v2.21.0

Added

• Added MCP 2026-07-28 endpoint probing and defaulted curated remote setup presets to automatic protocol negotiation for stateless MCP servers.
• Added resolveServerFromToolName so permission brokers can map prefixed MCP tool names back to their owning server. Thanks @jagaliano for PR #295.
• Added per-server oauth.skipIssuerMetadataValidation for known-misconfigured OAuth servers. Thanks @embik for issue #297.
• Added a configurable mcp.panel.save keybinding for the MCP panel Save action. Thanks @tim-hilde for issue #299.
• Added settings.agentPluginPaths to load MCP servers from Agent Plugins 1.0 packages.

Changed

• Refined MCP endpoint probing internals with typed strategies while preserving request order, fallback behavior, and diagnostics.

Fixed

• Rejected Agent Plugin command paths that escape the plugin directory and skipped normalized server-name collisions instead of overwriting servers.
• Stopped /mcp from inspecting host-specific config files when host config discovery is disabled. Thanks @rtfmkiesel for issue #292.
• Stopped optional numeric mcp and mcpScript tool parameters from leaking TypeBox internal markers into serialized schemas. Thanks @RainbowXie for issue #289 and PR #290.
• Forwarded RFC 9207 OAuth callback issuers to the MCP SDK during manual authorization completion. Thanks @tkoenig for issue #293 and PR #294, and @ugur-murat-alt for independent live verification.
• Kept mcpScript tools.describe() from omitting parameter information when TypeScript shape rendering falls back. Thanks @sheurich for issue #288.
• Reduced repeated collapsed MCP result rendering allocation after large or truncated tool outputs. Thanks @cp-yu for issue #291.