machine-bridge-mcp 3.0.0-beta.21 → 3.0.0-beta.26

package/src/worker/mcp-http-contract.ts

@@ -0,0 +1,276 @@
+import {
+  MCP_HEADER_MISMATCH,
+  MCP_MODERN_PROTOCOL_VERSIONS,
+  McpProtocolError,
+  requestProtocolVersion,
+  validateModernRequestMetadata,
+} from "../shared/mcp-protocol.mjs";
+import type { JsonRpcRequest } from "./mcp-jsonrpc.ts";
+
+const HEADER_TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+const BASE64_SENTINEL = /^=\?base64\?([A-Za-z0-9+/]*={0,2})\?=$/;
+const MIRRORED_NAME_METHODS = new Map([
+  ["tools/call", "name"],
+  ["prompts/get", "name"],
+  ["resources/read", "uri"],
+]);
+
+type JsonObject = Record<string, unknown>;
+type ToolDefinition = { name: string; inputSchema?: unknown };
+type HeaderBinding = { headerName: string; path: string[]; type: "string" | "integer" | "boolean" };
+
+export type McpRequestEra = "modern" | "legacy";
+
+export type ModernHttpRequestContext = {
+  era: "modern";
+  version: string;
+  clientCapabilities: JsonObject;
+  clientInfo: JsonObject | null;
+  progressToken: unknown;
+  logLevel: unknown;
+};
+
+export class McpHttpContractError extends Error {
+  readonly status: number;
+  readonly code: number;
+  readonly data?: unknown;
+  constructor(code: number, message: string, data?: unknown, status = 400) {
+    super(message);
+    this.name = "McpHttpContractError";
+    this.status = status;
+    this.code = code;
+    this.data = data;
+  }
+}
+
+export function detectHttpMcpEra(request: Pick<Request, "headers">, body: JsonRpcRequest): McpRequestEra {
+  const bodyVersion = requestProtocolVersion(body);
+  const headerVersion = request.headers.get("mcp-protocol-version")?.trim() ?? "";
+  const legacySession = request.headers.get("mcp-session-id")?.trim() ?? "";
+  if (body.method === "server/discover" || bodyVersion || headerVersion === MCP_MODERN_PROTOCOL_VERSIONS[0]) return "modern";
+  if (body.method === "initialize" || legacySession) return "legacy";
+  return "legacy";
+}
+
+export function validateModernHttpRequest(input: {
+  request: Pick<Request, "headers">;
+  body: JsonRpcRequest;
+  tools?: readonly ToolDefinition[];
+  supportedVersions?: readonly string[];
+}): ModernHttpRequestContext {
+  const supportedVersions = input.supportedVersions ?? MCP_MODERN_PROTOCOL_VERSIONS;
+  validateAcceptHeader(input.request.headers);
+  const bodyVersion = requestProtocolVersion(input.body);
+  if (!bodyVersion) {
+    try { validateModernRequestMetadata(input.body, supportedVersions); }
+    catch (error) {
+      if (error instanceof McpProtocolError) throw new McpHttpContractError(error.code, error.message, error.data);
+      throw error;
+    }
+  }
+  const headerVersion = requiredHeader(input.request.headers, "MCP-Protocol-Version");
+  if (headerVersion !== bodyVersion) {
+    throw headerMismatch("MCP-Protocol-Version does not match request metadata");
+  }
+  const method = requiredHeader(input.request.headers, "Mcp-Method");
+  if (method !== input.body.method) {
+    throw headerMismatch("Mcp-Method does not match the JSON-RPC method");
+  }
+
+  const params = asObject(input.body.params);
+  const nameField = MIRRORED_NAME_METHODS.get(input.body.method);
+  if (nameField) validateMirroredName(input.request.headers, params, nameField);
+  if (input.body.method === "tools/call") {
+    validateToolParameterHeaders(input.request.headers, params, input.tools ?? []);
+  }
+
+  let metadata;
+  try { metadata = validateModernRequestMetadata(input.body, supportedVersions); }
+  catch (error) {
+    if (error instanceof McpProtocolError) throw new McpHttpContractError(error.code, error.message, error.data);
+    throw error;
+  }
+  return { era: "modern", ...metadata };
