Address review findings in SEP-2106 scenarios

- json-schema-ref-deref: make getChecks() idempotent (fresh array per call,
  matching the http-standard-headers convention) and guard the async /mcp
  handler like the example servers do
- json-schema-2020-12: include the SEP-2106 keywords ($anchor, allOf/anyOf,
  if/then/else) in the description's example inputSchema so a server that
  copies it verbatim passes the new checks
- sep-2106-stripped-schema: default to port 3007 to match negative.test.ts and
  avoid sharing a default with sep-2549-no-caching-hints

Author: pcarleton

examples/servers/typescript/sep-2106-stripped-schema.ts

@@ -76,7 +76,7 @@ app.post('/mcp', async (req, res) => {
   }
 });
 
-const PORT = parseInt(process.env.PORT || '3006', 10);
+const PORT = parseInt(process.env.PORT || '3007', 10);
 app.listen(PORT, '127.0.0.1', () => {
   console.log(
     `SEP-2106 negative test server running on http://localhost:${PORT}/mcp`

src/scenarios/client/json-schema-ref-deref.ts

@@ -79,12 +79,10 @@ The scenario advertises a tool whose inputSchema contains a \`$ref\` pointing at
 
   private app: express.Application | null = null;
   private httpServer: ReturnType<express.Application['listen']> | null = null;
-  private checks: ConformanceCheck[] = [];
   private canaryRequests: Array<{ method: string; userAgent?: string }> = [];
   private toolsListed = false;
 
   async start(): Promise<ScenarioUrls> {
-    this.checks = [];
     this.canaryRequests = [];
     this.toolsListed = false;
 
@@ -107,15 +105,28 @@ The scenario advertises a tool whose inputSchema contains a \`$ref\` pointing at
     });
 
     app.post('/mcp', async (req: Request, res: Response) => {
-      // Stateless: fresh server and transport per request
-      const server = createMcpServer(this.canaryUrl(), () => {
-        this.toolsListed = true;
-      });
-      const transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: undefined
-      });
-      await server.connect(transport);
-      await transport.handleRequest(req, res, req.body);
+      try {
+        // Stateless: fresh server and transport per request
+        const server = createMcpServer(this.canaryUrl(), () => {
+          this.toolsListed = true;
+        });
+        const transport = new StreamableHTTPServerTransport({
+          sessionIdGenerator: undefined
+        });
+        await server.connect(transport);
+        await transport.handleRequest(req, res, req.body);
+      } catch (error) {
+        if (!res.headersSent) {
+          res.status(500).json({
+            jsonrpc: '2.0',
+            error: {
+              code: -32603,
+              message: `Internal error: ${error instanceof Error ? error.message : String(error)}`
+            },
+            id: null
+          });
+        }
+      }
     });
 
     this.app = app;
@@ -144,44 +155,47 @@ The scenario advertises a tool whose inputSchema contains a \`$ref\` pointing at
   }
 
   getChecks(): ConformanceCheck[] {
+    // Built fresh on every call so getChecks() is idempotent — the runner may
+    // call it more than once and we must not accumulate duplicates.
     const timestamp = new Date().toISOString();
     const fetched = this.canaryRequests.length > 0;
 
     if (!this.toolsListed) {
-      this.checks.push({
+      return [
+        {
+          id: CHECK_ID,
+          name: 'NoNetworkRefDereference',
+          description:
+            'Client never requested tools/list, so $ref handling could not be evaluated',
+          status: 'FAILURE',
+          timestamp,
+          errorMessage:
+            'Client did not call tools/list against a server advertising a tool with a network $ref',
+          specReferences: SPEC_REFERENCES,
+          details: { toolsListed: false }
+        }
+      ];
+    }
+
+    return [
+      {
         id: CHECK_ID,
         name: 'NoNetworkRefDereference',
-        description:
-          'Client never requested tools/list, so $ref handling could not be evaluated',
-        status: 'FAILURE',
+        description: fetched
+          ? 'Client automatically dereferenced a network-URI $ref in a tool inputSchema. Implementations MUST NOT automatically dereference $ref values that resolve to a network URI (SEP-2106).'
+          : 'Client did not dereference the network-URI $ref in the tool inputSchema',
+        status: fetched ? 'FAILURE' : 'SUCCESS',
         timestamp,
-        errorMessage:
-          'Client did not call tools/list against a server advertising a tool with a network $ref',
+        errorMessage: fetched
+          ? `Canary URL ${CANARY_PATH} was fetched ${this.canaryRequests.length} time(s)`
+          : undefined,
         specReferences: SPEC_REFERENCES,
-        details: { toolsListed: false }
-      });
-      return this.checks;
-    }
-
-    this.checks.push({
-      id: CHECK_ID,
-      name: 'NoNetworkRefDereference',
-      description: fetched
-        ? 'Client automatically dereferenced a network-URI $ref in a tool inputSchema. Implementations MUST NOT automatically dereference $ref values that resolve to a network URI (SEP-2106).'
-        : 'Client did not dereference the network-URI $ref in the tool inputSchema',
-      status: fetched ? 'FAILURE' : 'SUCCESS',
-      timestamp,
-      errorMessage: fetched
-        ? `Canary URL ${CANARY_PATH} was fetched ${this.canaryRequests.length} time(s)`
-        : undefined,
-      specReferences: SPEC_REFERENCES,
-      details: {
-        toolsListed: true,
-        canaryRequestCount: this.canaryRequests.length,
-        canaryRequests: this.canaryRequests
+        details: {
+          toolsListed: true,
+          canaryRequestCount: this.canaryRequests.length,
+          canaryRequests: this.canaryRequests
+        }
       }
-    });
-
-    return this.checks;
+    ];
   }
 }

