pi-mcp-adapter 2.13.0 → 2.14.0

package/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.14.0] - 2026-07-25
+
+### Added
+- Added the global `settings.showStatusIcon` opt-out for plain `MCP: ...` status and connection text while keeping the plug icon enabled by default. Thanks @vaultboy001 for issue #216.
+
+### Fixed
+- Deferred implicit OAuth credential-store access until an HTTP server actually challenges for authentication, so unauthenticated remote Streamable HTTP servers work in headless environments. Thanks @vdom-1 for issue #218.
+- Accepted draft-07 tool output schemas alongside JSON Schema 2020-12 while preserving structured-content validation. Thanks Daniel Marbach (@danielmarbach) for issue #217.
+
 ## [2.13.0] - 2026-07-25
 
 ### Added

package/README.md

@@ -237,6 +237,7 @@ When any enabled server uses `eager` or `keep-alive`, initialization also starts
     "toolPrefix": "server",
     "idleTimeout": 10,
     "requestTimeoutMs": 30000,
+    "showStatusIcon": true,
     "hostConfigDiscovery": "off",
     "oauthDir": ".pi/mcp-oauth",
     "trace": {
@@ -255,6 +256,7 @@ When any enabled server uses `eager` or `keep-alive`, initialization also starts
 | `toolPrefix` | `"server"` (default), `"short"` (strips `-mcp` suffix), `"none"`, or `"mcp"` (prefixes with `mcp__`, using server-mode normalization) |
 | `idleTimeout` | Global idle timeout in minutes (default: 10, 0 to disable) |
 | `requestTimeoutMs` | Global request timeout in milliseconds for live MCP calls (if omitted or `<= 0`, the MCP SDK default timeout is used) |
+| `showStatusIcon` | Show the plug icon in MCP status and connection text (default: `true`). Set to `false` for plain `MCP: ...` text. |
 | `hostConfigDiscovery` | Host-specific config policy: `"off"` (default), `"prompt"` (detect/report only), or `"on"` (explicitly load detected host configs as the lowest-precedence fallback) |
 | `oauthDir` | Legacy OAuth `tokens.json` import directory for this MCP config. Relative paths resolve from the active project cwd. `MCP_OAUTH_DIR` still wins when set. Persistent OAuth credentials are stored in the OS credential store, not this directory. |
 | `directTools` | Global default for all servers (default: false). Per-server overrides this. |
@@ -522,6 +524,10 @@ If `settings.autoAuth` is `true`, `mcp({ connect: ... })`, `mcp({ tool: ... })`,
 
 In interactive sessions, you can also authenticate from `/mcp` with `ctrl+a` or Enter on a server that needs auth. In remote/headless sessions, use the proxy tool's `auth-start` and `auth-complete` actions to copy the authorization URL locally and paste the redirect URL back into Pi. `/mcp-auth` without a server only opens a picker in the interactive UI.
 
+### MCP output schemas
+
+Advertised tool `outputSchema` values support JSON Schema draft-07 and 2020-12. Unstamped schemas use the SDK's 2020-12 default. Returned `structuredContent` is validated against the advertised schema for both proxy and direct-tool calls.
+
 ## How It Works
 
 - One `mcp` tool in context (~200 tokens) instead of hundreds

package/init.ts

@@ -22,7 +22,7 @@ import {
 import { McpServerManager } from "./server-manager.ts";
 import { buildToolMetadata, totalToolCount } from "./tool-metadata.ts";
 import { UiResourceHandler } from "./ui-resource-handler.ts";
-import { openUrl, parallelLimit, sanitizeTerminalText } from "./utils.ts";
+import { formatMcpStatus, openUrl, parallelLimit, sanitizeTerminalText } from "./utils.ts";
 import { logger } from "./logger.ts";
 import { throwIfAborted } from "./abort.ts";
 import { getAuthStorageOptions } from "./mcp-auth.ts";
@@ -261,7 +261,7 @@ export async function initializeMcp(
       });
 
