mcpi work summary — PR #1783 (2026-09-13 → 2026-09-14)

Branch: v2/mcpi-client in /Users/bob/Documents/GitHub/inspector-trees/v2-mcpi-client
Repo: modelcontextprotocol/inspector
PR: #1783 — all pushed; CI (build, coverage) green as of 7fd4af59.

Organized by what actually changed functionally, not commit order.

1. Modern protocol-era support (era + skills primitives)

Gave mcpi first-class awareness of MCP's protocol eras (legacy vs. modern/
task-capable) and filled in missing skills primitives:

• --era override on connect (f2fc1a2c): force which protocol era an
  ad-hoc session negotiates as, instead of only auto-detecting.
• sessions/show replaces initialize (9550b32c): the session-info RPC
  now reports era details directly (protocol version, task support, etc.)
  instead of the old bare initialize response.
• protocolEra surfaced everywhere (380dd3e7): every session listing
  (sessions/list, not just sessions/show) now reports era at a glance.
• tasks/update (22d5c9f4): implemented to resume paused "modern"
  (task-capable) MCP tasks, with success/error-path tests.
• skills/list and skills/get (40b4f441): implemented the RPCs
  (previously stubbed/missing), supporting positional and --uri argument
  forms, plus a --verify flag on skills/list.
• Docs (2a61f427): documented --era, sessions/show, and
  tasks/update end-to-end.

2. Elicitation features (legacy URL-mode and modern/MRTR form-mode)

Built out MCP's elicitation flow, covering both eras' mechanisms:

• URL-mode (legacy elicitation) (ac7e4bf1): when a server elicits via a
  URL, mcpi prompts to confirm/open it and waits for completion.
• Form-mode (modern/MRTR structured elicitation) (258d789f): when a
  server elicits structured form data (JSON-schema-driven, per the newer
  request-response/MRTR-style pattern), mcpi walks the user through each
  field interactively with a review step before submitting.
• --elicit capability override (98a41510): lets a caller declare
  elicitation support explicitly, for ad-hoc/non-standard clients.

3. Making mcpi agent-friendly

Everything else — reframing and hardening mcpi so an AI agent driving it
non-interactively gets the same guarantees a human at a terminal gets:

• Packaging (29193232): bundled mcpi into the published
  @modelcontextprotocol/inspector npm package so it actually ships.
• mcpi agent-help + skills/mcpi/SKILL.md (9ecd2647): a discoverable,
  self-contained reference for agents on how to drive mcpi non-interactively.
• OAuth without a TTY (0096e2c7): OAuth's URL-prompt-and-wait flow no
  longer requires an interactive terminal; message reframed for an
  agent-attended flow ("The user needs to navigate to this link to
  authenticate: <url>"). Added clean SIGINT/SIGTERM cancellation so a user
  (or agent) can break out of the ~15-minute OAuth wait if they decide not to
  auth or auth fails, instead of it being a hard, uninterruptible block. Also
  addressed the daemon idle-timeout interacting with long OAuth waits.
  Live-tested with a real, non-TTY OAuth flow.
• Non-TTY elicitation (7cf45384): removed the TTY gate on elicitation
  entirely — both URL-mode and form-mode now work non-interactively, since
  the underlying readline-based prompting was never actually TTY-dependent,
  just gated by policy. Closed the one real risk this exposed (stdin EOF/close
  could hang readline.question() forever) by racing every prompt against a
  "stdin closed" signal. Live end-to-end tested against a real MCP test
  server, including a piped-EOF instant-decline case and a live-FIFO
  simulated-agent-relayed-answer case.
• Final non-TTY audit + SIGINT cleanup (7fd4af59): audited all
  remaining isTTY gates; confirmed auth/clear --all and
  requireExplicitSession()'s explicit-session requirement are intentional
  (see MRU note below), fixed a stale doc comment, and extended clean
  SIGINT/SIGTERM cancellation from the two streaming RPCs to the general
  rpc path so Ctrl-C during any blocking call (e.g. tools/call, an
  elicitation wait) cancels cleanly instead of killing the process.

