[alexluong]

Add mcp-dev, an experimental command to try, drive and check MCP Events (draft SEP-3415) servers, clients and receivers, and make up/mcp to start the local stack with MCP Events on and sample events loaded.

Stacked on #1192.

Try it

make up/mcp, then make mcp/dev ARGS=tour. The tour runs in one terminal: it lists the events, subscribes with an argument, publishes a matching and a non-matching event (only one arrives, with a valid signature), refreshes, unsubscribes and publishes once more (nothing arrives). Each step prints the JSON-RPC call next to what the receiver got.

Changes

1. make up/mcp. make up plus MCP Events on (EXPERIMENTAL_MCP_ENABLED) with five sample events from cmd/mcp-dev/samples/events.json, http callbacks allowed to host.docker.internal only (where mcp-dev listens), retries after 1, 2 and 5 seconds, and a tenant demo. The MCP server itself is mcp-dev serve. make up turns MCP Events off again.
2. mcp-dev serve, client, receive. serve is a reference MCP Events server over Streamable HTTP that forwards events/list, events/subscribe and events/unsubscribe to Outpost. client calls any MCP Events server (discover, list, subscribe, refresh, unsubscribe). receive is a webhook receiver that answers the challenge, verifies every signature and prints each message and any rule it breaks.
3. mcp-dev check. Runs the conformance checks from test: add MCP Events conformance checks and a shared test server #1192 with its own receiver and prints one line per rule. Exit status 0 means no FAIL, 1 a FAIL, 2 a usage error; --json prints the report, so it can run in CI. With --publish-tenant it publishes through Outpost and also checks delivered data, retries, secret rotation, filtering and isolation; without it, it waits for an upstream event and works against any server.
4. mcp-dev tour. The narrated run above.
5. publish, diff, samples. publish sends sample events built from each event's payloadSchema (with --sink, through a temporary webhook destination so Outpost keeps them), diff compares two events/list lists or a list and a server, and samples --out writes the sample list. serve also serves it at GET /samples/events.json, outside the MCP endpoint.
6. README. cmd/mcp-dev/README.md: try it, drive it yourself in three terminals, check, connecting to Outpost behind a proxy (--outpost-url, --api-key, --outpost-header), troubleshooting.

Behavior changes

None to Outpost.

Tests

Run by hand against a stack started with the make up/mcp compose overlay: tour completes, check --publish-tenant demo passes every check with one WARN (the server accepts an http callback, as the development switch allows), publish --sink delivers every event to the sink, and diff of the sample list against serve is equal.

Not in this PR

• Webhook mode only; http callbacks work only against a server that has the development exception, because the draft requires https.
• No shell hook for publishing to non-Outpost upstreams; wait mode covers them.
• Ideas: a broken events/list sample file next to the other sample files; loading a list from a URL.

🤖 Generated with Claude Code