* Extensions: Connection Info both eras + io.modelcontextprotocol/ui advertisement (Phase 3 of #1633) Completes the Extensions surfacing and advertises the MCP Apps UI extension. core/mcp/extensions.ts: - Add UI_EXTENSION_KEY ("io.modelcontextprotocol/ui") and MCP_APP_MIME_TYPE ("text/html;profile=mcp-app") — mirrors of ext-apps' EXTENSION_ID / RESOURCE_MIME_TYPE (hardcoded: the constants live on the package's /server subpath or an extensionless re-export that doesn't resolve under NodeNext). - Registry entries gain an optional `advertisement` value; the builder stamps it (default {}). Add the `ui` entry, default-advertised with `{ mimeTypes: ["text/html;profile=mcp-app"] }` — the Inspector always renders App tools. No ext-apps cast needed: the extensions value type is `object`. ConnectionInfoContent: - Source server extensions from the negotiated `capabilities.extensions` (getServerCapabilities, era-transparent) instead of the modern-only discoverResult, so a LEGACY server advertising extensions renders them too. - Add a two-column "Server Extensions" / "Advertised Extensions" section (the Inspector's own advertised map), mirroring the server/client capability columns. Drop the now-redundant Extensions row from the modern Discovery section (Supported versions stays). Tests: extensions.test.ts covers the ui entry + advertisement value and the per-extension enable/disable; ConnectionInfoContent.test.tsx covers legacy server extensions (no discovery), the advertised-extensions column, and the em-dash empty states. npm run ci green (the one InspectorView localStorage failure is a known flake, passes on re-run). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNdjEPKLG637X8YmhDiEk5 * Extensions: address Phase 3 review (mime drift-guard, story, exact em-dashes) - extensions-mimetype.test.ts (integration/node): assert MCP_APP_MIME_TYPE equals ext-apps' real RESOURCE_MIME_TYPE (imported) and that the client advertises it — a genuine drift guard, replacing the tautological literal check in the unit test (which now just asserts the type). - ConnectionInfoContent Modern story: carry the tasks extension on initializeResult.capabilities too, so the Server Extensions row demonstrates it (the row now reads negotiated server capabilities, not discoverResult). - Tighten the em-dash assertions from ">= N" to exact counts (3/3/2) now that the two extension sections em-dash by default. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNdjEPKLG637X8YmhDiEk5 * Extensions: drift-guard UI_EXTENSION_KEY against ext-apps EXTENSION_ID (review) Address the Phase 3 re-review nit: the extension id was the other half of the same drift risk (a server keys its Apps lookup on it). Import ext-apps' EXTENSION_ID from the /server subpath in the node integration test (fine there; the browser build is what avoids /server) and assert UI_EXTENSION_KEY === it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNdjEPKLG637X8YmhDiEk5 * Extensions: clone the registry advertisement so builds never alias it (review) Address the Phase 3 re-review's optional defensive nit: buildClientExtensions returned the same object reference as the ADVERTISABLE_EXTENSIONS entry for the ui advertisement, so an in-place mutation of a stamped value (e.g. extensions[ui].mimeTypes) could corrupt the registry for later connections. structuredClone the advertisement on stamp; add a test asserting a mutated build doesn't leak into the next one. Nothing mutates it today — purely defensive. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNdjEPKLG637X8YmhDiEk5 * Extensions: add #1740 Connection Info proof screenshots End-to-end smoke test in the web client against the legacy advertised-extensions-http.json server: the Connection Info modal shows the new era-transparent Server Extensions / Advertised Extensions section, with Advertised Extensions listing io.modelcontextprotocol/tasks + io.modelcontextprotocol/ui (the new ui advertisement), and only ui after toggling Tasks off and reconnecting. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XNdjEPKLG637X8YmhDiEk5 --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
8.9 KiB
Connection Info extensions + io.modelcontextprotocol/ui (#1740) — proof screenshots
End-to-end verification of the Phase 3 Connection Info UI against the legacy
advertised-extensions-http.json test server (port 3220), driven in a real
browser through the web client's remote-proxy transport.
The Connection Info modal on a legacy connection (Era: LEGACY, no
Discovery section). The new Server Extensions / Advertised Extensions
two-column section renders — proving it is era-transparent (before #1740,
extensions only appeared in the modern-only Discovery section). Advertised
Extensions shows io.modelcontextprotocol/tasks, io.modelcontextprotocol/ui,
confirming the Inspector now advertises the MCP Apps ui extension. (Server
Extensions is — because this test server advertises none server-side.)
After unchecking Tasks in Server Settings → Advertised Extensions (Phase 2)
and reconnecting, the Advertised Extensions column shows only
io.modelcontextprotocol/ui — the display reflects the per-server override live,
and the ui advertisement persists (it is a separate registry entry).
Note: the Connection Info modal is populated from the connection's
initializeResult, which requiresserverInfo. On the modern test server used hereserverInfowasn't populated, so the modal stays closed on that modern connection — a pre-existing connection-layer behavior, independent of this PR (which only changes content inside the modal). The era-transparent Server Extensions path is covered by unit tests (ConnectionInfoContent.test.tsxrenders legacy server extensions with nodiscoverResult).
