From b7a7032609ecc8f3c5cd306df99201fdb73759d9 Mon Sep 17 00:00:00 2001
From: signal-forge-lab <61216086+signal-forge-lab@users.noreply.github.com>
Date: Sat, 5 Sep 2026 02:53:49 +0900
Subject: [PATCH 1/8] feat(mcp): rebase 2026-07-28 support onto v1.0.8

---
 README.md                     |   2 +
 package.json                  |   2 +
 pnpm-lock.yaml                |  40 ++++++
 src/artifact-tools.ts         |   2 +-
 src/mcp-modern-server.test.ts | 252 ++++++++++++++++++++++++++++++++++
 src/mcp-modern-server.ts      | 115 ++++++++++++++++
 src/server.test.ts            | 220 ++++++++++++++++++++++++++++-
 src/server.ts                 |  92 +++++++++++--
 src/tool-surfaces/types.ts    |   2 +-
 9 files changed, 715 insertions(+), 12 deletions(-)
 create mode 100644 src/mcp-modern-server.test.ts
 create mode 100644 src/mcp-modern-server.ts

diff --git a/README.md b/README.md
index 381930db8..877ce2ad7 100644
--- a/README.md
+++ b/README.md
@@ -20,6 +20,8 @@
 
 DevSpace is a self-hosted MCP server that lets ChatGPT read, edit, search, and run code in your real local projects — your files, your tools, your terminal — without uploading anything to a third party. You run it on your machine, expose it through a tunnel you control, and approve the connection with a password only you have.
 
+The same `/mcp` endpoint supports existing sessionful MCP clients and the 2026-07-28 per-request protocol.
+
 ## Sponsors and Special Thanks
 <!-- 
 
diff --git a/package.json b/package.json
index 9a4c2a83a..82bfc4142 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,9 @@
     "@clack/prompts": "^1.5.1",
     "@earendil-works/pi-coding-agent": "^0.80.3",
     "@modelcontextprotocol/ext-apps": "^1.7.2",
+    "@modelcontextprotocol/node": "^2.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/server": "^2.0.0",
     "@opencode-ai/sdk": "^1.17.13",
     "@pierre/diffs": "^1.3.6",
     "better-result": "^2.10.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ff4ab0a76..7045eecd2 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -26,9 +26,15 @@ importers:
       '@modelcontextprotocol/ext-apps':
         specifier: ^1.7.2
         version: 1.7.2(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3)
+      '@modelcontextprotocol/node':
+        specifier: ^2.0.0
+        version: 2.0.0(@modelcontextprotocol/server@2.0.0)(hono@4.12.25)
       '@modelcontextprotocol/sdk':
         specifier: ^1.29.0
         version: 1.29.0(zod@4.4.3)
+      '@modelcontextprotocol/server':
+        specifier: ^2.0.0
+        version: 2.0.0
       '@opencode-ai/sdk':
         specifier: ^1.17.13
         version: 1.17.13
@@ -576,6 +582,10 @@ packages:
       '@opentelemetry/api':
         optional: true
 
+  '@modelcontextprotocol/core@2.0.0':
+    resolution: {integrity: sha512-pJCEwGG7Lfr/+PQp9ZTwKXNeO5wzbfKL7H3MYpCorM4oFBoQrdjnBgEoqG+RjhsvS1FKrDbKux+M1HhlnGWqcA==}
+    engines: {node: '>=20'}
+
   '@modelcontextprotocol/ext-apps@1.7.2':
     resolution: {integrity: sha512-OOWKDxdAjYDcgHkmzVzccyyag3FK+jBWPaWu4WvTxFsU4R/cgOX4eep66zPRA5n4v6WfxUNibPyvX4iJ7egYTg==}
     engines: {node: '>=20'}
@@ -590,6 +600,16 @@ packages:
       react-dom:
         optional: true
 
+  '@modelcontextprotocol/node@2.0.0':
+    resolution: {integrity: sha512-Y4hAC2XdGDUdDOCbLDOCA4+aL3NUldjsOWlDL/YwpAxrPhRm1xHd7lZ+mLacvZ9t3PaH28wgNoaLQGrIk1P2pg==}
+    engines: {node: '>=20'}
+    peerDependencies:
+      '@modelcontextprotocol/server': ^2.0.0
+      hono: ^4.11.4
+    peerDependenciesMeta:
+      hono:
+        optional: true
+
   '@modelcontextprotocol/sdk@1.29.0':
     resolution: {integrity: sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==}
     engines: {node: '>=18'}
@@ -600,6 +620,10 @@ packages:
       '@cfworker/json-schema':
         optional: true
 
+  '@modelcontextprotocol/server@2.0.0':
+    resolution: {integrity: sha512-YhHWdHfpFMQfd0prsEnxKeS3Qz3ytIGmsS0sth4KDjnacIT7hxk6hXHkJ9KysxlkvTM+WZAtQbbcUhdoP4Hvtw==}
+    engines: {node: '>=20'}
+
   '@napi-rs/wasm-runtime@1.1.5':
     resolution: {integrity: sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q==}
     peerDependencies:
@@ -2609,6 +2633,10 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
+  '@modelcontextprotocol/core@2.0.0':
+    dependencies:
+      zod: 4.4.3
+
   '@modelcontextprotocol/ext-apps@1.7.2(@modelcontextprotocol/sdk@1.29.0(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(zod@4.4.3)':
     dependencies:
       '@modelcontextprotocol/sdk': 1.29.0(zod@4.4.3)
@@ -2618,6 +2646,13 @@ snapshots:
       react: 19.2.6
       react-dom: 19.2.6(react@19.2.6)
 
+  '@modelcontextprotocol/node@2.0.0(@modelcontextprotocol/server@2.0.0)(hono@4.12.25)':
+    dependencies:
+      '@hono/node-server': 1.19.14(hono@4.12.25)
+      '@modelcontextprotocol/server': 2.0.0
+    optionalDependencies:
+      hono: 4.12.25
+
   '@modelcontextprotocol/sdk@1.29.0(zod@4.4.3)':
     dependencies:
       '@hono/node-server': 1.19.14(hono@4.12.25)
@@ -2640,6 +2675,11 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@modelcontextprotocol/server@2.0.0':
+    dependencies:
+      '@modelcontextprotocol/core': 2.0.0
+      zod: 4.4.3
+
   '@napi-rs/wasm-runtime@1.1.5(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
     dependencies:
       '@emnapi/core': 1.10.0
diff --git a/src/artifact-tools.ts b/src/artifact-tools.ts
index fe9a195af..e7fc35dfa 100644
--- a/src/artifact-tools.ts
+++ b/src/artifact-tools.ts
@@ -83,7 +83,7 @@ interface ArtifactDestination {
 }
 
