Capabilities object accurately matches implementation
Why it matters
The capabilities object in the initialize response is the contract that tells clients which MCP features to use. Declaring resources with subscribe: true but providing no subscription implementation causes clients to attempt subscriptions that fail silently. Implementing prompts but not declaring prompts in capabilities means clients never discover them — the feature is invisible. These mismatches are a form of contract violation: the server lies about its interface, and clients built against that lie fail in ways that are hard to diagnose.
Severity rationale
High because capabilities mismatches cause systematic failures — either clients invoking unimplemented features or silently missing features the server provides — both producing broken integrations.
Remediation
Audit your capabilities object against your actual handler registrations before every release. Declare exactly what you implement, nothing more.
// src/index.ts — capabilities must match implementation
const server = new Server(
{ name: 'my-server', version: '1.0.0' },
{
capabilities: {
tools: { listChanged: true }, // only if tools are registered
resources: { subscribe: false }, // only if resources are registered
// omit 'prompts' if no prompts are registered
},
}
)
Do not copy a capability template and leave unused fields in — remove subscribe: true if you don't implement the resources/subscribe handler.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the MCP Server Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · mcp-spec-capabilities — MCP Specification — Server capabilities object
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mcp-server·automated