mcpcompat shim advertises only {logging:{}} instead of capabilities.tools and capabilities.resources

[JAORMX]

Context

While writing regression tests for the mcp-go → go-sdk migration (#5742), a critical capability advertisement regression was discovered in github.com/stacklok/toolhive-core/mcpcompat v0.0.27.

Finding

A spec-compliant client initializing against vMCP receives capabilities: {"logging":{}} in the initialize result. The capabilities.tools and capabilities.resources fields are absent.

This is because per-session tool registration (via SetSessionTools) happens AFTER the initialize response is constructed — the OnRegisterSession hook fires after the response is written. The server-level advertised capabilities never reflect the per-session tools/resources.

Impact: Clients that gate tools/list on the presence of capabilities.tools (as the MCP spec allows) will see zero tools. This is a critical regression — it breaks spec-compliant clients.

This is tracked as finding U1 in stacklok/toolhive-core#156.

Regression test coverage

• TestRegression_InitializeAdvertisesToolsAndResourcesCapabilities in pkg/vmcp/server/capability_regression_test.go — pins the current (broken) behavior with documented assertions. When the shim is fixed, the assertions should be flipped to verify capabilities ARE advertised.

MCP spec reference

MCP 2025-11-25 §"Capabilities": the initialize result's capabilities object must advertise tools and resources when the server supports them.

Acceptance criteria

When the shim is fixed:

• The initialize response should include capabilities.tools (non-nil) and capabilities.resources (non-nil) when the server has tools/resources
• The regression test should be updated to assert the correct behavior