 export function registerArtifactTools(
-  server: McpServer,
+  server: Pick<McpServer, "registerTool">,
   {
     config,
     workspaces,
diff --git a/src/mcp-modern-server.test.ts b/src/mcp-modern-server.test.ts
new file mode 100644
index 000000000..621615bac
--- /dev/null
+++ b/src/mcp-modern-server.test.ts
@@ -0,0 +1,252 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { registerAppResource, registerAppTool } from "@modelcontextprotocol/ext-apps/server";
+import { createMcpHandler, McpServer } from "@modelcontextprotocol/server";
+import * as z from "zod/v4";
+import {
+  compileMcpRegistrationSurface,
+  createModernMcpServerAdapter,
+  modernMcpAdapterErrorLogFields,
+} from "./mcp-modern-server.js";
+
+test("strict modern handler answers the 2026-07-28 discovery probe", async (t) => {
+  const handler = createMcpHandler(() => new McpServer(
+    { name: "devspace-modern-test", version: "1.0.0" },
+    { capabilities: { tools: {} } },
+  ), { legacy: "reject" });
+  t.after(async () => handler.close());
+
+  const response = await handler.fetch(modernRequest("server/discover", {}));
+
+  assert.equal(response.status, 200);
+  const body = await response.json() as {
+    result?: { supportedVersions?: string[] };
+  };
+  assert.ok(body.result?.supportedVersions?.includes("2026-07-28"));
+});
+
+test("modern registration adapter preserves tools and request metadata", async (t) => {
+  const handler = createMcpHandler(() => {
+    const adapter = createModernMcpServerAdapter({
+      name: "devspace-modern-test",
+      version: "1.0.0",
+    });
+    registerAppTool(
+      adapter.registrationTarget,
+      "echo_scope",
+      {
+        description: "Echo the modern request scope.",
+        inputSchema: { value: z.string() },
+        _meta: {},
+      },
+      async ({ value }, { _meta }) => ({
+        content: [{
+          type: "text",
+          text: `${value}:${String(_meta?.["openai/session"] ?? "missing")}`,
+        }],
+      }),
+    );
+    return adapter.server;
+  }, { legacy: "reject" });
+  t.after(async () => handler.close());
+
+  const listed = await handler.fetch(modernRequest("tools/list", {}));
+  assert.equal(listed.status, 200);
+  const listBody = await listed.json() as {
+    result?: { tools?: Array<{ name?: string }> };
+  };
+  assert.ok(listBody.result?.tools?.some((tool) => tool.name === "echo_scope"));
+
+  const called = await handler.fetch(modernRequest("tools/call", {
+    name: "echo_scope",
+    arguments: { value: "ok" },
+    _meta: { "openai/session": "modern-chat" },
+  }));
+  assert.equal(called.status, 200, await called.clone().text());
+  const callBody = await called.json() as {
+    result?: { content?: Array<{ text?: string }> };
+  };
+  assert.equal(callBody.result?.content?.[0]?.text, "ok:modern-chat");
+});
+
+test("modern registration adapter preserves progress notifications", async (t) => {
+  const handler = createMcpHandler(() => {
+    const adapter = createModernMcpServerAdapter({
+      name: "devspace-modern-test",
+      version: "1.0.0",
+    });
+    registerAppTool(
+      adapter.registrationTarget,
+      "progress_echo",
+      {
+        inputSchema: {},
+        _meta: {},
+      },
+      async (_input, { sendNotification }) => {
+        await sendNotification({
+          method: "notifications/progress",
+          params: {
+            progressToken: "modern-progress",
+            progress: 1,
+            total: 1,
+          },
+        });
+        return { content: [{ type: "text", text: "done" }] };
+      },
+    );
+    return adapter.server;
+  }, { legacy: "reject" });
+  t.after(async () => handler.close());
+
+  const response = await handler.fetch(modernRequest("tools/call", {
+    name: "progress_echo",
+    arguments: {},
+    _meta: { progressToken: "modern-progress" },
+  }));
+
+  assert.equal(response.status, 200, await response.clone().text());
+  assert.match(response.headers.get("content-type") ?? "", /text\/event-stream/);
+  const messages = (await response.text())
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith("data: "))
+    .map((line) => JSON.parse(line.slice(6)) as Record<string, unknown>);
+  assert.ok(messages.some((message) => message.method === "notifications/progress"));
+  assert.match(JSON.stringify(messages.at(-1)), /done/);
+});
+
+test("modern registration adapter preserves resources", async (t) => {
+  const handler = createMcpHandler(() => {
+    const adapter = createModernMcpServerAdapter({
+      name: "devspace-modern-test",
+      version: "1.0.0",
+    });
+    registerAppResource(
+      adapter.registrationTarget,
+      "Test resource",
+      "ui://devspace/test.html",
+      {},
+      async (_uri, { _meta }) => ({
+        contents: [{
+          uri: "ui://devspace/test.html",
+          mimeType: "text/html",
+          text: `resource-ok:${String(_meta?.["openai/session"] ?? "missing")}`,
+        }],
+      }),
+    );
+    return adapter.server;
+  }, { legacy: "reject" });
+  t.after(async () => handler.close());
+
+  const response = await handler.fetch(modernRequest("resources/read", {
+    uri: "ui://devspace/test.html",
+    _meta: { "openai/session": "resource-chat" },
+  }));
+
+  assert.equal(response.status, 200, await response.clone().text());
+  assert.match(await response.text(), /resource-ok:resource-chat/);
+});
+
+test("compiled registration surface reuses static tool and resource definitions", async (t) => {
+  let registrationBuilds = 0;
+  const bindRegistrationSurface = compileMcpRegistrationSurface((target) => {
+    registrationBuilds += 1;
+    registerAppTool(
+      target,
+      "cached_echo",
+      {
+        inputSchema: { value: z.string() },
+        _meta: {},
+      },
+      async ({ value }) => ({
+        content: [{ type: "text", text: value }],
+      }),
+    );
+    registerAppResource(
+      target,
+      "Cached resource",
+      "ui://devspace/cached.html",
+      {},
+      async () => ({
+        contents: [{
+          uri: "ui://devspace/cached.html",
+          mimeType: "text/html",
+          text: "cached-resource",
+        }],
+      }),
+    );
+  });
+  assert.equal(registrationBuilds, 1);
+
+  const handler = createMcpHandler(() => {
+    const adapter = createModernMcpServerAdapter({
+      name: "devspace-modern-test",
+      version: "1.0.0",
+    });
+    bindRegistrationSurface(adapter.registrationTarget);
+    return adapter.server;
+  }, { legacy: "reject" });
+  t.after(async () => handler.close());
+
+  const firstList = await handler.fetch(modernRequest("tools/list", {}));
+  const secondList = await handler.fetch(modernRequest("tools/list", {}));
+  assert.equal(firstList.status, 200, await firstList.clone().text());
+  assert.equal(secondList.status, 200, await secondList.clone().text());
+  assert.equal(registrationBuilds, 1);
+
+  const resource = await handler.fetch(modernRequest("resources/read", {
+    uri: "ui://devspace/cached.html",
+  }));
+  assert.equal(resource.status, 200, await resource.clone().text());
+  assert.match(await resource.text(), /cached-resource/);
+  assert.equal(registrationBuilds, 1);
+});
+
+test("modern adapter error logging preserves error and cause identity", () => {
+  const fields = modernMcpAdapterErrorLogFields(
+    new Error("outer failure", { cause: new TypeError("inner failure") }),
+  );
+  assert.deepEqual(fields, {
+    error: "outer failure",
+    errorName: "Error",
+    cause: {
+      name: "TypeError",
+      message: "inner failure",
+    },
+  });
+});
+
+function modernRequest(method: string, params: Record<string, unknown>): Request {
+  const mcpName = typeof params.name === "string"
+    ? params.name
+    : typeof params.uri === "string"
+      ? params.uri
+      : undefined;
+  return new Request("https://example.test/mcp", {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "mcp-method": method,
+      "mcp-protocol-version": "2026-07-28",
+      ...(mcpName ? { "mcp-name": mcpName } : {}),
+    },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: `modern-${method}`,
+      method,
+      params: {
+        ...params,
+        _meta: {
+          ...objectValue(params._meta),
+          "io.modelcontextprotocol/protocolVersion": "2026-07-28",
+          "io.modelcontextprotocol/clientCapabilities": {},
+        },
+      },
+    }),
+  });
+}
+
+function objectValue(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : {};
+}
diff --git a/src/mcp-modern-server.ts b/src/mcp-modern-server.ts
new file mode 100644
index 000000000..9b5cabeb1
--- /dev/null
+++ b/src/mcp-modern-server.ts
@@ -0,0 +1,115 @@
+import {
+  McpServer,
+  type ServerContext,
+  type ServerOptions,
+} from "@modelcontextprotocol/server";
+import type { McpServer as LegacyMcpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { Implementation as LegacyImplementation } from "@modelcontextprotocol/sdk/types.js";
+
+export type McpRegistrationTarget = Pick<
+  LegacyMcpServer,
+  "registerTool" | "registerResource"
+>;
+
+export interface ModernMcpServerAdapter {
+  server: McpServer;
+  registrationTarget: McpRegistrationTarget;
+}
+
+type RegistrationReplay = (target: McpRegistrationTarget) => void;
+
+type ModernRegisterTool = (
+  name: string,
+  definition: Record<string, unknown>,
+  handler: (input: unknown, context: ServerContext) => unknown,
+) => unknown;
+
+type ModernRegisterResource = (...args: unknown[]) => unknown;
+
+export function createModernMcpServerAdapter(
+  serverInfo: LegacyImplementation,
+  options?: ServerOptions,
+): ModernMcpServerAdapter {
+  const server = new McpServer(serverInfo, options);
+  const registerModernTool = server.registerTool.bind(server) as unknown as ModernRegisterTool;
+  const registerModernResource = server.registerResource.bind(server) as unknown as ModernRegisterResource;
+  const registrationTarget: McpRegistrationTarget = {
+    registerTool: ((
+      name: string,
+      definition: Record<string, unknown>,
+      handler: (input: unknown, extra: Record<string, unknown>) => unknown,
+    ) => registerModernTool(
+      name,
+      definition,
+      async (input, context) => handler(input, legacyToolHandlerExtra(context)),
+    )) as LegacyMcpServer["registerTool"],
+    registerResource: ((...args: unknown[]) => {
+      const callback = args.at(-1) as (...callbackArgs: unknown[]) => unknown;
+      return registerModernResource(
+        ...args.slice(0, -1),
+        (...callbackArgs: unknown[]) => {
+          const context = callbackArgs.at(-1) as ServerContext;
+          return callback(
+            ...callbackArgs.slice(0, -1),
+            legacyToolHandlerExtra(context),
+          );
+        },
+      );
+    }) as unknown as LegacyMcpServer["registerResource"],
+  };
+
+  return {
+    server,
+    registrationTarget,
+  };
+}
+
+export function compileMcpRegistrationSurface(
+  registerSurface: (target: McpRegistrationTarget) => void,
+): (target: McpRegistrationTarget) => void {
+  const registrations: RegistrationReplay[] = [];
+  const recordingTarget: McpRegistrationTarget = {
+    registerTool: ((...args: unknown[]) => {
+      registrations.push((target) => {
+        (target.registerTool as (...callArgs: unknown[]) => unknown)(...args);
+      });
+    }) as unknown as McpRegistrationTarget["registerTool"],
+    registerResource: ((...args: unknown[]) => {
+      registrations.push((target) => {
+        (target.registerResource as (...callArgs: unknown[]) => unknown)(...args);
+      });
+    }) as unknown as McpRegistrationTarget["registerResource"],
+  };
+
+  registerSurface(recordingTarget);
+  const compiled = Object.freeze(registrations.slice());
+  return (target) => {
+    for (const replay of compiled) replay(target);
+  };
+}
+
+export function modernMcpAdapterErrorLogFields(error: Error): Record<string, unknown> {
+  const cause = error.cause;
+  return {
+    error: error.message,
+    errorName: error.name,
+    ...(cause === undefined ? {} : {
+      cause: cause instanceof Error
+        ? { name: cause.name, message: cause.message }
+        : { name: typeof cause, message: String(cause) },
+    }),
+  };
+}
+
+function legacyToolHandlerExtra(context: ServerContext): Record<string, unknown> {
+  return {
+    signal: context.mcpReq.signal,
+    authInfo: context.http?.authInfo,
+    sessionId: context.sessionId,
+    _meta: context.mcpReq._meta,
+    requestId: context.mcpReq.id,
+    requestInfo: context.http?.req,
+    sendNotification: context.mcpReq.notify,
+    sendRequest: context.mcpReq.send,
+  };
+}
diff --git a/src/server.test.ts b/src/server.test.ts
index 79c21a66c..24075b666 100644
--- a/src/server.test.ts
+++ b/src/server.test.ts
@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
 import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -13,7 +14,7 @@ import { buildLocalAgentProviderStatuses } from "./local-agent-catalog.js";
 import type { SubagentsConfig } from "./local-agent-config.js";
 import { createReviewCheckpointManager } from "./review-checkpoints.js";
 import { ProcessSessionManager } from "./process-sessions.js";
-import { createMcpServer } from "./server.js";
+import { createMcpServer, createServer } from "./server.js";
 import { SqliteWorkspaceStore } from "./workspace-store.js";
 import { WorkspaceRegistry } from "./workspaces.js";
 import { writeTestDevspaceConfig } from "./test-support/config.test.js";
@@ -287,6 +288,113 @@ test("open_workspace scopes checkout reuse to OpenAI session metadata", async (t
   assert.ok(Array.isArray(structuredContent(unscoped).agentsFiles));
 });
 
