[Bug]: Modern MCP deferred catalogs change after tool_search with unchanged credentials

Start with the visibility middleware in apps/server/src/mcp/McpHttpServer.ts (around lines 1350-1374), which picks the deferred catalog from provider-session state and the t3-tool-exposure header without checking the protocol revision. Then read apps/server/src/mcp/McpToolExposure.ts (lines 50-92), where tool search mutates the session's loaded set. Run the attached repro.mjs against the checkout; done means the modern tools/list results are equal before and after tool search, while the full-catalog control still passes.

Summary

A modern MCP client using deferred tool exposure receives a different tool catalog after calling tool search, even though its credentials and request configuration stay unchanged. The modern tools contract requires the available tool set to be independent of other requests on the connection. This was reproduced through the production HTTP transport with an in-memory registration and a synthetic provider identity; the control without deferred exposure kept a stable catalog.

Before submitting

• Related issues: none found for this broken modern tools-list contract in open and closed issues and PRs.
• Removed credentials, tokens, private paths, and sensitive data.

Area

apps/server

Steps to reproduce

1. Use the stated T3 Code revision with its locked dependencies installed.
2. Save the script below as repro.mjs and run node repro.mjs /path/to/t3code.
3. Observe the stable full-catalog control and the deferred catalog changing after the search request.

One complete, valid HTTP run deterministically demonstrated the catalog change. Two earlier setup attempts were inconclusive: the first omitted the modern Mcp-Name header and returned HTTP 400, and the second established that exact diagnostic; the final script supplies the header and receives successful results. These malformed setup probes are not defect evidence.

The script needs Node capable of running the checkout's TypeScript sources and the checkout's installed dependencies. It uses production layerMcpTransport, layerToolSearch, and toolkit registration with a synthetic control tool and mocked credential resolver; it opens only an ephemeral loopback server, uses disposable HOME, TMPDIR, and T3CODE_HOME paths, removes its scratch on exit, and leaves the checkout unchanged. Exit 0 means the catalogs remain equal, exit 1 means the defect was reproduced, and exit 2 means setup or the full-catalog control failed.

import { createRequire } from 'node:module';
import { pathToFileURL } from 'node:url';
import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { resolve, join } from 'node:path';
const repo=resolve(process.argv[2]??'.');
const scratch=mkdtempSync(join(tmpdir(),'t3-mcp-repro-'));
for(const k of ['HOME','TMPDIR','T3CODE_HOME']) {process.env[k]=join(scratch,k);mkdirSync(process.env[k],{recursive:true});}
const req=createRequire(join(repo,'apps/server/package.json'));
const pkg=async(s)=>import(pathToFileURL(req.resolve(s)).href);
const source=async(s)=>import(pathToFileURL(join(repo,s)).href);
let status=2;
try {
console.log('Node',process.version);console.log('Effect',req('effect/package.json').version);
const [Effect,Layer,Schema,{McpServer,Tool,Toolkit},{NodeHttpServer},{HttpRouter,HttpClient,HttpBody},McpHttpServer,Access,Invocation,Registry,Settings]=await Promise.all([
 pkg('effect/Effect'),pkg('effect/Layer'),pkg('effect/Schema'),pkg('effect/ai'),pkg('@effect/platform-node'),pkg('effect/http'),
 source('apps/server/src/mcp/McpHttpServer.ts'),source('apps/server/src/mcp/McpToolAccess.ts'),source('apps/server/src/mcp/McpInvocationContext.ts'),source('apps/server/src/mcp/McpSessionRegistry.ts'),source('apps/server/src/serverSettings.ts')]);
const scope={environmentId:'environment-test',requestNamespace:'session-test',thread:{threadId:'thread-test',providerSessionId:'session-test',providerInstanceId:'codex'},client:undefined,capabilities:new Set(['orchestration']),issuedAt:1};
const toolkit=Toolkit.make(Tool.make('schema_probe',{description:'Synthetic control tool.',success:Schema.Struct({ok:Schema.Boolean})}));
const registrations=Layer.mergeAll(McpHttpServer.layerToolSearch,McpHttpServer.toolkitRegistration(toolkit,Access.toLayer(toolkit,{schema_probe:Access.reads(()=>Effect.succeed({ok:true}))})));
const server=McpHttpServer.layerMcpTransport(registrations).pipe(Layer.provide(Settings.layerTest()),Layer.provide(Layer.mock(Registry.McpSessionRegistry)({resolve:(token)=>Effect.succeed(token==='synthetic-token'?scope:undefined)})));
const results=await Effect.runPromise(Effect.scoped(Effect.gen(function*(){
 yield* HttpRouter.serve(server,{disableListenLog:true,disableLogger:true}).pipe(Layer.build);
 const client=yield* HttpClient.HttpClient;let id=0;
 const rpc=(method,args={},deferred=true)=>Effect.gen(function*(){
  const response=yield* client.post('/mcp',{headers:{authorization:'Bearer synthetic-token',accept:'application/json, text/event-stream','mcp-method':method,...(method==='tools/call'?{'mcp-name':args.name}:{}),'mcp-protocol-version':'2026-07-28',...(deferred?{'t3-tool-exposure':'deferred'}:{})},body:HttpBody.text(JSON.stringify({jsonrpc:'2.0',id:++id,method,params:{...args,_meta:{'io.modelcontextprotocol/protocolVersion':'2026-07-28','io.modelcontextprotocol/clientCapabilities':{},'io.modelcontextprotocol/clientInfo':{name:'repro',version:'1'}}}}),'application/json')});
  if(response.status!==200)throw new Error(method+' HTTP '+response.status+' '+(yield* response.text));const body=yield* response.json;if(body.error)throw new Error(JSON.stringify(body.error));return body.result;
 });
 const control1=yield* rpc('tools/list',{},false);
 const discover=yield* rpc('server/discover');
 const before=yield* rpc('tools/list');
 const search=yield* rpc('tools/call',{name:'tool_search',arguments:{query:'schema_probe'}});
 const after=yield* rpc('tools/list');
 const control2=yield* rpc('tools/list',{},false);
 return {control1,discover,before,search,after,control2};
})).pipe(Effect.provide(NodeHttpServer.layerTest)));
const names=x=>x.tools.map(t=>t.name).sort();
console.log('discovery tools capability',JSON.stringify(results.discover.capabilities.tools));
for(const k of ['control1','before','after','control2']) console.log(k,JSON.stringify(names(results[k])));
console.log('search structuredContent',JSON.stringify(results.search.structuredContent));
const control=names(results.control1).includes('schema_probe')&&JSON.stringify(names(results.control1))===JSON.stringify(names(results.control2))&&results.search.structuredContent?.tools.some(t=>t.name==='schema_probe');
status=!control?2:JSON.stringify(names(results.before))===JSON.stringify(names(results.after))?0:1;
} catch(e){console.log('setup error:',e.message);} finally{rmSync(scratch,{recursive:true,force:true});}
console.log(status===0?'RESULT: expected behavior':status===1?'RESULT: defect reproduced':'RESULT: inconclusive');process.exitCode=status;

