fix(mcp): accept case-variant SSE media types

[cjagwani]

Summary

Fix managed MCP tool discovery when a compliant Streamable HTTP server returns an SSE response media type with case variation or parameters. Upgrade the official MCP SDK to its parsed media-type implementation and make the regression session part of every reviewed runtime image build.

This replaces #7748 with the same patch on current main; the published branch could not be rebased because repository rules forbid force-pushes.

Related Issue

Fixes #7726

Changes

• Pin @modelcontextprotocol/sdk to 1.30.0, refresh the exact lock, and record the adjacent-release, provenance, vulnerability, bundle, and license review.
• Add a real initialize → notifications/initialized → tools/list → session cleanup fixture using Text/Event-Stream; Charset=UTF-8.
• Stage and run that fixture in the shared reviewed runtime installer used by all agent image builds.

This restores the generic Streamable HTTP/SSE contract accepted in #6901 and implemented in #7591. It does not add a provider-specific integration or compatibility layer.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This restores the existing documented Streamable HTTP discovery lifecycle without changing commands, flags, configuration, schemas, or supported integrations.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex security review passed all nine repository categories; the credential placeholder, authorization, SSRF, policy, and final-image boundaries are unchanged, and the exact dependency pin is signature-, attestation-, license-, and audit-verified.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Existing docs already describe Streamable HTTP discovery generically. This restores standards-compliant handling of a valid response media type and changes no command, flag, configuration, workflow, supported protocol, or documented user contract. Changelog work remains part of separate pre-tag release preparation.
• Agent: Codex Desktop /root/replacement_docs_review

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — reviewed-runtime session test (1 passed), CLI runtime tests (12 passed), build-context/image-contract tests (15 passed), runtime and CLI typechecks, bundle allowlist/license generation, zero-vulnerability production audit, 98 verified registry signatures, and 11 verified attestations.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Charan Jagwani cjagwani@nvidia.com

Summary by CodeRabbit

• New Features

  • Improved MCP tool discovery compatibility with case-variant SSE response media types.
  • Preserved session and protocol headers during tool discovery requests.

• Bug Fixes

  • Updated the MCP runtime to ensure supported bundled content is included correctly.

• Tests

  • Added coverage for SSE discovery, authentication, session cleanup, and request headers.
  • Runtime installation now runs its test suite as part of verification.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 938d2c84-967c-46e9-b14a-6f303c018d53

📥 Commits

Reviewing files that changed from the base of the PR and between 71a7856 and 646d377.

⛔ Files ignored due to path filters (1)

• tools/mcp-tool-discovery-runtime/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (8)

• src/lib/sandbox/build-context.ts
• test/sandbox-build-context.test.ts
• tools/mcp-tool-discovery-runtime/build-runtime.ts
• tools/mcp-tool-discovery-runtime/dependency-review.md
• tools/mcp-tool-discovery-runtime/install-reviewed-runtime.sh
• tools/mcp-tool-discovery-runtime/package.json
• tools/mcp-tool-discovery-runtime/streamable-http-client.test.ts
• tsconfig.cli.json

---

📝 Walkthrough

Walkthrough

The MCP tool discovery runtime upgrades @modelcontextprotocol/sdk to 1.30.0, adds case-variant SSE integration coverage, updates bundle verification, runs tests during installation, and stages the new test file in sandbox build contexts.

Changes

MCP SSE runtime compatibility

Layer / File(s)	Summary
SDK update and SSE discovery validation tools/mcp-tool-discovery-runtime/package.json, tools/mcp-tool-discovery-runtime/streamable-http-client.test.ts, tsconfig.cli.json	The SDK is upgraded, a Node test validates case-variant SSE discovery and request propagation, and the test is excluded from CLI typechecking.
Bundle allowlist and installation verification tools/mcp-tool-discovery-runtime/build-runtime.ts, tools/mcp-tool-discovery-runtime/dependency-review.md, tools/mcp-tool-discovery-runtime/install-reviewed-runtime.sh	Bundle review includes content-type, dependency evidence documents the SDK migration, and installation runs the runtime tests before typecheck and bundling.
Runtime staging coverage src/lib/sandbox/build-context.ts, test/sandbox-build-context.test.ts	The build context copies streamable-http-client.test.ts, with fixture and staged-output expectations updated accordingly.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant StreamableHTTPClientTransport
  participant HTTPTestServer
  participant runMcpToolDiscoverySession
  Client->>StreamableHTTPClientTransport: Create bounded transport
  runMcpToolDiscoverySession->>HTTPTestServer: Send initialize request
  HTTPTestServer-->>StreamableHTTPClientTransport: Return case-variant SSE response
  runMcpToolDiscoverySession->>HTTPTestServer: Send tools/list and DELETE requests
  HTTPTestServer-->>runMcpToolDiscoverySession: Return discovery and cleanup responses
  runMcpToolDiscoverySession-->>Client: Publish successful tool discovery

Loading

Possibly related PRs

• NVIDIA/NemoClaw#7748: Contains matching MCP runtime staging, SDK, dependency review, and bundle allowlist updates.

Suggested labels: area: packaging, area: ci

Suggested reviewers: cv, ericksoa, jacobtomlinson

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: accepting case-variant SSE media types for MCP discovery.
Linked Issues check	✅ Passed	The PR addresses issue #7726 by fixing MCP discovery for SSE responses and adding a regression test.
Out of Scope Changes check	✅ Passed	The additional dependency review, installer, and test-staging updates all support the same MCP SSE discovery fix.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-mcp-sse-tool-discovery-v2

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 646d377 in the codex/fix-mcp-sse-to... branch remains at 96%, unchanged from commit 71a7856 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 646d377 in the codex/fix-mcp-sse-to... branch remains at 81%, unchanged from commit c3ab052 in the main branch.

Show a code coverage summary of the most impacted files.

File	main c3ab052	codex/fix-mcp-sse-to... 646d377	+/-
src/lib/onboard...ndbox-create.ts	83%	33%	-50%
src/lib/onboard...-create-plan.ts	88%	75%	-13%
src/lib/onboard...asoning-mode.ts	100%	89%	-11%
src/lib/onboard...ndbox-create.ts	91%	83%	-8%
src/lib/actions...or-inference.ts	100%	95%	-5%
src/lib/policy/index.ts	61%	61%	0%
src/lib/sandbox/config.ts	72%	74%	+2%
src/lib/sandbox...uild-context.ts	39%	41%	+2%
src/lib/private-networks.ts	88%	93%	+5%
src/commands/sandbox/mcp.ts	0%	85%	+85%

---

_{Updated July 28, 2026 19:59 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 1 more warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

• mcp-bridge

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.