feat(cli): add experimental MCP Apps support with resource/tool HTTP endpoints - #13271
Conversation
…endpoints - Add KILO_EXPERIMENTAL_MCP_APPS runtime flag - Expose clientName on McpTool interface and populate it during tool listing - Add POST /experimental/resource/read and POST /experimental/mcp/call-tool HTTP endpoints - Gate both endpoints behind experimentalMcpApps flag - Propagate mcpApp UI metadata (resourceUri, serverId) in tool call results when tools advertise _meta.ui.resourceUri in their definition - Add docs/kilo-headless-embedding.md for headless and embedding capabilities - Fix test fixtures to include clientName in McpTool mocks
- Add kilocode_change markers to all shared upstream files touched - Log MCP callTool failures instead of silently swallowing them - Remove redundant type casts on the callTool result - Make ReadResourcePayload.server required (schema-level validation) and drop the now-dead BadRequest guard - Remove unused meta field from ReadResourceContent schema
Extract the experimental MCP Apps schemas, HTTP handler bodies, and the tool-call metadata helper into @/kilocode/mcp/apps so the shared upstream files only carry minimal marked integration points (route registrations, imports, one field). Reduces the long-term diff against upstream opencode.
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| const client = (yield* mcp.clients())[ctx.payload.server] | ||
| if (!client) return yield* Effect.fail(new HttpApiError.NotFound({})) | ||
| const result = yield* Effect.tryPromise(() => | ||
| client.callTool({ name: ctx.payload.name, arguments: ctx.payload.arguments ?? {} }), |
There was a problem hiding this comment.
[WARNING]: Widget-initiated MCP tool calls skip permission, sandbox, and timeout controls
Session MCP tool execution goes through SandboxPolicy.executeMcp and ctx.ask before client.callTool, and McpCatalog.convertTool always passes the configured timeout, abort signal, and CallToolResultSchema. This HTTP path invokes client.callTool with only a name and arguments, so an authenticated client (or an unsecured kilo serve) can run any connected MCP tool with no permission prompt, no sandbox network check, and no timeout. Consider routing through the same execution path as session/code-mode tool calls, or at least applying permission + timeout here.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Files Reviewed (10 files)
Fix these issues in Kilo Cloud Reviewed by grok-4.6 · Input: 287.8K · Output: 31.3K · Cached: 725.9K Review guidance: REVIEW.md from base branch |
The httpapi coverage gate requires every declared route to have a scenario. Add Kilo-owned scenarios for POST /experimental/resource/read and POST /experimental/mcp/call-tool asserting the flag-gated 404 (the exerciser runs with experimentalMcpApps off).
|
@kilocode-bot can you check if the changes in packages/opencode/.kilo/tui.json are needed? Also check if the unresolved comment should be fixed in a follow up PR? |
|
Findings from the cloud agent:
The unresolved WARNING on
Recommend: remove |
|
@kilocode-bot please create a follow up PR to remove the accidental artifact. Also create an issue to check if we need to fix the comment. Assign both to romulorosa. |
|
One or more Cloud Agent sessions failed:
|
Removes packages/opencode/.kilo/tui.json, an empty {} file that was
accidentally committed by a broad 'git add' while running the httpapi
exerciser (PATCH /tui/config) from packages/opencode/ during work on
PR #13271 (feat(cli): add experimental MCP Apps support with
resource/tool HTTP endpoints).
Also ignores per-directory tui.json/tui.jsonc runtime config files
under packages/*/.kilo/ so this can't recur.
…n-artifact chore(cli): remove accidental tui.json artifact from PR #13271
2 participants
Summary
KILO_EXPERIMENTAL_MCP_APPSruntime flagPOST /experimental/resource/read,POST /experimental/mcp/call-tool) for MCP hosts to read UI resources and invoke tools directlymcpAppmetadata (resourceUri, serverId) in tool call results when a tool advertises_meta.ui.resourceUriin its definition, enabling hosts to preload UI resourcesContext
MCP Apps is a mechanism where MCP servers can advertise UI resources alongside their tools. When a tool is called, the server needs to know which UI resource to preload for that tool (identified by
resourceUriin_meta.ui). This change adds the plumbing: a flag to opt in, two HTTP endpoints to read resources and call tools from outside a session, and metadata propagation so tool call responses carry the MCP App context back to the host.The
clientNamefield was also added toMcpToolto identify which server a tool belongs to, which is needed to route resource reads and tool calls to the correct client.Test plan
bun run typecheckpasses inpackages/opencode/KILO_EXPERIMENTAL_MCP_APPS=true, connect an MCP server with tools that have_meta.ui.resourceUri, verify tool call responses includemcpAppmetadataPOST /experimental/resource/readandPOST /experimental/mcp/call-toolreturn 404 without the flag and correct data with it