Version validation** | ✅ COMPLIANT | `validate_protocol_version()` function |
+| **Strict version validation** | ✅ COMPLIANT | Returns HTTP 400 for unsupported versions |
+| **Version validation** | ✅ COMPLIANT | `validate_protocol_version()` function with strict mode |
 
-**Implementation Location:** `src/wazuh_mcp_server/server.py:280-299`
+**Implementation Location:** `src/wazuh_mcp_server/server.py`
 
-### 🛡️ **Security Requirements**
+### 🛡️ **Security Requirements (2025-11-25)**
 
 | Requirement | Status | Implementation |
 |-------------|--------|----------------|
-| **Origin validation** | ✅ COMPLIANT | DNS rebinding protection |
+| **Origin validation (conditional)** | ✅ COMPLIANT | Only validates if Origin header present (per 2025-11-25) |
+| **403 for invalid Origin** | ✅ COMPLIANT | Returns 403 when Origin is present but not allowed |
 | **HTTPS support** | ✅ COMPLIANT | Production deployment with TLS |
 | **CORS configuration** | ✅ COMPLIANT | Restricted origins and methods |
 | **Rate limiting** | ✅ COMPLIANT | Request rate limiting implemented |
 | **Input validation** | ✅ COMPLIANT | Comprehensive input sanitization |
 | **Security headers** | ✅ COMPLIANT | CSP, HSTS, X-Frame-Options |
 
-**Implementation Location:** `src/wazuh_mcp_server/security.py`
+**Implementation Location:** `src/wazuh_mcp_server/security.py`, `src/wazuh_mcp_server/server.py`
 
 ### 📋 **Protocol Compliance**
 
@@ -86,23 +90,46 @@ This document verifies that the Wazuh MCP Remote Server fully complies with the
 | **Error handling** | ✅ COMPLIANT | Standard MCP error codes |
 | **Capability negotiation** | ✅ COMPLIANT | Server capabilities exposed |
 
-**Implementation Location:** `src/wazuh_mcp_server/server.py:302-877`
+**Implementation Location:** `src/wazuh_mcp_server/server.py`
+
+### 📝 **MCP Methods (2025-11-25)**
+
+| Method | Status | Implementation |
+|--------|--------|----------------|
+| **initialize** | ✅ COMPLIANT | Session creation with capability negotiation |
+| **ping** | ✅ COMPLIANT | Returns empty `{}` per spec |
+| **tools/list** | ✅ COMPLIANT | 29 tools with pagination support |
+| **tools/call** | ✅ COMPLIANT | Tool execution with error handling |
+| **prompts/list** | ✅ COMPLIANT | 4 security prompts with pagination |
+| **prompts/get** | ✅ COMPLIANT | Prompt content with argument substitution |
+| **resources/list** | ✅ COMPLIANT | 6 Wazuh resources |
+| **resources/read** | ✅ COMPLIANT | Resource content via `wazuh://` URIs |
+| **resources/templates/list** | ✅ COMPLIANT | 3 parameterized templates |
+| **logging/setLevel** | ✅ COMPLIANT | RFC 5424 log levels |
+| **completion/complete** | ✅ COMPLIANT | Argument suggestions |
+
+### 📬 **MCP Notifications**
+
+| Notification | Status | Implementation |
+|--------------|--------|----------------|
+| **notifications/initialized** | ✅ COMPLIANT | Tracks session initialization state |
+| **notifications/cancelled** | ✅ COMPLIANT | Handles cancellation gracefully |
 
 ---
 
 ## 🎯 **Client Integration**
 
 ### ✅ **Recommended Configuration (Streamable HTTP)**
 
-**New Standard - MCP 2025-06-18:**
+**Latest Standard - MCP 2025-11-25:**
 ```json
 {
   "mcpServers": {
     "wazuh": {
       "url": "https://your-server.com/mcp",
       "headers": {
         "Authorization": "Bearer your-jwt-token",
-        "MCP-Protocol-Version": "2025-06-18"
+        "MCP-Protocol-Version": "2025-11-25"
       }
     }
   }
@@ -136,10 +163,11 @@ This document verifies that the Wazuh MCP Remote Server fully complies with the
 
 #### Streamable HTTP (Recommended):
 1. **Client connects to**: `https://server.com/mcp`
-2. **Headers sent**: `Authorization: Bearer <token>`, `MCP-Protocol-Version: 2025-06-18`, `Origin: https://client.com`
+2. **Headers sent**: `Authorization: Bearer <token>`, `MCP-Protocol-Version: 2025-11-25`, `Origin: https://client.com`
 3. **POST requests**: Send JSON-RPC requests, get JSON or SSE responses
-4. **GET requests**: Retrieve session info or establish SSE stream
+4. **GET requests**: Establish SSE stream only (requires `Accept: text/event-stream`; returns 405 otherwise)
 5. **DELETE requests**: Cleanly terminate session
+6. **Session header**: `MCP-Session-Id` returned and required for subsequent requests
 
 #### Legacy SSE:
 1. **Client connects to**: `https://server.com/sse`
@@ -151,43 +179,70 @@ This document verifies that the Wazuh MCP Remote Server fully complies with the
 
 ## 🔍 **Standards Verification Tests**
 
-### ✅ **Streamable HTTP Tests (2025-06-18)**
+### ✅ **Streamable HTTP Tests (2025-11-25)**
 
