Quests

Every MCP tutorial you have ever read opens with `initialize`. This one does not have it. Find out what replaced it, and make the server tell you which protocol version it actually speaks.

• Send a server/discover request to the weather server 40
• Read supportedVersions out of the result 30
• Read the capabilities and the serverInfo out of the same result 30

Two MCP servers are running on this network. One of them is not the one you have been working on all morning — it is the one handing you this quest. Go and ask it what it can do.

• Locate the second MCP server on the compose network 50
• Call tools/list against it 60
• Report the tool names in sorted order 40

A stateless protocol has no stream to reconnect to. Prove it — with a request, not a quotation.

• Send GET /message and record the status 60
• Send DELETE /message and record the status 60
• Explain why a stateless revision can answer nothing else here 30

A gateway waves through `Mcp-Name: read_document` while the body says `delete_everything`. Find out what a conformant server does about that.

• Send a tools/call whose Mcp-Name disagrees with params.name 120
• Record both the JSON-RPC error code and the HTTP status 90
• Explain why getting the code right and the status wrong still breaks clients 40

Some MCP answers may be cached and some may never be. The server tells you which — if you ask it properly.

• Read ttlMs and cacheScope off tools/list 80
• Read ttlMs and cacheScope off server/discover 80
• Confirm tools/call carries neither field, and say why 40

HTTP headers carry visible ASCII only. Norway does not. Write the encoder.

• Find the wrapping rule for non-ASCII header values 80
• Implement the wrapper in your own language 140
• Implement the matching decoder the server side needs 80

Three ways to be wrong, three different answers, and one of the HTTP statuses is deliberately not 400. Go and collect them.

• Provoke a parse error with a malformed body 80
• Provoke an unknown-method error 80
• Provoke an unknown-tool error 80
• Explain why one of the three statuses is not 400 60

DNS rebinding is the attack. The `Origin` header is the defence. Getting it wrong in either direction breaks something real.

• Send a request with an untrusted Origin 120
• Send the same request with no Origin at all 120
• Explain why this error code is a positive number 60
• Explain why an absent Origin must be allowed 50

A second connection is not a second config line. Your agent has to know which server it is talking to, and be able to say why.

• Call server/discover on both MCP servers 90
• Fetch tools/list from both, and index tool name -> server 120
• Make your agent choose a server per tool deliberately, in code 130
• State what your agent would do if both servers offered the same tool name 60

Every quest so far had you interrogate someone else's server. This one interrogates yours.

• Implement get_random_fact on your own MCP server 200
• Return content and structuredContent, and no cache fields 150
• Answer -32602/-32020/-32601 correctly under probing 150
• Pass the quest server's live probe 100