Close the stdio MCP lifecycle parity gap

The runtime already had stdio MCP bootstrap, initialize, tool discovery, and tool call plumbing, but the user-facing MCP tools still returned stub payloads. This wires ListMcpResources, ReadMcpResource, McpAuth, and MCP through real config-loaded MCP manager lifecycles, adds resource listing/reading support to the manager, and updates parity notes to reflect the new stdio-only coverage.\n\nConstraint: Keep scope on the MCP parity lane and avoid behavior changes in already-landed task/team/cron/bash/file tool work beyond lint-safe compile integration\nRejected: Implement remote MCP transports and browser OAuth flow now | broader than the requested parity slice\nConfidence: high\nScope-risk: moderate\nDirective: Reuse the manager-backed lifecycle for future remote transport support instead of adding new tool-local stubs\nTested: cargo fmt; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace\nNot-tested: Live OAuth/browser auth flow; non-stdio MCP transports

Author: Yeachan-Heo

PARITY.md

@@ -48,6 +48,10 @@ Canonical scenario map: `rust/mock_parity_scenarios.json`
 | **Sleep** | `tools` | delay execution — **good parity** |
 | **SendUserMessage/Brief** | `tools` | user-facing message — **good parity** |
 | **Config** | `tools` | config inspection — **moderate parity** |
+| **ListMcpResources** | `tools` + `runtime::mcp_stdio` | stdio MCP connect/list resources/disconnect — **moderate parity**. Missing: remote transports |
+| **ReadMcpResource** | `tools` + `runtime::mcp_stdio` | stdio MCP connect/read resource/disconnect — **moderate parity**. Missing: remote transports |
+| **McpAuth** | `tools` + `runtime::mcp_client` | stdio no-auth connect probe + OAuth requirement reporting — **partial parity**. Missing: interactive OAuth/browser flow |
+| **MCP** | `tools` + `runtime::mcp_stdio` | stdio MCP connect/list tools/call/disconnect — **moderate parity**. Missing: remote transports |
 | **EnterPlanMode** | `tools` | worktree plan mode toggle — **good parity** |
 | **ExitPlanMode** | `tools` | worktree plan mode restore — **good parity** |
 | **StructuredOutput** | `tools` | passthrough JSON — **good parity** |
@@ -71,10 +75,6 @@ Canonical scenario map: `rust/mock_parity_scenarios.json`
 | **CronDelete** | stub | needs cron registry |
 | **CronList** | stub | needs cron registry |
 | **LSP** | stub | needs language server client |
-| **ListMcpResources** | stub | needs MCP client |
-| **ReadMcpResource** | stub | needs MCP client |
-| **McpAuth** | stub | needs OAuth flow |
-| **MCP** | stub | needs MCP tool proxy |
 | **RemoteTrigger** | stub | needs HTTP client |
 | **TestingPermission** | stub | test-only, low priority |
 
@@ -108,7 +108,9 @@ Harness note: milestone 2 validates bash success plus workspace-write escalation
 Harness note: read_file, grep_search, write_file allow/deny, and multi-tool same-turn assembly are now covered by the mock parity harness.
 
 **Config/Plugin/MCP flows:**
-- [ ] Full MCP server lifecycle (connect, list tools, call tool, disconnect)
+- [x] Stdio MCP lifecycle (connect, list tools/resources, call tool, read resource, disconnect)
+- [ ] Remote MCP transports (HTTP/SSE/WS/managed proxy)
+- [ ] Interactive MCP OAuth/browser auth flow
 - [ ] Plugin install/enable/disable/uninstall full flow
 - [ ] Config merge precedence (user > project > local)
 

rust/crates/runtime/src/file_ops.rs

@@ -28,6 +28,7 @@ fn is_binary_file(path: &Path) -> io::Result<bool> {
 /// Validate that a resolved path stays within the given workspace root.
 /// Returns the canonical path on success, or an error if the path escapes
 /// the workspace boundary (e.g. via `../` traversal or symlink).
+#[allow(dead_code)]
 fn validate_workspace_boundary(resolved: &Path, workspace_root: &Path) -> io::Result<()> {
     if !resolved.starts_with(workspace_root) {
         return Err(io::Error::new(
@@ -544,6 +545,7 @@ fn normalize_path_allow_missing(path: &str) -> io::Result<PathBuf> {
 }
 
