@codingame/monaco-vscode-mcp-service-override 37.6.0 → 38.0.0

package/common.js

@@ -5,10 +5,12 @@ import { AllowedMcpServersService } from './vscode/src/vs/platform/mcp/common/al
 import { IMcpGalleryManifestService } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpGalleryManifest.service';
 import { McpGalleryService } from './vscode/src/vs/platform/mcp/common/mcpGalleryService.js';
 import { IAllowedMcpServersService, IMcpGalleryService } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement.service';
-import { McpResourceScannerService } from './vscode/src/vs/platform/mcp/common/mcpResourceScannerService.js';
+import { McpResourceScannerService } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpResourceScannerService';
 import { IMcpResourceScannerService } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpResourceScannerService.service';
 import { McpElicitationService } from './vscode/src/vs/workbench/contrib/mcp/browser/mcpElicitationService.js';
 import { McpWorkbenchService } from './vscode/src/vs/workbench/contrib/mcp/browser/mcpWorkbenchService.js';
+import { McpCopilotGlobalConfigurationService } from './vscode/src/vs/workbench/contrib/mcp/common/mcpCopilotGlobalConfigurationService.js';
+import { IMcpCopilotGlobalConfigurationService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpCopilotGlobalConfigurationService.service';
 import { McpRegistry } from './vscode/src/vs/workbench/contrib/mcp/common/mcpRegistry.js';
 import { IMcpRegistry } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpRegistryTypes.service';
 import { McpSamplingService } from './vscode/src/vs/workbench/contrib/mcp/common/mcpSamplingService.js';
@@ -24,6 +26,8 @@ import { IAuthenticationMcpUsageService } from '@codingame/monaco-vscode-api/vsc
 import { WorkbenchMcpGalleryManifestService } from './vscode/src/vs/workbench/services/mcp/browser/mcpGalleryManifestService.js';
 import { WorkbenchMcpManagementService } from './vscode/src/vs/workbench/services/mcp/browser/mcpWorkbenchManagementService.js';
 import { IWorkbenchMcpManagementService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/mcp/common/mcpWorkbenchManagementService.service';
+import { McpWorkspaceInstallTargetService } from './vscode/src/vs/workbench/services/mcp/common/mcpWorkspaceInstallTargetService.js';
+import { IMcpWorkspaceInstallTargetService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/mcp/common/mcpWorkspaceInstallTargetService.service';
 import { McpSandboxService } from './vscode/src/vs/workbench/contrib/mcp/common/mcpSandboxService.js';
 import { IWorkbenchMcpGatewayService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpGatewayService.service';
 import { BrowserMcpGatewayService } from './vscode/src/vs/workbench/contrib/mcp/browser/mcpGatewayService.js';
@@ -35,6 +39,8 @@ import './vscode/src/vs/workbench/api/browser/mainThreadMcp.js';
 function getServiceOverride() {
     return {
         [IMcpResourceScannerService.toString()]: new SyncDescriptor(McpResourceScannerService, [], true),
+        [IMcpCopilotGlobalConfigurationService.toString()]: new SyncDescriptor(McpCopilotGlobalConfigurationService, [], true),
+        [IMcpWorkspaceInstallTargetService.toString()]: new SyncDescriptor(McpWorkspaceInstallTargetService, [], true),
         [IMcpService.toString()]: new SyncDescriptor(McpService, [], true),
         [IMcpRegistry.toString()]: new SyncDescriptor(McpRegistry, [], true),
         [IAuthenticationMcpService.toString()]: new SyncDescriptor(AuthenticationMcpService, [], true),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codingame/monaco-vscode-mcp-service-override",
-  "version": "37.6.0",
+  "version": "38.0.0",
   "private": false,
   "description": "VSCode public API plugged on the monaco editor - mcp service-override",
   "keywords": [],
@@ -15,7 +15,7 @@
   },
   "type": "module",
   "dependencies": {
-    "@codingame/monaco-vscode-api": "37.6.0"
+    "@codingame/monaco-vscode-api": "38.0.0"
   },
   "main": "index.js",
   "module": "index.js",

package/session.d.ts

@@ -1 +1,2 @@
-export { default } from "./common.js";
+import type { IEditorOverrideServices } from "@codingame/monaco-vscode-api/vscode/vs/editor/standalone/browser/standaloneServices";
+export default function getServiceOverride(): IEditorOverrideServices;

