fix: reject unadvertised capability methods by default

crates/rmcp/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Default `prompts/list`, `completion/complete`, `resources/list`,
+  `resources/templates/list`, and `tools/list` handlers now return JSON-RPC
+  `-32601` (method not found) when their capability is not advertised. Servers
+  that relied on the previous empty success responses without declaring the
+  capability will see a behavior change; advertise the capability to retain
+  the empty default result.
+
 ## [3.9.0](https://github.com/modelcontextprotocol/rust-sdk/compare/rmcp-v3.8.0...rmcp-v3.9.0) - 2026-11-05
 
 ### Added

crates/rmcp/src/handler/server.rs

@@ -465,7 +465,11 @@ macro_rules! server_handler_methods {
             request: CompleteRequestParams,
             context: RequestContext<RoleServer>,
         ) -> impl Future<Output = Result<CompleteResult, McpError>> + MaybeSendFuture + '_ {
-            std::future::ready(Ok(CompleteResult::default()))
+            std::future::ready(if self.get_info().capabilities.completions.is_some() {
+                Ok(CompleteResult::default())
+            } else {
+                Err(McpError::method_not_found::<CompleteRequestMethod>())
+            })
         }
         fn set_level(
             &self,
@@ -486,14 +490,22 @@ macro_rules! server_handler_methods {
             request: Option<PaginatedRequestParams>,
             context: RequestContext<RoleServer>,
         ) -> impl Future<Output = Result<ListPromptsResult, McpError>> + MaybeSendFuture + '_ {
-            std::future::ready(Ok(ListPromptsResult::default()))
+            std::future::ready(if self.get_info().capabilities.prompts.is_some() {
+                Ok(ListPromptsResult::default())
+            } else {
+                Err(McpError::method_not_found::<ListPromptsRequestMethod>())
+            })
         }
         fn list_resources(
             &self,
             request: Option<PaginatedRequestParams>,
             context: RequestContext<RoleServer>,
         ) -> impl Future<Output = Result<ListResourcesResult, McpError>> + MaybeSendFuture + '_ {
-            std::future::ready(Ok(ListResourcesResult::default()))
+            std::future::ready(if self.get_info().capabilities.resources.is_some() {
+                Ok(ListResourcesResult::default())
+            } else {
+                Err(McpError::method_not_found::<ListResourcesRequestMethod>())
+            })
         }
         fn list_resource_templates(
             &self,
@@ -502,7 +514,11 @@ macro_rules! server_handler_methods {
         ) -> impl Future<Output = Result<ListResourceTemplatesResult, McpError>>
                + MaybeSendFuture
                + '_ {
-            std::future::ready(Ok(ListResourceTemplatesResult::default()))
+            std::future::ready(if self.get_info().capabilities.resources.is_some() {
+                Ok(ListResourceTemplatesResult::default())
+            } else {
+                Err(McpError::method_not_found::<ListResourceTemplatesRequestMethod>())
+            })
         }
         fn read_resource(
             &self,
@@ -602,7 +618,11 @@ macro_rules! server_handler_methods {
             request: Option<PaginatedRequestParams>,
             context: RequestContext<RoleServer>,
         ) -> impl Future<Output = Result<ListToolsResult, McpError>> + MaybeSendFuture + '_ {
-            std::future::ready(Ok(ListToolsResult::default()))
+            std::future::ready(if self.get_info().capabilities.tools.is_some() {
+                Ok(ListToolsResult::default())
+            } else {
+                Err(McpError::method_not_found::<ListToolsRequestMethod>())
+            })
         }
         /// Get a tool definition by name.
         ///

crates/rmcp/tests/common/handlers.rs

@@ -116,7 +116,12 @@ impl TestServer {
 impl ServerHandler for TestServer {
     #[allow(deprecated)]
     fn get_info(&self) -> ServerConfig {
-        ServerConfig::new(ServerCapabilities::builder().enable_logging().build())
+        ServerConfig::new(
+            ServerCapabilities::builder()
+                .enable_logging()
+                .enable_tools()
+                .build(),
+        )
     }
 
