Repository navigation
list: server instructions missing unless --no-oauth (regression of #76) #455
Description
Summary
Single-server mcporter list <server> no longer shows the server's instructions from the initialize response unless --no-oauth is passed. This affects both text and --json output. It's a regression of the feature from #76 (5d8e64d).
Reproduction
Minimal stdio server:
// /tmp/server.mjs
import readline from 'node:readline';
readline.createInterface({ input: process.stdin }).on('line', (line) => {
const m = JSON.parse(line);
if (m.id === undefined) return;
const result = m.method === 'initialize'
? { protocolVersion: m.params.protocolVersion, capabilities: { tools: {} }, serverInfo: { name: 't', version: '1' }, instructions: 'HELLO-INSTRUCTIONS' }
: m.method === 'tools/list' ? { tools: [{ name: 'ping', inputSchema: { type: 'object' } }] } : {};
process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: m.id, result }) + '\n');
});mcporter list --stdio "node /tmp/server.mjs" --json | jq .instructions # null
mcporter list --stdio "node /tmp/server.mjs" --json --no-oauth | jq .instructions # "HELLO-INSTRUCTIONS"| Version | text | text --no-oauth |
--json |
--json --no-oauth |
|---|---|---|---|---|
| 0.13.12 | missing | shown | missing | shown |
| 0.15.0 | missing | shown | missing | shown |
| main @ 5362d60 | missing | shown | missing | shown |
The same happens with a config-defined server and with an empty HOME. No daemon or keep-alive is involved.
Cause
src/cli/list-command.ts(~215-220 and ~289-294) loads tool metadata withautoAuthorize: false, anddisableOAuthisfalseunless--no-oauthis passed.- In
src/runtime.ts(~268-272), that takes the legacy no-authorize path:maxOAuthAttempts: 0, skipCache: true. The context is closed after listing. loadServerInstructionsthen callsruntime.getInstructions→connection-cache.tsgetInstructions(~73-88). That only checks cached or active entries, so it returnsundefined(~line 77).
getConnectionInfo doesn't have this problem because it falls back to the lastConnectionInfo snapshot stored on every connect (~line 334). Instructions have no such fallback. The list tests mock runtime.getInstructions, so they don't catch it.
Suggested fix
Store a lastInstructions snapshot next to lastConnectionInfo in connection-cache.ts. Set it on connect, clear it in supersedeDefinition, and return it from getInstructions when there's no cached entry. With that patch on main, all four combinations show the instructions, and the runtime-cache, cli-list-modes, cli-list-formatting and keep-alive-runtime tests pass. A non-mocked regression test (real stdio fixture through list, without --no-oauth) would guard it.
Workaround for now: mcporter list <server> --no-oauth.
Activity
clawsweeper commentedon Oct 19, 2026
Codex review: this still needs some work.
Summary
Current main still loses instructions after uncached discovery, and an open fixing PR owns the repair.
Reproducibility: Current source establishes the failure for a fresh runtime after uncached discovery; Strajk supplies a minimal stdio reproduction corroborated by contributor output in the linked PR, but this review executed no code or tests.
Regression provenance
Possible regression — suspected (reviewed change). No predecessor PR is attributed.
Root-cause cluster
Relationship:
canonicalCanonical: #455
Summary: This issue owns instruction loss after uncached discovery, with an open PR supplying the focused repair.
Members:
fixed_by_candidate: fix(list): show server instructions without --no-oauth #456 - Explicitly closes this issue through retained instructions and regression coverage.adjacent_distinct: MCP serverinstructionsfrom initialize response not surfaced to agents #76 - Established the named-listing instruction display contract.adjacent_distinct: fix(runtime): preserve disableOAuth across headless paths #198 - Established cache-friendly OAuth suppression, explaining why --no-oauth avoids the failing path.adjacent_distinct: fix: cancel and retire uncached discovery connections #383 - Established uncached cancellation and supersession safeguards relevant to retained metadata.Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.
Next step
Review #456 and keep this issue open until its fixing PR merges.
Review details
Best possible solution:
Retain initialization instructions through uncached discovery while preserving authorization behavior, connection cleanup, and definition invalidation.
Do we have a high-confidence way to reproduce the issue?
Current source establishes the failure for a fresh runtime after uncached discovery; Strajk supplies a minimal stdio reproduction corroborated by contributor output in the linked PR, but this review executed no code or tests.
Is this the best way to solve the issue?
The retained snapshot in #456 follows the existing connection-info pattern and addresses the lifecycle gap without reconnecting or changing OAuth policy.
AGENTS.md: found and applied where relevant.
Codex review notes: model internal, reasoning medium; reviewed against 5362d60d2e17.
Label changes
Label changes:
No label changes.
Label justifications:
P2: Named listings omit documented server guidance, but tool discovery remains usable and --no-oauth provides a workaround.impact:ux-friction: Users and agents must discover an unrelated-looking OAuth flag to retrieve server initialization instructions.Evidence reviewed
What I checked:
src/runtime.ts:268, 5362d60d2e17)src/runtime/connection-cache.ts:77, 5362d60d2e17)instructionsfrom initialize response not surfaced to agents #76 while intentionally excluding all-server summaries. (docs/cli-reference.md:16, 5362d60d2e17)tests/cli-list-formatting.test.ts:232, 5362d60d2e17)How this review workflow works
@clawsweeper re-reviewcomments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.@clawsweeper re-reviewor@clawsweeper re-runon an open PR or issue to request a fresh review only.@clawsweeper reviewto request a fresh review only.@clawsweeper explainto ask for more context, or@clawsweeper stopto stop active automation.Reviewed October 20, 2026, 3:46 PM ET / 19:46 UTC.
14 remaining items
fix(list): preserve server instructions after discovery (#456)
steipete commentedon Oct 20, 2026
Fixed in #456, merged as 845961a. Named text and JSON listings now retain server instructions after uncached discovery, with active-connection precedence and cancellation/definition invalidation preserved.
I reproduced five failures on main: the cache regression plus real CLI listings against legacy and modern servers over both stdio and HTTP. With the fix, all 2,275 tests, formatting, lint, typechecking, and installed npm package/CLI/library/OAuth checks passed. Coverage also checks that cancelled setup cannot retain instructions and that a subsequent connection with no instructions clears the snapshot.
Exact-head CI passed on Linux/Node 24, Linux/Node 26, macOS, and Windows. Thanks @Strajk for the reproduction and @KrasimirKralev for the repair.