+}
+
+export function validateToolHeaderSchemas(tools: readonly ToolDefinition[]): void {
+  toolParameterHeaderNames(tools);
+}
+
+export function toolParameterHeaderNames(tools: readonly ToolDefinition[]): ReadonlySet<string> {
+  const names = new Set<string>();
+  for (const tool of tools) {
+    for (const binding of collectHeaderBindings(tool.inputSchema, tool.name)) names.add(binding.headerName.toLowerCase());
+  }
+  return names;
+}
+
+export function decodeMcpHeaderValue(value: string): string {
+  const match = value.match(BASE64_SENTINEL);
+  if (!match) {
+    if (!isSafePlainHeaderValue(value)) throw headerMismatch("Mirrored MCP header contains an invalid plain value");
+    return value;
+  }
+  const encoded = match[1];
+  if (encoded.length % 4 !== 0) throw headerMismatch("Mirrored MCP header contains invalid Base64");
+  let bytes: Uint8Array;
+  try {
+    const binary = atob(encoded);
+    bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  } catch {
+    throw headerMismatch("Mirrored MCP header contains invalid Base64");
+  }
+  const canonical = btoa(String.fromCharCode(...bytes));
+  if (canonical !== encoded) throw headerMismatch("Mirrored MCP header contains non-canonical Base64");
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw headerMismatch("Mirrored MCP header contains invalid UTF-8");
+  }
+}
+
+function validateAcceptHeader(headers: Headers): void {
+  const value = headers.get("Accept") ?? "";
+  const accepted = new Set<string>();
+  for (const entry of value.split(",")) {
+    const [rawType, ...parameters] = entry.split(";");
+    const mediaType = rawType.trim().toLowerCase();
+    if (!mediaType) continue;
+    const qualities = parameters
+      .map((parameter) => parameter.trim().toLowerCase())
+      .filter((parameter) => parameter.startsWith("q="));
+    if (qualities.length > 1) continue;
+    if (qualities.length === 1 && !positiveHttpQuality(qualities[0].slice(2))) continue;
+    accepted.add(mediaType);
+  }
+  if (!accepted.has("application/json") || !accepted.has("text/event-stream")) {
+    throw new McpHttpContractError(-32600, "Accept header must include application/json and text/event-stream");
+  }
+}
+
+function positiveHttpQuality(value: string): boolean {
+  if (!/^(?:0(?:\.[0-9]{0,3})?|1(?:\.0{0,3})?)$/.test(value)) return false;
+  return Number(value) > 0;
+}
+
+function validateMirroredName(headers: Headers, params: JsonObject, field: string): void {
+  const bodyValue = params[field];
+  if (typeof bodyValue !== "string") throw new McpHttpContractError(-32602, `${field} must be a string`);
+  const headerValue = decodeMcpHeaderValue(requiredHeader(headers, "Mcp-Name"));
+  if (headerValue !== bodyValue) {
+    throw headerMismatch(`Mcp-Name does not match params.${field}`);
+  }
+}
+
+function validateToolParameterHeaders(headers: Headers, params: JsonObject, tools: readonly ToolDefinition[]): void {
+  const toolName = params.name;
+  if (typeof toolName !== "string") return;
+  const tool = tools.find((candidate) => candidate.name === toolName);
+  if (!tool) return;
+  const bindings = collectHeaderBindings(tool.inputSchema, tool.name);
+  const argumentsValue = asObject(params.arguments);
+  for (const binding of bindings) {
+    const bodyValue = valueAtPath(argumentsValue, binding.path);
+    const headerValue = headers.get(binding.headerName);
+    if (bodyValue === undefined || bodyValue === null) {
+      if (headerValue !== null) throw headerMismatch(`${binding.headerName} is present without a body value`);
+      continue;
+    }
+    if (headerValue === null) throw headerMismatch(`${binding.headerName} is required for this tool call`);
