Vendors are flooding the market with Model Context Protocol (MCP) servers that look flawless in a live demo. But for engineering teams responsible for production stability, a smooth presentation is meaningless if the underlying infrastructure collapses when a token expires or a user cancels a long-running request. A new guide published on October 24, 2026, by Pournasserian aims to bridge this gap, offering a practical, 12-question checklist for evaluating MCP vendors based on the July 28, 2026, specification.

Protocol Compliance and Statelessness

The first hurdle in the checklist is verifying true protocol compliance. The guide asks whether a vendor’s server implements discovery correctly and, crucially, if any instance can handle a request without relying on connection-specific session state. This distinction is vital for scaling; if your load balancer routes a request to a different server than the one that initiated the session, does it fail? The checklist also probes whether caching and transport requirements are respected, ensuring the server isn't just working in a vacuum but adhering to the standard's operational constraints.

Security and Input Validation

Security isn't just about encryption in transit; it's about rigorous validation at the edge. The guide pushes vendors to explain exactly how tokens are validated and whether the server checks the intended audience of those tokens. It also demands evidence of input validation, rate-limiting for tool calls, and output sanitization. These are the boring, unglamorous details that prevent prompt injection attacks and resource exhaustion, yet they are often glossed over in marketing materials that focus solely on AI capability.

Production Operations and Evidence

Perhaps the most pragmatic section of the checklist focuses on production operations. It asks what happens when a client disconnects or cancels a request mid-stream—a common occurrence in real-world usage that many demo environments fail to simulate. Furthermore, the guide insists on "evidence, not promises." It asks if the vendor runs the official conformance suite, tests against both older and newer protocol implementations, and verifies functionality across multiple AI hosts, including text-only clients. This level of rigor separates hobbyist projects from enterprise-ready infrastructure.

Key Takeaways

  • The guide is based on the 2026-07-28 Model Context Protocol specification, ensuring it reflects current standards.
  • It distinguishes between strict protocol requirements and the author's own best-practice recommendations, preventing scope creep in procurement.
  • The checklist is designed for CTOs, security reviewers, and engineering teams to ask before signing contracts.
  • It emphasizes testing against multiple AI hosts, including text-only clients, to ensure broad compatibility.

The Bottom Line

Stop buying demos. If a vendor can't answer these 12 questions with concrete evidence, they are asking you to be their beta testers. Demand the checklist, and watch the weak players fold.