Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

OpenCode's MCP client features are way behind the latest MCP standard. The gaps below were touched across many issues and PRs (see list below). I myself also encountered many difficulties due to the incomplete capability while developing MCP extensions for OpenCode. A one-time implementation is probably the cleanest fix to all of them and leaves no technical debt. This should also bring architectural advantages by flattening skills and tasks into the MCP layer.

I know this proposal for a project of this size might be a bit unrealistic. Rewriting the MCP client would definitely break loads of plugins and dependencies, and the migration wouldn't be easy. Even so, the count of issues on this is large enough that I think the discussion is at least worth having.

Behavioral gaps

Missing entirely:

• ❌ sampling/createMessage and the sampling capability¹
• ❌ elicitation/create (form + URL modes), notifications/elicitation/complete, URLElicitationRequiredError -32042, and the elicitation capability²
• ❌ roots/list, notifications/roots/list_changed, and the roots capability³
• ❌ resources/subscribe / resources/unsubscribe / notifications/resources/updated / notifications/resources/list_changed⁴
• ❌ resources/templates/list⁵
• ❌ completion/complete⁶
• ⚠️ logging/setLevel and notifications/message⁷ — inbound notifications/message is now handled; outbound logging/setLevel is still missing
• ❌ ping⁸
• ❌ The entire experimental tasks/* system from 2025-11-25⁹
• ❌ No capabilities object passed to new Client(...) — opencode advertises nothing at initialize¹⁰

Partial or incorrect:

• ⚠️ Progress: resetTimeoutOnProgress: true is passed to callTool and works at the SDK level for timeout resets, but onprogress is never wired through, so no progress token is sent and progress events are not surfaced to the user¹¹
• ❌ Cancellation: notifications/cancelled is never sent when a user aborts a tool call¹²
• ✅ Pagination: tools/list, resources/list, prompts/list are called without cursors; large lists silently truncate — resolved: generic paginate() with cursor support, cycle detection, and 1000-page max is implemented¹³
• ✅ Tool results: structuredContent is ignored — resolved: now JSON-stringified to text content¹⁴
• ❌ outputSchema is tolerated during tools/list fallback by stripping it rather than validated or consumed¹⁵
• ✅ resource_link content type is dropped — resolved: handled as 'resource' content type in session/tools.ts¹⁶
• ❌ audio content type is dropped¹⁷
• ❌ isError flag in tool results is not checked
• ❌ Tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint)¹⁸ and icons[]¹⁹ are not consumed
• ❌ tools/list_changed is the only notification handled; resources/list_changed and prompts/list_changed are missing²⁰
• ❌ The server's InitializeResult.instructions does not appear to be captured from MCP initialization or threaded into the LLM context, so the server's own usage hints are lost²¹

Authorization:

• ✅ Token refresh: refreshToken is stored but never executed — tokens silently expire — resolved: SDK v1.29.0 executes token refresh via refreshAuthorization()²²
• ✅ RFC 8707 resource indicators: not sent — resolved: implemented by SDK²³
• ✅ RFC 9728 protected resource metadata: no explicit WWW-Authenticate resource_metadata parsing — resolved: implemented by SDK²⁴
• ✅ OpenID Connect Discovery 1.0: not implemented — resolved: SDK falls back from RFC 8414 to OIDC Discovery²⁵
• ⚠️ Client ID Metadata Documents: SDK supports it, but OpenCode's McpOAuthProvider does not supply clientMetadataUrl²⁶
• ✅ Step-up authorization (insufficient_scope re-auth): not implemented — resolved: SDK handles with loop protection²⁷
• ❌ OAuth callback server (port 19876) is not stopped after auth completes
• ❌ OAuth callback page has unescaped error query parameter (XSS / CWE-79)
• ✅ headers config is not sent during mcp auth / mcp debug — resolved

Networking:

• ✅ Streamable HTTP Accept header doesn't always list both application/json and text/event-stream — resolved: SDK sends correct Accept header²⁸
• ⚠️ MCP-Protocol-Version header: SDK dynamically negotiates correctly during normal operation, but opencode mcp debug still hardcodes protocolVersion: "2024-11-05" (three revisions behind)²⁹
• ✅ Mcp-Session-Id is not handled; session loss permanently breaks the connection — resolved: SDK stores and sends session ID³⁰
• ✅ Last-Event-ID resumption is not implemented — resolved: SDK implements resumption³¹
• ✅ No transport-level auto-reconnect on socket errors — resolved: SDK auto-reconnects with exponential backoff²⁸
• ⚠️ Local stdio servers still have incomplete lifecycle cleanup coverage on disconnect / replace / rollback³²
• ❌ Origin header validation, SSRF protection, and session-hijacking mitigations from the spec's Security Best Practices are not implemented³³

Related issues and PRs

Sampling:

• [FEATURE]: Add MCP sampling support (createMessage) #11948

Elicitation / roots / initialize instructions:

• [FEATURE]: MCP elicitation support #23066
• Add MCP elicitation support #8251
• feat(mcp): add elicitation request handling #8243
• [Feature Request] Native Elicitation support for MCP tools (Commit Message Refinement) #21231
• feat: Implement MCP server instruction fetching and integration #7334
• [FEATURE]: MCP Server instructions exposure #7373
• Support MCP Roots #2308

Resources and resource content:

• feat(mcp): add resource subscription API with autoprompt #29355
• [FEATURE]:MCP client 需要支持资源读取 #29245
• [FEATURE]: Support MCP Resources (resources/read) in addition to MCP Tools #15535
• [FEATURE]:Resource subscription #12092
• feat: add MCP resource subscription support #20682
• MCP Ressources with custom scheme #14753
• Bug: MCP resource @mention dispatches local file read instead of resources/read RPC #17543

Prompts:

• Regression: MCP prompts are no longer listed after connecting MCP server #28579
• Feature: Support MCP Prompt content injection as system message (hidden from user) #23480
• fix(mcp): cache unsupported prompt lists #28301

Progress and cancellation:

• fix(mcp): add onprogress callback so resetTimeoutOnProgress actually works #21701
• MCP client doesn't pass onprogress to callTool, so progress notifications can't extend the request timeout #28186
• [BUG]: opencode doesn't receive progress notifications from MCP servers #24965
• BUG-001: MCP tool call missing progressToken injection causing timeout on long reviews (-32001) #14499
• Implement MCP progress notifications #2101
• [FEATURE]: MCP progress events via server/sdk #11821
• fix(mcp): pass onprogress so resetTimeoutOnProgress actually works #24964
• [FEATURE]: Progress indicator for MCP calls #26328
• fix: pass onprogress to callTool so progressToken is set and long-run… #28246

Tool result schemas, structured content, and content types:

• MCP tool parameters of type "object" are serialized as strings instead of being passed as objects #28472
• Non-vision models blocked from passing images to vision-capable MCP tools #29216
• [FEATURE]: outputSchema for mcp tools should be exposed to LLM #27577
• MCP servers with outputSchema in tools/list break tool discovery #21591
• "Failed to get tools" when MCP server returns outputSchema in tools/list response #21373

OAuth / auth:

• MCP OAuth scope from config is ignored for pre-registered remote servers #28895
• fix(mcp): include scope in OAuth authorization URL for pre-registered clients #29219
• fix(mcp): invalidate stale credentials before re-authentication #29521
• Unexpected status: needs_auth when trying to authenticate MCP after changing account (already authenticated) #29227
• feat(mcp): expose synthetic authenticate tool for needs_auth MCPs #27725
• fix(mcp): authenticate on toggle in TUI MCP picker #27704
• MCP OAuth scope config is not applied to authorization flow #26301
• opencode mcp auth fails to open browser for OAuth flow (Google Drive MCP) #26195
• [FEATURE]: Support for MCP Support Client ID Metadata Document (CIMD) #25961
• Agents have no awareness of MCPs that need auth #27724
• opencode mcp auth does not print authorize URL to terminal, making it unusable over SSH #23951
• [Bug]: OAuth callback server (port 19876) not stopped after authentication, causing cross-instance CSRF failures #23568
• [Bug]: OAuth callback server (port 19876) not stopped after authentication completes #23563
• [Bug]: OAuth callback server not stopped after authentication, causing cross-instance CSRF failures #23562
• MCP OAuth: opencode mcp auth doesn't refresh token in active sessions #21702
• Remote MCP OAuth browser flow never triggered - Datadog MCP silently fails to authenticate #18130
• fix(mcp): OAuth callback error page XSS via unescaped error parameter (CWE-79) #17364
• Remote MCP OAuth: browser never opens for re-authentication after session loss #16893
• Entra Authentication for MCP doesn't work #12308
• Oath MCP always using root level even though my rul is .../xmcp/mcp #7135
• Reauthentication with Jira MCP via Oauth doesn't work #5953
• MCP with oauth doesn't work #5444

Transport / Streamable HTTP / SSE:

• MCP remote type: Accept header missing for Streamable HTTP servers (HTTP 400) #25650
• MCP streamable-HTTP transport: 'Session not found' from server permanently breaks tool calls (no auto-reconnect) #25137
• MCP client sends deprecated protocol version causing GitLab MCP server to fail (401) #20239
• Unauthenticated streamable HTTP MCP servers are reported as SSE errors instead of missing auth #16247
• fix(opencode): reconnect MCP transport on session-expiration error and retry once #25135

Connection lifecycle / reconnect / stdio:

• MCP config using type "stdio" causes opaque TUI bootstrap server errors in 1.15.x #28625
• Local stdio MCP servers leak processes on disconnect / replace / rollback #26714
• MCP remote client has no transport-level retry on socket/connection errors #25287
• MCP client connection status goes stale after initial connect #25682
• fix(mcp): MCP status shows connected green after server reconnect even though server is down #24855
• fix(mcp): MCP server loses connection mid-session causing intermittent failures #23997
• MCP stdio transport sends batched requests without proper flush, breaking local servers #21516

Custom / dynamic headers:

• [FEATURE]: add dynamic MCP headersHelper support for remote authentication #27161
• [FEATURE]: add mcp.call.before plugin hook for per-call MCP request headers (e.g. sessionID forwarding) #28225
• feat(mcp): add mcp.call.before plugin hook for per-call MCP request headers #28319

Tool invocation and tool management:

• mcp处理高精度数字参数丢失精度 #28124
• MCP tool wrappers send extra _placeholder param causing ZodError in Supabase MCP + empty response in PythonAnywhere MCP #15041
• [FEATURE]: Per-agent MCP tool filtering to stay within model tool limits #28662

Server notifications, _meta, logging, and schema compatibility:

• Surface upstream HTTP response headers from remote MCP tool calls (e.g. pagination, rate-limit) via CallToolResult._meta #29665
• [FEATURE]: Support _meta when calling downstream MCP tools #17084
• feat(mcp): forward session ID and plugin _meta to MCP tool calls #21624
• [MCP] Schema validation fails for tools with multiple discriminated-union/nested-object parameters (e.g. obsidian-mcp-server patch_note, append_to_note) #26277
• OpenCode warns on nonstandard MCP schema formats before jsonSchema() #20749
• MCP tool schema resolution: RecursionError on circular schema references #16899

TLS / mTLS / certificate validation:

• [FEATURE]: Mutual TLS / client-side certificate support for remote MCP #26862
• [FEATURE]: Add MCP client support for skipping certificate validation #23506

Stdio / platform transport compatibility:

• Python FastMCP server (STDIO) exits immediately on Windows — Not connected #26128
• fix: local MCP servers fail on Windows without native shell context #25904
• Local MCP server always times out on Windows #22310
• MCP Subsystem entirely unresponsive on Windows Desktop App (/config loads, but /mcp times out) #16449