package/session.js

@@ -1,2 +1,14 @@
 
-export { default } from './common.js';
+import { SyncDescriptor } from '@codingame/monaco-vscode-api/vscode/vs/platform/instantiation/common/descriptors';
+import { SessionsMcpWorkspaceInstallTargetService } from './vscode/src/vs/sessions/services/mcp/browser/mcpWorkspaceInstallTargetService.js';
+import { IMcpWorkspaceInstallTargetService } from '@codingame/monaco-vscode-api/vscode/vs/workbench/services/mcp/common/mcpWorkspaceInstallTargetService.service';
+import getServiceOverride$1 from './common.js';
+
+function getServiceOverride() {
+    return {
+        ...getServiceOverride$1(),
+        [IMcpWorkspaceInstallTargetService.toString()]: new SyncDescriptor(SessionsMcpWorkspaceInstallTargetService, [], true)
+    };
+}
+
+export { getServiceOverride as default };

package/vscode/src/vs/platform/mcp/common/allowedMcpServersService.d.ts

@@ -11,7 +11,10 @@ export declare class AllowedMcpServersService extends Disposable implements IAll
     readonly onDidChangeAllowedMcpServers: import("@codingame/monaco-vscode-api/vscode/vs/base/common/event").Event<void>;
     constructor(configurationService: IConfigurationService);
     isAllowed(mcpServer: IGalleryMcpServer | ILocalMcpServer | IInstallableMcpServer): true | IMarkdownString;
+    isServerAllowedBeforeResolution(identity: IMcpServerIdentity): true | IMarkdownString;
     isServerAllowed(identity: IMcpServerIdentity): true | IMarkdownString;
+    private checkServerAllowed;
+    private checkServerAllowedBeforeResolution;
     private getAllConfiguredMatchers;
     private toIdentity;
 }

package/vscode/src/vs/platform/mcp/common/allowedMcpServersService.js

@@ -4,10 +4,11 @@ import { Disposable } from '@codingame/monaco-vscode-api/vscode/vs/base/common/l
 import { localize } from '@codingame/monaco-vscode-api/vscode/vs/nls';
 import { createCommandUri, MarkdownString } from '@codingame/monaco-vscode-api/vscode/vs/base/common/htmlContent';
 import { IConfigurationService } from '@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service';
+import { hasConfigurationVariable } from '@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configurationVariables';
 import { Emitter } from '@codingame/monaco-vscode-api/vscode/vs/base/common/event';
-import { hasKey } from '@codingame/monaco-vscode-api/vscode/vs/base/common/types';
+import { isString, hasKey } from '@codingame/monaco-vscode-api/vscode/vs/base/common/types';
 import { getMcpServerMatchers, checkMcpServerAllowed, McpServerAllowResult } from './allowedMcpServers.js';
-import { mcpAccessConfig, mcpAllowedServersConfig, mcpDeniedServersConfig, McpAccessValue } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement';
+import { mcpAccessConfig, mcpAllowedServersConfig, mcpDeniedServersConfig, McpAccessValue, replaceMcpServerVariableReferences } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement';
 import { McpServerType } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpPlatformTypes';
 import { COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_CONFIG } from '@codingame/monaco-vscode-api/vscode/vs/platform/policy/common/copilotManagedSettings';
 
