stacklok / toolhive / 41712012209

73%

Build Type

push

github

Committed by web-flow

Commit Message

Answer vMCP tools/call with a URL elicitation (#7025)

* Add the vMCP URL elicitation answer type

An embedder needs a typed way to answer a tools/call with an MCP
URL-mode elicitation from its own decorator code. pkg/vmcp is Stable,
so both new types keep their fields unexported behind validating
constructors and read accessors: no unvalidated answer can reach a
render seam.

URLElicitationRequiredError deliberately does not implement
mcpparser.CodedError (-32042 exists only in 2025-11-25), and its
Error() never includes the URL, so code paths that stringify it do
not leak the connect link.

Part of #7022.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Render the URL elicitation fallback on both protocols

A client that cannot receive a URL elicitation must still learn the
call needs the user, without seeing the URL: a model handed the link
could follow it and skip the user consent step URL mode exists for.

Modern clients that did not declare elicitation.url get -32021 with
requiredCapabilities {elicitation: {url: {}}} at HTTP 200, telling
them to declare it and retry. Legacy sessions get an isError tool
result carrying the elicitation message, through a direct tools/call
and the optimizer's call_tool, via conversion.ErrorToToolResult.
Authorization denials still outrank the answer on both paths.

Tests also pin that backends cannot produce the answer: a Legacy
-32042 and a Modern input_required round stay ordinary backend errors,
and composite workflows flatten it into a URL-free isError result.

Part of #7022.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Answer Modern tools/call with input_required

A Modern (2026-07-28) client that declared elicitation.url can carry
the user to the embedder's connect page itself, so it gets the URL
elicitation answer as an InputRequiredResult: inputRequests keyed by
elicitation ID, each elicitation/create with mode "url", in one HTTP
200 response, with no requestState and no vMCP state... (continued)

Coverage Stats

163 of 163 new or added lines in 6 files covered. (100.0%)

7 existing lines in 2 files now uncovered.

92135 of 127285 relevant lines covered (72.38%)

135.0 hits per line