Key design note (MRU): the daemon is a single shared process, so MRU
("most recently used" session) state is global, not per-terminal.
requireExplicitSession() gates on stdin, not stdout, so a human piping
output (mcpi tools/list | jq) still gets MRU convenience; a truly
non-interactive caller (agent/script/CI) must pass --session/@name
explicitly, since there's no live human to catch a wrong guess.
MCP_ALLOW_DEFAULT_SESSION=1 opts back into MRU for scripts that want it.

Non-functional maintenance (excluded from the above as "not changes")

These kept the branch buildable/green but didn't change behavior:

• e79dea7f, fd64afff — restored build:dev tooling/build config after a
  v2/main merge broke it.
• 54d00b91 — brought mcpi's validate scripts into parity with the rest of
  the repo's guards.
• aabc19fa, 12353bea — closed CI coverage/build gaps (including one
  caused by the agent-help commit itself shipping without tests) — pure
  test-coverage backfill, no functional change.

Thanks for the thorough review — reproducing 1a–1c made these easy to fix with confidence. Everything below is on the branch; local:gate is green on macOS (the §2c failure is gone). Two headline changes since your review, both maintainer-approved: the client is renamed (mcpi → mcpdo, clients/mcpi → clients/daemon-cli, "session" → "connection" vocabulary), and packaging is folded back into this PR (details under §3).

§1 Security

• 1a — fixed. ensureDaemon now fails loudly on any structured error reply (including daemon_auth_failed) and never unlinks the socket; only ECONNREFUSED/ENOENT is treated as stale. daemon.lock is a real O_EXCL pid+starttime lock with a kill(pid, 0) liveness check before any reclaim. Your repro sequence now errors instead of replacing the daemon.
• 1b — fixed. All server-derived terminal-bound text goes through a sanitizer (C0/C1 + DEL → visible escapes, \n/\t preserved); OSC 8 URIs are validated before wrapping. Covered by tests including your OSC 52/OSC 0 payloads. --format json unchanged.
• 1c — fixed. connect always sends an absolute cwd, defaulting to the caller's process.cwd(); the daemon chdirs to its own directory at startup. For PATH we went a step further than forwarding: bare command names are resolved client-side against the caller's PATH (which-style) and sent absolute, so no environment crosses the socket at all.
• 1d — fixed. Socket path length is validated up front against the platform sun_path limit with a clear error; the layout is shortened to $TMPDIR/mcp-conn-<uid>/<id>/ (0700); daemon stderr goes to a 0600 daemon.log and start-timeout errors include its tail.
• 1e — all taken. Daemon dir created 0700 before bind; token always required in every mode (0600 daemon.token in the 0700 dir — adopted your reasoning: it gives sandbox policies a file-read denial to enforce and retires the tokenless path from 1a); 1 MiB NDJSON request-line cap; SKILL.md elicitation wording corrected and the non-TTY-agent-may-answer decision is recorded in specification/v2_cli_v2.md (URL mode still requires an explicit answer); the OAuth SIGINT/SIGTERM handlers were a regression introduced by this PR's own first commit — they're now opt-in (handleSignals), so TUI Ctrl-C behavior is unchanged.

§2 Repo rules

• 2a — fixed. Client runtime deps removed; every root runtime dependency core/ reaches is named in clients/daemon-cli/tsup.config.ts external, mirroring clients/cli; AGENTS.md's "three lists" rule updated to four.
• 2b — fixed. ipc-glue.ts and stream-client.ts are in the ≥90 per-file gate; the accept/stream races were fixed with awaited conditions, and only genuinely-unreachable lines carry annotated v8 ignore. Only the two true bootstraps remain excluded. The AGENTS.md exclusion note is gone.
• 2c — fixed (fell out of 1d). local:gate green on stock macOS.
• 2d — fixed. Rebased; every commit carries Signed-off-by.
• 2e — done. PR description rewritten to match the code (including packaging); skills/ documented in the AGENTS.md and README structure trees with the .claude/skills/ distinction. Agreed on leaving the branch name.
• 2f — done, with one deviation. Rebased onto current v2/main and re-ran local:gate. Packaging was initially split to a separate branch as you suggested, then folded back after an explicit maintainer decision to ship it in this PR — see §3.
• 2g — done. Tracking issue chore(mcpi): replace the temporary @inspector/cli source alias with a real shared surface #2461 filed for promoting the @inspector/cli reach-in surface to a shared area; linked from the tsup comment.

