Research across 8 multi-server agent clients (Claude Code, Codex, Gemini
CLI, VS Code, Cline, Roo Code, Goose, OpenCode) showed all of them keep
the server namespace in model-facing MCP tool names; the RFC's premise
for raw names ("servers already prefix their tools") is false for the
official GitHub/filesystem/Sentry servers.
- Config: drop toolPrefix; require serverName ([A-Za-z0-9_-]{1,32}),
duplicate serverName fails the later instance at load (per-root
reservation, released on dispose)
- Names: always mcp__<serverName>__<rawName>; normalize to the DeepSeek
64-char [A-Za-z0-9_-] contract with a deterministic 12-hex identity
hash on lossy normalization; raw name is the only thing sent on the
wire (tools/call)
- Sync: two-phase fetch/swap — fetch failure keeps the previous
generation; a swap conflict rolls back the whole generation (never a
partial set); duplicate raw names reject the tool list
- RFC: moved to implemented/ (status + skeleton rewritten per the
format contract), naming design + tier-level test coverage recorded
- Tests: naming algorithm unit suite; keyless Streamable HTTP e2e
against an in-process StreamableHTTPServerTransport (namespace
discovery, execution, per-request auth headers); dotted-name
normalization e2e via a new fixture tool
pkg stores application files in a virtual filesystem, and its
worker_threads hook discovers worker entry points only when they are passed
as filesystem strings. Convert the code-runtime entry with fileURLToPath()
and return the workflow built entry as a string while retaining its
source-mode data URL bootstrap.
Emit worker entry bundles as CommonJS .cjs files. pkg executes a VFS-backed
string-path worker through Module._compile, so an ESM-only entry can be
present in the executable yet still fail when launched. Keep the public hosts
ESM, adapt worker startup accordingly, and align exports, package file lists,
workspace constraints, documentation, and built-worker tests with the actual
artifact format.
Expand the custom-config executable smoke to load the Code Mode and workflow
plugins and script real run_code and zero-agent workflow calls. Require both
tools to return 42 from workers launched inside the pkg VFS, turning worker
support from an asset-presence assumption into an end-to-end runtime
contract.
Update the implemented RFC and verification gates to describe and exercise
the supported built-worker path. This adds no tool or JSON-RPC protocol shape;
it fixes how existing worker-backed capabilities are located and executed in
the single-file distribution.
Keep DeepSeekHarness.run() reusable, but make ownership of its lazy
runtime process explicit. Document the context-manager/close contract and
update every construction example to use a context manager so repeated runs
remain valid without encouraging leaked subprocesses.
Contain notification predicate failures at the subscription boundary. Remove
only the subscriber whose callback raised, deliver that exception through its
queue, and continue dispatching to healthy subscribers so arbitrary callback
code cannot terminate the shared reader thread or strand later requests.
Enforce one in-flight prompt per server session with an atomic activePrompt
guard. Route overlap through the existing -32603 handler-error response and
clear the guard in finally, preserving parallel prompts across sessions and
sequential reuse without changing JSON-RPC request or notification shapes.
Use StringDecoder for line framing so a UTF-8 code point split across Buffer
chunks is not corrupted. Add a queued-write flush barrier, and make memoized
shutdown await it before disposal and exit while retaining exactly-once
cleanup when shutdown calls race or flushing fails.
Cover callback isolation, same-session exclusion, cross-session concurrency,
split multibyte input, delayed writes, racing shutdown, and flush failure with
deterministic tests.
Tianyi Cui
lintianle
Yichen Jiang