feat(mcp): modern MCP (2026-07-28) servers beside MCPL, over stdio and Streamable HTTP

README.md

@@ -301,6 +301,72 @@ A pattern that matches no tool is reported once, as a console line and an
 A pattern that could name a server's tools is not judged until that server
 has listed them, so late connects and reconnects don't cause early reports.
 
+#### Modern MCP servers (2026-07-28)
+
+The same `mcplServers` list also takes servers that speak modern MCP
+(revision `2026-07-28`), reached through the official SDK client. The
+configuration chooses the family, and nothing is probed:
+
+| Configuration | Family | Transport |
+|---|---|---|
+| `url: 'ws://…'` / `'wss://…'` | MCPL (MCP `2024-11-05`) | WebSocket |
+| `url: 'http://…'` / `'https://…'` | modern MCP | Streamable HTTP (`token` / `accessProvider` as bearer) |
+| `command` | MCPL | stdio |
+| `command` + `protocol: 'modern'` | modern MCP | stdio |
+
+```typescript
+{
+  mcplServers: [
+    { id: 'docs', url: 'https://mcp.example.com/mcp', accessProvider: getToken },
+    { id: 'search', command: 'search-mcp', protocol: 'modern', reconnect: true },
+  ],
+}
+```
+
+A configuration with both `command` and `url` needs `transport` to say which
+one is used; without it, it is refused rather than silently ignoring one.
+
+A modern server's tools get the same prefix, `enabledTools`/`disabledTools`,
+class overrides and dispatch as an MCPL server's, and `listMcplServers()`
+shows its `family`, `protocolVersion` and `transport`. Its config differs in
+three ways:
+- It has no MCPL surface (grant, push, channels, inference requests, feature
+  sets). A setting that asks for that surface can't apply, so it is a
+  configuration error: `allowHostCommands: true`, an `enabledCapabilities`
+  pattern that matches a capability denied by default, `channelSubscription:
+  'auto'` or a non-empty list, a scope's non-empty `whitelist`, a
+  `toolLifecycle` `observe` or `inputs` block, and a
+  `toolLifecycle.maxInputBytes` or an `autofetch` bound above its default.
+  A setting
+  that only takes something away, or repeats a default, is already
+  satisfied, so it is accepted: `enabledFeatureSets` and the rest of
+  `enabledCapabilities`, which are allow-lists, `disabledFeatureSets`,
+  `disabledCapabilities`, a scope's `blacklist`, `channelSubscription:
+  'manual'`, a `toolLifecycle.maxInputBytes` or an `autofetch` bound at or
+  below its default, and `shouldTriggerInference`.
+  So a host that puts a deny-list on every server it deploys can deploy a
+  modern one.
+- `requestTimeoutMs` is one deadline per tool call and must be 1 to 2^31−1;
+  0 is refused, where MCPL reads it as no watchdog.
+- Over stdio it takes no credential: `token` or `accessProvider` on one is
+  refused.
+
+At the deadline, cancellation is requested for a leg still in flight;
+between the rounds of an `input_required` continuation nothing is in flight
+to cancel. Either way the outcome is reported as unknown (`no-response`),
+and the call is never retried. The protocol has no cancel for a paused call,
+so whatever the server holds for it, beyond the `requestState` it gave this
+client, stays until the server lets it go. A call that ends for any other
+reason after the server asked for another round, before its final answer, is
+reported the same way, since the server may already have acted. An MCPL
+server that refuses `2024-11-05` with `-32022` fails with
+`McplProtocolVersionError`, and is not retried. The error names the
+revisions the server says it supports ("none listed" for an empty list), or its error text when it sends no list,
+and when the list includes `2026-07-28` it says to configure the server with
+`protocol: 'modern'` (stdio) or reach it over http(s).
+
+Server and transport text the framework records has the server's configured credentials replaced, in both engines. That covers connection traces, console lines, stderr traces, ops alerts, and a tool call's failure as its caller, the model and the `tool:failed` trace get it. The credentials are those the configuration holds and those its dials sent: from the url as each dial sends it (a WebSocket dial sets the token in the query, which writes the whole query again, form-encoded, and an access provider's token can be in it), credential-like path segments and query names, credential-shaped or credential-named query values, and a WebSocket url's userinfo, in their encoded and decoded forms, replaced wherever they occur; every non-empty query parameter as its whole `name=value`, where no letter or digit adjoins it; the static `token`, and each token an access provider handed a dial, the newest sixteen, raw and url-encoded; and a stdio server's `env` values whose names have a part ending in a credential word, such as `GITHUB_TOKEN`, `PGPASSWORD` or `SESSION_COOKIE`, raw and url-encoded. A stdio server's command-line arguments aren't derived. Standalone strings shorter than eight characters stay unchanged because they may be ordinary words; short query values are still removed with their parameter names. Treat a submitted configuration as immutable while the server uses it: apply changes with `restartMcplServer(id, newConfig)`. Secrets neither the configuration holds nor a dial sent remain outside this filtering. JSON-RPC tool answers, and the error a host's own connect raises, pass through as sent.
+
 #### Feature sets
 