@@ -24,15 +25,21 @@ let AllowedMcpServersService = class AllowedMcpServersService extends Disposable
         }));
     }
     isAllowed(mcpServer) {
-        return this.isServerAllowed(this.toIdentity(mcpServer));
+        return this.isServerAllowedBeforeResolution(this.toIdentity(mcpServer));
+    }
+    isServerAllowedBeforeResolution(identity) {
+        return this.checkServerAllowed(identity, "definition");
     }
     isServerAllowed(identity) {
+        return this.checkServerAllowed(identity, "resolved");
+    }
+    checkServerAllowed(identity, phase) {
         if (this.configurationService.getValue(mcpAccessConfig) === McpAccessValue.None) {
             const settingsCommandLink = ( createCommandUri("workbench.action.openSettings", {
                 query: `@id:${mcpAccessConfig}`
             }).toString());
             return (new MarkdownString(localize(
-                2416,
+                2790,
                 "Model Context Protocol servers are disabled in the Editor. Please check your [settings]({0}).",
                 settingsCommandLink
             )));
@@ -40,20 +47,42 @@ let AllowedMcpServersService = class AllowedMcpServersService extends Disposable
         const managedOnly = this.configurationService.getValue(COPILOT_ALLOW_MANAGED_MCP_SERVERS_ONLY_CONFIG) === true;
         const allowlist = managedOnly ? getMcpServerMatchers(this.configurationService.inspect(mcpAllowedServersConfig).policyValue) ?? [] : getMcpServerMatchers(this.configurationService.getValue(mcpAllowedServersConfig));
         const denylist = managedOnly ? this.getAllConfiguredMatchers(mcpDeniedServersConfig) : getMcpServerMatchers(this.configurationService.getValue(mcpDeniedServersConfig));
-        switch (checkMcpServerAllowed(allowlist, denylist, identity)) {
+        const result = phase === "definition" ? this.checkServerAllowedBeforeResolution(allowlist, denylist, identity) : checkMcpServerAllowed(allowlist, denylist, identity);
+        switch (result) {
         case McpServerAllowResult.Denied:
             return (new MarkdownString(localize(
-                2417,
+                2791,
                 "This Model Context Protocol server is blocked by your organization's policy. Please contact your administrator for more information."
             )));
         case McpServerAllowResult.NotAllowed:
             return (new MarkdownString(localize(
-                2418,
+                2792,
                 "This Model Context Protocol server is not in the list of servers allowed by your organization. Please contact your administrator for more information."
             )));
         }
         return true;
     }
+    checkServerAllowedBeforeResolution(allowlist, denylist, identity) {
+        const unresolvedUrl = identity.url !== undefined && hasConfigurationVariable(identity.url);
+        const unresolvedCommand = identity.command?.some(hasConfigurationVariable) ?? false;
+        if (!unresolvedUrl && !unresolvedCommand) {
+            return checkMcpServerAllowed(allowlist, denylist, identity);
+        }
+        const knownIdentity = {
+            name: identity.name,
+            url: unresolvedUrl ? undefined : identity.url,
+            command: unresolvedCommand ? undefined : identity.command
+        };
+        if (checkMcpServerAllowed(undefined, denylist, knownIdentity) === McpServerAllowResult.Denied) {
+            return McpServerAllowResult.Denied;
+        }
+        if (allowlist === undefined || checkMcpServerAllowed(allowlist, undefined, knownIdentity) === McpServerAllowResult.Allowed) {
+            return McpServerAllowResult.Allowed;
+        }
+        return ( allowlist.some(
+            matcher => (unresolvedUrl && isString(matcher.serverUrl)) || (unresolvedCommand && Array.isArray(matcher.serverCommand))
+        )) ? McpServerAllowResult.Allowed : McpServerAllowResult.NotAllowed;
+    }
     getAllConfiguredMatchers(key) {
         const inspected = this.configurationService.inspect(key);
         return [
@@ -83,9 +112,10 @@ let AllowedMcpServersService = class AllowedMcpServersService extends Disposable
                 command: [config.command, ...(config.args ?? [])]
             };
         }
+        const remote = mcpServer.configuration.remotes?.[0];
         return {
             name: mcpServer.name,
-            url: mcpServer.configuration.remotes?.[0]?.url
+            url: remote ? replaceMcpServerVariableReferences(remote.url, remote.variables) : undefined
         };
     }
 };

package/vscode/src/vs/platform/mcp/common/mcpGalleryManifestService.d.ts

@@ -16,6 +16,7 @@ export declare class McpGalleryManifestService extends Disposable implements IMc
     get mcpGalleryManifestStatus(): McpGalleryManifestStatus;
     constructor(productService: IProductService, requestService: IRequestService, logService: ILogService);
     getMcpGalleryManifest(): Promise<IMcpGalleryManifest | null>;
+    getDefaultMcpGalleryManifest(): Promise<IMcpGalleryManifest | null>;
     protected createMcpGalleryManifest(url: string, version?: string): Promise<IMcpGalleryManifest>;
     private getVersion;
     private checkVersion;

package/vscode/src/vs/platform/mcp/common/mcpGalleryManifestService.js

@@ -24,6 +24,9 @@ let McpGalleryManifestService = class McpGalleryManifestService extends Disposab
         this.versionByUrl = ( new Map());
     }
     async getMcpGalleryManifest() {
+        return this.getDefaultMcpGalleryManifest();
+    }
+    async getDefaultMcpGalleryManifest() {
         if (!this.productService.mcpGallery) {
             return null;
         }