 /// Read a file with workspace boundary enforcement.
+#[allow(dead_code)]
 pub fn read_file_in_workspace(
     path: &str,
     offset: Option<usize>,
@@ -559,6 +561,7 @@ pub fn read_file_in_workspace(
 }
 
 /// Write a file with workspace boundary enforcement.
+#[allow(dead_code)]
 pub fn write_file_in_workspace(
     path: &str,
     content: &str,
@@ -573,6 +576,7 @@ pub fn write_file_in_workspace(
 }
 
 /// Edit a file with workspace boundary enforcement.
+#[allow(dead_code)]
 pub fn edit_file_in_workspace(
     path: &str,
     old_string: &str,
@@ -589,6 +593,7 @@ pub fn edit_file_in_workspace(
 }
 
 /// Check whether a path is a symlink that resolves outside the workspace.
+#[allow(dead_code)]
 pub fn is_symlink_escape(path: &Path, workspace_root: &Path) -> io::Result<bool> {
     let metadata = fs::symlink_metadata(path)?;
     if !metadata.is_symlink() {

rust/crates/runtime/src/lib.rs

@@ -57,11 +57,11 @@ pub use mcp_client::{
 };
 pub use mcp_stdio::{
     spawn_mcp_stdio_process, JsonRpcError, JsonRpcId, JsonRpcRequest, JsonRpcResponse,
-    ManagedMcpTool, McpInitializeClientInfo, McpInitializeParams, McpInitializeResult,
-    McpInitializeServerInfo, McpListResourcesParams, McpListResourcesResult, McpListToolsParams,
-    McpListToolsResult, McpReadResourceParams, McpReadResourceResult, McpResource,
-    McpResourceContents, McpServerManager, McpServerManagerError, McpStdioProcess, McpTool,
-    McpToolCallContent, McpToolCallParams, McpToolCallResult, UnsupportedMcpServer,
+    ManagedMcpResource, ManagedMcpTool, McpInitializeClientInfo, McpInitializeParams,
+    McpInitializeResult, McpInitializeServerInfo, McpListResourcesParams, McpListResourcesResult,
+    McpListToolsParams, McpListToolsResult, McpReadResourceParams, McpReadResourceResult,
+    McpResource, McpResourceContents, McpServerManager, McpServerManagerError, McpStdioProcess,
+    McpTool, McpToolCallContent, McpToolCallParams, McpToolCallResult, UnsupportedMcpServer,
 };
 pub use oauth::{
     clear_oauth_credentials, code_challenge_s256, credentials_path, generate_pkce_pair,

rust/crates/runtime/src/mcp_stdio.rs

@@ -25,6 +25,11 @@ const MCP_LIST_TOOLS_TIMEOUT_MS: u64 = 300;
 #[cfg(not(test))]
 const MCP_LIST_TOOLS_TIMEOUT_MS: u64 = 30_000;
 
+#[cfg(test)]
+const MCP_LIST_RESOURCES_TIMEOUT_MS: u64 = 300;
+#[cfg(not(test))]
+const MCP_LIST_RESOURCES_TIMEOUT_MS: u64 = 30_000;
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(untagged)]
 pub enum JsonRpcId {
@@ -223,6 +228,12 @@ pub struct ManagedMcpTool {
     pub tool: McpTool,
 }
 
+#[derive(Debug, Clone, PartialEq)]
+pub struct ManagedMcpResource {
+    pub server_name: String,
+    pub resource: McpResource,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UnsupportedMcpServer {
     pub server_name: String,
@@ -420,6 +431,65 @@ impl McpServerManager {
         Ok(discovered_tools)
     }
 