+test("HTTP endpoint serves modern MCP while preserving legacy sessions", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "devspace-modern-http-test-"));
+  const ownerToken = "test-owner-token-that-is-long-enough";
+  const env = writeTestDevspaceConfig(join(root, ".config"), {
+    server: {
+      port: 1,
+      publicBaseUrl: "https://example.test",
+    },
+    workspaces: {
+      allowedRoots: [root],
+      worktreeRoot: join(root, ".worktrees"),
+    },
+    storage: { stateDir: join(root, ".state") },
+  });
+  const config = loadConfig(env);
+  const running = createServer(config, { incomingArtifactAdapters: [] });
+  const httpServer = running.app.listen(0, "127.0.0.1");
+  await new Promise<void>((resolve) => httpServer.once("listening", resolve));
+
+  t.after(async () => {
+    await new Promise<void>((resolve, reject) => {
+      httpServer.close((error) => error ? reject(error) : resolve());
+    });
+    await running.close();
+    await rm(root, { recursive: true, force: true });
+  });
+
+  const address = httpServer.address();
+  assert.ok(address && typeof address === "object");
+  const localBaseUrl = `http://127.0.0.1:${address.port}`;
+  const accessToken = await issueTestAccessToken(
+    localBaseUrl,
+    config.publicBaseUrl,
+    ownerToken,
+  );
+
+  const unauthenticated = await postModernMcp(
+    localBaseUrl,
+    undefined,
+    "tools/list",
+    {},
+  );
+  assert.equal(unauthenticated.status, 401, await unauthenticated.clone().text());
+
+  const discovery = await postModernMcp(
+    localBaseUrl,
+    accessToken,
+    "server/discover",
+    {},
+  );
+  assert.equal(discovery.status, 200, await discovery.clone().text());
+  const discoveryBody = await discovery.json() as {
+    result?: { supportedVersions?: string[] };
+  };
+  assert.ok(discoveryBody.result?.supportedVersions?.includes("2026-07-28"));
+
+  const listed = await postModernMcp(
+    localBaseUrl,
+    accessToken,
+    "tools/list",
+    {},
+  );
+  assert.equal(listed.status, 200, await listed.clone().text());
+  const listBody = await listed.json() as {
+    result?: { tools?: Array<{ name?: string }> };
+  };
+  assert.ok(listBody.result?.tools?.some((tool) => tool.name === "open_workspace"));
+
+  const called = await postModernMcp(
+    localBaseUrl,
+    accessToken,
+    "tools/call",
+    {
+      name: "open_workspace",
+      arguments: { path: root },
+      _meta: { "openai/session": "modern-http-test" },
+    },
+  );
+  assert.equal(called.status, 200, await called.clone().text());
+  const callBody = await called.json() as {
+    result?: { structuredContent?: { workspaceId?: string } };
+  };
+  assert.equal(typeof callBody.result?.structuredContent?.workspaceId, "string");
+
+  const legacy = await fetch(`${localBaseUrl}/mcp`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${accessToken}`,
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+    },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: "legacy-initialize",
+      method: "initialize",
+      params: {
+        protocolVersion: "2025-06-18",
+        capabilities: {},
+        clientInfo: { name: "devspace-legacy-test", version: "1.0.0" },
+      },
+    }),
+  });
+  assert.equal(legacy.status, 200, await legacy.clone().text());
+  assert.ok(legacy.headers.get("mcp-session-id"));
+  assert.match(await legacy.text(), /"protocolVersion"/);
+});
+
 interface ServerFixture {
   client: Client;
   project: string;
@@ -401,6 +509,116 @@ async function git(cwd: string, args: string[]): Promise<void> {
   await execFileAsync("git", args, { cwd });
 }
 
+async function issueTestAccessToken(
+  localBaseUrl: string,
+  publicBaseUrl: string,
+  ownerToken: string,
+): Promise<string> {
+  const redirectUri = "http://127.0.0.1/callback";
+  const resource = new URL("/mcp", publicBaseUrl).href;
+  const verifier = "devspace-modern-protocol-test-verifier-0123456789";
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  const registration = await fetch(`${localBaseUrl}/register`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      client_name: "DevSpace modern protocol test",
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+    }),
+  });
+  assert.equal(registration.status, 201, await registration.clone().text());
+  const client = await registration.json() as { client_id?: string };
+  assert.ok(client.client_id);
+
+  const approval = await fetch(`${localBaseUrl}/authorize`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      client_id: client.client_id,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      scope: "devspace",
+      resource,
+      state: "modern-test",
+      owner_token: ownerToken,
+    }),
+    redirect: "manual",
+  });
+  assert.equal(approval.status, 302, await approval.clone().text());
+  const location = approval.headers.get("location");
+  assert.ok(location);
+  const code = new URL(location).searchParams.get("code");
+  assert.ok(code);
+
+  const exchange = await fetch(`${localBaseUrl}/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: client.client_id,
+      code,
+      code_verifier: verifier,
+      redirect_uri: redirectUri,
+      resource,
+    }),
+  });
+  assert.equal(exchange.status, 200, await exchange.clone().text());
+  const tokens = await exchange.json() as { access_token?: string };
+  assert.ok(tokens.access_token);
+  return tokens.access_token;
+}
+
+function postModernMcp(
+  localBaseUrl: string,
+  accessToken: string | undefined,
+  method: string,
+  params: Record<string, unknown>,
+): Promise<Response> {
+  const mcpName = typeof params.name === "string"
+    ? params.name
+    : typeof params.uri === "string"
+      ? params.uri
+      : undefined;
+  return fetch(`${localBaseUrl}/mcp`, {
+    method: "POST",
+    headers: {
+      ...(accessToken ? { authorization: `Bearer ${accessToken}` } : {}),
+      "content-type": "application/json",
+      "mcp-method": method,
+      "mcp-protocol-version": "2026-07-28",
+      ...(mcpName ? { "mcp-name": mcpName } : {}),
+    },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: `modern-${method}`,
+      method,
+      params: {
+        ...params,
+        _meta: {
+          ...recordValue(params._meta),
+          "io.modelcontextprotocol/protocolVersion": "2026-07-28",
+          "io.modelcontextprotocol/clientCapabilities": {},
+          "io.modelcontextprotocol/clientInfo": {
+            name: "devspace-modern-http-test",
+            version: "1.0.0",
+          },
+        },
+      },
+    }),
+  });
+}
+
+function recordValue(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : {};
+}
+
 async function callOpen(
   client: Client,
   path: string,
diff --git a/src/server.ts b/src/server.ts
index 9e7ded7fd..d48eb0549 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -9,6 +9,8 @@ import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middlew
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { checkResourceAllowed, resourceUrlFromServerUrl } from "@modelcontextprotocol/sdk/shared/auth-utils.js";
+import { createMcpHandler, isLegacyRequest } from "@modelcontextprotocol/server";
+import { toNodeHandler, toWebRequest } from "@modelcontextprotocol/node";
 import {
   registerAppResource,
   registerAppTool,
@@ -34,6 +36,12 @@ import {
 } from "./logger.js";
 import { readFileTool } from "./pi-tools.js";
 import { SingleUserOAuthProvider } from "./oauth-provider.js";
+import {
+  compileMcpRegistrationSurface,
+  createModernMcpServerAdapter,
+  modernMcpAdapterErrorLogFields,
+  type McpRegistrationTarget,
+} from "./mcp-modern-server.js";
 import {
   McpSessionRegistry,
   type McpSessionCloseResult,
@@ -78,6 +86,16 @@ const MCP_SESSION_IDLE_TIMEOUT_MS = 24 * 60 * 60 * 1_000;
 const MCP_SESSION_CLEANUP_INTERVAL_MS = 5 * 60 * 1_000;
 const WORKSPACE_APP_MANIFEST_ENTRY = "workspace-app.html";
 