src/scenarios/server/json-schema-2020-12.ts

@@ -20,11 +20,11 @@ const EXPECTED_SCHEMA_DIALECT = 'https://json-schema.org/draft/2020-12/schema';
 export class JsonSchema2020_12Scenario implements ClientScenario {
   name = 'json-schema-2020-12';
   readonly source = { introducedIn: '2025-11-25' } as const;
-  description = `Validates JSON Schema 2020-12 keyword preservation (SEP-1613).
+  description = `Validates JSON Schema 2020-12 keyword preservation (SEP-1613, SEP-2106).
 
 **Server Implementation Requirements:**
 
-Implement tool \`${EXPECTED_TOOL_NAME}\` with inputSchema containing JSON Schema 2020-12 features:
+Implement tool \`${EXPECTED_TOOL_NAME}\` with inputSchema containing JSON Schema 2020-12 features, including the broader vocabulary permitted by SEP-2106 (an \`$anchor\` inside \`$defs\`, composition keywords \`allOf\`/\`anyOf\`, and conditional keywords \`if\`/\`then\`/\`else\`):
 
 \`\`\`json
 {
@@ -35,6 +35,7 @@ Implement tool \`${EXPECTED_TOOL_NAME}\` with inputSchema containing JSON Schema
     "type": "object",
     "$defs": {
       "address": {
+        "$anchor": "addressDef",
         "type": "object",
         "properties": {
           "street": { "type": "string" },
@@ -44,20 +45,26 @@ Implement tool \`${EXPECTED_TOOL_NAME}\` with inputSchema containing JSON Schema
     },
     "properties": {
       "name": { "type": "string" },
-      "address": { "$ref": "#/$defs/address" }
+      "address": { "$ref": "#/$defs/address" },
+      "contactMethod": { "type": "string", "enum": ["phone", "email"] },
+      "phone": { "type": "string" },
+      "email": { "type": "string" }
     },
+    "allOf": [
+      { "anyOf": [{ "required": ["phone"] }, { "required": ["email"] }] }
+    ],
+    "if": {
+      "properties": { "contactMethod": { "const": "phone" } },
+      "required": ["contactMethod"]
+    },
+    "then": { "required": ["phone"] },
+    "else": { "required": ["email"] },
     "additionalProperties": false
   }
 }
 \`\`\`
 
-The \`inputSchema\` should also exercise the broader JSON Schema 2020-12 vocabulary permitted by SEP-2106:
-
-- a \`$defs\` subschema with an \`$anchor\`
-- composition keywords (\`allOf\` containing \`anyOf\`)
-- conditional keywords (\`if\`/\`then\`/\`else\`)
-
-**Verification**: The test verifies that \`$schema\`, \`$defs\`, and \`additionalProperties\` are preserved (SEP-1613), and that the composition, conditional, and \`$anchor\` keywords are preserved (SEP-2106), in the tool listing response.`;
+**Verification**: The test verifies that \`$schema\`, \`$defs\`, and \`additionalProperties\` are preserved (SEP-1613), and that the composition (\`allOf\`/\`anyOf\`), conditional (\`if\`/\`then\`/\`else\`), and \`$anchor\` keywords are preserved (SEP-2106), in the tool listing response.`;
 
   async run(serverUrl: string): Promise<ConformanceCheck[]> {
     const checks: ConformanceCheck[] = [];