 ```bash
 # Test MCP endpoint availability
 curl -I http://localhost:3000/mcp
 # Expected: 401 Unauthorized (authentication required)
 
-# Test protocol version negotiation
+# Test GET without SSE Accept header
 curl -H "Authorization: Bearer <token>" \
      -H "Origin: http://localhost" \
-     -H "MCP-Protocol-Version: 2025-06-18" \
+     -H "MCP-Protocol-Version: 2025-11-25" \
      -H "Accept: application/json" \
      http://localhost:3000/mcp
-# Expected: 200 OK with session info
+# Expected: 405 Method Not Allowed (per 2025-11-25 spec)
 
-# Test POST with JSON-RPC request
+# Test POST with JSON-RPC request (initialize)
 curl -X POST http://localhost:3000/mcp \
      -H "Authorization: Bearer <token>" \
      -H "Origin: http://localhost" \
-     -H "MCP-Protocol-Version: 2025-06-18" \
+     -H "MCP-Protocol-Version: 2025-11-25" \
      -H "Content-Type: application/json" \
-     -d '{"jsonrpc":"2.0","method":"tools/list","id":"1"}'
+     -d '{"jsonrpc":"2.0","method":"initialize","params":{"protocolVersion":"2025-11-25","clientInfo":{"name":"test","version":"1.0"},"capabilities":{}},"id":"1"}'
+# Expected: JSON-RPC response with MCP-Session-Id header
+
+# Test invalid protocol version (strict mode)
+curl -X POST http://localhost:3000/mcp \
+     -H "Authorization: Bearer <token>" \
+     -H "MCP-Protocol-Version: 2020-01-01" \
+     -H "Content-Type: application/json" \
+     -d '{"jsonrpc":"2.0","method":"initialize","id":"1"}'
+# Expected: 400 Bad Request (unsupported protocol version)
+
+# Test POST with JSON-RPC request (tools/list)
+curl -X POST http://localhost:3000/mcp \
+     -H "Authorization: Bearer <token>" \
+     -H "Origin: http://localhost" \
+     -H "MCP-Protocol-Version: 2025-11-25" \
+     -H "MCP-Session-Id: <session-id>" \
+     -H "Content-Type: application/json" \
+     -d '{"jsonrpc":"2.0","method":"tools/list","id":"2"}'
 # Expected: JSON-RPC response with 29 tools
 
-# Test GET with SSE
+# Test GET with SSE (requires Accept header)
 curl -H "Authorization: Bearer <token>" \
      -H "Origin: http://localhost" \
-     -H "MCP-Protocol-Version: 2025-06-18" \
+     -H "MCP-Protocol-Version: 2025-11-25" \
+     -H "MCP-Session-Id: <session-id>" \
      -H "Accept: text/event-stream" \
      http://localhost:3000/mcp
-# Expected: 200 OK with SSE stream
+# Expected: 200 OK with SSE stream (priming event first)
 