+function mcpServerInfo() {
+  return {
+    name: "devspace",
+    title: "DevSpace",
+    version: "0.1.0",
+    description:
+      "Coding tools for project workspaces. Open each project or worktree once, then reuse its workspaceId.",
+  };
+}
+
 interface RunningServer {
   app: ReturnType<typeof createMcpExpressApp>;
   config: ServerConfig;
@@ -288,18 +306,35 @@ export function createMcpServer(
 ): McpServer {
   const toolSurface = getToolSurface(config.toolMode);
   const server = new McpServer(
-    {
-      name: "devspace",
-      title: "DevSpace",
-      version: "0.1.0",
-      description:
-        "Coding tools for project workspaces. Open each project or worktree once, then reuse its workspaceId.",
-    },
+    mcpServerInfo(),
     {
       instructions: serverInstructions(config, toolSurface),
     },
   );
 
+  registerMcpSurface(
+    server,
+    config,
+    workspaces,
+    reviewCheckpoints,
+    processSessions,
+    resolveLocalAgentProviders,
+    incomingArtifactAdapters,
+  );
+  return server;
+}
+
+function registerMcpSurface(
+  server: McpRegistrationTarget,
+  config: ServerConfig,
+  workspaces: WorkspaceRegistry,
+  reviewCheckpoints: ReturnType<typeof createReviewCheckpointManager>,
+  processSessions: ProcessSessionManager,
+  resolveLocalAgentProviders: () => LocalAgentProviderStatus[],
+  incomingArtifactAdapters: readonly IncomingArtifactAdapter[],
+): void {
+  const toolSurface = getToolSurface(config.toolMode);
+
   registerAppResource(
     server,
     "DevSpace Diff Card",
@@ -698,8 +733,6 @@ export function createMcpServer(
       incomingArtifactAdapters,
     });
   }
-
-  return server;
 }
 
 export interface CreateServerOptions {
@@ -740,6 +773,34 @@ export function createServer(
     config.subagents,
     getLocalAgentProviderAvailabilitySnapshot(),
   );
+  const modernToolSurface = getToolSurface(config.toolMode);
+  const bindModernMcpSurface = compileMcpRegistrationSurface((target) => {
+    registerMcpSurface(
+      target,
+      config,
+      workspaces,
+      reviewCheckpoints,
+      processSessions,
+      resolveLocalAgentProviders,
+      incomingArtifactAdapters,
+    );
+  });
+  const modernMcpHandler = createMcpHandler(() => {
+    const adapter = createModernMcpServerAdapter(
+      mcpServerInfo(),
+      { instructions: serverInstructions(config, modernToolSurface) },
+    );
+    bindModernMcpSurface(adapter.registrationTarget);
+    return adapter.server;
+  }, { legacy: "reject" });
+  const modernNodeHandler = toNodeHandler(modernMcpHandler, {
+    onerror: (error) => logEvent(
+      config.logging,
+      "error",
+      "mcp_modern_adapter_error",
+      modernMcpAdapterErrorLogFields(error),
+    ),
+  });
 
   const logSessionCloseResults = (
     reason: "idle_timeout" | "server_shutdown",
@@ -863,6 +924,12 @@ export function createServer(
     });
 
     try {
+      const webRequest = await toWebRequest(req, req.body);
+      if (!await isLegacyRequest(webRequest, req.body)) {
+        await modernNodeHandler(req, res, req.body);
+        return;
+      }
+
       let transport: Transport | undefined;
 
       if (sessionId) {
@@ -928,6 +995,13 @@ export function createServer(
     close: () => {
       closePromise ??= (async () => {
         clearInterval(sessionCleanupTimer);
+        try {
+          await modernMcpHandler.close();
+        } catch (error) {
+          logEvent(config.logging, "warn", "mcp_modern_handler_close_failed", {
+            error: error instanceof Error ? error.message : String(error),
+          });
+        }
         const results = await transports.closeAll();
         logSessionCloseResults("server_shutdown", results);
         processSessions.shutdown();
diff --git a/src/tool-surfaces/types.ts b/src/tool-surfaces/types.ts
index a9d8131b8..bdf48598f 100644
--- a/src/tool-surfaces/types.ts
+++ b/src/tool-surfaces/types.ts
@@ -74,7 +74,7 @@ export interface ToolWidgetDescriptorMeta {
 }
 
 export interface ToolRegistrationContext {
-  server: McpServer;
+  server: Pick<McpServer, "registerTool" | "registerResource">;
   config: ServerConfig;
   workspaces: WorkspaceRegistry;
   processSessions: ProcessSessionManager;

From cf2d4d7927fa560d26eee60c867be08061294473 Mon Sep 17 00:00:00 2001
From: Waishnav <86405648+Waishnav@users.noreply.github.com>
Date: Sun, 6 Sep 2026 10:21:34 +0530
Subject: [PATCH 2/8] refactor(mcp): serve legacy clients statelessly

---
 src/logger.ts            |   4 --
 src/mcp-sessions.test.ts |  86 ----------------------------
 src/mcp-sessions.ts      |  87 ----------------------------
 src/server.test.ts       |  44 ++++++++++++--
 src/server.ts            | 121 +++------------------------------------
 5 files changed, 49 insertions(+), 293 deletions(-)
 delete mode 100644 src/mcp-sessions.test.ts
 delete mode 100644 src/mcp-sessions.ts

diff --git a/src/logger.ts b/src/logger.ts
index c183ff64c..2bcd2d261 100644
--- a/src/logger.ts
+++ b/src/logger.ts
@@ -68,10 +68,6 @@ export function requestPath(req: Request): string {
   return req.path || req.url.split("?")[0] || req.url;
 }
 