package/vscode/src/vs/platform/mcp/common/mcpGalleryService.d.ts

@@ -1,13 +1,18 @@
 import { CancellationToken } from "@codingame/monaco-vscode-api/vscode/vs/base/common/cancellation";
 import { Disposable } from "@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle";
+import { URI } from "@codingame/monaco-vscode-api/vscode/vs/base/common/uri";
 import { IFileService } from "@codingame/monaco-vscode-api/vscode/vs/platform/files/common/files.service";
 import { ILogService } from "@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log.service";
 import { IRequestService } from "@codingame/monaco-vscode-api/vscode/vs/platform/request/common/request.service";
-import { IGalleryMcpServer, IMcpGalleryServerResolveResult, IQueryOptions } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement";
+import { IGalleryMcpServer, IMcpGalleryQueryPage, IMcpGalleryQueryPageOptions, IMcpGalleryServerResolveResult, IQueryOptions } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement";
 import { IMcpGalleryService } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement.service";
 import { IMcpGalleryManifest } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpGalleryManifest";
 import { IMcpGalleryManifestService } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpGalleryManifest.service";
 import { IIterativePager } from "@codingame/monaco-vscode-api/vscode/vs/base/common/paging";
+export declare class UnsupportedMcpGalleryPackageError extends Error {
+    readonly repositoryUrl: URI | undefined;
+    constructor(repositoryUrl: URI | undefined);
+}
 export declare class McpGalleryService extends Disposable implements IMcpGalleryService {
     private readonly requestService;
     private readonly fileService;
@@ -17,21 +22,22 @@ export declare class McpGalleryService extends Disposable implements IMcpGallery
     private galleryMcpServerDataSerializers;
     constructor(requestService: IRequestService, fileService: IFileService, logService: ILogService, mcpGalleryManifestService: IMcpGalleryManifestService);
     isEnabled(): boolean;
-    query(options?: IQueryOptions, token?: CancellationToken): Promise<IIterativePager<IGalleryMcpServer>>;
+    queryPage(options: IMcpGalleryQueryPageOptions, token: CancellationToken, galleryManifest?: IMcpGalleryManifest): Promise<IMcpGalleryQueryPage>;
+    query(options?: IQueryOptions, token?: CancellationToken, manifest?: IMcpGalleryManifest): Promise<IIterativePager<IGalleryMcpServer>>;
     getMcpServersFromGallery(infos: {
         name: string;
         id?: string;
-    }[]): Promise<IGalleryMcpServer[]>;
+    }[], manifest?: IMcpGalleryManifest): Promise<IGalleryMcpServer[]>;
     resolveMcpServersFromGallery(infos: {
         name: string;
         id?: string;
-    }[]): Promise<Map<string, IMcpGalleryServerResolveResult>>;
+    }[], manifest?: IMcpGalleryManifest): Promise<Map<string, IMcpGalleryServerResolveResult>>;
     private getMcpServerByName;
     getReadme(gallery: IGalleryMcpServer, token: CancellationToken): Promise<string>;
     private toGalleryMcpServer;
     private queryGalleryMcpServers;
     private queryRawGalleryMcpServers;
-    getMcpServer(mcpServerUrl: string, mcpGalleryManifest?: IMcpGalleryManifest | null): Promise<IGalleryMcpServer | undefined>;
+    getMcpServer(mcpServerUrl: string, mcpGalleryManifest?: IMcpGalleryManifest | null, token?: CancellationToken): Promise<IGalleryMcpServer | undefined>;
     private serializeMcpServer;
     private serializeMcpServersResult;
     private getSerializer;

package/vscode/src/vs/platform/mcp/common/mcpGalleryService.js

@@ -1,6 +1,7 @@
 
 import { __decorate, __param } from '@codingame/monaco-vscode-api/external/tslib/tslib.es6';
 import { CancellationToken } from '@codingame/monaco-vscode-api/vscode/vs/base/common/cancellation';
+import { raceCancellationError } from '@codingame/monaco-vscode-api/vscode/vs/base/common/async';
 import { MarkdownString } from '@codingame/monaco-vscode-api/vscode/vs/base/common/htmlContent';
 import { Disposable } from '@codingame/monaco-vscode-api/vscode/vs/base/common/lifecycle';
 import { Schemas } from '@codingame/monaco-vscode-api/vscode/vs/base/common/network';
@@ -9,7 +10,7 @@ import { URI } from '@codingame/monaco-vscode-api/vscode/vs/base/common/uri';
 import { localize } from '@codingame/monaco-vscode-api/vscode/vs/nls';
 import { IFileService } from '@codingame/monaco-vscode-api/vscode/vs/platform/files/common/files.service';
 import { ILogService } from '@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log.service';
-import { asText, isSuccess, asJson } from '@codingame/monaco-vscode-api/vscode/vs/platform/request/common/request';
+import { asText, isSuccess, asJson, readBoundedResponse } from '@codingame/monaco-vscode-api/vscode/vs/platform/request/common/request';
 import { IRequestService } from '@codingame/monaco-vscode-api/vscode/vs/platform/request/common/request.service';
 import { RegistryType, TransportType, McpGalleryResolveStatus, GalleryMcpServerStatus } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement';
 import { getMcpGalleryManifestResourceUri, McpGalleryResourceType, McpGalleryManifestStatus } from '@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpGalleryManifest';
@@ -17,6 +18,17 @@ import { IMcpGalleryManifestService } from '@codingame/monaco-vscode-api/vscode/
 import { CancellationError, isCancellationError } from '@codingame/monaco-vscode-api/vscode/vs/base/common/errors';
 import { isString, isObject } from '@codingame/monaco-vscode-api/vscode/vs/base/common/types';
 
