MCP protocol reference
This page describes what the fx MCP client implements. To add and operate servers, see MCP.
fx implements the core MCP 2026-07-28 specification over local stdio and stateless Streamable HTTP. Version-scoped adapters retain compatibility with legacy stdio, 2025-11-25/2025-06-18/2025-03-26 Streamable HTTP, and deprecated 2024-11-05 HTTP+SSE. The client is available to the interactive shell, fx ask, ACP sessions, and authorized subagents.
Core MCP client scope
fx supports the current core client protocol and the legacy compatibility paths listed below. It does not currently implement the MCP Tasks, MCP Apps, Skills over MCP, Client Credentials, or Enterprise-Managed Authorization extensions. fx does not install servers from a registry and does not expose itself as an MCP server.
Protocol compatibility
| Transport | Current protocol | Retained compatibility |
|---|---|---|
| stdio | 2026-07-28 | Version-negotiated legacy initialization |
| Streamable HTTP | Stateless 2026-07-28 | 2025-11-25, 2025-06-18, and 2025-03-26 |
| HTTP+SSE | Not used by the current protocol | Deprecated 2024-11-05 compatibility only |
Current requests are stateless and self-contained. fx uses server/discover, per-request client metadata and capabilities, required HTTP routing headers, resultType, cache hints, subscriptions/listen, and Multiple Round-Trip Requests (MRTR). Legacy adapters use the initialization, session, notification, and elicitation behavior defined by their negotiated revision. fx falls back through the legacy negotiation ladder when a server does not implement modern discovery.
Core protocol coverage
| Surface | fx behavior |
|---|---|
| Tools | Lazy search and selection, namespaced identities, input and output schema validation, progress, cancellation, and permission checks before transport |
| Resources | Paginated resource and template catalogs, explicit URI reads, template completion, multiple text or blob contents, resource links, annotations, metadata, icons, and bounded caches |
| Prompts | Paginated discovery, exact server-qualified invocation, typed arguments, multiple messages and content types, annotations, metadata, icons, and argument completion |
| Completion | Bounded resource-template and prompt-argument candidates with cancellation and deadlines |
| Change delivery | Cache hints, list-change notifications, resource subscriptions, reconnect recovery, and modern subscriptions/listen |
| Elicitation | Form and URL requests, accept/decline/cancel results, MRTR continuation for modern servers, and version-scoped legacy handling |
Elicitation by surface
Interactive and fx ask surfaces can collect supported form input and ask for consent before opening an HTTPS or loopback URL. fx does not fetch elicitation URLs or their metadata. Noninteractive fx ask returns a typed input-required result instead of waiting for input it cannot collect. ACP advertises only the form or URL modes supported by that client session.
Tool schemas
Tool schemas without $schema use JSON Schema 2020-12. Canonical 2020-12 declarations and canonical Draft 7 declarations are evaluated with their declared semantics, including Draft 7 definitions, tuple items, dependencies, identifier scoping, and $ref sibling behavior. Invalid model arguments fail before tools/call, and structured results are checked against the declared output schema.
Other dialects and references that require fetching another document fail before tools are published. Pattern evaluation uses a bounded non-backtracking engine; unsupported expression constructs fail explicitly rather than becoming permissive.
Discovery and isolation
fx first attempts modern discovery and falls back to version-scoped legacy initialization when required. The model uses mcp_search_tools, then mcp_select_tool, to load a matching schema. Selected tools are namespaced and sanitized so they do not collide with built-ins. Server instructions, descriptions, search results, and selected schemas are bounded by context limits.
ACP mcpServers are authoritative for their active ACP session and do not inherit profile servers.
One-off and persistent subagents receive an immutable, permission-filtered view of their active parent or ACP session's MCP servers, tools, resources, prompts, and completion capability. No admitted view means MCP is disabled; reload, removal, authentication partition changes, authority changes, parent or session closure, and cancellation fail closed before transport.
Trust and security
MCP server instructions, descriptions, prompts, resources, schemas, and tool results are external input. fx bounds them before ownership or model projection and marks returned content as untrusted_external with no authority. Resource content remains outside model context until an explicit read, and resource or prompt text cannot grant permissions or override the user's instructions.
Dynamic MCP tool calls use the same fx permission policy as built-in tools. Authorization and generation checks run again immediately before transport, so reload, logout, server removal, session replacement, parent closure, and permission changes cannot reuse stale authority. Health output omits credentials, configured secrets, raw responses, and server URLs. URL opener traces record termination metadata without recording the URL.
Conformance
CI runs the official MCP client conformance suite for 2026-07-28 against the freshly built fx binary. The pinned baseline has no expected client failures. Retained legacy conformance and deterministic stdio, Streamable HTTP, HTTP+SSE, authentication, ACP, lifecycle, and subagent end-to-end tests cover behavior not yet represented in the upstream suite.