Fix MCP Apps marker batch self-attestation bypass

Author: cursoragent

src/lib/mcp/tools/auth-login-app.test.ts

@@ -271,7 +271,7 @@ describe("managed-auth MCP App registration", () => {
           },
         },
       ]),
-    ).toBe(true);
+    ).toBe(false);
     expect(
       initializeDeclaresMcpApps({
         jsonrpc: "2.0",

src/lib/mcp/tools/mcp-apps-gate.ts

@@ -10,24 +10,21 @@ export const MCP_APPS_EXTENSION = "io.modelcontextprotocol/ui";
 const MCP_APPS_MARKER_TTL_SECONDS = 24 * 60 * 60;
 
 /**
- * Whether a JSON-RPC payload (single message or batch) is an initialize that
- * declares MCP Apps support. The route layer uses this to record the client
- * capability, because the stateless streamable-HTTP transport does not expose
- * it to later requests.
+ * Whether a JSON-RPC payload is a standalone initialize request that declares
+ * MCP Apps support. The route layer records capability only for standalone
+ * initialize requests so a mixed batch cannot self-attest and invoke app-only
+ * tools in the same HTTP call.
  */
 export function initializeDeclaresMcpApps(body: unknown): boolean {
-  const messages = Array.isArray(body) ? body : [body];
-  return messages.some((message) => {
-    if (!message || typeof message !== "object") return false;
-    const request = message as {
-      method?: unknown;
-      params?: { capabilities?: { extensions?: Record<string, unknown> } };
-    };
-    return (
-      request.method === "initialize" &&
-      Boolean(request.params?.capabilities?.extensions?.[MCP_APPS_EXTENSION])
-    );
-  });
+  if (!body || typeof body !== "object" || Array.isArray(body)) return false;
+  const request = body as {
+    method?: unknown;
+    params?: { capabilities?: { extensions?: Record<string, unknown> } };
+  };
+  return (
+    request.method === "initialize" &&
+    Boolean(request.params?.capabilities?.extensions?.[MCP_APPS_EXTENSION])
+  );
 }
 
 /**