+const maxMcpServerResponseBytes = 5 * 1024 * 1024;
+const mcpServerRequestTimeout = 30_000;
+class UnsupportedMcpGalleryPackageError extends Error {
+    constructor(repositoryUrl) {
+        super("The MCP server has no supported package or remote endpoint.");
+        this.repositoryUrl = repositoryUrl;
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function toSupportedPackageRegistryType(input) {
     switch (input) {
     case "npm":
@@ -46,6 +58,25 @@ function filterMcpPackages(packages, getRegistryType, convert) {
     }
     return result;
 }
+function getUnsupportedMcpSetup(data) {
+    if (!isRecord(data) || !isRecord(data.server) || !isString(data.server.name) || !isString(data.server.version) || !Array.isArray(data.server.packages) || data.server.packages.length === 0 || ( data.server.packages.some(
+        item => !isRecord(item) || toSupportedPackageRegistryType(item.registryType)
+    )) || (Array.isArray(data.server.remotes) && data.server.remotes.length > 0)) {
+        return undefined;
+    }
+    const repository = data.server.repository;
+    if (isRecord(repository) && isString(repository.url)) {
+        try {
+            const url = ( new URL(repository.url));
+            if (url.protocol === `${Schemas.https}:` && !url.username && !url.password) {
+                return {
+                    repositoryUrl: ( URI.parse(url.href))
+                };
+            }
+        } catch {}
+    }
+    return {};
+}
 function getMcpServerUrlInGallery(mcpServerUrl, mcpGalleryManifest) {
     const mcpGalleryUrl = getMcpGalleryManifestResourceUri(mcpGalleryManifest, McpGalleryResourceType.McpServersQueryService) ?? mcpGalleryManifest.url;
     try {
@@ -408,8 +439,27 @@ let McpGalleryService = class McpGalleryService extends Disposable {
     isEnabled() {
         return this.mcpGalleryManifestService.mcpGalleryManifestStatus === McpGalleryManifestStatus.Available;
     }
-    async query(options, token = CancellationToken.None) {
-        const mcpGalleryManifest = await this.mcpGalleryManifestService.getMcpGalleryManifest();
+    async queryPage(options, token, galleryManifest) {
+        if (token.isCancellationRequested) {
+            throw ( new CancellationError());
+        }
+        const manifest = galleryManifest ?? (await this.mcpGalleryManifestService.getMcpGalleryManifest());
+        if (!manifest) {
+            throw ( new Error(( localize(2799, "The MCP gallery is not configured."))));
+        }
+        const query = ( new Query()).withPage(options.cursor ?? "", options.pageSize).withSearchText(options.cursor ? undefined : options.text?.trim());
+        const {
+            servers,
+            metadata
+        } = await this.queryGalleryMcpServers(query, manifest, token, true);
+        return {
+            items: servers,
+            total: metadata.count >= servers.length ? metadata.count : undefined,
+            nextCursor: metadata.nextCursor
+        };
+    }
+    async query(options, token = CancellationToken.None, manifest) {
+        const mcpGalleryManifest = manifest ?? (await this.mcpGalleryManifestService.getMcpGalleryManifest());
         if (!mcpGalleryManifest) {
             return {
                 firstPage: {
@@ -462,8 +512,8 @@ let McpGalleryService = class McpGalleryService extends Disposable {
             }
         };
     }
-    async getMcpServersFromGallery(infos) {
-        const resolved = await this.resolveMcpServersFromGallery(infos);
+    async getMcpServersFromGallery(infos, manifest) {
+        const resolved = await this.resolveMcpServersFromGallery(infos, manifest);
         const mcpServers = [];
         for (const result of ( resolved.values())) {
             if (result.status === McpGalleryResolveStatus.Found) {
@@ -472,9 +522,9 @@ let McpGalleryService = class McpGalleryService extends Disposable {
         }
         return mcpServers;
     }
-    async resolveMcpServersFromGallery(infos) {
+    async resolveMcpServersFromGallery(infos, manifest) {
         const result = ( new Map());
