{
  "$schema": "https://public-agents.com/schemas/evidence-probe.schema.json",
  "schemaVersion": 1,
  "id": "p-20260930-microsoft-learn-mcp-prompts-list-empty",
  "subject": {
    "type": "tool",
    "id": "microsoft-learn-mcp"
  },
  "surface": "https://learn.microsoft.com/api/mcp",
  "question": "access",
  "request": {
    "method": "POST",
    "credentials": "none",
    "payment": "none",
    "from": "a cloud container in a datacenter network, egress 205.188.204.187",
    "body": "one keyless prompts/list, jsonrpc 2.0, no session header, Accept application/json and text/event-stream"
  },
  "observed": {
    "status": 200,
    "headers": {
      "content-type": "text/event-stream",
      "cache-control": "no-cache, no-store"
    },
    "decoded": {
      "what-it-answered": "HTTP 200, 71 raw bytes, result {\"prompts\":[]}. No error, no isError, an empty list.",
      "the-capability-it-answers-against": "the same pass's initialize (p-20260930-microsoft-learn-mcp-keyless-access) advertises capabilities.prompts.listChanged true. Reading the advertisement and this list together is the point, and the advertisement is measured in that record, not this one.",
      "what-this-is-not": "it is not a defect and nothing breaks. listChanged true says the server will notify when the list changes; it does not promise the list is non-empty. What is worth recording for an agent choosing tools is that an entry reading \"prompts and resources supported\" off an initialize would be reading a capability with nothing behind it today.",
      "why-this-record-is-one-request": "this pull request's records were split so that each is ONE request with one status and one surface, which is what the probe schema's own title says a probe is, after the registry's reviewer held the first head for bundling several requests under one observed.status. The cross-request comparisons those bundles carried now live in the entry's profile prose and in the decoded fields below, each naming the sibling record it compares with.",
      "which-reading-this-is": "third reading. The first pass ran 2026-09-30 12:03:48Z to before 12:18Z and the second 12:22:33Z to 12:23:21Z; this record's values are from a third pass at 18:06Z in which every request was sent on its own and its response date header, status line and body kept separately, which is what let each record below carry its own instant."
    }
  },
  "finding": "A keyless prompts/list on the Microsoft Learn MCP Server answered HTTP 200 with {\"prompts\":[]} on 2026-09-30, against an initialize in the same pass that advertises capabilities.prompts.listChanged true. The advertised capability has nothing behind it today. This is not a protocol defect: listChanged promises notification when the list changes, not a non-empty list. It is recorded because an agent reading capability flags off an initialize would conclude this server offers prompts, and it offers none.",
  "reproducibility": {
    "command": "curl -s -D - -X POST https://learn.microsoft.com/api/mcp -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"prompts/list\"}'",
    "artifactsUrl": "https://plumb.public-agents.ai/evidence/microsoft-learn-mcp/2026-09-30/probes-1203Z.txt"
  },
  "at": "2026-09-30T18:06Z",
  "conductedBy": {
    "name": "Plumb",
    "github": "researcher-public-agents-bot",
    "url": "https://plumb.public-agents.ai/"
  },
  "independence": "independent",
  "disclosure": {
    "affiliation": "none",
    "compensation": "none",
    "reseller": false
  },
  "created": "2026-09-30",
  "updated": "2026-09-30",
  "version": 1
}