   if (ui && startupServers.length > 0) {
-    ui.setStatus("mcp", `🔌 MCP: connecting to ${startupServers.length} servers...`);
+    ui.setStatus("mcp", formatMcpStatus(state.config, `connecting to ${startupServers.length} servers...`));
   }
 
   const results = await parallelLimit(startupServers, 10, async ([name, definition]) => {
@@ -523,10 +523,11 @@ export function updateStatusBar(state: McpExtensionState): void {
     const definition = state.config.mcpServers[name];
     return connection.status === "connected" && definition !== undefined && !isServerDisabled(definition);
   }).length;
-  let status = `🔌 MCP: ${enabledCount} ${enabledCount === 1 ? "server" : "servers"} enabled`;
+  let status = `${enabledCount} ${enabledCount === 1 ? "server" : "servers"} enabled`;
   if (connectedCount > 0) status += ` (${connectedCount} connected)`;
   if (disabledCount > 0) status += ` (${disabledCount} disabled)`;
-  ui.setStatus("mcp", ui.theme ? ui.theme.fg("accent", status) : status);
+  const formattedStatus = formatMcpStatus(state.config, status);
+  ui.setStatus("mcp", ui.theme ? ui.theme.fg("accent", formattedStatus) : formattedStatus);
 }
 
 export function getFailureAgeSeconds(state: McpExtensionState, serverName: string): number | null {
@@ -563,7 +564,7 @@ export async function lazyConnect(state: McpExtensionState, serverName: string,
 
   try {
     if (state.ui) {
-      state.ui.setStatus("mcp", `🔌 MCP: connecting to ${serverName}...`);
+      state.ui.setStatus("mcp", formatMcpStatus(state.config, `connecting to ${serverName}...`));
     }
     const newConnection = await state.manager.connect(serverName, definition, ownedSignal);
     if (newConnection.status === "needs-auth") {

package/json-schema-validator.ts

@@ -0,0 +1,55 @@
+import {
+  Ajv,
+  AjvJsonSchemaValidator,
+  addFormats,
+} from "@modelcontextprotocol/client/validators/ajv";
+import type {
+  JsonSchemaType,
+  JsonSchemaValidator,
+  jsonSchemaValidator as JsonSchemaValidatorProvider,
+} from "@modelcontextprotocol/client";
+
+type SchemaDialect =
+  | { status: "unstamped" }
+  | { status: "stamped"; uri: string };
+
+const DRAFT_07_SCHEMA_URIS: ReadonlySet<string> = new Set([
+  "http://json-schema.org/draft-07/schema",
+  "https://json-schema.org/draft-07/schema",
+]);
+
+function schemaDialect(schema: JsonSchemaType): SchemaDialect {
+  if (!("$schema" in schema) || typeof schema.$schema !== "string") {
+    return { status: "unstamped" };
+  }
+  return {
+    status: "stamped",
+    uri: schema.$schema.endsWith("#") ? schema.$schema.slice(0, -1) : schema.$schema,
+  };
+}
+
+export function createJsonSchemaValidator(): JsonSchemaValidatorProvider {
+  const defaultValidator = new AjvJsonSchemaValidator();
+  let draft07Validator: AjvJsonSchemaValidator | undefined;
+
+  return {
+    getValidator<T>(schema: JsonSchemaType): JsonSchemaValidator<T> {
+      const dialect = schemaDialect(schema);
+      if (dialect.status !== "stamped" || !DRAFT_07_SCHEMA_URIS.has(dialect.uri)) {
+        return defaultValidator.getValidator<T>(schema);
+      }
+
+      draft07Validator ??= (() => {
+        const ajv = new Ajv({
+          strict: false,
+          validateFormats: true,
+          validateSchema: false,
+          allErrors: true,
+        });
+        addFormats(ajv);
+        return new AjvJsonSchemaValidator(ajv);
+      })();
+      return draft07Validator.getValidator<T>(schema);
+    },
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-adapter",
-  "version": "2.13.0",
+  "version": "2.14.0",
   "description": "MCP (Model Context Protocol) adapter extension for Pi coding agent",
   "type": "module",
   "types": "./index.ts",
@@ -75,6 +75,7 @@
     "ui-stream-types.ts",
     "config.ts",
     "server-manager.ts",
+    "json-schema-validator.ts",
     "session-recovery.ts",
     "sampling-handler.ts",
     "elicitation-handler.ts",

