#!/bin/sh
# Raw HTTP checks of /mcp in the 2026-07-28 stateless era. Usage: scripts/qa-mcp-2026.sh [base]
B=${1:-http://127.0.0.1:8787}; V=2026-07-28
post() { curl -s -w ' [HTTP %{http_code}]' -X POST "$B/mcp" -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' -H "MCP-Protocol-Version: $1" -H "Mcp-Method: $2" ${3:+-H "Mcp-Name: $3"} --data-binary "$4"; echo; }
M='"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28"}'
echo "## server/discover"; post $V server/discover "" '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{'"$M"'}}'
echo "## tools/list"; post $V tools/list "" '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{'"$M"'}}' | python3 -c "import json,sys;t=sys.stdin.read();d=json.loads(t[:t.rindex(' [HTTP')]);r=d['result'];print(r.get('resultType'),r.get('ttlMs'),r.get('cacheScope'),[x['name'] for x in r['tools']])"
R=$(cat examples/countersigned.json)
echo "## tools/call verify_delivery_receipt (countersigned example)"; post $V tools/call verify_delivery_receipt '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"verify_delivery_receipt","arguments":{"receipt":'"$R"'},'"$M"'}}' | cut -c1-300
echo "## tools/call lookup_delivery_receipt by file_sha256"; post $V tools/call lookup_delivery_receipt '{"jsonrpc":"2.0","id":4,"method":"tools/call","params":{"name":"lookup_delivery_receipt","arguments":{"file_sha256":"'"$(sha256sum examples/artifact.txt | cut -c1-64)"'"},'"$M"'}}' | cut -c1-300
echo "## header mismatch (Mcp-Name says log_stats, body says verify) -> expect -32020 / 400"; post $V tools/call log_stats '{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"verify_delivery_receipt","arguments":{}, '"$M"'}}'
echo "## unsupported version -> expect -32022"; post 2099-01-01 tools/list "" '{"jsonrpc":"2.0","id":6,"method":"tools/list","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2099-01-01"}}}'
echo "## GET /mcp -> expect 405"; curl -s -o /dev/null -w '%{http_code}\n' "$B/mcp"
echo "## foreign Origin -> expect 403"; curl -s -o /dev/null -w '%{http_code}\n' -X POST "$B/mcp" -H 'Origin: https://evil.example' -H 'content-type: application/json' --data-binary '{"jsonrpc":"2.0","id":7,"method":"tools/list"}'