-        const mcpGalleryManifest = await this.mcpGalleryManifestService.getMcpGalleryManifest();
+        const mcpGalleryManifest = manifest ?? (await this.mcpGalleryManifestService.getMcpGalleryManifest());
         if (!mcpGalleryManifest) {
             for (const info of infos) {
                 result.set(info.name, {
@@ -545,7 +595,7 @@ let McpGalleryService = class McpGalleryService extends Disposable {
     async getReadme(gallery, token) {
         const readmeUrl = gallery.readmeUrl;
         if (!readmeUrl) {
-            return Promise.resolve(( localize(2419, "No README available")));
+            return Promise.resolve(( localize(2800, "No README available")));
         }
         const uri = ( URI.parse(readmeUrl));
         if (uri.scheme === Schemas.file) {
@@ -557,7 +607,7 @@ let McpGalleryService = class McpGalleryService extends Disposable {
             }
         }
         if (uri.authority !== "raw.githubusercontent.com") {
-            return ( new MarkdownString(( localize(2420, "You can find information about this server [here]({0})", readmeUrl)))).value;
+            return ( new MarkdownString(( localize(2801, "You can find information about this server [here]({0})", readmeUrl)))).value;
         }
         const context = await this.requestService.request({
             type: "GET",
@@ -647,19 +697,22 @@ let McpGalleryService = class McpGalleryService extends Disposable {
             }
         };
     }
-    async queryGalleryMcpServers(query, mcpGalleryManifest, token) {
+    async queryGalleryMcpServers(query, mcpGalleryManifest, token, strict = false) {
         const {
             servers,
             metadata
-        } = await this.queryRawGalleryMcpServers(query, mcpGalleryManifest, token);
+        } = await this.queryRawGalleryMcpServers(query, mcpGalleryManifest, token, strict);
         return {
             servers: servers.map(item => this.toGalleryMcpServer(item, mcpGalleryManifest)),
             metadata
         };
     }
-    async queryRawGalleryMcpServers(query, mcpGalleryManifest, token) {
+    async queryRawGalleryMcpServers(query, mcpGalleryManifest, token, strict = false) {
         const mcpGalleryUrl = this.getMcpGalleryUrl(mcpGalleryManifest);
         if (!mcpGalleryUrl) {
+            if (strict) {
+                throw ( new Error(( localize(2802, "The MCP gallery has no query endpoint."))));
+            }
             return {
                 servers: [],
                 metadata: {
@@ -675,11 +728,14 @@ let McpGalleryService = class McpGalleryService extends Disposable {
                 return JSON.parse(data);
             } catch (error) {
                 this.logService.error(`Failed to read file from ${uri}: ${error}`);
+                if (strict) {
+                    throw error;
+                }
             }
         }
         let url = `${mcpGalleryUrl}?limit=${query.pageSize}&version=latest`;
         if (query.cursor) {
-            url += `&cursor=${query.cursor}`;
+            url += `&cursor=${encodeURIComponent(query.cursor)}`;
         }
         if (query.searchText) {
             const text = encodeURIComponent(query.searchText);
@@ -697,6 +753,9 @@ let McpGalleryService = class McpGalleryService extends Disposable {
                 throw error;
             }
             this.logService.error(`Failed to query MCP gallery: ${error}`);
+            if (strict) {
+                throw error;
+            }
             return {
                 servers: [],
                 metadata: {
@@ -706,6 +765,9 @@ let McpGalleryService = class McpGalleryService extends Disposable {
         }
         if (!isSuccess(context)) {
             this.logService.error(`Failed to query MCP gallery: Server returned ${context.res.statusCode}`);
+            if (strict) {
+                throw ( new Error(( localize(2803, "The MCP gallery returned HTTP {0}.", context.res.statusCode))));
+            }
             return {
                 servers: [],
                 metadata: {
@@ -715,6 +777,9 @@ let McpGalleryService = class McpGalleryService extends Disposable {
         }
