LibreChat/packages/api
Dustin Healy b24eee648e refactor(mcp): advertise UI capability at host level and fix tool-visibility scoping
Advertise io.modelcontextprotocol/ui unconditionally on every MCP connection instead of gating it on
a per-connection appsEnabled value, and remove the now-unused enableApps plumbing from the
connection factory, inspector, and connection-building call sites. Per SEP-1865 the capability is a
per-session statement of host rendering ability, not a per-user setting; gating it per request on a
shared connection pool was both spec-incorrect and unable to support tenant opt-in. Per-tenant apps
enablement stays enforced downstream (callTool UI-resource attachment plus the app endpoints), which
now works for both opt-in and opt-out.

Replace the exact-match visibility helpers with includes-based semantics: a tool is hidden from the
model when an explicit visibility array omits "model", and denied to app callers when it omits
"app". An empty or future-scoped array such as [] or ["model","internal"] is now handled correctly,
and the both-scopes default applies only when visibility is absent. Rename the cache to reflect that
it holds app-hidden tools.
2026-06-30 17:16:58 -07:00
..
src refactor(mcp): advertise UI capability at host level and fix tool-visibility scoping 2026-06-30 17:16:58 -07:00
types 🔬 ci: Add TypeScript Type Checks to Backend Workflow and Fix All Type Errors (#12451) 2026-03-28 21:06:39 -04:00
.gitignore
babel.config.cjs
jest.config.mjs fix(ci): add @modelcontextprotocol/ext-apps to jest transformIgnorePatterns and fix import sort 2026-06-23 15:46:38 -07:00
jest.setup.cjs 🌱 fix: Inject Code-Tool Files Into Graph Sessions on First Call (+ read_file Sandbox Fallback) (#12831) 2026-04-27 08:56:39 +09:00
package.json fix(mcp): harden MCP Apps host security and CJS compatibility 2026-06-28 21:56:28 -07:00
tsconfig-paths-bootstrap.mjs
tsconfig.build.json 🧑‍💻 refactor: Secure Field Selection for 2FA & API Build Sourcemap (#9087) 2025-08-15 18:55:49 -04:00
tsconfig.json 📦 chore: npm audit fixes and Mongoose 8.23 TypeScript follow-ups (#12996) 2026-05-07 09:47:40 -04:00
tsconfig.spec.json 📦 chore: Update TypeScript Config for TS v7 (#12794) 2026-04-23 12:51:03 -04:00
tsdown.config.mjs 🪟 fix: Cross-Platform Absolute-Path Check in tsdown neverBundle Predicates (#13700) 2026-06-13 11:04:46 -04:00