+    if (!mirroredValueEquals(decodeMcpHeaderValue(headerValue), bodyValue, binding.type)) {
+      throw headerMismatch(`${binding.headerName} does not match the tool argument`);
+    }
+  }
+}
+
+function collectHeaderBindings(schema: unknown, toolName: string): HeaderBinding[] {
+  const bindings: HeaderBinding[] = [];
+  const names = new Set<string>();
+  visitSchema(schema, [], true, toolName, bindings, names);
+  return bindings;
+}
+
+function visitSchema(
+  value: unknown,
+  path: string[],
+  reachable: boolean,
+  toolName: string,
+  bindings: HeaderBinding[],
+  names: Set<string>,
+): void {
+  if (!isObject(value)) return;
+  const annotation = value["x-mcp-header"];
+  if (annotation !== undefined) {
+    if (!reachable) throw new Error(`tool ${toolName} has x-mcp-header outside a properties-only path`);
+    if (typeof annotation !== "string" || !annotation || !HEADER_TOKEN.test(annotation)) {
+      throw new Error(`tool ${toolName} has an invalid x-mcp-header name`);
+    }
+    const type = value.type;
+    if (type !== "string" && type !== "integer" && type !== "boolean") {
+      throw new Error(`tool ${toolName} uses x-mcp-header on a non-primitive property`);
+    }
+    const normalized = annotation.toLowerCase();
+    if (names.has(normalized)) throw new Error(`tool ${toolName} has duplicate x-mcp-header names`);
+    names.add(normalized);
+    bindings.push({ headerName: `Mcp-Param-${annotation}`, path, type });
+  }
+
+  const properties = isObject(value.properties) ? value.properties : null;
+  if (properties) {
+    for (const [key, child] of Object.entries(properties)) {
+      visitSchema(child, [...path, key], reachable, toolName, bindings, names);
+    }
+  }
+  for (const [key, child] of Object.entries(value)) {
+    if (key === "properties" || key === "x-mcp-header") continue;
+    if (Array.isArray(child)) {
+      for (const item of child) visitSchema(item, path, false, toolName, bindings, names);
+    } else if (isObject(child)) {
+      visitSchema(child, path, false, toolName, bindings, names);
+    }
+  }
+}
+
+function mirroredValueEquals(headerValue: string, bodyValue: unknown, type: HeaderBinding["type"]): boolean {
+  if (type === "string") return typeof bodyValue === "string" && headerValue === bodyValue;
+  if (type === "boolean") return typeof bodyValue === "boolean" && headerValue === String(bodyValue);
+  if (typeof bodyValue !== "number" || !Number.isSafeInteger(bodyValue)) return false;
+  const parsed = Number(headerValue);
+  return Number.isSafeInteger(parsed) && parsed === bodyValue;
+}
+
+function valueAtPath(value: JsonObject, path: readonly string[]): unknown {
+  let current: unknown = value;
+  for (const segment of path) {
+    if (!isObject(current) || !Object.hasOwn(current, segment)) return undefined;
+    current = current[segment];
+  }
+  return current;
+}
+
+function requiredHeader(headers: Headers, name: string): string {
+  const value = headers.get(name);
+  if (value === null || !value) throw headerMismatch(`${name} header is required`);
+  return value;
+}
+
+function headerMismatch(message: string, data?: unknown): McpHttpContractError {
+  return new McpHttpContractError(MCP_HEADER_MISMATCH, `Header mismatch: ${message}`, data);
+}
+
+function isSafePlainHeaderValue(value: string): boolean {
+  if (value !== value.trim() || BASE64_SENTINEL.test(value)) return false;
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    if (code !== 9 && (code < 32 || code > 126)) return false;
+  }
+  return true;
+}
+
+function asObject(value: unknown): JsonObject {
+  return isObject(value) ? value : {};
+}
+
+function isObject(value: unknown): value is JsonObject {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}

