@chrischall/gemini-mcp 2.3.1 → 2.3.3

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "MCP server for Google Gemini image generation and editing — generate and edit images via the Gemini API",
-    "version": "2.3.1"
+    "version": "2.3.3"
   },
   "plugins": [
     {
@@ -15,7 +15,7 @@
       "displayName": "Gemini Images",
       "source": "./",
       "description": "Generate and edit images with Google Gemini image models (Nano Banana / Nano Banana Pro) via natural language prompts",
-      "version": "2.3.1",
+      "version": "2.3.3",
       "author": {
         "name": "Chris Hall"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "gemini-mcp",
   "displayName": "Gemini Images",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "description": "MCP server for Google Gemini image generation and editing — generate and edit images via the Gemini API",
   "author": {
     "name": "Chris Hall",

package/README.md

@@ -26,7 +26,8 @@ Developed and maintained by AI (Claude Code).
 
 Sending a **local file** to Google (the `images` / `master_images` / `video_path` inputs, or
 `gemini_upload_file`'s `path`) and every **delete** ask for confirmation first. A client that can
-show a confirmation prompt (Claude Code) gets the real prompt. Elsewhere the first call does
+show a confirmation prompt (Claude Code) gets the real prompt, unless `MCP_CONFIRM_ELICITATION=off`.
+Elsewhere the first call does
 nothing and returns a preview (the resolved local paths with their MIME types and sizes, or the
 method/path being deleted) plus a `confirmToken`; only a repeat call with the same arguments and
 that token proceeds. The token is single-use, expires, and is bound to the exact arguments — a
@@ -35,7 +36,8 @@ changed prompt or a swapped file between the two calls is refused. Pure text pro
 
 | variable | default | |
 |---|---|---|
-| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_MODE` | `ask-user` | What a write does on a client that cannot show a confirmation prompt (claude.ai, Claude Desktop). `ask-user`: two steps — the first call does nothing and returns a preview plus a token, and the model must get your approval in chat before calling again with it. `auto`: the same two steps, but the model may use the token after reviewing the preview itself. `refuse`: writes are refused on such clients. A client that can show prompts (Claude Code) always gets the real prompt, unless `MCP_CONFIRM_ELICITATION=off`. An unrecognised value is treated as `refuse`. |
+| `MCP_CONFIRM_ELICITATION` | `on` | `off` never shows a confirmation prompt, so every client gets the `MCP_CONFIRM_MODE` path. Set it for a client that claims to support prompts but never shows one (the gated call hangs — opencode 2.0.x). Any other value stays `on`, with a warning on stderr. |
 | `MCP_CONFIRM_TTL_SECONDS` | `600` | How long a token stays valid. |
 | `MCP_CONFIRM_SECRET` | random per process | Signing key; set it only if tokens must survive a server restart. |
 

package/dist/bundle.js

@@ -24393,7 +24393,7 @@ var init_internal = __esm({
   }
 });
 
