@graphorin/mcp 0.6.0 → 0.7.0

package/src/client/defer-loading.ts

@@ -0,0 +1,108 @@
+/**
+ * Deferred-loading resolution for the `toTools()` adapter (extracted
+ * from `to-tools.ts` per F-MCP-001).
+ *
+ * Computes the per-server effective `defer_loading` flag: when the
+ * operator does not pass an explicit `defer_loading`, the auto-default
+ * fires once when `listTools().length > deferLoadingThreshold` (default
+ * `10`) and flips deferral on for every tool from the server. Emits the
+ * retrieval counters and the once-per-server INFO log.
+ *
+ * @packageDocumentation
+ */
+
+import { incrementCounter } from '@graphorin/tools/audit';
+import type { ServerIdentity } from '../transport/types.js';
+
+/** Default auto-deferral threshold per the operator-facing convention. */
+export const DEFAULT_DEFER_LOADING_THRESHOLD = 10;
+
+/** Operator-supplied structured logger (mirrors the client logger shape). */
+type AdapterLogger = (
+  level: 'debug' | 'info' | 'warn' | 'error',
+  message: string,
+  fields?: Record<string, unknown>,
+) => void;
+
+/**
+ * Process-scoped dedup keys for the auto-default INFO-log. Each
+ * `(serverIdentity, threshold)` pair triggers the log once across all
+ * `MCPClient.toTools(...)` invocations in the process so re-running
+ * `toTools()` on the same client does not double-log.
+ */
+const autoDeferralInfoSeen = new Set<string>();
+
+/**
+ * Process-scoped dedup keys for the explicit `defer_loading: true`
+ * INFO-log. Mirrors the auto-default discipline.
+ */
+const explicitDeferralInfoSeen = new Set<string>();
+
+/**
+ * Reset the deferral dedup sets. Used by
+ * {@link import('./to-tools.js')._resetMcpAdapterDedupForTesting}.
+ *
+ * @experimental
+ */
+export function _resetDeferLoadingDedupForTesting(): void {
+  autoDeferralInfoSeen.clear();
+  explicitDeferralInfoSeen.clear();
+}
+
+/** Outcome of {@link resolveDeferLoading}. */
+export interface DeferralResolution {
+  readonly autoDeferralFired: boolean;
+  readonly resolvedDeferLoading: boolean;
+}
+
+/**
+ * Resolve the effective `defer_loading` flag for a server's tool
+ * catalogue and emit the retrieval counters + once-per-server INFO log.
+ */
+export function resolveDeferLoading(args: {
+  readonly serverIdentity: ServerIdentity;
+  readonly toolNames: ReadonlyArray<string>;
+  readonly explicitDefer: boolean | undefined;
+  readonly threshold: number;
+  readonly logger?: AdapterLogger;
+}): DeferralResolution {
+  const total = args.toolNames.length;
+  const autoDeferralFired = args.explicitDefer === undefined && total > args.threshold;
+  const resolvedDeferLoading = args.explicitDefer ?? autoDeferralFired;
+
+  if (autoDeferralFired) {
+    for (let i = 0; i < total; i++) {
+      incrementCounter('tool.retrieval.deferred.total', { source: 'mcp-server-default' });
+    }
+    const dedupKey = `${args.serverIdentity.id}:${args.threshold}`;
+    if (!autoDeferralInfoSeen.has(dedupKey) && args.logger !== undefined) {
+      autoDeferralInfoSeen.add(dedupKey);
+      args.logger('info', 'mcp.tools.defer_loading.auto-default fired', {
+        server: args.serverIdentity.id,
+        thresholdValue: args.threshold,
+        toolCount: total,
+        toolNames: [...args.toolNames],
+        source: 'mcp-server-default',
+      });
+    }
+  } else if (args.explicitDefer === true) {
+    for (let i = 0; i < total; i++) {
+      incrementCounter('tool.retrieval.deferred.total', { source: 'explicit' });
+    }
+    const dedupKey = `${args.serverIdentity.id}:explicit`;
+    if (!explicitDeferralInfoSeen.has(dedupKey) && args.logger !== undefined) {
+      explicitDeferralInfoSeen.add(dedupKey);
+      args.logger('info', 'mcp.tools.defer_loading.explicit fired', {
+        server: args.serverIdentity.id,
+        toolCount: total,
+        source: 'explicit',
+      });
+    }
+  } else if (args.explicitDefer === false) {
+    for (let i = 0; i < total; i++) {
+      incrementCounter('tool.retrieval.eager.total', { source: 'mcp-explicit-eager' });
+    }
+  }
+
+  return { autoDeferralFired, resolvedDeferLoading };
+}

package/src/client/inbound-filters.ts

@@ -0,0 +1,246 @@
+/**
+ * Inbound prompt-injection filtering for the `toTools()` adapter
+ * (extracted from `to-tools.ts` per F-MCP-001).