package/src/worker/mcp-jsonrpc.ts

@@ -1,4 +1,5 @@
 import { projectMcpResult } from "../shared/result-projection.mjs";
+import { MCP_LEGACY_PROTOCOL_VERSION, resultForProtocol } from "../shared/mcp-protocol.mjs";
 const JSONRPC_VERSION = "2.0";
 const MAX_SESSION_INSTRUCTION_BYTES = 3 * 1024 * 1024;
 
@@ -37,16 +38,21 @@ export function rpcError(id: JsonRpcId | undefined, code: number, message: strin
   return { jsonrpc: JSONRPC_VERSION, id: id ?? null, error };
 }
 
-export function textToolResult(value: unknown, isError = false): Record<string, unknown> {
+export function textToolResult(
+  value: unknown,
+  isError = false,
+  protocolVersion: string = MCP_LEGACY_PROTOCOL_VERSION,
+  serverInfo?: Record<string, unknown>,
+): Record<string, unknown> {
   const special = asObject(value).$mcp;
   if (special && typeof special === "object" && !Array.isArray(special)) {
     const specialObject = special as Record<string, unknown>;
     if (Array.isArray(specialObject.content)) {
       const result: Record<string, unknown> = { content: specialObject.content, isError };
-      if (specialObject.structuredContent && typeof specialObject.structuredContent === "object" && !Array.isArray(specialObject.structuredContent)) {
-        result.structuredContent = specialObject.structuredContent;
+      if (Object.prototype.hasOwnProperty.call(specialObject, "structuredContent")) {
+        result.structuredContent = structuredClone(specialObject.structuredContent);
       }
-      return result;
+      return resultForProtocol(protocolVersion, result, { serverInfo });
     }
   }
   const projection = projectMcpResult(value);
@@ -54,8 +60,8 @@ export function textToolResult(value: unknown, isError = false): Record<string,
     content: [{ type: "text", text: projection.text }],
     isError,
   };
-  if (projection.structuredContent) result.structuredContent = projection.structuredContent;
-  return result;
+  if (projection.hasStructuredContent) result.structuredContent = structuredClone(projection.structuredContent);
+  return resultForProtocol(protocolVersion, result, { serverInfo });
 }
 
 export function asObject(value: unknown): Record<string, unknown> {

package/src/worker/mcp-legacy-dispatch.ts

@@ -0,0 +1,104 @@
+import type { AuthorizedToken } from "./oauth-controller.ts";
+import { publicWorkerToolError } from "./errors.ts";
+import { legacyMcpClientRequestKey } from "./mcp-session.ts";
+import { inspectWorkerToolCall } from "./mcp-tool-call-input.ts";
+import {
+  asObject, rpcError, rpcResult, sessionInstructionText, textToolResult,
+  type JsonRpcRequest,
+} from "./mcp-jsonrpc.ts";
+
+type LegacyMcpConfig = Readonly<{
+  defaultVersion: string;
+  supportedVersions: readonly string[];
+  serverInfo: Record<string, unknown>;
+  instructions: string;
+  daemonToolEnabled: (name: string) => boolean;
+  callDaemonTool: (name: string, args: Record<string, unknown>, authorized: AuthorizedToken) => Promise<unknown>;
+  recordError: (code: string) => void;
+  cancelClientRequest: (requestKey?: string) => Promise<void>;
+  tools: (authorized: AuthorizedToken) => Array<Record<string, unknown>>;
+  callTool: (input: {
+    name: string;
+    args: Record<string, unknown>;
+    base: string;
+    authorized: AuthorizedToken;
+    requestKey?: string;
+  }) => Promise<unknown>;
+}>;
+
+export class LegacyMcpDispatcher {
+  private readonly config: LegacyMcpConfig;
+
+  constructor(config: LegacyMcpConfig) {
+    this.config = config;
+  }
+
+  async dispatch(
+    request: JsonRpcRequest,
+    base: string,
+    authorized: AuthorizedToken,
+    sessionId: string,
+  ): Promise<Record<string, unknown> | null> {
