inspector/test-servers/src/resolve-config.ts
cliffhall 63623b754b feat: support the Skills extension (SEP-2640) with digest verification
Adds detection, enumeration, and conformance checking for the Skills
extension (`io.modelcontextprotocol/skills`) — phases 1 and 2 of #2234,
which is everything its Acceptance list names.

Skills is a *server*-declared extension, read off the connecting server's
`capabilities.extensions`, so it is deliberately absent from
`ADVERTISABLE_EXTENSIONS` — that registry is what the Inspector advertises
and the user toggles, and an entry there would be a meaningless toggle.

`skills/list` and `skills/get` are consumer-owned extension methods that
neither era codec defines, so the SDK's era gate skips them and they go out
as ordinary `client.request` calls with explicit result schemas. The
raw-wire channel modern `tasks/*` needs is not used, and the Skills tab is
not era-gated: a legacy-era server that declares the extension is serving it.

The checks are the point, not the list view. `core/mcp/skills.ts` reports
each obligation SEP-2640 states — the name/path invariant, the digest
format, the 512-entry and 16 MiB limits, and `resources: "dynamic"`, which
means integrity cannot be verified at all. Digest verification hashes the
fetched bytes with WebCrypto and returns a mismatch with both digests
attached rather than throwing, because showing a mismatch loudly is the
whole value proposition.

Files are fetched on demand: SEP-2640 is explicit that a `resources/read`
of a `SKILL.md` is not a load and confers no standing, so none of the SEP's
host machinery is implemented.

The `skills-http` fixture serves four skills over two pages, three of them
deliberately non-conforming — without those the verification code is
untestable.

Phase 3 (CLI, TUI, `resources/directory/read`, paged mode) is #2248.

Closes #2234

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018kfrH3uRNUM4JAk1reKtyY
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-09-04 20:45:15 -04:00

121 lines
3.8 KiB
TypeScript

/**
* Resolves config file preset refs to ServerConfig for createMcpServer
*/
import type { ServerConfig } from "./composable-test-server.js";
import type {
ToolDefinition,
TaskToolDefinition,
ResourceDefinition,
PromptDefinition,
ResourceTemplateDefinition,
} from "./composable-test-server.js";
import { createTestServerInfo } from "./test-server-fixtures.js";
import { resolvePreset } from "./preset-registry.js";
import type { ConfigFile, PresetRef } from "./load-config.js";
function mergeRequiredScopes<T extends { requiredScopes?: string[] }>(
item: T,
ref: PresetRef,
): T {
if (!ref.requiredScopes?.length) {
return item;
}
return { ...item, requiredScopes: ref.requiredScopes };
}
function resolvePresetRefs<T extends { requiredScopes?: string[] }>(
refs: Array<PresetRef | PresetRef[]> | undefined,
type: "tool" | "resource" | "resourceTemplate" | "prompt",
): T[] {
if (!refs || refs.length === 0) return [];
const result: Array<{ requiredScopes?: string[] }> = [];
for (const entry of refs) {
const items = Array.isArray(entry) ? entry : [entry];
for (const ref of items) {
const presetName = ref.preset;
if (!presetName || typeof presetName !== "string") {
throw new Error(
`Invalid preset ref: preset must be a non-empty string`,
);
}
const resolved = resolvePreset(type, presetName, ref.params);
const arr = Array.isArray(resolved) ? resolved : [resolved];
for (const item of arr) {
result.push(mergeRequiredScopes(item, ref));
}
}
}
// The caller pairs `type` with the matching `T`, so each resolved preset is
// the requested definition kind; TS can't see that correspondence.
return result as T[];
}
/**
* Resolve config file to ServerConfig for createMcpServer
*/
export function resolveConfig(config: ConfigFile): ServerConfig {
const tools = resolvePresetRefs<ToolDefinition | TaskToolDefinition>(
config.tools,
"tool",
);
const resources = resolvePresetRefs<ResourceDefinition>(
config.resources,
"resource",
);
const resourceTemplates = resolvePresetRefs<ResourceTemplateDefinition>(
config.resourceTemplates,
"resourceTemplate",
);
const prompts = resolvePresetRefs<PromptDefinition>(config.prompts, "prompt");
const serverInfo = createTestServerInfo(
config.serverInfo.name,
config.serverInfo.version,
);
const transport = config.transport;
const isHttp =
transport.type === "streamable-http" || transport.type === "sse";
const serverConfig: ServerConfig = {
serverInfo,
tools: tools.length > 0 ? tools : undefined,
resources: resources.length > 0 ? resources : undefined,
resourceTemplates:
resourceTemplates.length > 0 ? resourceTemplates : undefined,
prompts: prompts.length > 0 ? prompts : undefined,
logging: config.logging,
listChanged: config.listChanged,
subscriptions: config.subscriptions,
tasks: config.tasks,
tasksExtension: config.tasksExtension,
skills: config.skills,
appElicitation: config.appElicitation,
maxPageSize: config.maxPageSize,
duplicateToolNames: config.duplicateToolNames,
rawToolSchemas: config.rawToolSchemas,
extensionGatedTools: config.extensionGatedTools,
serverType: isHttp
? (transport.type as "sse" | "streamable-http")
: undefined,
port: isHttp ? transport.port : undefined,
};
// Normalize the modern flag: `true` is shorthand for the default (dual-era
// stateless) posture; the object form passes through.
if (transport.modern !== undefined) {
serverConfig.modern =
transport.modern === true ? {} : transport.modern || undefined;
}
if (config.oauth) {
const { issuerUrl, ...oauthRest } = config.oauth;
serverConfig.oauth = {
...oauthRest,
...(issuerUrl && { issuerUrl: new URL(issuerUrl) }),
};
}
return serverConfig;
}