Expected behavior

For core revision 2026-07-28, the Tools capabilities contract permits the available set to vary with the authorization on a request but forbids variation per connection or as a side effect of other requests on the connection. With the same credentials and list-request configuration, invoking tool search must not make the modern catalog depend on that prior call. This report concerns the modern revision; it does not claim that the legacy deferred-loading policy violates the legacy tools contract.

Actual behavior

With protocol version 2026-07-28 and t3-tool-exposure: deferred, a tools/list request initially returned only tool_search in the reduced fixture. Calling tools/call for tool_search with {"query":"schema_probe"} then made the next identical list request return both schema_probe and tool_search. Every request used the same synthetic provider credential, invocation scope, client metadata, and deferred header. The non-deferred control returned schema_probe before and after the search. Discovery advertised tools.listChanged: true.

Impact

Impact: P2 - A supported, opt-in modern MCP path exposes a request-history-dependent tool catalog contrary to the protocol contract. The observed scope is modern provider-session requests carrying the deferred-exposure header; unchanged full-list controls return a stable catalog.

A verified workaround is to omit t3-tool-exposure: deferred, which lists the available control tool on both requests. NOT_ENOUGH_INFO: no real provider client cache failure was exercised; its actual downstream effect would need a client integration run. No data loss, authorization bypass, or failure of non-deferred clients was observed.

Version or commit

T3 Code commit 59e64eef881632a23f89c4138bcf37f23d92bf93.

Environment

Node v26.12.1, Effect 4.1.3, macOS arm64. The reproduction uses the repository-pinned Effect dependency without changing its version.

Evidence

Observed output from the complete valid run:

Node v26.12.1
Effect 4.1.3
discovery tools capability {"listChanged":true}
control1 ["schema_probe"]
before ["tool_search"]
after ["schema_probe","tool_search"]
control2 ["schema_probe"]
search structuredContent {"tools":[{"name":"schema_probe","description":"Synthetic control tool."}]}
RESULT: defect reproduced

T3 registers both protocol adapters at apps/server/src/mcp/McpHttpServer.ts#L1308-L1317. The global list-visibility middleware chooses the deferred catalog from provider-session state and the exposure header without a protocol-revision distinction at apps/server/src/mcp/McpHttpServer.ts#L1350-L1374. Search mutates that session's loaded set and announces a list change at apps/server/src/mcp/McpToolExposure.ts#L50-L92.

Analysis

Source: the deferred catalog belongs to T3's McpToolExposure service and visibility middleware. Inspection of the pinned Effect transport shows that it delegates visibility to registered middleware and supplies the list-change machinery; the catalog's request-history dependence is introduced by T3's provider-session loaded set, rather than Effect's serialization.

Restoration check

Run the same script against the repaired checkout. The full-catalog controls must still pass, and modern list requests with the same authorization and configuration must not differ because tool search ran between them. A successful script run exits 0 and prints RESULT: expected behavior.

References

• https://github.com/pingdotgg/t3code/pull/34245 — introduced session-scoped deferred loading for Copilot; this report concerns applying that behavior to the separately supported modern core revision.