Implements initialize method and returns capabilities
Why it matters
The MCP handshake (initialize → server capabilities → notifications/initialized) is a mandatory protocol sequence. A server that does not handle the initialize method returns a method-not-found error on the very first client message, causing immediate disconnection before any tool can be called. Processing tool requests before the handshake completes violates the protocol ordering guarantee and causes undefined behavior in clients that enforce the sequence. This is a baseline conformance requirement with no workaround on the client side.
Severity rationale
Critical because a missing `initialize` handler causes clients to disconnect on first contact — no tools, resources, or prompts are reachable until the handshake completes successfully.
Remediation
If using the MCP SDK, the handshake is handled automatically when you call server.connect(transport). Verify your server config includes all capabilities you implement.
// src/index.ts — SDK handles initialize automatically
const server = new Server(
{ name: 'my-server', version: '1.0.0' },
{ capabilities: { tools: { listChanged: true }, resources: {} } }
)
const transport = new StdioServerTransport()
await server.connect(transport) // handshake negotiated here
For custom implementations, add a handler for initialize that returns protocolVersion, capabilities, and serverInfo, and gates all other method handlers behind an isInitialized flag.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the MCP Server Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · mcp-spec-lifecycle — MCP Specification — Connection lifecycle and initialize handshake
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mcp-server·automated