+ *
+ * Owns: the per-server inbound-sanitization default, the once-per-server
+ * `pass-through` override WARN, and the tool-description strip applied at
+ * registration time. The trust class is pinned to `'mcp-derived'` for
+ * every produced tool so the agent runtime's per-step preamble fires
+ * regardless of the body-level policy chosen here.
+ *
+ * @packageDocumentation
+ */
+
+import type { InboundSanitizationPolicy } from '@graphorin/core';
+import { incrementCounter } from '@graphorin/tools/audit';
+import { applyInboundSanitization } from '@graphorin/tools/inbound';
+import type { JsonSchemaLike } from '../registry/json-schema.js';
+import type { ServerIdentity } from '../transport/types.js';
+
+/** Operator-supplied structured logger (mirrors the client logger shape). */
+type AdapterLogger = (
+  level: 'debug' | 'info' | 'warn' | 'error',
+  message: string,
+  fields?: Record<string, unknown>,
+) => void;
+
+/**
+ * Process-scoped dedup keys for the `pass-through` override WARN. The
+ * spec mandates exactly-one WARN per server identity per process - the
+ * Set retains the keys for the lifetime of the process. Tests reset via
+ * {@link import('./to-tools.js')._resetMcpAdapterDedupForTesting}.
+ */
+const passthroughWarnSeen = new Set<string>();
+
+/**
+ * Reset the inbound-filter dedup set. Used by
+ * {@link import('./to-tools.js')._resetMcpAdapterDedupForTesting}.
+ *
+ * @experimental
+ */
+export function _resetInboundFiltersDedupForTesting(): void {
+  passthroughWarnSeen.clear();
+}
+
+/**
+ * Resolve the effective per-server inbound-sanitization policy. MCP
+ * tools default to the strictest body-level policy.
+ */
+export function resolveInboundPolicy(
+  override: InboundSanitizationPolicy | undefined,
+): InboundSanitizationPolicy {
+  return override ?? 'detect-and-strip-and-wrap';
+}
+
+/**
+ * WARN-once per server when the operator opts out of body-level
+ * sanitization. The trust class stays `'mcp-derived'` regardless so the
+ * per-step preamble in the agent runtime still fires; the WARN exists so
+ * the audit log records the operator's deliberate choice.
+ */
+export function warnOnPassthroughOverride(args: {
+  readonly resolvedInbound: InboundSanitizationPolicy;
+  readonly serverIdentity: ServerIdentity;
+  readonly logger?: AdapterLogger;
+}): void {
+  if (args.resolvedInbound !== 'pass-through') return;
+  if (passthroughWarnSeen.has(args.serverIdentity.id)) return;
+  passthroughWarnSeen.add(args.serverIdentity.id);
+  incrementCounter('mcp.inbound.sanitization.passthrough-override.warn.total', {
+    server: args.serverIdentity.id,
+  });
+  if (args.logger !== undefined) {
+    args.logger('warn', 'mcp.inbound.sanitization.passthrough-override', {
+      server: args.serverIdentity.id,
+      policy: 'pass-through',
+      note: "Body-level prompt-injection sanitization is disabled for this MCP server; the trust class remains 'mcp-derived' so the per-step preamble still fires. The WARN cannot be silenced (deliberate operator-friction).",
+    });
+  }
+}
+
+/**
+ * Strip imperative payloads from a tool description before it enters the
+ * per-step tool catalogue. The description is never wrapped in the
+ * `<<<untrusted_content>>>` envelope (the wrap is reserved for tool
+ * result bodies emitted into the conversation history).