-export function sessionIdPrefix(sessionId: string | undefined): string | undefined {
-  return sessionId ? sessionId.slice(0, 8) : undefined;
-}
-
 export function commandPreview(command: string): string {
   const normalized = command.replace(/\s+/g, " ").trim();
   return normalized.length > 120 ? `${normalized.slice(0, 117)}...` : normalized;
diff --git a/src/mcp-sessions.test.ts b/src/mcp-sessions.test.ts
deleted file mode 100644
index 1b3ecf349..000000000
--- a/src/mcp-sessions.test.ts
+++ /dev/null
@@ -1,86 +0,0 @@
-import assert from "node:assert/strict";
-import { McpSessionRegistry } from "./mcp-sessions.js";
-
-interface FakeTransport {
-  closeCalls: number;
-  close(): Promise<void>;
-}
-
-function createTransport(closeError?: Error): FakeTransport {
-  return {
-    closeCalls: 0,
-    async close() {
-      this.closeCalls += 1;
-      if (closeError) throw closeError;
-    },
-  };
-}
-
-let now = 0;
-const registry = new McpSessionRegistry<FakeTransport>({ now: () => now });
-const staleTransport = createTransport();
-const activeTransport = createTransport();
-
-registry.register("stale", staleTransport);
-now = 1_000;
-registry.register("active", activeTransport);
-now = 1_500;
-assert.equal(registry.get("active"), activeTransport);
-now = 2_000;
-
-const idleResults = await registry.closeIdle(1_500);
-assert.deepEqual(idleResults, [{ sessionId: "stale" }]);
-assert.equal(staleTransport.closeCalls, 1);
-assert.equal(activeTransport.closeCalls, 0);
-assert.equal(registry.size, 1);
-assert.equal(registry.get("stale"), undefined);
-assert.equal(registry.get("active"), activeTransport);
-
-const closeError = new Error("close failed");
-const failingTransport = createTransport(closeError);
-registry.register("failing", failingTransport);
-now = 10_000;
-
-const failingResults = await registry.closeIdle(1);
-assert.equal(failingResults.length, 2);
-assert.deepEqual(failingResults.map((result) => result.sessionId).sort(), ["active", "failing"]);
-assert.equal(failingResults.find((result) => result.sessionId === "failing")?.error, closeError);
-assert.equal(failingTransport.closeCalls, 1);
-assert.equal(registry.size, 0);
-
-const first = createTransport();
-const second = createTransport();
-registry.register("first", first);
-registry.register("second", second);
-registry.remove("first");
-
-const shutdownResults = await registry.closeAll();
-assert.deepEqual(shutdownResults, [{ sessionId: "second" }]);
-assert.equal(first.closeCalls, 0);
-assert.equal(second.closeCalls, 1);
-assert.equal(registry.size, 0);
-
-let finishDelayedClose: (() => void) | undefined;
-let delayedCloseResolved = false;
-const delayedTransport: FakeTransport = {
-  closeCalls: 0,
-  close() {
-    this.closeCalls += 1;
-    return new Promise<void>((resolve) => {
-      finishDelayedClose = resolve;
-    });
-  },
-};
-registry.register("delayed", delayedTransport);
-const delayedClose = registry.closeAll();
-void delayedClose.then(() => {
-  delayedCloseResolved = true;
-});
-
-await Promise.resolve();
-assert.equal(delayedCloseResolved, false);
-assert.equal(delayedTransport.closeCalls, 1);
-finishDelayedClose?.();
-await delayedClose;
-assert.equal(delayedCloseResolved, true);
-assert.equal(registry.size, 0);
diff --git a/src/mcp-sessions.ts b/src/mcp-sessions.ts
deleted file mode 100644
index 3a844943a..000000000
--- a/src/mcp-sessions.ts
+++ /dev/null
@@ -1,87 +0,0 @@
-export interface ClosableMcpTransport {
-  close(): Promise<void>;
-}
-
-export interface McpSessionCloseResult {
-  sessionId: string;
-  error?: unknown;
-}
-
-interface McpSessionEntry<TTransport> {
-  transport: TTransport;
-  lastActivityAt: number;
-}
-
-export interface McpSessionRegistryOptions {
-  now?: () => number;
-}
-
-export class McpSessionRegistry<TTransport extends ClosableMcpTransport> {
-  private readonly sessions = new Map<string, McpSessionEntry<TTransport>>();
-  private readonly now: () => number;
-
-  constructor(options: McpSessionRegistryOptions = {}) {
-    this.now = options.now ?? Date.now;
-  }
-
-  get size(): number {
-    return this.sessions.size;
-  }
-
-  register(sessionId: string, transport: TTransport): void {
-    this.sessions.set(sessionId, {
-      transport,
-      lastActivityAt: this.now(),
-    });
-  }
-
-  get(sessionId: string): TTransport | undefined {
-    const entry = this.sessions.get(sessionId);
-    if (!entry) return undefined;
-
-    entry.lastActivityAt = this.now();
-    return entry.transport;
-  }
-
-  remove(sessionId: string): boolean {
-    return this.sessions.delete(sessionId);
-  }
-
-  async closeIdle(idleTimeoutMs: number): Promise<McpSessionCloseResult[]> {
-    const cutoff = this.now() - idleTimeoutMs;
-    const idleSessions: Array<{ sessionId: string; transport: TTransport }> = [];
-
-    for (const [sessionId, entry] of this.sessions) {
-      if (entry.lastActivityAt > cutoff) continue;
-
-      this.sessions.delete(sessionId);
-      idleSessions.push({ sessionId, transport: entry.transport });
-    }
-
-    return closeSessions(idleSessions);
-  }
-
-  async closeAll(): Promise<McpSessionCloseResult[]> {
-    const sessions = Array.from(this.sessions, ([sessionId, entry]) => ({
-      sessionId,
-      transport: entry.transport,
-    }));
-    this.sessions.clear();
-    return closeSessions(sessions);
-  }
-}
-
-async function closeSessions<TTransport extends ClosableMcpTransport>(
-  sessions: Array<{ sessionId: string; transport: TTransport }>,
-): Promise<McpSessionCloseResult[]> {
-  return Promise.all(
-    sessions.map(async ({ sessionId, transport }) => {
-      try {
-        await transport.close();
-        return { sessionId };
-      } catch (error) {
-        return { sessionId, error };
-      }
-    }),
-  );
-}
diff --git a/src/server.test.ts b/src/server.test.ts
index 24075b666..13057ac96 100644
--- a/src/server.test.ts
+++ b/src/server.test.ts
@@ -288,7 +288,7 @@ test("open_workspace scopes checkout reuse to OpenAI session metadata", async (t
   assert.ok(Array.isArray(structuredContent(unscoped).agentsFiles));
 });
 
-test("HTTP endpoint serves modern MCP while preserving legacy sessions", async (t) => {
+test("HTTP endpoint serves modern MCP and stateless legacy clients", async (t) => {
   const root = await mkdtemp(join(tmpdir(), "devspace-modern-http-test-"));
   const ownerToken = "test-owner-token-that-is-long-enough";
   const env = writeTestDevspaceConfig(join(root, ".config"), {
@@ -368,9 +368,27 @@ test("HTTP endpoint serves modern MCP while preserving legacy sessions", async (
   );
   assert.equal(called.status, 200, await called.clone().text());
   const callBody = await called.json() as {
-    result?: { structuredContent?: { workspaceId?: string } };
+    result?: { structuredContent?: { workspaceId?: string; agentsFiles?: unknown[] } };
   };
-  assert.equal(typeof callBody.result?.structuredContent?.workspaceId, "string");
+  const workspaceId = callBody.result?.structuredContent?.workspaceId;
+  assert.equal(typeof workspaceId, "string");
+
+  const repeated = await postModernMcp(
+    localBaseUrl,
+    accessToken,
+    "tools/call",
+    {
+      name: "open_workspace",
+      arguments: { path: root },
+      _meta: { "openai/session": "modern-http-test" },
+    },
+  );
+  assert.equal(repeated.status, 200, await repeated.clone().text());
+  const repeatedBody = await repeated.json() as {
+    result?: { structuredContent?: { workspaceId?: string; agentsFiles?: unknown[] } };
+  };
+  assert.equal(repeatedBody.result?.structuredContent?.workspaceId, workspaceId);
+  assert.equal(repeatedBody.result?.structuredContent?.agentsFiles, undefined);
 
   const legacy = await fetch(`${localBaseUrl}/mcp`, {
     method: "POST",
@@ -391,8 +409,26 @@ test("HTTP endpoint serves modern MCP while preserving legacy sessions", async (
     }),
   });
   assert.equal(legacy.status, 200, await legacy.clone().text());
-  assert.ok(legacy.headers.get("mcp-session-id"));
+  assert.equal(legacy.headers.get("mcp-session-id"), null);
   assert.match(await legacy.text(), /"protocolVersion"/);
+
+  const legacyTools = await fetch(`${localBaseUrl}/mcp`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${accessToken}`,
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream",
+    },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: "legacy-tools-list",
+      method: "tools/list",
+      params: {},
+    }),
+  });
+  assert.equal(legacyTools.status, 200, await legacyTools.clone().text());
+  assert.equal(legacyTools.headers.get("mcp-session-id"), null);
+  assert.match(await legacyTools.text(), /"open_workspace"/);
 });
 
 interface ServerFixture {
diff --git a/src/server.ts b/src/server.ts
index d48eb0549..92aad24b7 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -6,11 +6,9 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
 import { mcpAuthRouter, getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { checkResourceAllowed, resourceUrlFromServerUrl } from "@modelcontextprotocol/sdk/shared/auth-utils.js";
-import { createMcpHandler, isLegacyRequest } from "@modelcontextprotocol/server";
-import { toNodeHandler, toWebRequest } from "@modelcontextprotocol/node";
+import { createMcpHandler } from "@modelcontextprotocol/server";
+import { toNodeHandler } from "@modelcontextprotocol/node";
 import {
   registerAppResource,
   registerAppTool,
@@ -32,7 +30,6 @@ import {
   logEvent,
   requestIp,
   requestPath,
-  sessionIdPrefix,
 } from "./logger.js";
 import { readFileTool } from "./pi-tools.js";
 import { SingleUserOAuthProvider } from "./oauth-provider.js";
@@ -42,10 +39,6 @@ import {
   modernMcpAdapterErrorLogFields,
   type McpRegistrationTarget,
 } from "./mcp-modern-server.js";
-import {
-  McpSessionRegistry,
-  type McpSessionCloseResult,
-} from "./mcp-sessions.js";
 import { ProcessSessionManager } from "./process-sessions.js";
 import { createReviewCheckpointManager } from "./review-checkpoints.js";
 import { openAiConversationScopeId } from "./request-meta.js";
@@ -79,11 +72,6 @@ import {
   type ToolSurface,
 } from "./tool-surfaces/types.js";
 