+    if (request.method === "initialize") return this.initialize(request, authorized);
+    if (request.method === "notifications/initialized") return null;
+    if (request.method === "notifications/cancelled") {
+      await this.config.cancelClientRequest(legacyMcpClientRequestKey(
+        authorized.tokenKey, sessionId, asObject(request.params).requestId,
+      ));
+      return null;
+    }
+    if (request.method === "logging/setLevel" || request.method === "ping") return rpcResult(request.id, {});
+    if (request.method === "tools/list") return rpcResult(request.id, { tools: this.config.tools(authorized) });
+    if (request.method === "tools/call") return this.callTool(request, base, authorized, sessionId);
+    return rpcError(request.id, -32601, "Method not found");
+  }
+
+  private async initialize(request: JsonRpcRequest, authorized: AuthorizedToken): Promise<Record<string, unknown> | null> {
+    const requested = asObject(request.params).protocolVersion;
+    const protocolVersion = typeof requested === "string" && this.config.supportedVersions.includes(requested)
+      ? requested
+      : this.config.defaultVersion;
+    let bootstrap = null;
+    if (this.config.daemonToolEnabled("session_bootstrap")) {
+      try { bootstrap = await this.config.callDaemonTool("session_bootstrap", { path: "." }, authorized); }
+      catch { this.config.recordError("session_bootstrap_failed"); }
+    }
+    const localInstructions = sessionInstructionText(bootstrap);
+    return rpcResult(request.id, {
+      protocolVersion,
+      capabilities: { tools: { listChanged: false }, logging: {} },
+      serverInfo: this.config.serverInfo,
+      instructions: localInstructions
+        ? `${this.config.instructions}\n\n--- LOCAL SESSION INSTRUCTIONS ---\n${localInstructions}`
+        : this.config.instructions,
+    });
+  }
+
+  private async callTool(
+    request: JsonRpcRequest,
+    base: string,
+    authorized: AuthorizedToken,
+    sessionId: string,
+  ): Promise<Record<string, unknown>> {
+    if (request.id === undefined || request.id === null) {
+      return rpcError(null, -32600, "tools/call requires a non-null request id");
+    }
+    const inspected = inspectWorkerToolCall(request.params, this.config.tools(authorized));
+    if (!inspected.ok) {
+      const message = inspected.reason === "missing_name" ? "tools/call requires a tool name"
+        : inspected.reason === "unknown_tool" ? "Unknown tool"
+          : "Tool arguments do not match the input schema";
+      return rpcError(request.id, -32602, message, inspected.issues ? { side_effects_started: false, validation_issues: [...inspected.issues] } : undefined);
+    }
+    const { name, args } = inspected;
+    try {
+      const result = await this.config.callTool({
+        name, args, base, authorized,
+        requestKey: legacyMcpClientRequestKey(authorized.tokenKey, sessionId, request.id),
+      });
+      return rpcResult(request.id, textToolResult(result))!;
+    } catch (error) {
+      return rpcResult(request.id, textToolResult({ error: publicWorkerToolError(error) }, true))!;
+    }
+  }
+}

package/src/worker/mcp-modern-controller.ts

@@ -0,0 +1,199 @@
+import type { AuthorizedToken } from "./oauth-controller.ts";
+import { publicWorkerToolError } from "./errors.ts";
+import { inspectWorkerToolCall } from "./mcp-tool-call-input.ts";
+import { acceptsEventStream } from "./mcp-stream.ts";
+import { modernMcpStreamRequestKey } from "./mcp-session.ts";
+import { mcpStreamProxyId, type StreamProxyMode } from "./mcp-stream-proxy.ts";
+import { modernJsonRpcResponseStream, modernSubscriptionResponse } from "./mcp-modern-stream.ts";