-// node_modules/@modelcontextprotocol/server/dist/src-BHSMhZ_W.mjs
+// node_modules/@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs
 function stampErrorBrands(instance, ctor) {
   const brands = /* @__PURE__ */ new Set();
   let current = ctor;
@@ -26373,7 +26373,8 @@ function build() {
     ListResourceTemplatesResultResponseSchema: wireResultResponse(ListResourceTemplatesResultSchema$1),
     ReadResourceResultResponseSchema: wireResultResponse(z2.union([ReadResourceResultSchema$1, InputRequiredResultSchema])),
     CompleteResultResponseSchema: wireResultResponse(CompleteResultSchema$1),
-    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1)
+    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1),
+    SubscriptionsListenResultResponseSchema: wireResultResponse(SubscriptionsListenResultSchema$1)
   };
 }
 function buildSchemas2026() {
@@ -26592,6 +26593,9 @@ function isSpecRequestMethod(method) {
 function isSpecNotificationMethod(method) {
   return ALL_CODECS.some((codec2) => codec2.hasNotificationMethod(method));
 }
+function isExtensionReusedRequestMethod(method) {
+  return method === "tasks/get" || method === "tasks/cancel";
+}
 function isPlainObject$3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -27166,8 +27170,8 @@ function normalizeRawShapeSchema(schema) {
   return schema;
 }
 var z2, BRANDS, OAuthError, SdkErrorCode, SdkError, SdkHttpError, FIRST_MODERN_PROTOCOL_VERSION, SUPPORTED_MODERN_PROTOCOL_VERSIONS, TOOL_RESULT_FOREIGN_FAMILY_KEYS, memo$1, REF_REWRITE_DATA_POSITION_KEYS, REF_REWRITE_NAME_MAP_KEYS, requestMethodKeys$1, notificationMethodKeys$1, resultMethodKeys, maps$1, rev2025RequestMethods, rev2025NotificationMethods, NOT_IN_ERA$1, rev2025Codec, memo, CACHEABLE_RESULT_METHODS, RESULT_CACHE_HINT_FALLBACK, ProtocolErrorCode, ProtocolError, ResourceNotFoundError, UrlElicitationRequiredError, UnsupportedProtocolVersionError, MissingRequiredClientCapabilityError, DEFAULT_CACHE_TTL_MS, DEFAULT_CACHE_SCOPE, EXTENDED_RESULT_TYPE_METHODS, INPUT_REQUEST_METHODS_2026, maps, requestMethodKeys, notificationMethodKeys, rev2026RequestMethods, rev2026NotificationMethods, NOT_IN_ERA, REQUIRED_ENVELOPE_KEYS, rev2026Codec, wireResultSchemasMemo, MODERN_WIRE_REVISION, ALL_CODECS, schemas_exports, isJSONRPCRequest, isJSONRPCNotification, isJSONRPCResultResponse, isJSONRPCErrorResponse, isInputRequiredResult, X_MCP_HEADER_KEY, RFC9110_TOKEN, PERMITTED_X_MCP_HEADER_TYPES, NON_REACHABLE_SUBSCHEMA_KEYWORDS, OBJECT_VALUED_SUBSCHEMA_KEYWORDS, HEADER_MISMATCH_ERROR_CODE, INBOUND_VALIDATION_LADDER, LADDER_ERROR_HTTP_STATUS, warnedZodFallback, JSON_SCHEMA_CONVERSION_TARGET, DATETIME_FRACTION_DIGITS, ANNOTATION_ONLY_JSON_SCHEMA_KEYWORDS, ROOT_KEYS, PROPERTY_KEYS_BY_TYPE, SUPPORTED_STRING_FORMATS, inputRequired, REQUEST_STATE_ONLY_LEG_PACING_MS, SPEC_SCHEMA_KEYS, authSchemas, _specTypeSchemas, _isSpecType, specTypeSchemas, isSpecType, DEFAULT_REQUEST_TIMEOUT_MSEC, RESERVED_ENVELOPE_META_KEYS, RETRY_PARAMS_KEYS, NO_REQUEST_STATE, writeNegotiatedProtocolVersion, Protocol, require_content_type, import_content_type, STDIO_DEFAULT_MAX_BUFFER_SIZE, ReadBuffer, TOOL_NAME_REGEX;
-var init_src_BHSMhZ_W = __esm({
-  "node_modules/@modelcontextprotocol/server/dist/src-BHSMhZ_W.mjs"() {
+var init_src_Cqbh3MYc = __esm({
+  "node_modules/@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs"() {
     init_chunk_Br0eD_fh();
     init_dialects_DoSzNhcb();
     init_internal();
@@ -28267,6 +28271,8 @@ var init_src_BHSMhZ_W = __esm({
       _transport;
       _requestMessageId = 0;
       _requestHandlers = /* @__PURE__ */ new Map();
+      /** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+      _customSchemaRequestMethods = /* @__PURE__ */ new Set();
       _requestHandlerAbortControllers = /* @__PURE__ */ new Map();
       _notificationHandlers = /* @__PURE__ */ new Map();
       _responseHandlers = /* @__PURE__ */ new Map();
@@ -28550,7 +28556,7 @@ var init_src_BHSMhZ_W = __esm({
             return;
           }
         }
-        if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method)) {
+        if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method) && !(isExtensionReusedRequestMethod(request.method) && this._customSchemaRequestMethods.has(request.method))) {
           sendErrorResponse(ProtocolErrorCode.MethodNotFound, "Method not found");
           return;
         }
@@ -28683,8 +28689,11 @@ var init_src_BHSMhZ_W = __esm({
       }
       request(request, schemaOrOptions, maybeOptions) {
         const codec2 = this._resolveOutboundCodec(request.method);
+        if (isStandardSchema(schemaOrOptions)) {
+          if (!isExtensionReusedRequestMethod(request.method)) this._assertOutboundRequestInEra(codec2, request.method);
+          return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
+        }
         this._assertOutboundRequestInEra(codec2, request.method);
-        if (isStandardSchema(schemaOrOptions)) return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
         const validate2 = codecResultValidator(codec2, request.method);
         if (validate2 === void 0) throw new TypeError(`'${request.method}' is not a spec method; pass a result schema as the second argument to request().`);
         return this._requestWithSchemaViaCodec(codec2, request, validate2, schemaOrOptions);
@@ -28928,6 +28937,8 @@ var init_src_BHSMhZ_W = __esm({
           return maybeHandler(parsed.data, ctx);
         };
         else throw new TypeError("setRequestHandler: handler is required");
+        if (typeof schemasOrHandler === "function") this._customSchemaRequestMethods.delete(method);
+        else this._customSchemaRequestMethods.add(method);
         this._requestHandlers.set(method, this._wrapHandler(method, stored));
       }
       /**
@@ -28957,6 +28968,7 @@ var init_src_BHSMhZ_W = __esm({
       */
       removeRequestHandler(method) {
         this._requestHandlers.delete(method);
+        this._customSchemaRequestMethods.delete(method);
       }
       /**
       * Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
@@ -36099,7 +36111,7 @@ var init_shimsNode = __esm({
   }
 });
 
