kevinswiber

Questions about MCP Tasks

1. Authorization Context Scope

The Tasks specification (2025-11-25) introduces "authorization context" for task binding and access control. However, other stateful protocol elements—initialization/capability negotiation, progress tokens, sampling requests, roots—also require context binding in multi-tenant deployments.

Was the decision to scope authorization context to Tasks intentional, or would you consider elevating it to a protocol-wide concept?

---

kevinswiber

import { AsyncResource } from "node:async_hooks";
import { createServer, request } from "node:http";

// A thin wrapper around AsyncResource to manage best-effort completions.
// Best-effort resources are not guaranteed to complete, but they are
// allowed time to complete before the process exits on SIGINT.
// In a real-world scenario, you would likely include more details
// in the resource context to help trace completed and
// abandoned best-effort executions.
class BestEffort extends AsyncResource {

kevinswiber

// Usage:
//   node --import=./typescript-hook.js --watch ./dist/index.js
//
// Make changes to your TypeScript code, have it automatically
// recompiled, and see it reloaded in Node.js.
//
// This file is intended to be used as a Node.js preload module.
// The TypeScript compiler (tsc) will be run in watch mode.
// This is useful while running Node.js itself runs in watch mode.
//

kevinswiber

import assert from "node:assert";

function escapeRegexString(str) {
  return str.replace(/[\.\+\*\?\^\$\{\}\(\)\[\]\|\/\\]/g, "\\$&");
}

function isValidNameCodePoint(codePoint, isFirstCodePoint) {
  if (isFirstCodePoint) {
    return (codePoint >= 65 && codePoint <= 90) ||
      (codePoint >= 97 && codePoint <= 122) ||

kevinswiber

rules:
  missing_error_response_content:
    given: '$..responses[?(@property && @property.match(/^(4|5)/))]'
    then:
      field: content
      function: defined
    formats:
      - oas3
    severity: warn
    message: Error response should contain a response body.

kevinswiber

// Purpose: A simple HTTP server with routing and logging.
// Author: Kevin Swiber <kswiber@gmail.com>
// Exports:
//   serve({ routes, host, port, protocol, secure, serverOptions })
//     routes: A Map of routes to handlers. Example:
//       const routes = new Map();
//       routes.set("/greeting", {
//         get: ({ response }) => {
//           response.setHeader("Content-Type", "application/json");
//           response.end(JSON.stringify({ hello: "world" }));

kevinswiber

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "$id": "@stoplight/spectral-core/meta/extensions",
  "$defs": {
    "Extends": {
      "$anchor": "extends",
      "oneOf": [
        {
          "type": "string"
        },

kevinswiber

Changing configuration.workspaceFolder to connection.workspace.getWorkspaceFolders() to support non-VSCode workspace folders.

diff --git a/dist/spectral-language-server/src/server.js b/dist/spectral-language-server/src/server.js
index 8878d95..7ec85d6 100644
--- a/dist/spectral-language-server/src/server.js
+++ b/dist/spectral-language-server/src/server.js
@@ -118,19 +118,21 @@ function resolveSettings(document) {
         }
         let rulesetFile = null;
         connection.console.log(`Using ruleset file: ${configuration.rulesetFile}.`);

kevinswiber

package dev.swiber.api.conference

error Error = NotFound | InternalServerError

[location="/conferences"]
resource Conference {
  [method="GET", location="/{id}"]
  operation Retrieve(RetrieveConference): (ConferenceRetrieved, Error)
  [method="POST"]
  operation Create(CreateConference): (ConferenceCreated, Error)

kevinswiber

{
  "data": {
    "__schema": {
      "queryType": {
        "name": "Root"
      },
      "mutationType": null,
      "subscriptionType": null,
      "types": [
        {