+import { json } from "./http.ts";
+import {
+  acceptedSubscriptionFilter, validateSubscriptionFilter,
+} from "../shared/mcp-subscriptions.mjs";
+import {
+  McpProtocolError, modernCacheableResult, modernDiscoverResult,
+} from "../shared/mcp-protocol.mjs";
+import {
+  asObject, rpcError, rpcResult, textToolResult, type JsonRpcRequest,
+} from "./mcp-jsonrpc.ts";
+
+type ModernMcpConfig = Readonly<{
+  capabilities: Record<string, unknown>;
+  serverInfo: Record<string, unknown>;
+  instructions: string;
+  supportedVersions: readonly string[];
+  discoveryTtlMs: number;
+  toolListTtlMs: number;
+  tools: (authorized: AuthorizedToken) => Array<Record<string, unknown>>;
+  recordError: (code: string) => void;
+  cancelClientRequest: (requestKey?: string) => Promise<void>;
+  callTool: (input: {
+    name: string;
+    args: Record<string, unknown>;
+    base: string;
+    authorized: AuthorizedToken;
+    signal: AbortSignal;
+    requestKey?: string;
+  }) => Promise<unknown>;
+}>;
+
+type ModernDispatchResult = Readonly<{
+  message: Record<string, unknown>;
+  status: number;
+}>;
+
+export class ModernMcpController {
+  private readonly config: ModernMcpConfig;
+
+  constructor(config: ModernMcpConfig) {
+    this.config = config;
+  }
+
+  async handleControl(request: Request, mode: StreamProxyMode): Promise<Response | null> {
+    if (mode !== "modern-cancel") return null;
+    const requestKey = modernMcpStreamRequestKey(mcpStreamProxyId(request));
+    await this.config.cancelClientRequest(requestKey);
+    return new Response(null, { status: requestKey ? 202 : 400 });
+  }
+
+  async handleRequest(input: {
+    request: Request;
+    body: JsonRpcRequest;
+    base: string;
+    authorized: AuthorizedToken;
+    protocolVersion: string;
+    proxyMode: StreamProxyMode;
+  }): Promise<Response> {
+    const { request, body } = input;
+    if (body.id === undefined) return json(rpcError(undefined, -32601, "Method not found"), 404);
+    if (body.id === null) return json(rpcError(null, -32600, "Modern MCP requests require a non-null request id"), 400);
+    const requestKey = input.proxyMode === "modern-direct"
+      ? modernMcpStreamRequestKey(mcpStreamProxyId(request))
+      : undefined;
+    if (input.proxyMode === "modern-direct" && !requestKey) {
+      return json(rpcError(body.id, -32600, "Invalid modern stream identity"), 400);
+    }
+    if (body.method === "subscriptions/listen") return this.subscriptionResponse(input);
+    if (body.method === "tools/call" && acceptsEventStream(request)) return this.streamedToolResponse({ ...input, requestKey });
+    const outcome = await this.dispatch(input.body, input.base, input.authorized, input.protocolVersion, request.signal, requestKey);
+    return json(outcome.message, outcome.status);
+  }
+
+  private subscriptionResponse(input: {
+    request: Request;
+    body: JsonRpcRequest;
+  }): Response {
+    const { request, body } = input;
+    if (!acceptsEventStream(request)) {
+      return json(rpcError(body.id, -32602, "subscriptions/listen requires text/event-stream support"), 406);
+    }
+    try {
+      const requested = validateSubscriptionFilter(asObject(body.params).notifications);
+      const accepted = acceptedSubscriptionFilter(requested, this.config.capabilities);
+      return modernSubscriptionResponse({
+        requestId: body.id as string | number,
+        notifications: accepted,
+        serverInfo: this.config.serverInfo,
+      });
+    } catch (error) {
+      if (error instanceof McpProtocolError) return json(rpcError(body.id, error.code, error.message, error.data), 400);
+      throw error;
+    }
+  }
+
+  private streamedToolResponse(input: {
+    request: Request;