+ */
+export function sanitizeDescription(args: {
+  readonly description: string;
+  readonly inboundSanitization: InboundSanitizationPolicy;
+  readonly toolName: string;
+  readonly serverIdentity: ServerIdentity;
+}): string {
+  const stripPolicy: InboundSanitizationPolicy =
+    args.inboundSanitization === 'pass-through' ? 'pass-through' : 'detect-and-strip';
+  const outcome = applyInboundSanitization({
+    body: args.description,
+    policy: stripPolicy,
+    trustClass: 'mcp-derived',
+    toolName: args.toolName,
+    contentOrigin: `mcp:tool-description:${args.serverIdentity.id}`,
+    failClosed: false,
+  });
+  // C6: tool-description poisoning is a registration-time SIGNAL, not
+  // just a silent strip - count it so operators see which server ships
+  // imperative-laden descriptions (Invariant Labs tool-poisoning class).
+  if (outcome.patternsHit.length > 0) {
+    incrementCounter('mcp.tool-description.injection-flagged.total', {
+      server: args.serverIdentity.id,
+      tool: args.toolName,
+    });
+  }
+  return outcome.body;
+}
+
+/**
+ * Result of {@link sanitizeSchemaAnnotations}: the sanitized COPY of
+ * the schema (the input document is never mutated) plus the pattern
+ * names that fired anywhere inside it.
+ */
+export interface SanitizedSchemaResult {
+  readonly schema: JsonSchemaLike;
+  readonly patternsHit: ReadonlyArray<string>;
+}
+
+// JSON Schema keys whose STRING values are pure annotations shown to
+// the model - the exact hiding place of the published Invariant Labs
+// tool-poisoning attacks. Only these are sanitized; semantic keywords
+// (`enum`, `const`, `pattern`, `required`, property names) participate
+// in input validation and MUST stay byte-identical.
+const ANNOTATION_STRING_KEYS = new Set(['description', 'title', '$comment']);
+// Keys whose value is a single sub-schema (or, for `items`, a tuple of
+// sub-schemas).
+const SCHEMA_VALUE_KEYS = new Set([
+  'items',
+  'additionalProperties',
+  'not',
+  'if',
+  'then',
+  'else',
+  'contains',
+  'propertyNames',
+]);
+// Keys whose value is a list of sub-schemas.
+const SCHEMA_LIST_KEYS = new Set(['oneOf', 'anyOf', 'allOf', 'prefixItems']);
+// Keys whose value is a record of named sub-schemas.
+const SCHEMA_RECORD_KEYS = new Set([
+  'properties',
+  '$defs',
+  'definitions',
+  'patternProperties',
+  'dependentSchemas',
+]);
+
+/**
+ * Strip imperative payloads from the ANNOTATION strings of an MCP tool
+ * JSON Schema (`description` / `title` / `$comment` / string
+ * `examples`) at any nesting depth, before the schema reaches the
+ * provider wire and the `tool_search` projection (W-018, the Invariant
+ * Labs tool-poisoning vector `properties.query.description`).
+ *
+ * Design choices:
+ *
+ * - Strip, never wrap: the result must remain a valid JSON Schema
+ *   document; an `<<<untrusted_content>>>` envelope would break the
+ *   structure.
+ * - Returns a recursively cloned COPY and never mutates the input.
+ *   The caller keeps hashing the RAW definition
+ *   (`computeToolDefinitionHash`), so existing TOFU pins stay valid
+ *   and drift detection still sees the original bytes - two
+ *   differently-poisoned schemas must not collapse into one redacted
+ *   hash.
+ * - Semantic keywords and unknown vocabulary are cloned byte-identical
+ *   (annotation keys are a whitelist, not a blacklist), so input
+ *   validation behaves exactly as with the raw schema.
+ * - `'pass-through'` returns the input as-is (operator override, same
+ *   contract as {@link sanitizeDescription}).
+ */
+export function sanitizeSchemaAnnotations(args: {
+  readonly schema: JsonSchemaLike;
+  readonly inboundSanitization: InboundSanitizationPolicy;
+  readonly toolName: string;
+  readonly serverIdentity: ServerIdentity;
+}): SanitizedSchemaResult {
+  if (args.inboundSanitization === 'pass-through') {
+    return { schema: args.schema, patternsHit: Object.freeze<string[]>([]) };
+  }
+  const hits = new Set<string>();
+  const sanitizeString = (body: string): string => {
+    const outcome = applyInboundSanitization({
+      body,
+      policy: 'detect-and-strip',
+      trustClass: 'mcp-derived',
+      toolName: args.toolName,
+      contentOrigin: `mcp:tool-schema:${args.serverIdentity.id}`,
+      failClosed: false,
+    });
+    for (const hit of outcome.patternsHit) hits.add(hit);
+    return outcome.body;
+  };
+  const schema = walkSchema(args.schema, sanitizeString) as JsonSchemaLike;
+  if (hits.size > 0) {
+    // Registration-time signal, mirroring the description counter (C6).
