[Bug]: Modern MCP deferred catalogs change after tool_search with unchanged credentials

Abierto
  • ¿Algo no está bien?
#35,799 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
nodejs, shell, typescript
Área
api, backend, security

Línea de trabajo

Start with the visibility middleware in apps/server/src/mcp/McpHttpServer.ts (around lines 1350-1374), which picks the deferred catalog from provider-session state and the t3-tool-exposure header without checking the protocol revision. Then read apps/server/src/mcp/McpToolExposure.ts (lines 50-92), where tool search mutates the session's loaded set. Run the attached repro.mjs against the checkout; done means the modern tools/list results are equal before and after tool search, while the full-catalog control still passes.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

vouch:denounced
Summary

A modern MCP client using deferred tool exposure receives a different tool catalog after calling tool search, even though its credentials and request configuration stay unchanged. The modern tools contract requires the available tool set to be independent of other requests on the connection. This was reproduced through the production HTTP transport with an in-memory registration and a synthetic provider identity; the control without deferred exposure kept a stable catalog.

Before submitting
  • Related issues: none found for this broken modern tools-list contract in open and closed issues and PRs.
  • Removed credentials, tokens, private paths, and sensitive data.
Area

apps/server

Steps to reproduce
  1. Use the stated T3 Code revision with its locked dependencies installed.
  2. Save the script below as repro.mjs and run node repro.mjs /path/to/t3code.
  3. Observe the stable full-catalog control and the deferred catalog changing after the search request.

One complete, valid HTTP run deterministically demonstrated the catalog change. Two earlier setup attempts were inconclusive: the first omitted the modern Mcp-Name header and returned HTTP 400, and the second established that exact diagnostic; the final script supplies the header and receives successful results. These malformed setup probes are not defect evidence.

The script needs Node capable of running the checkout's TypeScript sources and the checkout's installed dependencies. It uses production layerMcpTransport, layerToolSearch, and toolkit registration with a synthetic control tool and mocked credential resolver; it opens only an ephemeral loopback server, uses disposable HOME, TMPDIR, and T3CODE_HOME paths, removes its scratch on exit, and leaves the checkout unchanged. Exit 0 means the catalogs remain equal, exit 1 means the defect was reproduced, and exit 2 means setup or the full-catalog control failed.

Reproduction script: repro.mjs 
import { createRequire } from 'node:module';
import { pathToFileURL } from 'node:url';
import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { resolve, join } from 'node:path';
const repo=resolve(process.argv[2]??'.');
const scratch=mkdtempSync(join(tmpdir(),'t3-mcp-repro-'));
for(const k of ['HOME','TMPDIR','T3CODE_HOME']) {process.env[k]=join(scratch,k);mkdirSync(process.env[k],{recursive:true});}
const req=createRequire(join(repo,'apps/server/package.json'));
const pkg=async(s)=>import(pathToFileURL(req.resolve(s)).href);
const source=async(s)=>import(pathToFileURL(join(repo,s)).href);
let status=2;
try {
console.log('Node',process.version);console.log('Effect',req('effect/package.json').version);
const [Effect,Layer,Schema,{McpServer,Tool,Toolkit},{NodeHttpServer},{HttpRouter,HttpClient,HttpBody},McpHttpServer,Access,Invocation,Registry,Settings]=await Promise.all([
 pkg('effect/Effect'),pkg('effect/Layer'),pkg('effect/Schema'),pkg('effect/ai'),pkg('@effect/platform-node'),pkg('effect/http'),
 source('apps/server/src/mcp/McpHttpServer.ts'),source('apps/server/src/mcp/McpToolAccess.ts'),source('apps/server/src/mcp/McpInvocationContext.ts'),source('apps/server/src/mcp/McpSessionRegistry.ts'),source('apps/server/src/serverSettings.ts')]);
const scope={environmentId:'environment-test',requestNamespace:'session-test',thread:{threadId:'thread-test',providerSessionId:'session-test',providerInstanceId:'codex'},client:undefined,capabilities:new Set(['orchestration']),issuedAt:1};
const toolkit=Toolkit.make(Tool.make('schema_probe',{description:'Synthetic control tool.',success:Schema.Struct({ok:Schema.Boolean})}));
const registrations=Layer.mergeAll(McpHttpServer.layerToolSearch,McpHttpServer.toolkitRegistration(toolkit,Access.toLayer(toolkit,{schema_probe:Access.reads(()=>Effect.succeed({ok:true}))})));
const server=McpHttpServer.layerMcpTransport(registrations).pipe(Layer.provide(Settings.layerTest()),Layer.provide(Layer.mock(Registry.McpSessionRegistry)({resolve:(token)=>Effect.succeed(token==='synthetic-token'?scope:undefined)})));
const results=await Effect.runPromise(Effect.scoped(Effect.gen(function*(){
 yield* HttpRouter.serve(server,{disableListenLog:true,disableLogger:true}).pipe(Layer.build);
 const client=yield* HttpClient.HttpClient;let id=0;
 const rpc=(method,args={},deferred=true)=>Effect.gen(function*(){
  const response=yield* client.post('/mcp',{headers:{authorization:'Bearer synthetic-token',accept:'application/json, text/event-stream','mcp-method':method,...(method==='tools/call'?{'mcp-name':args.name}:{}),'mcp-protocol-version':'2026-07-28',...(deferred?{'t3-tool-exposure':'deferred'}:{})},body:HttpBody.text(JSON.stringify({jsonrpc:'2.0',id:++id,method,params:{...args,_meta:{'io.modelcontextprotocol/protocolVersion':'2026-07-28','io.modelcontextprotocol/clientCapabilities':{},'io.modelcontextprotocol/clientInfo':{name:'repro',version:'1'}}}}),'application/json')});
  if(response.status!==200)throw new Error(method+' HTTP '+response.status+' '+(yield* response.text));const body=yield* response.json;if(body.error)throw new Error(JSON.stringify(body.error));return body.result;
 });
 const control1=yield* rpc('tools/list',{},false);
 const discover=yield* rpc('server/discover');
 const before=yield* rpc('tools/list');
 const search=yield* rpc('tools/call',{name:'tool_search',arguments:{query:'schema_probe'}});
 const after=yield* rpc('tools/list');
 const control2=yield* rpc('tools/list',{},false);
 return {control1,discover,before,search,after,control2};
})).pipe(Effect.provide(NodeHttpServer.layerTest)));
const names=x=>x.tools.map(t=>t.name).sort();
console.log('discovery tools capability',JSON.stringify(results.discover.capabilities.tools));
for(const k of ['control1','before','after','control2']) console.log(k,JSON.stringify(names(results[k])));
console.log('search structuredContent',JSON.stringify(results.search.structuredContent));
const control=names(results.control1).includes('schema_probe')&&JSON.stringify(names(results.control1))===JSON.stringify(names(results.control2))&&results.search.structuredContent?.tools.some(t=>t.name==='schema_probe');
status=!control?2:JSON.stringify(names(results.before))===JSON.stringify(names(results.after))?0:1;
} catch(e){console.log('setup error:',e.message);} finally{rmSync(scratch,{recursive:true,force:true});}
console.log(status===0?'RESULT: expected behavior':status===1?'RESULT: defect reproduced':'RESULT: inconclusive');process.exitCode=status;
Expected behavior