 `enabledFeatureSets` and `disabledFeatureSets` select which of a server's

changelog.d/cleartext-mcp-credential-warning.added.md

@@ -0,0 +1,16 @@
+- Connecting to an MCP server warns once when a credential would cross the
+  network unencrypted, to an `http://` or `ws://` url whose host isn't this
+  machine: its `token` or `accessProvider`, or a secret the url carries
+  itself (a `ws://` url's userinfo, a query parameter whose name says
+  credential: `token`, `key`, `secret`, `password`, `auth` or `signature`,
+  or whose value is shaped like one under a plain name, a query parameter
+  name that may itself be one, or a path segment that looks like one, as
+  the redacted url judges it). A name that may itself be
+  a credential is counted in the warning, never quoted. An `http(s)://` url
+  with userinfo is refused instead, since the HTTP client can't send it and
+  its error would quote it. Loopback hosts are
+  exempt, and so are the unspecified addresses `0.0.0.0` and `[::]`, which
+  reach this host too. It warns rather than refuses, since a private network
+  or a TLS-terminating proxy can make that deliberate.
+  `serverConfigWarnings` is exported beside `serverConfigProblems`, so a host
+  can apply the same check in its own configuration validation.

changelog.d/legacy-mcp-protocol-boundary.breaking.md

@@ -0,0 +1,37 @@
+- **MCPL/MCP server authors:** the legacy engine now enforces the revision it
+  speaks. `McplServerConnection` offers MCP `2024-11-05` and now also requires
+  it back: an `initialize` result with any other `protocolVersion`, or with
+  none, fails as `McplProtocolVersionError` (`kind: 'mismatch'`), stating what
+  each side said. Every server family probed answers `2024-11-05`, but a
+  hand-written server that omits the field must add it. An `initialize`
+  answered with JSON-RPC `-32022` fails as `McplProtocolVersionError`
+  (`kind: 'rejected'`), keeping the server's `supported` list, code and data.
+  When that list names modern MCP, the message says to configure the server
+  with `protocol: 'modern'`. A protocol-version verdict is never retried: no
+  reconnect stub, and a reconnecting connection stops its backoff loop
+  (`reconnect-failed` carries `permanent: true` and raises the ops alert at
+  once). At startup the verdict raises the same `mcpl-down` ops alert, so a
+  server refused for its revision doesn't drop out with only a log line. The
+  established revision is on `connection.protocolVersion`.
+- `tools/list` now follows `nextCursor` across pages, so a paginating server's
+  whole inventory reaches the agent; before, every page after the first was
+  silently dropped. A repeated cursor, or more than 100 pages, is an error
+  rather than a partial inventory.
+- **Hosts and operators:** a server configuration with both `command` and
+  `url` and no `transport` is now refused before anything is spawned or
+  dialed. Before, it was launched as stdio and the url was silently
+  ignored. Migration: drop the field you don't use, or set `transport` to
+  say which one is used. Unchanged: a configuration with only one of them,
+  or with both and a `transport`, resolves as before (a host can still
+  layer a url and `transport: 'websocket'` over a file's command). A legacy
+  `requestTimeoutMs` above 2^31−1 is refused too: Node ran it as a timer of
+  about 1 ms, so every request timed out at once. Every value that worked,
+  `0` included, passes.
+- **Hosts:** `stop()` now rejects, after its whole teardown, when an MCP
+  server's child couldn't be confirmed exited, naming each such child and
+  its server. Before, closing a stdio server returned as soon as a signal
+  was sent, so `stop()` never failed for this. Code that chains work on
+  `stop()`, such as exiting a TUI or switching sessions, should catch that
+  rejection: the framework is stopped either way. As with any failed
+  teardown, an owned store stays open, and a later `stop()` retries the
+  reap, completing once the child has exited.