package/proxy-modes.ts

@@ -12,7 +12,7 @@ import { reconstructPromptMetadata } from "./metadata-cache.ts";
 import { resolveMcpResultContent, transformMcpContent } from "./tool-registrar.ts";
 import { guardMcpOutput, guardedMcpDetails, resolveMcpOutputGuardOptions } from "./mcp-output-guard.ts";
 import { maybeStartUiSession, summarizeUiSessionResult, type UiSessionRuntime } from "./ui-session.ts";
-import { formatAuthRequiredMessage, resolveServerUrl, truncateAtWord } from "./utils.ts";
+import { formatAuthRequiredMessage, formatMcpStatus, resolveServerUrl, truncateAtWord } from "./utils.ts";
 import { authenticate, completeAuthFromInput, startAuth, supportsOAuth } from "./mcp-auth-flow.ts";
 import { SessionRecoveryAuthRequiredError, withSessionRecovery } from "./session-recovery.ts";
 
@@ -663,7 +663,7 @@ export async function executeConnect(state: McpExtensionState, serverName: strin
 
   try {
     if (state.ui) {
-      state.ui.setStatus("mcp", `🔌 MCP: connecting to ${serverName}...`);
+      state.ui.setStatus("mcp", formatMcpStatus(state.config, `connecting to ${serverName}...`));
     }
     const currentConnection = state.manager.getConnection(serverName);
     let connection = currentConnection?.status === "connected"
@@ -948,7 +948,7 @@ export async function executeCall(
 
     try {
       if (state.ui) {
-        state.ui.setStatus("mcp", `🔌 MCP: connecting to ${serverName}...`);
+        state.ui.setStatus("mcp", formatMcpStatus(state.config, `connecting to ${serverName}...`));
       }
       connection = await state.manager.connect(serverName, definition, ownedSignal);
       if (connection.status === "needs-auth") {

package/server-manager.ts

@@ -2,6 +2,7 @@ import {
   Client,
   SSEClientTransport,
   StreamableHTTPClientTransport,
+  SdkHttpError,
   UnauthorizedError,
   type RequestOptions,
   type ReadResourceResult,
@@ -20,6 +21,7 @@ import {
 } from "./types.ts";
 import { SERVER_STREAM_RESULT_PATCH_METHOD, serverStreamResultPatchNotificationSchema } from "./types.ts";
 import { resolveNpxBinary } from "./npx-resolver.ts";
+import { createJsonSchemaValidator } from "./json-schema-validator.ts";
 import { logger } from "./logger.ts";
 import { McpOAuthProvider } from "./mcp-oauth-provider.ts";
 import { extractOAuthConfig, supportsOAuth, type McpOAuthRuntime } from "./mcp-auth-flow.ts";
@@ -50,6 +52,16 @@ const MCP_CLIENT_OPTIONS = {
 };
 const abortCleanupPromises = new WeakMap<object, Promise<void>>();
 
+type HttpAuthProviderState =
+  | { status: "disabled" }
+  | { status: "implicit-deferred" }
+  | { status: "explicit"; provider: McpOAuthProvider }
+  | { status: "implicit-challenged"; provider: McpOAuthProvider };
+
+function isUnauthorizedHttpError(error: unknown): boolean {
+  return error instanceof UnauthorizedError || (error instanceof SdkHttpError && error.status === 401);
+}
+
 function boundedStderrChunk(chunk: Buffer | string): Buffer {
   if (Buffer.isBuffer(chunk)) {
     const start = Math.max(0, chunk.byteLength - MAX_CAPTURED_STDERR_BYTES);
@@ -406,7 +418,7 @@ export class McpServerManager {
 