     #[allow(deprecated)]

crates/rmcp/tests/test_client_lifecycle_modes.rs

@@ -19,7 +19,11 @@ impl ClientHandler for DiscoverClient {}
 #[derive(Clone, Default)]
 struct StatelessServer;
 
-impl ServerHandler for StatelessServer {}
+impl ServerHandler for StatelessServer {
+    fn get_info(&self) -> rmcp::model::ServerConfig {
+        rmcp::model::ServerConfig::new(ServerCapabilities::builder().enable_tools().build())
+    }
+}
 
 #[tokio::test]
 async fn discover_startup_accepts_stringified_numeric_response_id() {

crates/rmcp/tests/test_default_list_capabilities.rs

@@ -0,0 +1,126 @@
+#![cfg(all(feature = "client", feature = "server"))]
+
+use rmcp::{
+    ClientHandler, RoleClient, RoleServer, ServerHandler,
+    model::{
+        ArgumentInfo, ClientConfig, CompleteRequestParams, ErrorCode, InitializeResult,
+        ProtocolVersion, Reference, ServerCapabilities, ServerConfig,
+    },
+    service::{ServiceError, serve_directly},
+};
+
+#[derive(Debug, Clone)]
+struct CapabilityServer(ServerCapabilities);
+
+impl ServerHandler for CapabilityServer {
+    fn get_info(&self) -> ServerConfig {
+        ServerConfig::new(self.0.clone())
+    }
+}
+
+#[derive(Debug, Clone)]
+struct ProbeClient;
+
+impl ClientHandler for ProbeClient {
+    fn get_info(&self) -> ClientConfig {
+        let mut info = ClientConfig::default();
+        info.protocol_version = ProtocolVersion::V_2026_07_28;
+        info
+    }
+}
+
+fn expect_result<T: std::fmt::Debug>(
+    method: &str,
+    result: Result<T, ServiceError>,
+    advertised: bool,
+) -> Option<T> {
+    if advertised {
+        Some(result.unwrap_or_else(|error| panic!("{method} should succeed: {error:?}")))
+    } else {
+        match result {
+            Err(ServiceError::McpError(error)) => {
+                assert_eq!(error.code, ErrorCode::METHOD_NOT_FOUND, "{method}");
+            }
+            other => panic!("{method} should return method not found: {other:?}"),
+        }
+        None
+    }
+}
+
+async fn check_capabilities(capabilities: ServerCapabilities) {
+    let prompts = capabilities.prompts.is_some();
+    let completions = capabilities.completions.is_some();
+    let resources = capabilities.resources.is_some();
+    let tools = capabilities.tools.is_some();
+
+    let (server_transport, client_transport) = tokio::io::duplex(4096);
+    let server = serve_directly::<RoleServer, _, _, _, _>(
+        CapabilityServer(capabilities),
+        server_transport,
+        Some(ProbeClient.get_info()),
+    );
+    let mut peer_info = InitializeResult::default();
+    peer_info.protocol_version = ProtocolVersion::V_2026_07_28;
+    let client = serve_directly::<RoleClient, _, _, _, _>(
+        ProbeClient,
+        client_transport,
+        Some(peer_info.into()),
+    );
+
+    if let Some(result) = expect_result("prompts/list", client.list_prompts(None).await, prompts) {
+        assert!(result.prompts.is_empty());
+    }
+    if let Some(result) = expect_result(
+        "completion/complete",
+        client
+            .complete(CompleteRequestParams::new(
+                Reference::for_prompt("unused"),
+                ArgumentInfo::new("argument", "value"),
+            ))
+            .await,
+        completions,
+    ) {
+        assert!(result.completion.values.is_empty());
+    }
+    if let Some(result) = expect_result(
+        "resources/list",
+        client.list_resources(None).await,
+        resources,
+    ) {
+        assert!(result.resources.is_empty());
+    }
+    if let Some(result) = expect_result(
+        "resources/templates/list",
+        client.list_resource_templates(None).await,
+        resources,
+    ) {
+        assert!(result.resource_templates.is_empty());
+    }
+    if let Some(result) = expect_result("tools/list", client.list_tools(None).await, tools) {
+        assert!(result.tools.is_empty());
+    }
+
+    client.cancel().await.expect("stop client");
+    server.cancel().await.expect("stop server");
+}
+
+#[tokio::test]
+async fn default_list_methods_follow_advertised_capabilities() {
+    // LocalSet also lets this test run with --all-features, where rmcp's
+    // `local` feature uses spawn_local for its service tasks.
+    tokio::task::LocalSet::new()
+        .run_until(async {
+            check_capabilities(ServerCapabilities::default()).await;
+            check_capabilities(ServerCapabilities::builder().enable_tools().build()).await;
+            check_capabilities(
+                ServerCapabilities::builder()
+                    .enable_tools()
+                    .enable_resources()
+                    .enable_prompts()
+                    .enable_completions()
+                    .build(),
+            )
+            .await;
+        })
+        .await;
+}

