fix(mcpproxy): default caching hints on resources/read re-encode

[abdulaziz-dev-lab]

Description

The legacy resources/read path decodes the backend result into mcp.ReadResourceResult to rewrite resource URIs and then re-encodes it. mcp.Cacheable has no omitempty (still true in go-sdk v1.8.0), so when a backend omits ttlMs/cacheScope, as pre-SEP-2549 servers do, the client receives "cacheScope":"". That is not a valid value, and strict clients reject the result (#2665). The list merges have set these fields since #2545, so this is the last place in internal/mcpproxy that re-encodes a cacheable result without them.

This sets a missing cacheScope to "private" before re-encoding. Read results can depend on the authenticated user and the gateway cannot tell when they don't, so it does not mark them shareable; the spec recommends "private" for such results [1]. A missing ttlMs decodes to 0, which the spec treats as immediately stale. Hints sent by the backend are passed through unchanged.

Tests: the existing resources/read case in Test_maybeResponseModify now uses a raw backend payload (the old fixture was built with json.Marshal(&mcp.ReadResourceResult{}) and already contained the empty scope). New cases check the encoded result when the backend omits the hints, sends an empty cacheScope, or sends its own (ttlMs: 5000, "public").

I also checked it end to end with aigw run in front of a minimal MCP server:

Build	Backend result	Client result
main	{"contents":[...]}	{"ttlMs":0,"cacheScope":"",...}
main	{"ttlMs":0,"cacheScope":"",...}	{"ttlMs":0,"cacheScope":"",...}
this PR	{"contents":[...]}	{"ttlMs":0,"cacheScope":"private",...}
this PR	{"ttlMs":0,"cacheScope":"",...}	{"ttlMs":0,"cacheScope":"private",...}
this PR	{"ttlMs":5000,"cacheScope":"public",...}	{"ttlMs":5000,"cacheScope":"public",...}

Related Issues/PRs (if applicable)

Fixes #2665 (the list responses were fixed in #2545; this covers resources/read)

Special notes for reviewers (if applicable)

• feat(mcp): stateless spec modern target apis and integration (28-07-2026) #2692 replaces this block. Its legacy path patches the raw JSON instead, so omitted hints stay omitted, and its modern resources/read handler fills them in as ttlMs: 0 / "private", the same default as here. This is a small fix for main until feat(mcp): stateless spec modern target apis and integration (28-07-2026) #2692 lands: if feat(mcp): stateless spec modern target apis and integration (28-07-2026) #2692 merges first I'll close this; if this merges first, feat(mcp): stateless spec modern target apis and integration (28-07-2026) #2692 can drop these lines when it rebases. One difference: on feat(mcp): stateless spec modern target apis and integration (28-07-2026) #2692's legacy path, an upstream that itself sends "cacheScope":"" (e.g. another proxy built on go-sdk types) is still forwarded as is.
• feat(mcp): opt-in content-digest verification for MCP resources #2744 adds a route argument to maybeResponseModify; the conflict with this PR is only in legacy_test.go.

1: https://modelcontextprotocol.io/specification/2026-07-28/server/utilities/caching#cache-scope-field

[netlify]

✅ Deploy Preview for theagentrouter canceled.

Name	Link
🔨 Latest commit	a499c81
🔍 Latest deploy log	https://app.netlify.com/projects/theagentrouter/deploys/6ac5074857d99f00079b5759

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[abdulaziz-dev-lab]

/retest

[abdulaziz-dev-lab]

The red checks here are unrelated to this change. The Unit Test failures are the TestRunExtprocStartFailure flake on main (#2793, fix in #2794). The Envoy Gateway v1.8.5 e2e job timed out after its tests had passed, when a kubectl delete in a test cleanup hung. I'll merge main once #2794 lands.

[abdulaziz-dev-lab]

/retest

[abdulaziz-dev-lab]

/retest

[abdulaziz-dev-lab]

/retest