       // Check for UnauthorizedError - server requires OAuth. A cleanup failure
       // remains a setup failure rather than being hidden behind needs-auth.
-      if (error instanceof UnauthorizedError && supportsOAuth(definition) && cleanupFailures.length === 0) {
+      if (isUnauthorizedHttpError(error) && supportsOAuth(definition) && cleanupFailures.length === 0) {
         return {
           client,
           transport,
@@ -484,6 +496,7 @@ export class McpServerManager {
       { name: `pi-mcp-${serverName}`, version: "1.0.0" },
       {
         ...MCP_CLIENT_OPTIONS,
+        jsonSchemaValidator: createJsonSchemaValidator(),
         ...(Object.keys(capabilities).length > 0 ? { capabilities } : {}),
         listChanged: {
           tools: {
@@ -630,88 +643,99 @@ export class McpServerManager {
 
     // Create request init with headers (Authorization now included for bearer auth)
     const requestInit = Object.keys(headers).length > 0 ? { headers } : undefined;
-
-    // For OAuth servers, create an auth provider
-    let authProvider: McpOAuthProvider | undefined;
-    if (supportsOAuth(definition)) {
-      const oauthConfig = extractOAuthConfig(definition);
-      authProvider = new McpOAuthProvider(
-        serverName,
-        serverUrl,
-        oauthConfig,
-        {
-          onRedirect: async (_authUrl) => {
-            // URL is captured by startAuth, no need to log
-          },
+    const createAuthProvider = (): McpOAuthProvider => new McpOAuthProvider(
+      serverName,
+      serverUrl,
+      extractOAuthConfig(definition),
+      {
+        onRedirect: async (_authUrl) => {
+          // URL is captured by startAuth, no need to log
         },
-        this.authStorageOptions,
-        this.oauthRuntime?.signal,
-      );
-    }
-
-    // Try StreamableHTTP first (modern MCP servers)
-    const streamableTransport = new StreamableHTTPClientTransport(url, {
-      requestInit,
-      authProvider,
-    });
-    const probeTransport = traceObserver
-      ? wrapTransportWithMcpTrace(streamableTransport, serverName, "streamable-http", traceObserver)
-      : streamableTransport;
-
-    const testClient = new Client(
-      { name: "pi-mcp-probe", version: "2.1.2" },
-      MCP_CLIENT_OPTIONS,
+      },
+      this.authStorageOptions,
+      this.oauthRuntime?.signal,
     );
-    let probeCleanupAttempted = false;
-    try {
-      await this.connectClientWithAbort(
-        testClient,
-        probeTransport,
-        this.buildRequestOptions(definition, requestSignal),
-        signal,
+
+    // Explicit OAuth must check the secure credential store before connecting.
+    let authState: HttpAuthProviderState = supportsOAuth(definition)
+      ? definition.auth === undefined
+        ? { status: "implicit-deferred" }
+        : { status: "explicit", provider: createAuthProvider() }
+      : { status: "disabled" };
+
+    // Try StreamableHTTP first (modern MCP servers). For implicit OAuth, defer
+    // creating the provider until the server proves that authentication is needed.
+    for (;;) {
+      const authProvider = "provider" in authState ? authState.provider : undefined;
+      const streamableTransport = new StreamableHTTPClientTransport(url, {
+        requestInit,
+        authProvider,
+      });
+      const probeTransport = traceObserver
+        ? wrapTransportWithMcpTrace(streamableTransport, serverName, "streamable-http", traceObserver)
+        : streamableTransport;
+      const testClient = new Client(
+        { name: "pi-mcp-probe", version: "2.1.2" },
+        MCP_CLIENT_OPTIONS,
       );
-      probeCleanupAttempted = true;
+      let probeCleanupAttempted = false;
       try {
-        await testClient.close();
-      } catch (cleanupError) {
-        throw new AggregateError([cleanupError], "MCP HTTP probe cleanup failed");
-      }
-
-      // StreamableHTTP works - create fresh transport for actual use
-      return new StreamableHTTPClientTransport(url, { requestInit, authProvider });
-    } catch (error) {
-      if (error instanceof AggregateError && (
-        error.message === "MCP connection abort cleanup failed" ||
-        error.message === "MCP HTTP probe cleanup failed"
-      )) {
-        throw error;
-      }
-
-      // StreamableHTTP failed, close through the SDK client and try SSE fallback.
-      // If connectClientWithAbort already owned the close, await that operation
-      // instead of closing the same transport again.
-      if (!probeCleanupAttempted) {
+        await this.connectClientWithAbort(
+          testClient,
+          probeTransport,
+          this.buildRequestOptions(definition, requestSignal),
+          signal,
+        );
         probeCleanupAttempted = true;
         try {
-          await (abortCleanupPromises.get(probeTransport) ?? testClient.close());
+          await testClient.close();
         } catch (cleanupError) {
-          throw new AggregateError([error, cleanupError], "MCP HTTP probe cleanup failed");
+          throw new AggregateError([cleanupError], "MCP HTTP probe cleanup failed");
         }
-      }
 