-// node_modules/@modelcontextprotocol/server/dist/mcp-DYuW2ZSs.mjs
+// node_modules/@modelcontextprotocol/server/dist/mcp-DIH4cS6P.mjs
 function isCompletable(schema) {
   return !!schema && typeof schema === "object" && COMPLETABLE_SYMBOL in schema;
 }
@@ -36209,6 +36221,30 @@ function serverIdentityOf(server) {
 function discoverAdvertisedCapabilities(capabilities) {
   return { ...capabilities };
 }
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node2 = stack.pop();
+    if (node2 === null || typeof node2 !== "object") continue;
+    if (Array.isArray(node2)) for (const child of node2) {
+      if (++count > max) return count;
+      if (child !== null && typeof child === "object") stack.push(child);
+    }
+    else for (const key in node2) {
+      if (!Object.prototype.hasOwnProperty.call(node2, key)) continue;
+      if (++count > max) return count;
+      const child = node2[key];
+      if (child !== null && typeof child === "object") stack.push(child);
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === void 0 || value === Infinity) return void 0;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  return value;
+}
 function createToolExecutor(inputSchema, handler) {
   if (inputSchema) {
     const callback$1 = handler;
@@ -36217,6 +36253,12 @@ function createToolExecutor(inputSchema, handler) {
   const callback = handler;
   return async (_args, ctx) => callback(ctx);
 }
+function convertListedInputSchema(name, inputSchema) {
+  const json2 = standardSchemaToJsonSchema(inputSchema, "input");
+  const scan = scanXMcpHeaderDeclarations(json2);
+  if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
+  return json2;
+}
 function convertOutputSchemaJson(outputSchema) {
   if (outputSchema === void 0) return void 0;
   try {
@@ -36229,7 +36271,7 @@ function createPromptHandler(name, argsSchema, callback) {
   if (argsSchema) {
     const typedCallback = callback;
     return async (args, ctx) => {
-      const parseResult = await validateStandardSchema(argsSchema, args);
+      const parseResult = await validateStandardSchema(argsSchema, args ?? {});
       if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for prompt ${name}: ${parseResult.error}`);
       return typedCallback(parseResult.data, ctx);
     };
@@ -36259,9 +36301,9 @@ function unwrapOptionalSchema(schema) {
   return schema.def?.innerType ?? schema;
 }
 var COMPLETABLE_SYMBOL, MAX_TIMER_DELAY_MS, DEFAULT_MAX_SUBSCRIPTIONS, CHANGE_NOTIFICATION_METHODS, StdioListenRouter, DEFAULT_LEGACY_SHIM_MAX_ROUNDS, DEFAULT_LEGACY_SHIM_ROUND_TIMEOUT_MS, LegacyInputRequiredShim, INPUT_REQUIRED_CAPABLE_METHODS, writeClientIdentity, installDiscoverHandler, readServerIdentity, Server, McpServer, EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT;
-var init_mcp_DYuW2ZSs = __esm({
-  "node_modules/@modelcontextprotocol/server/dist/mcp-DYuW2ZSs.mjs"() {
-    init_src_BHSMhZ_W();
+var init_mcp_DIH4cS6P = __esm({
+  "node_modules/@modelcontextprotocol/server/dist/mcp-DIH4cS6P.mjs"() {
+    init_src_Cqbh3MYc();
     init_shimsNode();
     COMPLETABLE_SYMBOL = /* @__PURE__ */ Symbol.for("mcp.completable");
     MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
@@ -36284,7 +36326,7 @@ var init_mcp_DYuW2ZSs = __esm({
       _serverCapabilities;
       /**
       * The serving instance's identity, stamped onto the graceful-close
-      * results' `_meta` (the spec's `SubscriptionsListenResultMeta` extends
+      * results' `_meta` (the spec's `SubscriptionsListenResultMetaObject` extends
       * `ResultMetaObject`). Handed over together with the capabilities.
       */
       _serverInfo;
@@ -36550,6 +36592,11 @@ var init_mcp_DYuW2ZSs = __esm({
         if (modernProtocolVersions(this._supportedProtocolVersions).length > 0) this.setRequestHandler("server/discover", () => this._ondiscover());
         if (this._capabilities.logging) this._registerLoggingHandler();
       }
+      /** Attaches to the given transport; rejects while this instance is connected to another one. */
+      async connect(transport) {
+        if (this.transport !== void 0) throw new SdkError(SdkErrorCode.AlreadyConnected, "Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first.");
+        await super.connect(transport);
+      }
       /**
       * Registers the built-in `logging/setLevel` request handler.
       *
@@ -37105,16 +37152,12 @@ var init_mcp_DYuW2ZSs = __esm({
       * The underlying {@linkcode Server} instance, useful for advanced operations like sending notifications.
       */
       server;
+      _maxToolInputElements;
       _registeredResources = {};
       _registeredResourceTemplates = {};
       _registeredTools = {};
       _registeredPrompts = {};
-      /**
-      * Per-tool JSON-converted `inputSchema`, memoized so the SEP-2243