+    incrementCounter('mcp.tool-schema.injection-flagged.total', {
+      server: args.serverIdentity.id,
+      tool: args.toolName,
+    });
+  }
+  return { schema, patternsHit: Object.freeze([...hits]) };
+}
+
+function walkSchema(node: unknown, sanitizeString: (body: string) => string): unknown {
+  if (node === null || typeof node !== 'object') return node;
+  if (Array.isArray(node)) return node.map((el) => walkSchema(el, sanitizeString));
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(node)) {
+    if (ANNOTATION_STRING_KEYS.has(key) && typeof value === 'string') {
+      out[key] = sanitizeString(value);
+    } else if (key === 'examples' && Array.isArray(value)) {
+      out[key] = value.map((el) => (typeof el === 'string' ? sanitizeString(el) : cloneJson(el)));
+    } else if (SCHEMA_VALUE_KEYS.has(key)) {
+      out[key] = walkSchema(value, sanitizeString);
+    } else if (SCHEMA_LIST_KEYS.has(key) && Array.isArray(value)) {
+      out[key] = value.map((el) => walkSchema(el, sanitizeString));
+    } else if (
+      SCHEMA_RECORD_KEYS.has(key) &&
+      typeof value === 'object' &&
+      value !== null &&
+      !Array.isArray(value)
+    ) {
+      const record: Record<string, unknown> = {};
+      for (const [name, sub] of Object.entries(value)) {
+        record[name] = walkSchema(sub, sanitizeString);
+      }
+      out[key] = record;
+    } else {
+      out[key] = cloneJson(value);
+    }
+  }
+  return out;
+}
+
+/** Deep JSON clone that keeps semantic keyword values byte-identical. */
+function cloneJson(value: unknown): unknown {
+  if (value === null || typeof value !== 'object') return value;
+  return structuredClone(value);
+}

package/src/client/index.ts

@@ -0,0 +1,42 @@
+/**
+ * Public surface for the MCP client.
+ *
+ * @packageDocumentation
+ */
+
+export { _resetSseWarnDedupForTesting, createMCPClient } from './client.js';
+export {
+  type CreateManagedMCPClientOptions,
+  createManagedMCPClient,
+  type ManagedReconnectOptions,
+} from './managed.js';
+export {
+  createMcpResourceReader,
+  type McpResourceReaderOptions,
+} from './mcp-resource-reader.js';
+export {
+  _resetMcpAdapterDedupForTesting,
+  adaptCallResult,
+  adaptMCPTools,
+  DEFAULT_DEFER_LOADING_THRESHOLD,
+} from './to-tools.js';
+export type {
+  CreateMCPClientOptions,
+  MCPCallToolResult,
+  MCPClient,
+  MCPContentPart,
+  MCPElicitationHandler,
+  MCPElicitationRequest,
+  MCPElicitationResult,
+  MCPPromptDefinition,
+  MCPPromptMessage,
+  MCPResourceContent,
+  MCPResourceDefinition,
+  MCPSamplingContent,
+  MCPSamplingHandler,
+  MCPSamplingMessage,
+  MCPSamplingRequest,
+  MCPSamplingResult,
+  MCPToolDefinition,
+  MCPToToolsOptions,
+} from './types.js';

package/src/client/managed.ts

@@ -0,0 +1,222 @@
+/**
+ * W-080: opt-in managed MCP client with automatic reconnection.