-type Transport = StreamableHTTPServerTransport;
-// MCP clients can reconnect without closing the previous transport. Bound stale
-// session retention so abandoned MCP servers do not accumulate for the life of the process.
-const MCP_SESSION_IDLE_TIMEOUT_MS = 24 * 60 * 60 * 1_000;
-const MCP_SESSION_CLEANUP_INTERVAL_MS = 5 * 60 * 1_000;
 const WORKSPACE_APP_MANIFEST_ENTRY = "workspace-app.html";
 
 function mcpServerInfo() {
@@ -752,7 +740,6 @@ export function createServer(
     host: config.host,
     ...(allowedHosts ? { allowedHosts } : {}),
   });
-  const transports = new McpSessionRegistry<Transport>();
   const mcpUrl = new URL("/mcp", config.publicBaseUrl);
   const resourceServerUrl = resourceUrlFromServerUrl(mcpUrl);
   const oauthProvider = new SingleUserOAuthProvider(config.oauth, mcpUrl, config.stateDir);
@@ -785,54 +772,23 @@ export function createServer(
       incomingArtifactAdapters,
     );
   });
-  const modernMcpHandler = createMcpHandler(() => {
+  const mcpHandler = createMcpHandler(() => {
     const adapter = createModernMcpServerAdapter(
       mcpServerInfo(),
       { instructions: serverInstructions(config, modernToolSurface) },
     );
     bindModernMcpSurface(adapter.registrationTarget);
     return adapter.server;
-  }, { legacy: "reject" });
-  const modernNodeHandler = toNodeHandler(modernMcpHandler, {
+  });
+  const mcpNodeHandler = toNodeHandler(mcpHandler, {
     onerror: (error) => logEvent(
       config.logging,
       "error",
-      "mcp_modern_adapter_error",
+      "mcp_handler_error",
       modernMcpAdapterErrorLogFields(error),
     ),
   });
 
-  const logSessionCloseResults = (
-    reason: "idle_timeout" | "server_shutdown",
-    results: McpSessionCloseResult[],
-  ) => {
-    for (const result of results) {
-      if (result.error) {
-        logEvent(config.logging, "warn", "mcp_session_close_failed", {
-          reason,
-          sessionIdPrefix: sessionIdPrefix(result.sessionId),
-          error:
-            result.error instanceof Error
-              ? result.error.message
-              : String(result.error),
-        });
-        continue;
-      }
-
-      logEvent(config.logging, "info", "mcp_session_closed", {
-        reason,
-        sessionIdPrefix: sessionIdPrefix(result.sessionId),
-      });
-    }
-  };
-
-  const sessionCleanupTimer = setInterval(() => {
-    void transports
-      .closeIdle(MCP_SESSION_IDLE_TIMEOUT_MS)
-      .then((results) => logSessionCloseResults("idle_timeout", results));
-  }, MCP_SESSION_CLEANUP_INTERVAL_MS);
-  sessionCleanupTimer.unref();
-
   if (config.logging.trustProxy) {
     app.set("trust proxy", true);
   }
@@ -892,8 +848,6 @@ export function createServer(
 
   app.all("/mcp", async (req, res) => {
     const requestId = res.locals.requestId as string | undefined;
-    const sessionId = req.header("mcp-session-id");
-    const initializeRequest = req.method === "POST" && isInitializeRequest(req.body);
 
     await new Promise<void>((resolve, reject) => {
       bearerAuth(req, res, (error?: unknown) => {
@@ -918,64 +872,10 @@ export function createServer(
     logEvent(config.logging, "debug", "mcp_request", {
       requestId,
       method: req.method,
-      sessionIdPresent: Boolean(sessionId),
-      sessionIdPrefix: sessionIdPrefix(sessionId),
-      isInitialize: initializeRequest,
     });
 
     try {
-      const webRequest = await toWebRequest(req, req.body);
-      if (!await isLegacyRequest(webRequest, req.body)) {
-        await modernNodeHandler(req, res, req.body);
-        return;
-      }
-
-      let transport: Transport | undefined;
-
-      if (sessionId) {
-        transport = transports.get(sessionId);
-        if (!transport) {
-          sendJsonRpcError(res, 404, -32000, "Unknown MCP session");
-          return;
-        }
-      } else if (initializeRequest) {
-        transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID(),
-          onsessioninitialized: (newSessionId) => {
-            if (transport) transports.register(newSessionId, transport);
-            logEvent(config.logging, "info", "mcp_session_created", {
-              requestId,
-              sessionIdPrefix: sessionIdPrefix(newSessionId),
-              ...requestLogFields(req, config),
-            });
-          },
-        });
-
-        transport.onclose = () => {
-          const closedSessionId = transport?.sessionId;
-          if (closedSessionId && transports.remove(closedSessionId)) {
-            logEvent(config.logging, "info", "mcp_session_closed", {
-              reason: "transport_close",
-              sessionIdPrefix: sessionIdPrefix(closedSessionId),
-            });
-          }
-        };
-
-        const server = createMcpServer(
-          config,
-          workspaces,
-          reviewCheckpoints,
-          processSessions,
-          resolveLocalAgentProviders,
-          incomingArtifactAdapters,
-        );
-        await server.connect(transport);
-      } else {
-        sendJsonRpcError(res, 400, -32000, "No valid MCP session");
-        return;
-      }
-
-      await transport.handleRequest(req, res, req.body);
+      await mcpNodeHandler(req, res, req.body);
     } catch (error) {
       logEvent(config.logging, "error", "mcp_request_error", {
         requestId,
@@ -994,16 +894,13 @@ export function createServer(
     localAgentProviders,
     close: () => {
       closePromise ??= (async () => {
-        clearInterval(sessionCleanupTimer);
         try {
-          await modernMcpHandler.close();
+          await mcpHandler.close();
         } catch (error) {
-          logEvent(config.logging, "warn", "mcp_modern_handler_close_failed", {
+          logEvent(config.logging, "warn", "mcp_handler_close_failed", {
             error: error instanceof Error ? error.message : String(error),
           });
         }
-        const results = await transports.closeAll();
-        logSessionCloseResults("server_shutdown", results);
         processSessions.shutdown();
         oauthProvider.close();
         workspaceStore.close?.();

From 3926336dc46ad35d12a1567b3c4b12b9fa58f896 Mon Sep 17 00:00:00 2001
From: Waishnav <86405648+Waishnav@users.noreply.github.com>
Date: Sun, 6 Sep 2026 10:24:46 +0530
Subject: [PATCH 3/8] fix(server): drain active MCP tool work on shutdown

---
 src/server.test.ts | 96 +++++++++++++++++++++++++++++++++++++++++++++-
 src/server.ts      | 58 +++++++++++++++++++++++++---
 2 files changed, 147 insertions(+), 7 deletions(-)

diff --git a/src/server.test.ts b/src/server.test.ts
index 13057ac96..3181e8f10 100644
--- a/src/server.test.ts
+++ b/src/server.test.ts
@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
-import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { access, mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test, { type TestContext } from "node:test";
@@ -431,6 +431,88 @@ test("HTTP endpoint serves modern MCP and stateless legacy clients", async (t) =
   assert.match(await legacyTools.text(), /"open_workspace"/);
 });
 
+test("server shutdown waits for an active MCP tool call", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "devspace-shutdown-test-"));
+  const ownerToken = "test-owner-token-that-is-long-enough";
+  const env = writeTestDevspaceConfig(join(root, ".config"), {
+    server: {
+      port: 1,
+      publicBaseUrl: "https://example.test",
+    },
+    workspaces: {
+      allowedRoots: [root],
+      worktreeRoot: join(root, ".worktrees"),
+    },
+    storage: { stateDir: join(root, ".state") },
+  });
+  const config = loadConfig(env);
+  const running = createServer(config, { incomingArtifactAdapters: [] });
+  const httpServer = running.app.listen(0, "127.0.0.1");
+  await new Promise<void>((resolve) => httpServer.once("listening", resolve));
+
+  t.after(async () => {
+    await new Promise<void>((resolve) => httpServer.close(() => resolve()));
+    await running.close();
+    await rm(root, { recursive: true, force: true });
+  });
+
+  const address = httpServer.address();
+  assert.ok(address && typeof address === "object");
+  const localBaseUrl = `http://127.0.0.1:${address.port}`;
+  const accessToken = await issueTestAccessToken(
+    localBaseUrl,
+    config.publicBaseUrl,
+    ownerToken,
+  );
+  const opened = await postModernMcp(
+    localBaseUrl,
+    accessToken,
+    "tools/call",
+    {
+      name: "open_workspace",
+      arguments: { path: root },
+      _meta: { "openai/session": "shutdown-test" },
+    },
+  );
+  const openBody = await opened.json() as {
+    result?: { structuredContent?: { workspaceId?: string } };
+  };
+  const workspaceId = openBody.result?.structuredContent?.workspaceId;
+  assert.equal(typeof workspaceId, "string");
+
+  const command = [
+    "const fs=require('node:fs')",
+    "fs.writeFileSync('started','')",
+    "const timer=setInterval(()=>{if(fs.existsSync('release')) clearInterval(timer)},10)",
+  ].join(";");
+  const toolCall = postModernMcp(
+    localBaseUrl,
+    accessToken,
+    "tools/call",
+    {
+      name: "exec_command",
+      arguments: {
+        workspaceId,
+        cmd: `node -e \"${command}\"`,
+        yieldTimeMs: 30_000,
+      },
+    },
+  );
+  await waitForFile(join(root, "started"));
+
+  let shutdownFinished = false;
+  const shutdown = running.close().then(() => {
+    shutdownFinished = true;
+  });
+  await new Promise((resolve) => setTimeout(resolve, 50));
+  assert.equal(shutdownFinished, false);
+
+  await writeFile(join(root, "release"), "");
+  await toolCall;
+  await shutdown;
+  assert.equal(shutdownFinished, true);
+});
+
 interface ServerFixture {
   client: Client;
   project: string;
@@ -545,6 +627,18 @@ async function git(cwd: string, args: string[]): Promise<void> {
   await execFileAsync("git", args, { cwd });
 }
 
