fix(mcp): accept case-variant SSE media types

[cjagwani]

Summary

Fix managed MCP tool discovery when a compliant Streamable HTTP server returns an SSE response media type with case variation or parameters. Upgrade the official MCP SDK to its parsed media-type implementation and make the regression session part of every reviewed runtime image build.

Related Issue

Fixes #7726

Changes

• Pin @modelcontextprotocol/sdk to 1.30.0, refresh the exact lock, and record the adjacent-release, provenance, vulnerability, bundle, and license review.
• Add a real initialize → notifications/initialized → tools/list → session cleanup fixture using Text/Event-Stream; Charset=UTF-8.
• Stage and run that fixture in the shared reviewed runtime installer used by all agent image builds.

This restores the generic Streamable HTTP/SSE contract accepted in #6901 and implemented in #7591. It does not add a provider-specific integration or compatibility layer.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: this restores the existing documented Streamable HTTP discovery lifecycle without changing commands, flags, configuration, schemas, or supported integrations.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex security review passed all nine repository categories; the credential placeholder, authorization, SSRF, policy, and final-image boundaries are unchanged, and the exact dependency pin is signature-, attestation-, license-, and audit-verified.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Existing docs already specify the standard Streamable HTTP discovery lifecycle. The fix restores that contract for a valid response media-type form and adds no user-facing surface. No docs/ or fern/ files changed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npm --prefix tools/mcp-tool-discovery-runtime test; runtime typecheck/bundle/audit; 12 CLI runtime unit tests; 15 build-context and image-contract integration tests.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Charan Jagwani cjagwani@nvidia.com

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit f41ab0d in the codex/fix-mcp-sse-to... branch remains at 96%, unchanged from commit 7f4b490 in the main branch.

---

_{Updated July 28, 2026 18:45 UTC}

[coderabbitai]

📝 Walkthrough

Walkthrough

Updates the MCP SDK, adds case-variant SSE discovery coverage, refreshes runtime bundle verification, and stages the new test file in the sandbox build context with matching fixture expectations.

Changes

MCP SDK update and validation

Layer / File(s)	Summary
SDK upgrade and SSE client coverage tools/mcp-tool-discovery-runtime/package.json, tools/mcp-tool-discovery-runtime/streamable-http-client.test.ts	Pins SDK 1.30.0 and tests MCP discovery over Streamable HTTP, including SSE responses, headers, sessions, and protocol values.
Bundle and regeneration verification tools/mcp-tool-discovery-runtime/build-runtime.ts, tools/mcp-tool-discovery-runtime/install-reviewed-runtime.sh, tools/mcp-tool-discovery-runtime/dependency-review.md	Adds content-type to the reviewed bundle, runs the new test during installation, and records updated SDK migration and verification details.
Sandbox staging integration src/lib/sandbox/build-context.ts, test/sandbox-build-context.test.ts, tsconfig.cli.json	Stages streamable-http-client.test.ts, excludes it from the CLI TypeScript project, and verifies its presence in the build-context fixture.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: cv

Sequence Diagram(s)

sequenceDiagram
  participant Test as streamable-http-client.test.ts
  participant Discovery as runMcpToolDiscoverySession
  participant Transport as StreamableHTTPClientTransport
  participant Server as MCP HTTP server
  Test->>Discovery: Start discovery session
  Discovery->>Transport: Send MCP requests
  Transport->>Server: initialize, tools/list, notification, DELETE
  Server-->>Transport: Return SSE-formatted responses
  Transport-->>Discovery: Provide parsed discovery result
  Discovery-->>Test: Publish discovered tool

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR upgrades the MCP SDK and adds coverage for SSE media-type variants, matching the tool-discovery failure described in #7726.
Out of Scope Changes check	✅ Passed	The added script, fixture staging, and dependency-review updates all support the MCP discovery fix and test flow.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: accepting case-variant SSE media types in MCP tool discovery.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-mcp-sse-tool-discovery

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 1 blocker · 0 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported 1 more blocker, the same number of warnings, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

• mcp-bridge

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cjagwani]

Superseded by #7760, which preserves this exact patch on current main with a fresh GitHub-verified branch because repository rules prohibit force-pushing this published branch.