-      // Host cancellation is not transport capability evidence; do not fall
-      // through to SSE when the caller is trying to cancel the connect.
-      if (signal?.aborted) {
-        throwIfAborted(signal);
-      }
+        // StreamableHTTP works - create fresh transport for actual use
+        return new StreamableHTTPClientTransport(url, { requestInit, authProvider });
+      } catch (error) {
+        if (error instanceof AggregateError && (
+          error.message === "MCP connection abort cleanup failed" ||
+          error.message === "MCP HTTP probe cleanup failed"
+        )) {
+          throw error;
+        }
 
-      // If this was an UnauthorizedError, don't try SSE - the server needs auth
-      if (error instanceof UnauthorizedError) {
-        throw error;
-      }
+        // StreamableHTTP failed, close through the SDK client and try SSE fallback.
+        // If connectClientWithAbort already owned the close, await that operation
+        // instead of closing the same transport twice.
+        if (!probeCleanupAttempted) {
+          probeCleanupAttempted = true;
+          try {
+            await (abortCleanupPromises.get(probeTransport) ?? testClient.close());
+          } catch (cleanupError) {
+            throw new AggregateError([error, cleanupError], "MCP HTTP probe cleanup failed");
+          }
+        }
+
+        // Host cancellation is not transport capability evidence; do not fall
+        // through to SSE when the caller is trying to cancel the connect.
+        if (signal?.aborted) {
+          throwIfAborted(signal);
+        }
+
+        // An implicit URL-only server gets a provider only after a real auth
+        // challenge. This keeps unauthenticated servers independent of storage.
+        if (authState.status === "implicit-deferred" && isUnauthorizedHttpError(error)) {
+          authState = { status: "implicit-challenged", provider: createAuthProvider() };
+          continue;
+        }
+
+        // If this was an UnauthorizedError, don't try SSE - the server needs auth
+        if (isUnauthorizedHttpError(error)) {
+          throw error;
+        }
 
-      // SSE is the legacy transport
-      return new SSEClientTransport(url, { requestInit, authProvider });
+        // SSE is the legacy transport
+        return new SSEClientTransport(url, { requestInit, authProvider });
+      }
     }
   }
 

package/types.ts

@@ -395,6 +395,8 @@ export interface McpTraceSettings {
 
 export interface McpSettings {
   toolPrefix?: ToolPrefix;
+  /** Show the plug prefix in MCP status and connection text (default: true). Set to false to disable it. */
+  showStatusIcon?: boolean;
   /** Discover detected host-specific MCP configs only when explicitly enabled. */
   hostConfigDiscovery?: HostConfigDiscovery;
   idleTimeout?: number; // minutes, default 10, 0 to disable

package/utils.ts

@@ -221,6 +221,10 @@ export function formatAuthRequiredMessage(
   return template ? template.replaceAll("${server}", serverName) : defaultMessage;
 }
 
+export function formatMcpStatus(config: Pick<McpConfig, "settings">, message: string): string {
+  return `${config.settings?.showStatusIcon === false ? "MCP: " : "🔌 MCP: "}${message}`;
+}
+
 /**
  * Extract the adapter-owned UI stream mode from tool metadata.
  */