+ *
+ * `createMCPClient` connections are deliberately one-shot: transient
+ * Streamable-HTTP hiccups are healed by the SDK itself (Last-Event-ID),
+ * but a dead stdio child or a lost HTTP session kills the client for
+ * good, and every `Tool` adapted from it closes over the corpse. The
+ * managed wrapper fixes the long-running-agent story:
+ *
+ * - it holds the current inner client in a mutable ref and implements
+ *   {@link MCPClient} by delegation, so ALL consumers (including every
+ *   adapted `Tool.execute`, which the wrapper's `toTools()` binds to the
+ *   WRAPPER, not the inner client) transparently follow a swap;
+ * - on transport close it rebuilds the inner client with exponential
+ *   backoff + jitter (`mcp.reconnect.attempt/success/gave-up.total`
+ *   counters), then re-runs `toTools()` with the last-used options so
+ *   the pin comparison (TOFU store / explicit pins) re-screens the
+ *   post-reconnect catalogue - a rug-pull across a reconnect is caught;
+ * - it NEVER retries an in-flight call: a call that died with the
+ *   transport stays failed (retry policy belongs to the executor /
+ *   model), only the CONNECTION heals;
+ * - the operator's `onTransportClose` fires once, on FINAL failure
+ *   (reconnect exhausted) - intermediate closes are the wrapper's job.
+ *
+ * The plain `createMCPClient` contract is unchanged; this wrapper is a
+ * separate, additive entry point.
+ *
+ * @packageDocumentation
+ */
+
+import type { Tool } from '@graphorin/core';
+import { incrementCounter } from '@graphorin/tools/audit';
+import { createMCPClient } from './client.js';
+import { runToTools, type ToolFingerprintRef } from './to-tools-run.js';
+import type { CreateMCPClientOptions, MCPClient, MCPToToolsOptions } from './types.js';
+
+/** Reconnection tuning for {@link createManagedMCPClient}. @stable */
+export interface ManagedReconnectOptions {
+  /** Attempts per outage before giving up. Default `5`. */
+  readonly maxAttempts?: number;
+  /** First backoff delay (doubles per attempt, jittered). Default `500` ms. */
+  readonly initialDelayMs?: number;
+  /** Backoff ceiling. Default `30_000` ms. */
+  readonly maxDelayMs?: number;
+}
+
+/** Options for {@link createManagedMCPClient}. @stable */
+export type CreateManagedMCPClientOptions = CreateMCPClientOptions & {
+  readonly reconnect?: ManagedReconnectOptions;
+  /**
+   * Client factory seam - tests inject fake inner clients; production
+   * uses {@link createMCPClient}.
+   *
+   * @internal
+   */
+  readonly _clientFactory?: (options: CreateMCPClientOptions) => Promise<MCPClient>;
+};
+
+/**
+ * Open a managed (auto-reconnecting) MCP client. See the module doc for
+ * the exact semantics. `close()` is terminal: it stops any in-progress
+ * backoff and no further reconnects happen.
+ *
+ * @stable
+ */
+export async function createManagedMCPClient(
+  options: CreateManagedMCPClientOptions,
+): Promise<MCPClient> {
+  const { reconnect, _clientFactory, ...clientOptions } = options;
+  const factory = _clientFactory ?? createMCPClient;
+  const maxAttempts = reconnect?.maxAttempts ?? 5;
+  const initialDelayMs = reconnect?.initialDelayMs ?? 500;
+  const maxDelayMs = reconnect?.maxDelayMs ?? 30_000;
+
+  let closed = false;
+  let reconnecting: Promise<void> | null = null;
+  let toolsEverListed = false;
+  let lastToToolsOpts: MCPToToolsOptions | undefined;
+  // Drift tracking spans reconnects on purpose: a definition swapped
+  // behind a reconnect still diffs against the pre-outage snapshot.
+  const fingerprintRef: ToolFingerprintRef = { current: undefined };
+
+  const innerOptions: CreateMCPClientOptions = {
+    ...clientOptions,
+    // The wrapper owns transport-close handling; the operator callback
+    // fires once, on final (gave-up) failure - see the module doc.
+    onTransportClose: (info) => {
+      if (closed) return;
+      void reconnectLoop(info);
+    },
+  };
+
+  let current = await factory(innerOptions);
+
+  async function reconnectLoop(info: { readonly server: string }): Promise<void> {
+    if (closed || reconnecting !== null) return;
+    const task = (async () => {
+      const dead = current;
+      let delay = initialDelayMs;
+      for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        if (closed) return;
+        incrementCounter('mcp.reconnect.attempt.total', { server: info.server });
+        try {
+          const next = await factory(innerOptions);
+          if (closed) {
+            // close() raced the rebuild - do not resurrect.