+    body: JsonRpcRequest;
+    base: string;
+    authorized: AuthorizedToken;
+    protocolVersion: string;
+    requestKey?: string;
+  }): Response {
+    const controller = new AbortController();
+    const cancel = () => controller.abort();
+    input.request.signal.addEventListener("abort", cancel, { once: true });
+    const result = this.dispatch(input.body, input.base, input.authorized, input.protocolVersion, controller.signal, input.requestKey)
+      .then((outcome) => outcome.message)
+      .finally(() => input.request.signal.removeEventListener("abort", cancel));
+    return modernJsonRpcResponseStream(result, {
+      onCancel: cancel,
+      onError: () => {
+        this.config.recordError("modern_stream_dispatch_failed");
+        return rpcError(input.body.id, -32603, "Internal error");
+      },
+    });
+  }
+
+  private async dispatch(
+    request: JsonRpcRequest,
+    base: string,
+    authorized: AuthorizedToken,
+    protocolVersion: string,
+    signal: AbortSignal,
+    requestKey?: string,
+  ): Promise<ModernDispatchResult> {
+    if (request.method === "server/discover") return this.discover(request);
+    if (request.method === "tools/list") return this.listTools(request, authorized);
+    if (request.method === "tools/call") return this.callTool(request, base, authorized, protocolVersion, signal, requestKey);
+    return { status: 404, message: rpcError(request.id, -32601, "Method not found") };
+  }
+
+  private discover(request: JsonRpcRequest): ModernDispatchResult {
+    return {
+      status: 200,
+      message: rpcResult(request.id, modernDiscoverResult({
+        supportedVersions: this.config.supportedVersions,
+        capabilities: this.config.capabilities,
+        instructions: this.config.instructions,
+        ttlMs: this.config.discoveryTtlMs,
+        serverInfo: this.config.serverInfo,
+      }))!,
+    };
+  }
+
+  private listTools(request: JsonRpcRequest, authorized: AuthorizedToken): ModernDispatchResult {
+    return {
+      status: 200,
+      message: rpcResult(request.id, modernCacheableResult(
+        { tools: this.config.tools(authorized) },
+        { ttlMs: this.config.toolListTtlMs, cacheScope: "private", serverInfo: this.config.serverInfo },
+      ))!,
+    };
+  }
+
+  private async callTool(
+    request: JsonRpcRequest,
+    base: string,
+    authorized: AuthorizedToken,
+    protocolVersion: string,
+    signal: AbortSignal,
+    requestKey?: string,
+  ): Promise<ModernDispatchResult> {
+    const inspected = inspectWorkerToolCall(request.params, this.config.tools(authorized));
+    if (!inspected.ok) {
+      const message = inspected.reason === "missing_name" ? "tools/call requires a tool name"
+        : inspected.reason === "unknown_tool" ? "Unknown tool"
+          : "Tool arguments do not match the input schema";
+      return {
+        status: 200,
+        message: rpcError(request.id, -32602, message, inspected.issues ? { side_effects_started: false, validation_issues: [...inspected.issues] } : undefined),
+      };
+    }
+    const { name, args: rawArgs } = inspected;
+    try {
+      const result = await this.config.callTool({
+        name, args: rawArgs as Record<string, unknown>, base, authorized, signal, requestKey,
+      });
+      return {
+        status: 200,
+        message: rpcResult(request.id, textToolResult(result, false, protocolVersion, this.config.serverInfo))!,
+      };
+    } catch (error) {
+      return {
+        status: 200,
+        message: rpcResult(request.id, textToolResult(
+          { error: publicWorkerToolError(error) }, true, protocolVersion, this.config.serverInfo,
+        ))!,
+      };
+    }
+  }
+}