-      * registration-time scan and the pre-dispatch validation step share one
-      * conversion instead of paying it twice per request under the
-      * per-request-factory `createMcpHandler` model.
-      */
+      /** Per-tool JSON-converted `inputSchema`, filled on first use by `toolInputSchemaJson()`. */
       _toolInputSchemaJson = {};
       /**
       * The JSON-serialized `inputSchema` of a registered tool, or `undefined`
@@ -37139,6 +37182,7 @@ var init_mcp_DYuW2ZSs = __esm({
       }
       constructor(serverInfo, options) {
         this.server = new Server(serverInfo, options);
+        this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
         if (options?.capabilities?.tools) this.setToolRequestHandlers();
         if (options?.capabilities?.resources) this.setResourceRequestHandlers();
         if (options?.capabilities?.prompts) this.setPromptRequestHandlers();
@@ -37211,7 +37255,7 @@ var init_mcp_DYuW2ZSs = __esm({
             name,
             title: tool.title,
             description: tool.description,
-            inputSchema: tool.inputSchema ? standardSchemaToJsonSchema(tool.inputSchema, "input") : EMPTY_OBJECT_JSON_SCHEMA,
+            inputSchema: tool.inputSchema ? convertListedInputSchema(name, tool.inputSchema) : EMPTY_OBJECT_JSON_SCHEMA,
             annotations: tool.annotations,
             icons: tool.icons,
             execution: tool.execution,
@@ -37256,6 +37300,7 @@ var init_mcp_DYuW2ZSs = __esm({
       * Validates tool input arguments against the tool's input schema.
       */
       async validateToolInput(tool, args, toolName) {
+        if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
         if (!tool.inputSchema) return;
         const parseResult = await validateStandardSchema(tool.inputSchema, args ?? {});
         if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Input validation error: Invalid arguments for tool ${toolName}: ${parseResult.error}`);
@@ -37530,20 +37575,19 @@ var init_mcp_DYuW2ZSs = __esm({
       }
       _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
         validateAndWarnToolName(name);
-        if (inputSchema !== void 0) try {
-          const json2 = standardSchemaToJsonSchema(inputSchema, "input");
-          this._toolInputSchemaJson[name] = json2;
-          const scan = scanXMcpHeaderDeclarations(json2);
-          if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
-        } catch {
-        }
         let currentHandler = handler;
+        let outputSchemaJson;
         const registeredTool = {
           title,
           description,
           inputSchema,
           outputSchema,
-          outputSchemaJson: convertOutputSchemaJson(outputSchema),
+          get outputSchemaJson() {
+            return outputSchemaJson ??= convertOutputSchemaJson(registeredTool.outputSchema);
+          },
+          set outputSchemaJson(value) {
+            outputSchemaJson = value;
+          },
           annotations,
           icons,
           execution,
@@ -37987,8 +38031,8 @@ function toError(value) {
 var swallowsErrorsAfterClose, StdioServerTransport, DISCARD_ANSWER_TIMEOUT_MS, StdioConnectionChannel;
 var init_stdio = __esm({
   "node_modules/@modelcontextprotocol/server/dist/stdio.mjs"() {
-    init_mcp_DYuW2ZSs();
-    init_src_BHSMhZ_W();
+    init_mcp_DIH4cS6P();
+    init_src_Cqbh3MYc();
     init_shimsNode();
     swallowsErrorsAfterClose = /* @__PURE__ */ Symbol("swallowsErrorsAfterClose");
     StdioServerTransport = class {
@@ -38179,8 +38223,8 @@ var init_stdio = __esm({
 var DEFAULT_MAX_REQUEST_BODY_SIZE;
 var init_dist = __esm({
   "node_modules/@modelcontextprotocol/server/dist/index.mjs"() {
-    init_mcp_DYuW2ZSs();
-    init_src_BHSMhZ_W();
+    init_mcp_DIH4cS6P();
+    init_src_Cqbh3MYc();
     init_shimsNode();
     DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
   }
@@ -58808,6 +58852,15 @@ ${JSON.stringify(preview, null, 2)}`,
   };
   const response = inputResponse(ctx.mcpReq.inputResponses, requestKey);
   const accepted = acceptedContent(ctx.mcpReq.inputResponses, requestKey, confirmationSchema);
+  if (options.elicitation === false) {
+    return textResult({
+      confirmed: false,
+      dispatched: false,
+      action: options.action,
+      reason: "confirmation-unsupported",
+      note: options.unsupportedNote ? `${DISABLED_NOTE}. ${options.unsupportedNote}` : `${DISABLED_NOTE}.`
+    });
+  }
   if (response.kind === "missing") {
     if (callerAcceptsFormElicitation(ctx) === false) {
       return textResult({
@@ -58838,7 +58891,7 @@ ${JSON.stringify(preview, null, 2)}`,
     note: "Nothing was changed because the confirmation was declined, cancelled, or left unchecked."
   });
 }
-var DEFAULT_REQUEST_KEY, DEFAULT_CONFIRMATION_LABEL, UNSUPPORTED_NOTE, STATE_PREFIX;
+var DEFAULT_REQUEST_KEY, DEFAULT_CONFIRMATION_LABEL, UNSUPPORTED_NOTE, DISABLED_NOTE, STATE_PREFIX;