+async function waitForFile(path: string): Promise<void> {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    try {
+      await access(path);
+      return;
+    } catch {
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+  }
+  assert.fail(`Timed out waiting for ${path}`);
+}
+
 async function issueTestAccessToken(
   localBaseUrl: string,
   publicBaseUrl: string,
diff --git a/src/server.ts b/src/server.ts
index 92aad24b7..0ee2b2c2d 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -91,6 +91,25 @@ interface RunningServer {
   close(): Promise<void>;
 }
 
+type TrackToolActivity = <T>(operation: () => Promise<T>) => Promise<T>;
+
+class ToolActivityTracker {
+  private readonly active = new Set<Promise<unknown>>();
+
+  readonly track: TrackToolActivity = <T>(operation: () => Promise<T>): Promise<T> => {
+    const promise = operation();
+    this.active.add(promise);
+    void promise.finally(() => this.active.delete(promise));
+    return promise;
+  };
+
+  async waitForIdle(): Promise<void> {
+    while (this.active.size > 0) {
+      await Promise.allSettled(Array.from(this.active));
+    }
+  }
+}
+
 interface WorkspaceAppManifestEntry {
   file: string;
   css?: string[];
@@ -291,6 +310,7 @@ export function createMcpServer(
   processSessions: ProcessSessionManager,
   resolveLocalAgentProviders: () => LocalAgentProviderStatus[],
   incomingArtifactAdapters: readonly IncomingArtifactAdapter[],
+  trackToolActivity?: TrackToolActivity,
 ): McpServer {
   const toolSurface = getToolSurface(config.toolMode);
   const server = new McpServer(
@@ -308,6 +328,7 @@ export function createMcpServer(
     processSessions,
     resolveLocalAgentProviders,
     incomingArtifactAdapters,
+    trackToolActivity,
   );
   return server;
 }
@@ -320,11 +341,15 @@ function registerMcpSurface(
   processSessions: ProcessSessionManager,
   resolveLocalAgentProviders: () => LocalAgentProviderStatus[],
   incomingArtifactAdapters: readonly IncomingArtifactAdapter[],
+  trackToolActivity?: TrackToolActivity,
 ): void {
+  const registrationTarget = trackToolActivity
+    ? withTrackedToolHandlers(server, trackToolActivity)
+    : server;
   const toolSurface = getToolSurface(config.toolMode);
 
   registerAppResource(
-    server,
+    registrationTarget,
     "DevSpace Diff Card",
     WORKSPACE_APP_URI,
     {
@@ -355,7 +380,7 @@ function registerMcpSurface(
   );
 
   registerAppTool(
-    server,
+    registrationTarget,
     "open_workspace",
     {
       title: "Open workspace",
@@ -562,7 +587,7 @@ function registerMcpSurface(
     },
   );
 
-  server.registerTool(
+  registrationTarget.registerTool(
     toolNames.read,
     {
       title: "Read file",
@@ -644,14 +669,14 @@ function registerMcpSurface(
   );
 
   toolSurface.register({
-    server,
+    server: registrationTarget,
     config,
     workspaces,
     processSessions,
   });
 
   registerAppTool(
-    server,
+    registrationTarget,
     "show_changes",
     {
       title: "Show changes",
@@ -715,7 +740,7 @@ function registerMcpSurface(
   );
 
   if (config.artifactsEnabled && isArtifactDownloadSupportedPlatform()) {
-    registerArtifactTools(server, {
+    registerArtifactTools(registrationTarget, {
       config,
       workspaces,
       incomingArtifactAdapters,
@@ -723,6 +748,24 @@ function registerMcpSurface(
   }
 }
 
+function withTrackedToolHandlers(
+  server: McpRegistrationTarget,
+  trackToolActivity: TrackToolActivity,
+): McpRegistrationTarget {
+  return {
+    registerTool: ((...args: unknown[]) => {
+      const handler = args.at(-1) as (...handlerArgs: unknown[]) => unknown;
+      return (server.registerTool as (...callArgs: unknown[]) => unknown)(
+        ...args.slice(0, -1),
+        (...handlerArgs: unknown[]) => trackToolActivity(
+          () => Promise.resolve(handler(...handlerArgs)),
+        ),
+      );
+    }) as McpRegistrationTarget["registerTool"],
+    registerResource: server.registerResource.bind(server),
+  };
+}
+
 export interface CreateServerOptions {
   incomingArtifactAdapters?: readonly IncomingArtifactAdapter[];
 }
@@ -752,6 +795,7 @@ export function createServer(
   const workspaces = new WorkspaceRegistry(config, workspaceStore);
   const reviewCheckpoints = createReviewCheckpointManager();
   const processSessions = new ProcessSessionManager();
+  const toolActivities = new ToolActivityTracker();
   const localAgentProviders = buildLocalAgentProviderStatuses(
     config.subagents,
     getLocalAgentProviderAvailabilitySnapshot(),
@@ -770,6 +814,7 @@ export function createServer(
       processSessions,
       resolveLocalAgentProviders,
       incomingArtifactAdapters,
+      toolActivities.track,
     );
   });
   const mcpHandler = createMcpHandler(() => {
@@ -901,6 +946,7 @@ export function createServer(
             error: error instanceof Error ? error.message : String(error),
           });
         }
+        await toolActivities.waitForIdle();
         processSessions.shutdown();
         oauthProvider.close();
         workspaceStore.close?.();

From d8525f867e75bfe208e888b03bdbd77273c69668 Mon Sep 17 00:00:00 2001
From: Waishnav <86405648+Waishnav@users.noreply.github.com>
Date: Sun, 6 Sep 2026 10:25:16 +0530
Subject: [PATCH 4/8] refactor(workspace): isolate conversation scope metadata

---
 src/request-meta.test.ts | 8 ++++----
 src/request-meta.ts      | 2 +-
 src/server.ts            | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/request-meta.test.ts b/src/request-meta.test.ts
index 5a6c7b02d..f00ed5f95 100644
--- a/src/request-meta.test.ts
+++ b/src/request-meta.test.ts
@@ -1,8 +1,8 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { openAiConversationScopeId } from "./request-meta.js";
+import { conversationScopeIdFromRequestMeta } from "./request-meta.js";
 
-test("OpenAI conversation scope accepts only a non-empty session string", () => {
+test("conversation scope resolves valid OpenAI session metadata", () => {
   for (const meta of [
     undefined,
     {},
@@ -10,11 +10,11 @@ test("OpenAI conversation scope accepts only a non-empty session string", () =>
     { "openai/session": 42 },
     { "openai/session": {} },
   ]) {
-    assert.equal(openAiConversationScopeId(meta), undefined);
+    assert.equal(conversationScopeIdFromRequestMeta(meta), undefined);
   }
 
   assert.equal(
-    openAiConversationScopeId({
+    conversationScopeIdFromRequestMeta({
       "openai/session": "chat-session-opaque-value",
       "openai/subject": "user-1",
       "openai/organization": "org-1",
diff --git a/src/request-meta.ts b/src/request-meta.ts
index 5b8cb1ead..0f88996cb 100644
--- a/src/request-meta.ts
+++ b/src/request-meta.ts
@@ -7,7 +7,7 @@ function metadataString(
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
 
-export function openAiConversationScopeId(
+export function conversationScopeIdFromRequestMeta(
   meta: unknown,
 ): string | undefined {
   return metadataString(meta, "openai/session");
diff --git a/src/server.ts b/src/server.ts
index 0ee2b2c2d..1997de17e 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -41,7 +41,7 @@ import {
 } from "./mcp-modern-server.js";
 import { ProcessSessionManager } from "./process-sessions.js";
 import { createReviewCheckpointManager } from "./review-checkpoints.js";
-import { openAiConversationScopeId } from "./request-meta.js";
+import { conversationScopeIdFromRequestMeta } from "./request-meta.js";
 import { shutdownHttpServer } from "./server-shutdown.js";
 import { formatPathForPrompt } from "./skills.js";
 import { createWorkspaceStore } from "./workspace-store.js";
@@ -446,7 +446,7 @@ function registerMcpSurface(
         includeBootstrapContext,
       } = await workspaces.openWorkspace(
         { path, mode, baseRef },
-        { conversationScopeId: openAiConversationScopeId(_meta) },
+        { conversationScopeId: conversationScopeIdFromRequestMeta(_meta) },
       );
       const review = await reviewCheckpoints.initializeWorkspace({
         workspaceId: workspace.id,

From 23d7b51e178e6af9c9327d3f47d20ada6f28e424 Mon Sep 17 00:00:00 2001
From: Waishnav <86405648+Waishnav@users.noreply.github.com>
Date: Sun, 6 Sep 2026 10:25:40 +0530
Subject: [PATCH 5/8] docs(mcp): document automatic protocol compatibility

---
 README.md     | 2 +-
 docs/setup.md | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 877ce2ad7..3caa568bf 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@
 
 DevSpace is a self-hosted MCP server that lets ChatGPT read, edit, search, and run code in your real local projects — your files, your tools, your terminal — without uploading anything to a third party. You run it on your machine, expose it through a tunnel you control, and approve the connection with a password only you have.
 