         const data = await asJson(context);
         if (!data) {
+            if (strict) {
+                throw ( new Error(( localize(2804, "The MCP gallery returned an empty response."))));
+            }
             return {
                 servers: [],
                 metadata: {
@@ -728,7 +793,7 @@ let McpGalleryService = class McpGalleryService extends Disposable {
         }
         return result;
     }
-    async getMcpServer(mcpServerUrl, mcpGalleryManifest) {
+    async getMcpServer(mcpServerUrl, mcpGalleryManifest, token = CancellationToken.None) {
         const manifest = mcpGalleryManifest ?? (await this.mcpGalleryManifestService.getMcpGalleryManifest());
         if (!manifest) {
             throw ( new Error("Cannot fetch MCP server because no MCP gallery is configured"));
@@ -741,25 +806,49 @@ let McpGalleryService = class McpGalleryService extends Disposable {
             type: "GET",
             url: validatedMcpServerUrl,
             followRedirects: 0,
+            ...(mcpGalleryManifest ? {
+                timeout: mcpServerRequestTimeout
+            } : {}),
             callSite: "mcpGalleryService.getMcpServer"
-        }, CancellationToken.None);
-        if (context.res.statusCode === 404) {
-            return undefined;
-        }
-        if (!isSuccess(context)) {
-            throw ( new Error(
-                `Failed to fetch MCP server from ${mcpServerUrl}: server responded with ${context.res.statusCode}`
-            ));
-        }
-        const data = await asJson(context);
-        if (!data) {
-            throw ( new Error(`Failed to fetch MCP server from ${mcpServerUrl}: empty response`));
-        }
-        const server = this.serializeMcpServer(data, manifest);
-        if (!server) {
-            throw ( new Error(`Failed to serialize MCP server from ${mcpServerUrl}`, data));
+        }, token);
+        try {
+            if (context.res.statusCode === 404) {
+                return undefined;
+            }
+            if (!isSuccess(context)) {
+                throw ( new Error(
+                    `Failed to fetch MCP server from ${mcpServerUrl}: server responded with ${context.res.statusCode}`
+                ));
+            }
+            let data;
+            if (mcpGalleryManifest) {
+                const text = await raceCancellationError(
+                    readBoundedResponse(context, maxMcpServerResponseBytes, () => ( new Error(( localize(2805, "The MCP registry response is too large to install."))))),
+                    token
+                );
+                try {
+                    data = JSON.parse(text);
+                } catch {
+                    throw ( new Error(( localize(2806, "The MCP registry returned invalid server metadata."))));
+                }
+            } else {
+                data = await raceCancellationError(asJson(context), token);
+            }
+            if (!data) {
+                throw ( new Error(`Failed to fetch MCP server from ${mcpServerUrl}: empty response`));
+            }
+            const server = this.serializeMcpServer(data, manifest);
+            if (!server) {
+                const setup = getUnsupportedMcpSetup(data);
+                if (setup) {
+                    throw ( new UnsupportedMcpGalleryPackageError(setup.repositoryUrl));
+                }
+                throw ( new Error(`Failed to serialize MCP server from ${mcpServerUrl}`, data));
+            }
+            return this.toGalleryMcpServer(server, manifest);
+        } finally {
+            context.stream.destroy();
         }
-        return this.toGalleryMcpServer(server, manifest);
     }
     serializeMcpServer(data, mcpGalleryManifest) {
         return this.getSerializer(mcpGalleryManifest)?.toRawGalleryMcpServer(data);
@@ -822,4 +911,4 @@ let McpGalleryService = class McpGalleryService extends Disposable {
 };
 McpGalleryService = ( __decorate([( __param(0, IRequestService)), ( __param(1, IFileService)), ( __param(2, ILogService)), ( __param(3, IMcpGalleryManifestService))], McpGalleryService));
 