 var init_confirmation = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirmation.js"() {
     init_dist();
@@ -58849,6 +58902,7 @@ var init_confirmation = __esm({
     DEFAULT_REQUEST_KEY = "confirmation";
     DEFAULT_CONFIRMATION_LABEL = "Confirm this action should proceed.";
     UNSUPPORTED_NOTE = "Nothing was done because this client cannot show a confirmation prompt (it declares no MCP elicitation capability), and this action is never taken without one";
+    DISABLED_NOTE = "Nothing was done because confirmation prompts are turned off for this server, and this action is never taken without one";
     STATE_PREFIX = "mcpu.confirm.v1.";
   }
 });
@@ -59002,7 +59056,7 @@ async function tokenConfirmation(action, fb) {
 }
 async function requireConfirmationWithFallback(ctx, options) {
   const { tokenFallback, ...confirmation } = options;
-  if (tokenFallback && callerAcceptsFormElicitation(ctx) === false) {
+  if (tokenFallback && (options.elicitation === false || callerAcceptsFormElicitation(ctx) === false)) {
     return tokenConfirmation(options.action, tokenFallback);
   }
   return requireConfirmation(ctx, confirmation);
@@ -59179,6 +59233,20 @@ function readConfirmMode(env = process.env) {
   }
   return "refuse";
 }
+function readConfirmElicitation(env = process.env) {
+  const raw = readEnvVar("MCP_CONFIRM_ELICITATION", { env })?.trim().toLowerCase();
+  if (!raw || raw === "on")
+    return "on";
+  if (raw === "off")
+    return "off";
+  const key = `elicitation:${raw}`;
+  if (!warned.has(key)) {
+    warned.add(key);
+    process.stderr.write(`MCP_CONFIRM_ELICITATION="${raw}" is not one of on, off; treating it as on.
+`);
+  }
+  return "on";
+}
 function readConfirmTtl(env) {
   const raw = readEnvVar("MCP_CONFIRM_TTL_SECONDS", { env })?.trim();
   if (!raw)
@@ -59231,10 +59299,13 @@ function confirmationFromEnv(options) {
   const spent = callerSpent ?? spentTokenStoreFromEnv(env);
   const mode = readConfirmMode(env);
   const ttlSeconds = readConfirmTtl(env);
+  const elicitationOff = readConfirmElicitation(env) === "off";
   const bound = args === void 0 ? void 0 : boundArgs(args);
-  const confirmation = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  const bindingAdded = bound === void 0 || rest.binding ? rest : { ...rest, binding: { key: confirmKeyFromEnv(env), args: bound, ttlSeconds: ttlSeconds ?? DEFAULT_TTL_SECONDS2 } };
+  const confirmation = elicitationOff ? { ...bindingAdded, elicitation: false } : bindingAdded;
   if (mode === "refuse" || ttlSeconds === void 0) {
-    const hint = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const reason = mode === "refuse" ? REFUSE_HINT : BAD_TTL_HINT;
+    const hint = elicitationOff ? `${ELICITATION_OFF_HINT} ${reason}` : reason;
     return {
       ...confirmation,
       unsupportedNote: confirmation.unsupportedNote ? `${confirmation.unsupportedNote} ${hint}` : hint
@@ -59260,7 +59331,7 @@ function confirmationFromEnv(options) {
     }
   };
 }
-var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, fileStores, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT, BAD_TTL_HINT;
+var MODES, DEFAULT_TTL_SECONDS2, warned, processKey, fileStores, CONFIRM_TOKEN_AUTO_INSTRUCTION, REFUSE_HINT, ELICITATION_OFF_HINT, BAD_TTL_HINT;
 var init_confirm_env = __esm({
   "node_modules/@chrischall/mcp-utils/dist/server/confirm-env.js"() {
     init_config();
@@ -59272,6 +59343,7 @@ var init_confirm_env = __esm({
     fileStores = /* @__PURE__ */ new Map();
     CONFIRM_TOKEN_AUTO_INSTRUCTION = "Nothing has been done yet. Review this preview; if it is what was intended, call again with the same arguments plus confirmToken. (This server runs with MCP_CONFIRM_MODE=auto, so the user's approval in chat is not required.)";
     REFUSE_HINT = "Set MCP_CONFIRM_MODE=ask-user on the server to allow two-step confirmation instead.";
+    ELICITATION_OFF_HINT = "MCP_CONFIRM_ELICITATION=off on the server turns confirmation prompts off.";
     BAD_TTL_HINT = "MCP_CONFIRM_TTL_SECONDS on the server is not a positive whole number of seconds; fix it to allow two-step confirmation.";
   }
 });
@@ -59368,7 +59440,10 @@ function surfaceToolHints(server) {
   ));
 }
 async function createMcpServer(opts) {
-  const server = new McpServer({ name: opts.name, version: opts.version }, { supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS] });
+  const server = new McpServer({ name: opts.name, version: opts.version }, {
+    supportedProtocolVersions: [...SERVER_PROTOCOL_VERSIONS],
+    ...opts.maxToolInputElements !== void 0 ? { maxToolInputElements: opts.maxToolInputElements } : {}
+  });
   if (opts.surfaceHints !== false)
     surfaceToolHints(server);
   if (opts.banner !== void 0) {
@@ -59770,6 +59845,21 @@ var init_fs = __esm({
   }
 });
 