For core revision 2026-07-28, the Tools capabilities contract permits the available set to vary with the authorization on a request but forbids variation per connection or as a side effect of other requests on the connection. With the same credentials and list-request configuration, invoking tool search must not make the modern catalog depend on that prior call. This report concerns the modern revision; it does not claim that the legacy deferred-loading policy violates the legacy tools contract.

Actual behavior

With protocol version 2026-07-28 and t3-tool-exposure: deferred, a tools/list request initially returned only tool_search in the reduced fixture. Calling tools/call for tool_search with {"query":"schema_probe"} then made the next identical list request return both schema_probe and tool_search. Every request used the same synthetic provider credential, invocation scope, client metadata, and deferred header. The non-deferred control returned schema_probe before and after the search. Discovery advertised tools.listChanged: true.

Impact

Impact: P2 - A supported, opt-in modern MCP path exposes a request-history-dependent tool catalog contrary to the protocol contract. The observed scope is modern provider-session requests carrying the deferred-exposure header; unchanged full-list controls return a stable catalog.

A verified workaround is to omit t3-tool-exposure: deferred, which lists the available control tool on both requests. NOT_ENOUGH_INFO: no real provider client cache failure was exercised; its actual downstream effect would need a client integration run. No data loss, authorization bypass, or failure of non-deferred clients was observed.

Version or commit

T3 Code commit 59e64eef881632a23f89c4138bcf37f23d92bf93.

Environment

Node v26.12.1, Effect 4.1.3, macOS arm64. The reproduction uses the repository-pinned Effect dependency without changing its version.

Evidence

Observed output from the complete valid run:

Node v26.12.1
Effect 4.1.3
discovery tools capability {"listChanged":true}
control1 ["schema_probe"]
before ["tool_search"]
after ["schema_probe","tool_search"]
control2 ["schema_probe"]
search structuredContent {"tools":[{"name":"schema_probe","description":"Synthetic control tool."}]}
RESULT: defect reproduced

T3 registers both protocol adapters at apps/server/src/mcp/McpHttpServer.ts#L1308-L1317. The global list-visibility middleware chooses the deferred catalog from provider-session state and the exposure header without a protocol-revision distinction at apps/server/src/mcp/McpHttpServer.ts#L1350-L1374. Search mutates that session's loaded set and announces a list change at apps/server/src/mcp/McpToolExposure.ts#L50-L92.

Analysis

Source: the deferred catalog belongs to T3's McpToolExposure service and visibility middleware. Inspection of the pinned Effect transport shows that it delegates visibility to registered middleware and supplies the list-change machinery; the catalog's request-history dependence is introduced by T3's provider-session loaded set, rather than Effect's serialization.

Restoration check

Run the same script against the repaired checkout. The full-catalog controls must still pass, and modern list requests with the same authorization and configuration must not differ because tool search ran between them. A successful script run exits 0 and prints RESULT: expected behavior.

References
Lenguaje dominante
TypeScript
Estrellas
24.8k
Forks
6.4k
Merge medio
59 min
PR fusionados (30 d)
418

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de pingdotgg/t3code

Todos los issues de pingdotgg/t3code

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.