§3 Decisions

• Shipping: maintainer-approved to bundle in this PR, under the new conflict-free bin name mcpdo (your mcpi-collision point drove the rename). Data point: the addition is ~199 KB compressed / ~770 KB unpacked (~16% of the tarball), and the daemon is inert unless the bin is invoked. Without bundling there was no reasonable install story for the experimental client (build-from-source + npm link).
• Containerizing: agree — no. Your opt-in per-connection isolation recipe (docker run -i --rm --network none …) is now documented in clients/daemon-cli/README.md; a first-class --sandbox flag is deferred as a possible follow-up.

Ready for re-review whenever you are.

Review round 18 — all 3 items fixed in 4c1c96d (no inline threads):

• cli: tasks/update could silently change overflowing numbers to null — --input-responses '{"a":1e999}' parsed to Infinity, which IPC/MCP serialization would send as null. Parsed input responses are now validated recursively as JSON-round-trippable (mirroring the daemon-cli tool-argument parser from round 17) and rejected with a clear error. Regression test covers a nested non-finite value.
• spec: IPC op list omitted connections/show — added; the list now matches DaemonOp and the command surface.
• spec: stale "Windows daemon transport" to-do — removed; named-pipe transport shipped in round 15 (src/daemon/paths.ts + tests).

Full validate, per-file coverage thresholds, and the repo gate are green.

Round 20 "previously missed" items are addressed in 87945d7:

• --ema on ad-hoc targets (clients/daemon-cli/src/connection/mcp.ts): connect now rejects --ema for ad-hoc targets up front with actionable guidance ("add the server to a catalog with oauth.clientId and oauth.clientSecret, then connect by entry name"), rather than failing deep in emaFlow with an opaque error. We deliberately did not add client-id/secret CLI flags — secrets on the command line leak via shell history and process listings, and the catalog entry is the supported secure path. The --ema help text no longer advertises ad-hoc use.
• resources/subscribe cross-talk (clients/cli/src/handlers/run-method.ts): the stream's resourceUpdated listener now filters events by the subscribed URI, so multiple subscribe streams on one named connection no longer receive each other's updates. Update events carrying no uri (spec-noncompliant server) still pass through, preserving the previous fallback.

Also fixed while gating: the verify:format-coverage guard flagged round 19's clients/daemon-cli/scripts/stop-dev-daemon.mjs as outside the prettier globs; scripts is now included in daemon-cli's format/format:check.

Regression tests added for both findings; full local gate green.

Round 21 "previously missed" items are addressed in f87360f:

• __proto__ schema property dropped (clients/daemon-cli/src/connection/form-prompt.ts): the accepted payload is now built with a null-prototype object (mirroring sanitizeDeep), so a valid schema property named __proto__ becomes an own property instead of invoking the prototype setter. Test: a required __proto__ string field survives into the accepted content.
• Subscriptions leak when the caller disconnects mid-handle (clients/daemon-cli/src/daemon/ipc-glue.ts): when the socket is already destroyed after handle() returns, a stream outcome is now started inert and stopped immediately, so resources/subscribe's producer-side subscription is disposed rather than becoming a hidden consumer-less subscription.
• Async stream-cleanup rejections unhandled (ipc-glue.ts / clients/cli/src/handlers/run-method.ts): the resource stream's stop now catches the unsubscribeFromResource() promise at the source, so a post-disconnectAll rejection during daemon shutdown can no longer surface as an unhandled rejection.
• Streams outlive their named connection (clients/daemon-cli/src/daemon/server.ts): the stream contract gained a producer-side endStream channel (end frame + socket end), and openStream now wires a statusChange listener that ends the stream when its connection reaches a terminal state — so mcpdo disconnect <name> (or a transport failure) terminates attached logging/tail/subscribe streams instead of leaving them hanging until Ctrl-C or daemon idle shutdown. Test: an open stream ends when its connection is disconnected.

Regression tests added for all items; full local gate green.