+// node_modules/@chrischall/mcp-utils/dist/internal/headers.js
+function responseHeader(res, name) {
+  return getHeader(res?.headers, name);
+}
+function getHeader(headers, name) {
+  if (!headers || typeof headers.get !== "function")
+    return null;
+  const value = headers.get.call(headers, name);
+  return typeof value === "string" ? value : null;
+}
+var init_headers = __esm({
+  "node_modules/@chrischall/mcp-utils/dist/internal/headers.js"() {
+  }
+});
+
 // node_modules/@chrischall/mcp-utils/dist/internal/ascii.js
 var init_ascii = __esm({
   "node_modules/@chrischall/mcp-utils/dist/internal/ascii.js"() {
@@ -60020,7 +60110,7 @@ function createApiClient(opts) {
       if (retryStatuses.includes(res.status) && attempt < retry.count) {
         discard(current);
         attempt += 1;
-        const delay = retry.honorRetryAfter ? parseRetryAfterMs(res.headers.get("retry-after"), {
+        const delay = retry.honorRetryAfter ? parseRetryAfterMs(responseHeader(res, "retry-after"), {
           defaultMs: retry.delayMs,
           capMs: retry.maxRetryAfterMs ?? 3e4
         }) : retry.delayMs;
@@ -60033,7 +60123,7 @@ function createApiClient(opts) {
   async function unauthorizedOrEdge(attempt, method, path) {
     const res = attempt.res;
     let text = "";
-    if (/json/i.test(res.headers.get("content-type") ?? "")) {
+    if (/json/i.test(responseHeader(res, "content-type") ?? "")) {
       discard(attempt);
     } else {
       text = await readBody(attempt, (r) => r.text()).catch(() => "");
@@ -60045,14 +60135,14 @@ function createApiClient(opts) {
   }
   async function rateLimitedError(attempt, method, path) {
     const res = attempt.res;
-    const retryAfter = res.headers.get("retry-after");
+    const retryAfter = responseHeader(res, "retry-after");
     const retryAfterMs = retryAfterToMs(retryAfter);
     if (!opts.onRateLimited) {
       discard(attempt);
       return new RateLimitedError(service, retryAfterMs);
     }
     let text = "";
-    if (/json/i.test(res.headers.get("content-type") ?? "")) {
+    if (/json/i.test(responseHeader(res, "content-type") ?? "")) {
       discard(attempt);
     } else {
       text = await readBody(attempt, (r) => r.text()).catch(() => "");
@@ -60112,7 +60202,7 @@ function createApiClient(opts) {
     const bytes = new Uint8Array(await readBody(attempt, (r) => r.arrayBuffer()));
     return {
       status: res.status,
-      contentType: res.headers.get("content-type"),
+      contentType: responseHeader(res, "content-type"),
       headers: res.headers,
       bytes
     };
@@ -60145,6 +60235,7 @@ function formatApiError(status, method, path, errorText, opts = {}) {
 var DEFAULT_RETRY, defaultSleep, UnauthorizedError, RateLimitedError, RequestTimeoutError, ApiError, EdgeBlockedError, EDGE_BLOCK_SCAN_MAX, EDGE_BLOCK_MARKERS;
 var init_http = __esm({
   "node_modules/@chrischall/mcp-utils/dist/http/index.js"() {
+    init_headers();
     init_cancel();
     init_errors();
     init_scrape();
@@ -60320,6 +60411,7 @@ var init_es256 = __esm({
 // node_modules/@chrischall/mcp-utils/dist/auth/index.js
 var init_auth = __esm({
   "node_modules/@chrischall/mcp-utils/dist/auth/index.js"() {
+    init_headers();
     init_config();
     init_errors();
     init_http();
@@ -60691,7 +60783,7 @@ async function loadStdioDotenv() {
 }
 
