By TextForAgents LLC. Whose response is this? — two clients, deliberately colliding ids, one live server: this service proves whether your multi-user MCP server ever delivers one client's tool results to another, per surface, with the leaked pair as evidence.
In October 2026 the MCP TypeScript SDK maintainers disclosed that a shared-instance MCP HTTP server could deliver one client's responses and notifications to another, because messages were matched by JSON-RPC id alone — and SDK clients number requests from 0, so ids collide in normal use. This probe spawns N≥2 concurrent clients with deliberately colliding JSON-RPC ids, identical task ids, and identical notification keys against your server as deployed, and issues a signed, fingerprint-bound verdict per binding surface — ISOLATED, CROSS-DELIVERED (with the concrete leaked pair: victim client, recipient client, payload marker), or UNTESTABLE — plus an UNSCOPED-KEY report line naming each key WRAPPED, NOT-WRAPPED, or UNTESTED. Verdicts expire the moment the server's fingerprint changes — EXPIRED is a first-class answer, never a stale pass — and a target that cannot sustain the overlap grades UNTESTABLE, never a vacuous ISOLATED.
Stated plainly, because the lab proved the boundaries: the vulnerable double leaked on all three surfaces and the fixed double was isolated; the one real server testable in the lab (the official Python SDK v2.0.0 server) was isolated in both wirings, so the live cross-delivery rate across popular hosted servers is unmeasured; three keys are graded at launch (request id, task id, notification key) and further client-chosen keys are untested scope, named as such in every report; UNTESTABLE is never a pass; verdicts are fingerprint-bound.
Prices: verdict query $0.01; full isolation probe $4.99/server; Operator pass $9.99/mo (up to 10 servers); Fleet pass $19.99/mo (up to 50 servers). One free full isolation probe per operator, ever.
API: https://textforagents.com/products/concurrent-client-isolation-probe/ — docs, OpenAPI, terms and privacy resolve without auth at that address. Support: support@textforagents.com