+            void next.close().catch(() => {});
+            return;
+          }
+          current = next;
+          incrementCounter('mcp.reconnect.success.total', { server: info.server });
+          options.logger?.('info', 'mcp.reconnect.success: inner client rebuilt', {
+            server: info.server,
+            attempt,
+          });
+          // Best-effort close of the dead client (idempotent by contract).
+          void dead.close().catch(() => {});
+          // Re-screen the post-reconnect catalogue with the SAME options
+          // the operator last used, so pin comparison + drift diff run
+          // against it. A pin rejection here must not kill the reconnect
+          // (the connection is healthy) - it is logged and counted by
+          // the pipeline itself.
+          if (toolsEverListed) {
+            try {
+              await managedToTools(lastToToolsOpts);
+            } catch (cause) {
+              options.logger?.(
+                'warn',
+                'mcp.reconnect.catalogue-rescreen-failed: post-reconnect toTools() rejected (pin mismatch or listing failure) - the previously adapted tools remain registered; investigate before trusting this server',
+                {
+                  server: info.server,
+                  error: cause instanceof Error ? cause.message : String(cause),
+                },
+              );
+            }
+          }
+          return;
+        } catch (cause) {
+          if (attempt >= maxAttempts) {
+            incrementCounter('mcp.reconnect.gave-up.total', { server: info.server });
+            options.logger?.('error', 'mcp.reconnect.gave-up: reconnect attempts exhausted', {
+              server: info.server,
+              attempts: attempt,
+              error: cause instanceof Error ? cause.message : String(cause),
+            });
+            options.onTransportClose?.(info);
+            return;
+          }
+          // Full jitter on an exponential ladder, capped at maxDelayMs.
+          const jittered = Math.min(delay, maxDelayMs) * (0.5 + Math.random() * 0.5);
+          await sleep(jittered);
+          delay = Math.min(delay * 2, maxDelayMs);
+        }
+      }
+    })().finally(() => {
+      reconnecting = null;
+    });
+    reconnecting = task;
+    await task;
+  }
+
+  async function managedToTools(toolsOpts?: MCPToToolsOptions): Promise<ReadonlyArray<Tool>> {
+    toolsEverListed = true;
+    lastToToolsOpts = toolsOpts;
+    return runToTools({
+      // THE point of the wrapper: adapted tools close over `managed`,
+      // so their `execute` transparently follows an inner-client swap.
+      client: managed,
+      fingerprintRef,
+      ...(options.logger === undefined ? {} : { logger: options.logger }),
+      ...(toolsOpts === undefined ? {} : { toolsOpts }),
+    });
+  }
+
+  // Data fields delegate through getters so a swap is instantly visible;
+  // the cast bridges `priority?: number` vs an always-present getter
+  // returning `number | undefined` (exactOptionalPropertyTypes).
+  const managed = {
+    get id() {
+      return current.id;
+    },
+    get serverInfo() {
+      return current.serverInfo;
+    },
+    get serverIdentity() {
+      return current.serverIdentity;
+    },
+    get collisionStrategy() {
+      return current.collisionStrategy;
+    },
+    get priority() {
+      return current.priority;
+    },
+    get sessionIdPresent() {
+      return current.sessionIdPresent;
+    },
+    get resumable() {
+      return current.resumable;
+    },
+    listTools: (opts?: { signal?: AbortSignal }) => current.listTools(opts),
+    listResources: (opts?: { signal?: AbortSignal }) => current.listResources(opts),
+    listPrompts: (opts?: { signal?: AbortSignal }) => current.listPrompts(opts),
+    callTool: (name: string, args: unknown, opts?: { signal?: AbortSignal; timeoutMs?: number }) =>
+      current.callTool(name, args, opts),
+    readResource: (uri: string, opts?: { signal?: AbortSignal }) => current.readResource(uri, opts),
+    readResourceContents: (uri: string, opts?: { signal?: AbortSignal }) =>
+      current.readResourceContents(uri, opts),
+    getPrompt: (name: string, args?: unknown, opts?: { signal?: AbortSignal }) =>
+      current.getPrompt(name, args, opts),
+    toTools: managedToTools,
+    close: async (): Promise<void> => {
+      closed = true;
+      await current.close();
+    },
+  } as MCPClient;
+
+  return managed;
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}