 // src/version.ts
-var VERSION = "2.3.1";
+var VERSION = "2.3.3";
 
 // src/errors.ts
 init_dist2();
@@ -65725,7 +65817,7 @@ await runMcp({
 });
 /*! Bundled license information:
 
-@modelcontextprotocol/server/dist/src-BHSMhZ_W.mjs:
+@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Single source of the server version. release-please bumps the literal below. */
-export const VERSION = '2.3.1'; // x-release-please-version
+export const VERSION = '2.3.3'; // x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrischall/gemini-mcp",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "mcpName": "io.github.chrischall/gemini-mcp",
   "description": "Gemini image-generation MCP server for Claude — developed and maintained by AI (Claude Code)",
   "author": "Claude Code (AI) <https://www.anthropic.com/claude>",
@@ -46,13 +46,13 @@
     "typecheck": "tsc -p tsconfig.test.json"
   },
   "dependencies": {
-    "@chrischall/mcp-utils": "^2.13.0",
-    "@modelcontextprotocol/server": "^2.2.0",
+    "@chrischall/mcp-utils": "^2.15.0",
+    "@modelcontextprotocol/server": "^2.3.0",
     "dotenv": "^18.0.2",
     "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@modelcontextprotocol/client": "^2.2.0",
+    "@modelcontextprotocol/client": "^2.3.0",
     "@types/node": "^26.0.0",
     "@vitest/coverage-v8": "^5.0.0",
     "esbuild": "^0.28.0",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/chrischall/gemini-mcp",
     "source": "github"
   },
-  "version": "2.3.1",
+  "version": "2.3.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@chrischall/gemini-mcp",
-      "version": "2.3.1",
+      "version": "2.3.3",
       "transport": {
         "type": "stdio"
       },