crates/rmcp/tests/test_discover_http_client_startup.rs

@@ -16,7 +16,10 @@ use axum::{
 };
 use rmcp::{
     ClientLifecycleMode, ClientServiceExt, ServerHandler,
-    model::{ClientConfig, DiscoverResult, ErrorCode, ErrorData, ProtocolVersion},
+    model::{
+        ClientConfig, DiscoverResult, ErrorCode, ErrorData, ProtocolVersion, ServerCapabilities,
+        ServerConfig,
+    },
     service::{MaybeSendFuture, RequestContext, RoleServer},
     transport::{
         StreamableHttpClientTransport,
@@ -34,6 +37,10 @@ use tokio_util::sync::CancellationToken;
 struct DiscoverHttpServer;
 
 impl ServerHandler for DiscoverHttpServer {
+    fn get_info(&self) -> ServerConfig {
+        ServerConfig::new(ServerCapabilities::builder().enable_tools().build())
+    }
+
     fn supported_protocol_versions(&self) -> Cow<'static, [ProtocolVersion]> {
         Cow::Borrowed(&[ProtocolVersion::V_2026_07_28])
     }
@@ -43,6 +50,10 @@ impl ServerHandler for DiscoverHttpServer {
 struct LegacyHttpServer;
 
 impl ServerHandler for LegacyHttpServer {
+    fn get_info(&self) -> ServerConfig {
+        ServerConfig::new(ServerCapabilities::builder().enable_tools().build())
+    }
+
     fn discover(
         &self,
         _context: RequestContext<RoleServer>,

crates/rmcp/tests/test_handler_cache_hints.rs

@@ -7,7 +7,8 @@ use rmcp::{
     model::{
         CacheScope, ClientConfig, InitializeResult, ListPromptsResult, ListResourcesResult,
         ListToolsResult, PaginatedRequestParams, ProtocolVersion, ReadResourceRequestParams,
-        ReadResourceResponse, ReadResourceResult, ResourceContents,
+        ReadResourceResponse, ReadResourceResult, ResourceContents, ServerCapabilities,
+        ServerConfig,
     },
     prompt_handler,
     service::{RequestContext, RunningService, serve_directly},
@@ -40,6 +41,16 @@ impl ServerHandler for CacheHintServer {}
 struct ManualServer;
 
 impl ServerHandler for ManualServer {
+    fn get_info(&self) -> ServerConfig {
+        ServerConfig::new(
+            ServerCapabilities::builder()
+                .enable_tools()
+                .enable_prompts()
+                .enable_resources()
+                .build(),
+        )
+    }
+
     async fn list_tools(
         &self,
         _request: Option<PaginatedRequestParams>,
@@ -70,6 +81,10 @@ impl ServerHandler for ManualServer {
 struct ExplicitHintServer;
 