Addressed the round-22 "previously missed" item in b7a675b:

Avoid hidden app info RPCs for JSON tool calls (dispatch.ts:41) — format is now a frontend-only concern: dispatchConnectionRpc no longer includes it in the daemon rpc params, and the daemon's stripConnectionFields drops it defensively for any older caller. JSON tool calls therefore no longer trip runMethod's format === "json" app-info branch (the hidden extra resources/read + timeout wait whose result mcpdo discarded). Explicit --app-info still probes via the separate appInfo flag. Tests assert the rpc params omit format (dispatch) and that a daemon tools/call with format: "json" returns no appInfo while appInfo: true still does (end-to-end DaemonServer test).

Addressed the round-23 "previously missed" item in 4012412:

Correct misleading comment about authentication (daemon/auth.ts:28) — the getDaemonTokenFromEnv doc no longer describes shared mode as "unauthenticated". It now states the actual model: an unset environment variable selects shared mode, where the daemon generates its own required token (daemon/run.ts) and publishes it to daemon.token for same-user clients; every daemon requires a token, and the env var only selects who supplies it. Doc-only change, no behavior difference.

Addressed the round-24 "previously missed" item in be7d78e:

Handle already-aborted signal before installing abort listener (connections.ts:312) — fixed as a class rather than a spot check: a new withAbort(start, signal, makeError) helper checks signal.aborted synchronously and installs the abort listener before invoking the thunk, so no abort can interleave between check and listen (AbortSignal does not replay). connectLocked uses it for the dial; a pre-aborted signal now means the connect is never even started. The same class of bug existed client-side in callDaemon/streamDaemon (a SIGINT during ensureDaemon pre-aborted their signals before listener install; with timeoutMs: 0 the request hung forever) — both now check first. Tests: abort landing in the reconnect-teardown window (dial never starts), pre-aborted callDaemon rejects immediately, pre-aborted streamDaemon finishes immediately.

Round 25 fixes (commit a88e4bd) — both "previously missed" items from review 5324826242:

1. Stream setup ignored configured timeouts (dispatch.ts / stream-client.ts): the stream path now passes timeoutMs: 0 to streamDaemon, matching the rpc path — core enforces the configured MCP request timeout daemon-side, so the fixed local 60s deadline could falsely fail valid long-running stream setups. Also fixed the underlying class issue: streamDaemon's open-deadline timer was an unconditional setTimeout, so timeoutMs: 0 (documented as "no deadline") would have fired immediately; it now mirrors callDaemon and skips the timer when timeoutMs <= 0. (The subscription-leak half is already covered by the earlier mid-handle stream disposal, which unsubscribes when the socket dies before the outcome.) Regression tests: timeoutMs-0 disables the deadline against a slow-responding socket; dispatch asserts timeoutMs: 0 reaches streamDaemon.

2. Required multiselect infinite loop on blank input (form-prompt.ts): JSON Schema required only demands the key be present — [] is a valid value unless minItems forbids it. Blank input on a required multiselect now submits [] when (minItems ?? 0) === 0; when minItems >= 1 it re-prompts with "Select at least N" instead of the misleading "This field is required". Optional fields still omit the key. Regression tests cover both branches.

Full gate green (daemon-cli 322 tests, coverage clean).

Note on the round-27 review headline (review 5324968883, commit 10db834 — Findings: None):

The overview sentence — "Client disconnects do not cancel daemon-side RPC or stream setup, potentially leaving abandoned work blocking the connection" — had no finding filed with it. For the record, it describes a real but intentional, bounded design property rather than a defect:

• When a caller aborts (Ctrl-C closes the client socket), the per-socket AbortSignal (ipc-glue.ts) is forwarded into handle(), but only connect setup honors it (withAbort in connections.ts). A mid-flight rpc op (e.g. a slow tool call) runs to completion daemon-side.
• Because rpc ops are serialized per connection (rpcQueues, required for exact elicitation routing), a subsequent command on that connection can briefly queue behind the abandoned op. This is bounded by the daemon-side MCP request timeout; nothing leaks or hangs indefinitely — streams are torn down on socket close, and terminal connection status ends them (see 10db834).
• Honoring the signal mid-rpc would require threading cancellation through runMethod into core's InspectorClient request path (issuing MCP cancelled notifications) — a core-level change out of scope for this PR. Left as a possible follow-up if head-of-line blocking after abandoned long ops proves to matter in practice.