package/skills/gemini-mcp/SKILL.md

@@ -307,7 +307,7 @@ Condensed from Google's official Nano Banana prompting guide. Core rule:
 
 ## Notes
 
-- **Confirmations.** Local file inputs (`images`, `master_images`, `video_path`, `gemini_upload_file`'s `path`) and every delete are confirmed before anything is sent: a confirmation prompt where the client supports one; otherwise the first call does nothing and returns `status: "confirmation-required"` with a `preview` (resolved paths, MIME types, sizes — or the method/path being deleted) and a `confirmToken`. Show the preview to the user, and only after they approve call again with the **same arguments** plus `confirmToken`. The token is single-use, expires (default 10 min), and is bound to those exact arguments — change anything and the call is refused (`DRAFT_CHANGED`, with a fresh preview and token). `MCP_CONFIRM_MODE` on the server picks `ask-user` (default), `auto` (the model may approve after reviewing the preview) or `refuse`. Text prompts, URLs, `files/` references and base64 inputs are not gated.
+- **Confirmations.** Local file inputs (`images`, `master_images`, `video_path`, `gemini_upload_file`'s `path`) and every delete are confirmed before anything is sent: a confirmation prompt where the client supports one (unless the server sets `MCP_CONFIRM_ELICITATION=off`); otherwise the first call does nothing and returns `status: "confirmation-required"` with a `preview` (resolved paths, MIME types, sizes — or the method/path being deleted) and a `confirmToken`. Show the preview to the user, and only after they approve call again with the **same arguments** plus `confirmToken`. The token is single-use, expires (default 10 min), and is bound to those exact arguments — change anything and the call is refused (`DRAFT_CHANGED`, with a fresh preview and token). `MCP_CONFIRM_MODE` on the server picks `ask-user` (default), `auto` (the model may approve after reviewing the preview) or `refuse`. Text prompts, URLs, `files/` references and base64 inputs are not gated.
 - **Input images** accept either file **paths** (`images` / `master_images`) or **base64/data-URI values** (`images_base64` / `master_images_base64`).
 - **`seed`** makes a result reproducible; it's echoed in the result metadata (a random one is chosen + echoed when omitted). `count>1` uses `seed, seed+1, …` so the images differ. Determinism isn't fully guaranteed by the model.
 - **`filename`/`basename`** set the output name (extension stripped); names never overwrite (a `-2`, `-3` suffix is added). The result echoes the absolute path(s), `model`, `seed`, and aspect/size.