Support MCP 2026-07-28 (stateless protocol) across scanners and SDK

[arananet]

MCP revision 2026-07-28 turned the protocol from a stateful, handshake-based
protocol into a stateless request/response one. The scanners were still
negotiating 2025-06-18 via initialize, which no longer reaches a server on
the current revision at all.

Add a dual-era MCP client (apps/web/src/lib/mcp.ts) that probes
server/discover at 2026-07-28, renegotiates on UnsupportedProtocolVersion,
and falls back to the initialize handshake only when the server turns out to
be legacy — inspecting the body of a 4xx before falling back, as the spec's
compatibility rules require. Modern requests carry the required per-request
_meta fields and the mirrored MCP-Protocol-Version / Mcp-Method /
Mcp-Name headers, with the base64 sentinel encoding for unsafe values.

Compliance tester now grades each server against the rules for its own era:
server/discover, supportedVersions, resultType, ttlMs/cacheScope
cache hints, header-mismatch rejection (400 + -32020), and statelessness
(no minted Mcp-Session-Id, GET not served) for stateless servers;
initialize / ping plus a superseded-revision warning for handshake servers.

Security scanner adds version-aware checks for the new surface: deprecated
Roots/Sampling/Logging capabilities, retained sessions and the removed SSE GET
endpoint, x-mcp-header constraint violations and parameters mirrored into
credential-shaped headers, cacheScope: "public" on authenticated servers,
network $ref targets in tool schemas, and authorization-server metadata for
RFC 9207 issuer identification and CIMD-vs-deprecated-DCR registration.

Tool explorer calls tools in the server's era, mirroring x-mcp-header
parameters, rejecting tools with invalid annotations, and surfacing multi
round-trip input_required results instead of treating them as output.

mcp-sdk gains the stateless types (MCPDiscoverResult, MCPCacheableResult,
MCPInputRequiredResult, reserved _meta keys, spec error codes), a dual-era
client with connect()/discover(), and era-tagged compliance rules.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01N4mJKbHLw7YzjnfHJjtWn5