 impl ServerHandler for ExplicitHintServer {
+    fn get_info(&self) -> ServerConfig {
+        ServerConfig::new(ServerCapabilities::builder().enable_resources().build())
+    }
+
     async fn list_resources(
         &self,
         _request: Option<PaginatedRequestParams>,

crates/rmcp/tests/test_stateless_server_requests.rs

@@ -11,8 +11,8 @@ use rmcp::{
         ClientCapabilities, ClientJsonRpcMessage, ClientRequest, DiscoverRequest,
         DiscoverRequestParams, ErrorCode, ErrorData, Implementation, ListToolsRequest,
         ListToolsResult, NumberOrString, PaginatedRequestParams, ProgressNotificationParam,
-        ProgressToken, ProtocolVersion, RequestId, RequestMetaObject, ServerJsonRpcMessage,
-        ServerNotification,
+        ProgressToken, ProtocolVersion, RequestId, RequestMetaObject, ServerCapabilities,
+        ServerConfig, ServerJsonRpcMessage, ServerNotification,
     },
     service::{MaybeSendFuture, RequestContext, RoleServer},
     transport::{IntoTransport, Transport},
@@ -21,7 +21,15 @@ use rmcp::{
 #[derive(Clone, Default)]
 struct StatelessServer;
 
-impl ServerHandler for StatelessServer {}
+impl ServerHandler for StatelessServer {
+    fn get_info(&self) -> ServerConfig {
+        tools_info()
+    }
+}
+
+fn tools_info() -> ServerConfig {
+    ServerConfig::new(ServerCapabilities::builder().enable_tools().build())
+}
 
 fn complete_meta() -> RequestMetaObject {
     complete_meta_for("stateless-client")
@@ -129,6 +137,10 @@ struct ContextServer {
 }
 
 impl ServerHandler for ContextServer {
+    fn get_info(&self) -> ServerConfig {
+        tools_info()
+    }
+
     fn list_tools(
         &self,
         _request: Option<PaginatedRequestParams>,
@@ -260,6 +272,10 @@ async fn stateless_server_rejects_malformed_metadata_without_selecting_lifecycle
 struct ProgressServer;
 
 impl ServerHandler for ProgressServer {
+    fn get_info(&self) -> ServerConfig {
+        tools_info()
+    }
+
     async fn list_tools(
         &self,
         _request: Option<PaginatedRequestParams>,

crates/rmcp/tests/test_streamable_http_session_store.rs

@@ -115,7 +115,7 @@ async fn test_session_state_persisted_to_store() -> anyhow::Result<()> {
         .await?;
 
     // Make a real request so the session is fully active.
-    let _resources = client.list_all_resources().await?;
+    let _tools = client.list_all_tools().await?;
 
     // The store should now contain exactly one session entry.
     assert_eq!(
@@ -178,7 +178,7 @@ async fn test_session_state_deleted_from_store_on_delete() -> anyhow::Result<()>
         .with_protocol_version(ProtocolVersion::LATEST_WITH_INITIALIZE)
         .serve(transport)
         .await?;
-    let _resources = client.list_all_resources().await?;
+    let _tools = client.list_all_tools().await?;
 
     assert_eq!(store.len().await, 1, "store should have one entry");
 
@@ -422,11 +422,11 @@ async fn test_no_session_created_at_latest_protocol_version() -> anyhow::Result<
         .header("content-type", "application/json")
         .header("mcp-protocol-version", ProtocolVersion::LATEST.as_str())
         // Required by SEP-2243 from 2026-07-28 onward.
-        .header("mcp-method", "resources/list")
+        .header("mcp-method", "tools/list")
         .json(&serde_json::json!({
             "jsonrpc": "2.0",
             "id": 1,
-            "method": "resources/list",
+            "method": "tools/list",
             "params": {
                 "_meta": {
                     "io.modelcontextprotocol/protocolVersion": ProtocolVersion::LATEST.as_str(),