-export { McpGalleryService };
+export { McpGalleryService, UnsupportedMcpGalleryPackageError };

package/vscode/src/vs/sessions/services/mcp/browser/mcpWorkspaceInstallTargetService.d.ts

@@ -0,0 +1,4 @@
+import { McpWorkspaceInstallTargetService, McpWorkspaceInstallTarget } from "../../../../workbench/services/mcp/common/mcpWorkspaceInstallTargetService.js";
+export declare class SessionsMcpWorkspaceInstallTargetService extends McpWorkspaceInstallTargetService {
+    getTargets(): readonly McpWorkspaceInstallTarget[];
+}

package/vscode/src/vs/sessions/services/mcp/browser/mcpWorkspaceInstallTargetService.js

@@ -0,0 +1,12 @@
+
+import '@codingame/monaco-vscode-api/vscode/vs/platform/instantiation/common/extensions';
+import { McpWorkspaceInstallTargetService } from '../../../../workbench/services/mcp/common/mcpWorkspaceInstallTargetService.js';
+import '@codingame/monaco-vscode-api/vscode/vs/platform/instantiation/common/instantiation';
+
+class SessionsMcpWorkspaceInstallTargetService extends McpWorkspaceInstallTargetService {
+    getTargets() {
+        return this.workspaceService.getWorkspace().folders;
+    }
+}
+
+export { SessionsMcpWorkspaceInstallTargetService };

package/vscode/src/vs/workbench/api/browser/mainThreadMcp.d.ts

@@ -4,6 +4,7 @@ import { IContextKeyService } from "@codingame/monaco-vscode-api/vscode/vs/platf
 import { IConfigurationService } from "@codingame/monaco-vscode-api/vscode/vs/platform/configuration/common/configuration.service";
 import { IDialogService } from "@codingame/monaco-vscode-api/vscode/vs/platform/dialogs/common/dialogs.service";
 import { LogLevel } from "@codingame/monaco-vscode-api/vscode/vs/platform/log/common/log";
+import { IAllowedMcpServersService } from "@codingame/monaco-vscode-api/vscode/vs/platform/mcp/common/mcpManagement.service";
 import { ITelemetryService } from "@codingame/monaco-vscode-api/vscode/vs/platform/telemetry/common/telemetry.service";
 import { ISecretStorageService } from "@codingame/monaco-vscode-api/vscode/vs/platform/secrets/common/secrets.service";
 import { IWorkbenchMcpGatewayService } from "@codingame/monaco-vscode-api/vscode/vs/workbench/contrib/mcp/common/mcpGatewayService.service";
@@ -32,17 +33,20 @@ export declare class MainThreadMcp extends Disposable implements MainThreadMcpSh
     private readonly _mcpGatewayService;
     private readonly _configurationService;
     private readonly _secretStorageService;
+    private readonly _allowedMcpServersService;
     private _serverIdCounter;
     private readonly _servers;
     private readonly _serverDefinitions;
+    private readonly _serverRequestUrls;
     private readonly _serverAuthTracking;
     private readonly _proxy;
     private readonly _collectionDefinitions;
     private readonly _gateways;
-    constructor(_extHostContext: IExtHostContext, _mcpRegistry: IMcpRegistry, dialogService: IDialogService, _authenticationService: IAuthenticationService, authenticationMcpServersService: IAuthenticationMcpService, authenticationMCPServerAccessService: IAuthenticationMcpAccessService, authenticationMCPServerUsageService: IAuthenticationMcpUsageService, _dynamicAuthenticationProviderStorageService: IDynamicAuthenticationProviderStorageService, _extensionService: IExtensionService, _contextKeyService: IContextKeyService, _telemetryService: ITelemetryService, _mcpGatewayService: IWorkbenchMcpGatewayService, _configurationService: IConfigurationService, _secretStorageService: ISecretStorageService);
+    constructor(_extHostContext: IExtHostContext, _mcpRegistry: IMcpRegistry, dialogService: IDialogService, _authenticationService: IAuthenticationService, authenticationMcpServersService: IAuthenticationMcpService, authenticationMCPServerAccessService: IAuthenticationMcpAccessService, authenticationMCPServerUsageService: IAuthenticationMcpUsageService, _dynamicAuthenticationProviderStorageService: IDynamicAuthenticationProviderStorageService, _extensionService: IExtensionService, _contextKeyService: IContextKeyService, _telemetryService: ITelemetryService, _mcpGatewayService: IWorkbenchMcpGatewayService, _configurationService: IConfigurationService, _secretStorageService: ISecretStorageService, _allowedMcpServersService: IAllowedMcpServersService);
     private _publishServerDefinitions;
     $upsertMcpCollection(collection: McpCollectionDefinition.FromExtHost, serversDto: McpServerDefinition.Serialized[]): void;
     $deleteMcpCollection(collectionId: string): void;
+    $checkMcpServerAllowed(id: number, url: string): Promise<string | undefined>;
     $onDidChangeState(id: number, update: McpConnectionState): void;
     $onDidPublishLog(id: number, level: LogLevel, log: string): void;
     $onDidReceiveMessage(id: number, message: string): void;
@@ -77,6 +81,8 @@ export interface IMcpServerAuthContext {
     readonly clientId?: string;
     readonly resource?: string;
     readonly audience?: string;
+    /** Secret-storage reference; the secret itself is never retained here. */
+    readonly clientSecretStorageKey?: string;
 }
 /**
  * Tracks which MCP servers are using which authentication providers.