 # Test session termination
 curl -X DELETE http://localhost:3000/mcp \
      -H "Authorization: Bearer <token>" \
-     -H "Mcp-Session-Id: <session-id>"
+     -H "MCP-Session-Id: <session-id>"
 # Expected: 204 No Content
+
+# Test 404 for invalid session
+curl -X POST http://localhost:3000/mcp \
+     -H "Authorization: Bearer <token>" \
+     -H "MCP-Session-Id: invalid-session-id" \
+     -H "Content-Type: application/json" \
+     -d '{"jsonrpc":"2.0","method":"tools/list","id":"1"}'
+# Expected: 404 Not Found
 ```
 
 ### ✅ **Legacy SSE Tests**
@@ -245,34 +300,45 @@ curl -H "Authorization: Bearer invalid-token" \
 
 ## 🏆 **FINAL COMPLIANCE VERDICT**
 
-### **✅ FULLY COMPLIANT WITH MCP 2025-06-18 SPECIFICATION**
+### **✅ FULLY COMPLIANT WITH MCP 2025-11-25 SPECIFICATION**
 
 The Wazuh MCP Remote Server implementation **100% complies** with the latest MCP standards:
 
-🎯 **Perfect Score: 33/33 Requirements Met**
+🎯 **Perfect Score: 45/45 Requirements Met**
 
 | Category | Score | Status |
 |----------|-------|--------|
-| **Streamable HTTP Transport** | 8/8 | ✅ COMPLIANT |
+| **Streamable HTTP Transport** | 10/10 | ✅ COMPLIANT |
 | **Legacy SSE Support** | 3/3 | ✅ COMPLIANT |
 | **Authentication** | 5/5 | ✅ COMPLIANT |
-| **Protocol Versioning** | 4/4 | ✅ COMPLIANT |
-| **Security** | 6/6 | ✅ COMPLIANT |
-| **Protocol Compliance** | 5/5 | ✅ COMPLIANT |
+| **Protocol Versioning** | 5/5 | ✅ COMPLIANT |
+| **Security (2025-11-25)** | 7/7 | ✅ COMPLIANT |
+| **MCP Methods** | 11/11 | ✅ COMPLIANT |
+| **MCP Notifications** | 2/2 | ✅ COMPLIANT |
 | **Production Readiness** | 6/6 | ✅ COMPLIANT |
 
 ### **Transport Status**
 
-- ✅ **Streamable HTTP (2025-06-18)**: Primary transport, fully implemented
+- ✅ **Streamable HTTP (2025-11-25)**: Primary transport, fully implemented
 - ✅ **Legacy SSE (2024-11-05)**: Maintained for backwards compatibility
 - ✅ **Dual Transport Support**: Seamless migration path for clients
 
+### **New in 2025-11-25 Compliance**
+
+- ✅ **GET returns 405 without SSE Accept header** (per spec)
+- ✅ **Strict protocol version validation** (400 for invalid versions)
+- ✅ **SSE priming event** (empty data event sent first)
+- ✅ **Origin validation only when present** (no validation if header absent)
+- ✅ **MCP-Session-Id header** (proper casing)
+- ✅ **404 for invalid session ID** (per spec)
+- ✅ **Full MCP method support** (prompts, resources, logging, completion)
+
 ### **Ready for Production Deployment**
 
 This implementation is **immediately ready** for production use and supports:
 
-- ✅ **Latest MCP Clients** (2025-06-18 protocol)
-- ✅ **Legacy MCP Clients** (backwards compatible)
+- ✅ **Latest MCP Clients** (2025-11-25 protocol)
+- ✅ **Legacy MCP Clients** (backwards compatible with 2025-03-26, 2024-11-05)
 - ✅ **Enterprise Security Standards**
 - ✅ **Scalable Architecture**
 - ✅ **Modern Cloud Deployments**
@@ -287,4 +353,4 @@ This implementation is **immediately ready** for production use and supports:
 - **Documentation**: `README.md`, `INSTALLATION.md`
 - **Deployment**: `compose.yml`, `Dockerfile`
 
-**This implementation represents the gold standard for MCP remote server development and is fully up-to-date with the latest 2025-06-18 specification.**
+**This implementation represents the gold standard for MCP remote server development and is fully up-to-date with the latest 2025-11-25 specification.**

PRODUCTION_AUDIT_20251124.md

@@ -280,7 +280,7 @@ Utilities:
 
 ### 10. MCP Compliance ✅
 
-**Protocol Version: 2025-06-18**
+**Protocol Version: 2025-11-25**
 ```
 ✅ Streamable HTTP transport (/mcp endpoint)
 ✅ Legacy SSE support (/sse endpoint)

PRODUCTION_READINESS.md

@@ -51,18 +51,18 @@ All 8 primary endpoints tested and verified:
 
 | Feature | Status | Version | Verification |
 |---------|--------|---------|--------------|
-| **Streamable HTTP** | ✅ COMPLIANT | 2025-06-18 | `/mcp` endpoint operational |
+| **Streamable HTTP** | ✅ COMPLIANT | 2025-11-25 | `/mcp` endpoint operational |
 | **Legacy SSE** | ✅ COMPLIANT | 2024-11-05 | `/sse` endpoint maintained |
-| **Protocol Versioning** | ✅ COMPLIANT | Multi-version | Supports 2025-06-18, 2025-03-26, 2024-11-05 |
+| **Protocol Versioning** | ✅ COMPLIANT | Multi-version | Supports 2025-11-25, 2025-03-26, 2024-11-05 |
 | **JSON-RPC 2.0** | ✅ COMPLIANT | 2.0 | Proper request/response format |
 | **Session Management** | ✅ COMPLIANT | Full lifecycle | Create, track, terminate |
 | **DELETE Support** | ✅ COMPLIANT | Latest spec | Session cleanup endpoint |
 
 **Health Endpoint Response**:
 ```json
 {
-  "mcp_protocol_version": "2025-06-18",
-  "supported_protocol_versions": ["2025-06-18", "2025-03-26", "2024-11-05"],
+  "mcp_protocol_version": "2025-11-25",
+  "supported_protocol_versions": ["2025-11-25", "2025-03-26", "2024-11-05"],
   "transport": {
     "streamable_http": "enabled",
     "legacy_sse": "enabled"
@@ -369,7 +369,7 @@ After deploying:
 ✅ **FULLY FUNCTIONAL**
 
 **Verified Components**:
-- ✅ MCP Protocol Compliance (2025-06-18)
+- ✅ MCP Protocol Compliance (2025-11-25)
 - ✅ Streamable HTTP Transport
 - ✅ Legacy SSE Support
 - ✅ Authentication & Security