-The same `/mcp` endpoint supports existing sessionful MCP clients and the 2026-07-28 per-request protocol.
+The same `/mcp` endpoint serves the 2026-07-28 per-request protocol and automatically supports older 2025-era clients through stateless compatibility handling. There is no protocol mode to configure.
 
 ## Sponsors and Special Thanks
 <!-- 
diff --git a/docs/setup.md b/docs/setup.md
index 83a66a6eb..427bea5dc 100644
--- a/docs/setup.md
+++ b/docs/setup.md
@@ -99,6 +99,10 @@ Configure the MCP client with the full MCP endpoint:
 https://your-tunnel-host.example.com/mcp
 ```
 
+Protocol compatibility is automatic. DevSpace serves MCP 2026-07-28 requests
+directly and handles older 2025-era clients statelessly on the same endpoint;
+there is no client-protocol setting to maintain.
+
 A Coding Agents-only setup skips this section.
 
 ## Start The Server

From eaff76276c90baaabbdfff5ee2b76abceb7c72e1 Mon Sep 17 00:00:00 2001
From: Waishnav <86405648+Waishnav@users.noreply.github.com>
Date: Sun, 6 Sep 2026 10:26:52 +0530
Subject: [PATCH 6/8] fix(server): settle tool activity tracking safely

---
 src/server.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/server.ts b/src/server.ts
index 1997de17e..be768ba0b 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -99,7 +99,8 @@ class ToolActivityTracker {
   readonly track: TrackToolActivity = <T>(operation: () => Promise<T>): Promise<T> => {
     const promise = operation();
     this.active.add(promise);
-    void promise.finally(() => this.active.delete(promise));
+    const remove = () => this.active.delete(promise);
+    void promise.then(remove, remove);
     return promise;
   };
 

From ce8bbbe13e6053a6785ea300cd7c20d4473f93f7 Mon Sep 17 00:00:00 2001
From: Waishnav <86405648+Waishnav@users.noreply.github.com>
Date: Sun, 6 Sep 2026 10:27:49 +0530
Subject: [PATCH 7/8] test(server): share MCP HTTP fixture

---
 src/server.test.ts | 117 ++++++++++++++++++++-------------------------
 1 file changed, 53 insertions(+), 64 deletions(-)

diff --git a/src/server.test.ts b/src/server.test.ts
index 3181e8f10..254ce0a61 100644
--- a/src/server.test.ts
+++ b/src/server.test.ts
@@ -289,39 +289,9 @@ test("open_workspace scopes checkout reuse to OpenAI session metadata", async (t
 });
 
 test("HTTP endpoint serves modern MCP and stateless legacy clients", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "devspace-modern-http-test-"));
-  const ownerToken = "test-owner-token-that-is-long-enough";
-  const env = writeTestDevspaceConfig(join(root, ".config"), {
-    server: {
-      port: 1,
-      publicBaseUrl: "https://example.test",
-    },
-    workspaces: {
-      allowedRoots: [root],
-      worktreeRoot: join(root, ".worktrees"),
-    },
-    storage: { stateDir: join(root, ".state") },
-  });
-  const config = loadConfig(env);
-  const running = createServer(config, { incomingArtifactAdapters: [] });
-  const httpServer = running.app.listen(0, "127.0.0.1");
-  await new Promise<void>((resolve) => httpServer.once("listening", resolve));
-
-  t.after(async () => {
-    await new Promise<void>((resolve, reject) => {
-      httpServer.close((error) => error ? reject(error) : resolve());
-    });
-    await running.close();
-    await rm(root, { recursive: true, force: true });
-  });
-
-  const address = httpServer.address();
-  assert.ok(address && typeof address === "object");
-  const localBaseUrl = `http://127.0.0.1:${address.port}`;
-  const accessToken = await issueTestAccessToken(
-    localBaseUrl,
-    config.publicBaseUrl,
-    ownerToken,
+  const { root, localBaseUrl, accessToken } = await httpServerFixture(
+    t,
+    "devspace-modern-http-test-",
   );
 
   const unauthenticated = await postModernMcp(
@@ -432,37 +402,9 @@ test("HTTP endpoint serves modern MCP and stateless legacy clients", async (t) =
 });
 
 test("server shutdown waits for an active MCP tool call", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "devspace-shutdown-test-"));
-  const ownerToken = "test-owner-token-that-is-long-enough";
-  const env = writeTestDevspaceConfig(join(root, ".config"), {
-    server: {
-      port: 1,
-      publicBaseUrl: "https://example.test",
-    },
-    workspaces: {
-      allowedRoots: [root],
-      worktreeRoot: join(root, ".worktrees"),
-    },
-    storage: { stateDir: join(root, ".state") },
-  });
-  const config = loadConfig(env);
-  const running = createServer(config, { incomingArtifactAdapters: [] });
-  const httpServer = running.app.listen(0, "127.0.0.1");
-  await new Promise<void>((resolve) => httpServer.once("listening", resolve));
-
-  t.after(async () => {
-    await new Promise<void>((resolve) => httpServer.close(() => resolve()));
-    await running.close();
-    await rm(root, { recursive: true, force: true });
-  });
-
-  const address = httpServer.address();
-  assert.ok(address && typeof address === "object");
-  const localBaseUrl = `http://127.0.0.1:${address.port}`;
-  const accessToken = await issueTestAccessToken(
-    localBaseUrl,
-    config.publicBaseUrl,
-    ownerToken,
+  const { root, localBaseUrl, accessToken, running } = await httpServerFixture(
+    t,
+    "devspace-shutdown-test-",
   );
   const opened = await postModernMcp(
     localBaseUrl,
@@ -518,6 +460,53 @@ interface ServerFixture {
   project: string;
 }
 
+interface HttpServerFixture {
+  root: string;
+  localBaseUrl: string;
+  accessToken: string;
+  running: ReturnType<typeof createServer>;
+}
+
+async function httpServerFixture(
+  t: TestContext,
+  prefix: string,
+): Promise<HttpServerFixture> {
+  const root = await mkdtemp(join(tmpdir(), prefix));
+  const ownerToken = "test-owner-token-that-is-long-enough";
+  const config = loadConfig(writeTestDevspaceConfig(join(root, ".config"), {
+    server: {
+      port: 1,
+      publicBaseUrl: "https://example.test",
+    },
+    workspaces: {
+      allowedRoots: [root],
+      worktreeRoot: join(root, ".worktrees"),
+    },
+    storage: { stateDir: join(root, ".state") },
+  }));
+  const running = createServer(config, { incomingArtifactAdapters: [] });
+  const httpServer = running.app.listen(0, "127.0.0.1");
+  await new Promise<void>((resolve) => httpServer.once("listening", resolve));
+
+  t.after(async () => {
+    await new Promise<void>((resolve, reject) => {
+      httpServer.close((error) => error ? reject(error) : resolve());
+    });
+    await running.close();
+    await rm(root, { recursive: true, force: true });
+  });
+
+  const address = httpServer.address();
+  assert.ok(address && typeof address === "object");
+  const localBaseUrl = `http://127.0.0.1:${address.port}`;
+  const accessToken = await issueTestAccessToken(
+    localBaseUrl,
+    config.publicBaseUrl,
+    ownerToken,
+  );
+  return { root, localBaseUrl, accessToken, running };
+}
+
 async function fixture(
   t: TestContext,
   options: {

From 57518e223f26c8e2484f88656fa8de0038a69c79 Mon Sep 17 00:00:00 2001
From: Waishnav <86405648+Waishnav@users.noreply.github.com>
Date: Sun, 6 Sep 2026 10:28:59 +0530
Subject: [PATCH 8/8] fix(mcp): log handler failures and pin stateless fallback

---
 src/server.ts | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/server.ts b/src/server.ts
index be768ba0b..8945d303d 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -818,6 +818,12 @@ export function createServer(
       toolActivities.track,
     );
   });
+  const logMcpHandlerError = (error: Error) => logEvent(
+    config.logging,
+    "error",
+    "mcp_handler_error",
+    modernMcpAdapterErrorLogFields(error),
+  );
   const mcpHandler = createMcpHandler(() => {
     const adapter = createModernMcpServerAdapter(
       mcpServerInfo(),
@@ -825,14 +831,12 @@ export function createServer(
     );
     bindModernMcpSurface(adapter.registrationTarget);
     return adapter.server;
+  }, {
+    legacy: "stateless",
+    onerror: logMcpHandlerError,
   });
   const mcpNodeHandler = toNodeHandler(mcpHandler, {
-    onerror: (error) => logEvent(
-      config.logging,
-      "error",
-      "mcp_handler_error",
-      modernMcpAdapterErrorLogFields(error),
-    ),
+    onerror: logMcpHandlerError,
   });
 
   if (config.logging.trustProxy) {