Advertised-extensions toggle (#1739) — proof screenshots
End-to-end verification of the advertised-extensions debugging knob against a
real legacy HTTP test server (test-servers/configs/advertised-extensions-http.json
on port 3220), driven in a real browser through the web client's remote-proxy
transport. The server registers echo (always) and get_weather gated on the
io.modelcontextprotocol/tasks extension (extensionGatedTools): the tool is
enabled on notifications/initialized only when the connected client declared
that extension.
Server Settings → Advertised Extensions (the new section). With no override, Tasks (io.modelcontextprotocol/tasks) is checked — the registry default — so the Inspector advertises it in its client capabilities.
Connected with Tasks advertised. The server sees the declared extension on
initialized and enables the gated tool, so tools/list returns both echo
and get_weather.
Unchecking Tasks writes the per-server advertisedExtensions override. The
change takes effect on the next connect (as the section note says).
After reconnecting, the client advertises no extensions, so the server never
enables the gated tool — tools/list now returns only echo. The server's
tool registration demonstrably changed based on what the client advertised,
exactly the acceptance criterion for #1739.
x-mcp-header Tools tooling (#1632) — proof screenshots
End-to-end verification of the SEP-2243 x-mcp-header Tools tooling against a
real modern (2026-07-28) HTTP test server
(test-servers/configs/xmcpheader-modern-http.json on port 3120), driven in a
real browser through the web client's remote-proxy transport.
Connected with Protocol Era = Modern. invalid_header_tool is dropped from
tools/list by the SDK (its x-mcp-header annotation is invalid), so the
Inspector re-lists the raw list and surfaces it struck-through under an
"Excluded (SEP-2243)" divider — showing why a tool vanished rather than
silently omitting it.
Hovering the excluded tool shows the exact scan reason: the header name
"Bad Header" contains a space, so it is not a valid RFC 9110 token.
get_weather's detail panel shows the "Mirrored request headers (SEP-2243)"
section: its city argument mirrors to Mcp-Param-City, with the note that the
SDK omits Mcp-Param-* on the browser transport.
Calling a tool the server no longer recognizes rejects with -32602 (SDK v2)
instead of an isError result, and renders as an "Unknown Tool" error panel
with a targeted hint (reproduced by swapping the sessionless server to one
without echo while the cached list still showed it).
-32602 is the generic Invalid params code, so a known tool rejected for
bad arguments throws the same code as an unknown tool. The panel disambiguates
from the message: a -32602 that does not name an unknown tool renders under
"Invalid Parameters" (with a schema hint) rather than "Unknown Tool".
Triggered live via the trigger_invalid_params tool, which returns a real
-32602 JSON-RPC error whose message is not about a missing tool.
Tasks extension era fork (#1631) — proof screenshots
End-to-end verification of the Tasks era fork against two real test servers
(test-servers/configs/tasks-modern-http.json on port 3222 and
tasks-legacy-http.json on 3223), driven in a real browser through the web
client's remote-proxy transport.
Modern era (2026-07-28, io.modelcontextprotocol/tasks extension)
Connected with Protocol Era = Modern (MCP 2026-07-28). The Tasks tab
appears in the monitoring sidebar because the io.modelcontextprotocol/tasks
extension was negotiated (it is empty until a task runs).
Connected with Protocol Era = Modern (MCP 2026-07-28). The Tasks tab is
gated on the negotiated io.modelcontextprotocol/tasks extension (not
capabilities.tasks). Running modern_task with Run as task on issues a
tools/call that returns a CreateTaskResult (resultType: "task"), then polls
tasks/get (no tasks/list); the completed task inlines its result (no
blocking tasks/result) — shown both in the Results panel and the Tasks card.
modern_input_task moves to input_required: the tasks/get response's
inputRequests map (visible in the task's Full Task Object) carries an embedded
elicitation/create, surfaced through the same pending-request modal the MRTR
path uses — note the accurate wording "your answer is submitted via a
tasks/update request (SEP-2663), not a retry". Answering it sends
tasks/update with the inputResponses, and the next poll completes the
task:
Legacy era (2025-11-25, contrast — unchanged)
Connected with Protocol Era = Legacy. The Tasks tab is gated on
capabilities.tasks; simple_task is taskSupport: "required" so Run as
task is forced on. The legacy flow uses tasks/list to populate the list,
tasks/get to poll, and the blocking tasks/result to fetch the payload
({ "message": "Task completed: no message", "taskId": … }). Note the legacy-only
Logs tab (this server advertises logging), absent from the modern monitor
set.
Notes
- SDK v2 removed all tasks support and era-gates the
tasks/*spec methods out of the 2026-07-28 era on both the client (outbound) and server (inbound), and its codec rejects aresultType: "task"result outright. So the Inspector drives the extension itself: the task-creation frame is rewritten at the transport into aCallToolResultcarrying the handle (the trueresultType: "task"frame is still logged to the Protocol/Network tabs), andtasks/get/tasks/update/tasks/cancelride a raw-wire request channel that carries the full modern envelope and is consumed by the transport before the SDK Client sees it. The test server servestasks/*from an Express interceptor ahead of the SDK handler (the SDK's modern leg would answer them-32601). - On modern, task creation is server-directed (SEP-2663): the client declares
the extension once and any tool may return a task, so the Tools screen offers
Run as task for every tool on a modern connection (rather than gating on the
legacy per-tool
taskSupport).















