modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: address Copilot review round 6 on #2251

Browse source 
Most of this round re-reported code the previous commit already changed
(it generated 0 new comments). Two findings were genuinely open.

- SkillsScreen: give "View SKILL.md" and "Fetch with skills/get" the same
  attempt ordering `verifyRow` got in round 3. Both were still
  last-completion-wins within one manifest: a double click whose older
  request settled last replaced the newer result. One shared `isStale`
  helper now covers all three actions — a result is dropped when its
  manifest was invalidated OR a later click already wrote.
- test-servers/skills.ts + docs: stop calling all three edge cases
  "non-conforming". `resources: "dynamic"` is a LEGAL wire form for
  generated content — it is unverifiable, not invalid, which is exactly
  why the checker reports it as a warning. The prose contradicted the
  code it was describing. Now: one legal-but-unverifiable case and two
  actual violations.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018kfrH3uRNUM4JAk1reKtyY
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-04 23:21:51 -04:00
commit 4e676a0a54
1 changed files with 135 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

20
test-servers/src/skills.ts
View file

@ -5,12 +5,20 @@
* the `skill://` URIs those entries name, so an Inspector connected here can
* exercise the whole flow: enumerate, fetch a file, and verify its digest.
*
* **The non-conforming skills are the point.** A fixture that only served a
* clean skill would leave every verification and conformance path in the
* Inspector untestable, so the set below deliberately includes one `"dynamic"`
* skill, one whose advertised digest does not match the bytes served, and one
* whose URI path segment disagrees with `frontmatter.name`. Each is the exact
* shape one of the checks in `core/mcp/skills.ts` exists to catch.
* **The awkward skills are the point.** A fixture that only served a clean
* skill would leave every verification and conformance path in the Inspector
* untestable, so the set below deliberately includes three edge cases — each
* the exact shape one of the checks in `core/mcp/skills.ts` exists to catch:
*
* - `dynamic-report` declares `resources: "dynamic"`. That is a **conforming**
* wire form for generated content, not a violation; what it costs is that
* integrity cannot be verified at all, which the Inspector reports as a
* warning. It is here because "legal but unverifiable" is the case most
* easily buried.
* - `tampered-notes` advertises a digest that does not match the bytes it
* serves — a genuine violation.
* - `wrong-folder` has a URI path segment that disagrees with
* `frontmatter.name` — the other genuine violation.
*
* `skills/list` and `skills/get` are registered through the **public**
* `setRequestHandler`, which accepts a consumer-owned method name as long as