+    pub async fn list_resources(
+        &mut self,
+        server_name: Option<&str>,
+    ) -> Result<Vec<ManagedMcpResource>, McpServerManagerError> {
+        let server_names = match server_name {
+            Some(server_name) => vec![server_name.to_string()],
+            None => self.servers.keys().cloned().collect::<Vec<_>>(),
+        };
+        let mut resources = Vec::new();
+
+        for server_name in server_names {
+            resources.extend(self.list_resources_for_server(&server_name).await?);
+        }
+
+        Ok(resources)
+    }
+
+    pub async fn read_resource(
+        &mut self,
+        server_name: &str,
+        uri: &str,
+    ) -> Result<JsonRpcResponse<McpReadResourceResult>, McpServerManagerError> {
+        let timeout_ms = self.tool_call_timeout_ms(server_name)?;
+
+        self.ensure_server_ready(server_name).await?;
+        let request_id = self.take_request_id();
+        let response =
+            {
+                let server = self.server_mut(server_name)?;
+                let process = server.process.as_mut().ok_or_else(|| {
+                    McpServerManagerError::InvalidResponse {
+                        server_name: server_name.to_string(),
+                        method: "resources/read",
+                        details: "server process missing after initialization".to_string(),
+                    }
+                })?;
+                Self::run_process_request(
+                    server_name,
+                    "resources/read",
+                    timeout_ms,
+                    process.read_resource(
+                        request_id,
+                        McpReadResourceParams {
+                            uri: uri.to_string(),
+                        },
+                    ),
+                )
+                .await
+            };
+
+        if let Err(error) = &response {
+            if Self::should_reset_server(error) {
+                self.reset_server(server_name).await?;
+            }
+        }
+
+        response
+    }
+
     pub async fn call_tool(
         &mut self,
         qualified_tool_name: &str,
@@ -623,6 +693,94 @@ impl McpServerManager {
         Ok(discovered_tools)
     }
 
+    async fn list_resources_for_server(
+        &mut self,
+        server_name: &str,
+    ) -> Result<Vec<ManagedMcpResource>, McpServerManagerError> {
+        let mut attempts = 0;
+
+        loop {
+            match self.list_resources_for_server_once(server_name).await {
+                Ok(resources) => return Ok(resources),
+                Err(error) if attempts == 0 && Self::is_retryable_error(&error) => {
+                    self.reset_server(server_name).await?;
+                    attempts += 1;
+                }
+                Err(error) => {
+                    if Self::should_reset_server(&error) {
+                        self.reset_server(server_name).await?;
+                    }
+                    return Err(error);
+                }
+            }
+        }
+    }
+
+    async fn list_resources_for_server_once(
+        &mut self,
+        server_name: &str,
+    ) -> Result<Vec<ManagedMcpResource>, McpServerManagerError> {
+        self.ensure_server_ready(server_name).await?;
+
+        let mut discovered_resources = Vec::new();
+        let mut cursor = None;
+        loop {
+            let request_id = self.take_request_id();
+            let response = {
+                let server = self.server_mut(server_name)?;
+                let process = server.process.as_mut().ok_or_else(|| {
+                    McpServerManagerError::InvalidResponse {
+                        server_name: server_name.to_string(),
+                        method: "resources/list",
+                        details: "server process missing after initialization".to_string(),
+                    }
+                })?;
+                Self::run_process_request(
+                    server_name,
+                    "resources/list",
+                    MCP_LIST_RESOURCES_TIMEOUT_MS,
+                    process.list_resources(
+                        request_id,
+                        Some(McpListResourcesParams {
+                            cursor: cursor.clone(),
+                        }),
+                    ),
+                )
+                .await?
+            };
+
+            if let Some(error) = response.error {
+                return Err(McpServerManagerError::JsonRpc {
+                    server_name: server_name.to_string(),
+                    method: "resources/list",
+                    error,
+                });
+            }
+
+            let result = response
+                .result
+                .ok_or_else(|| McpServerManagerError::InvalidResponse {
+                    server_name: server_name.to_string(),
+                    method: "resources/list",
+                    details: "missing result payload".to_string(),
+                })?;
+
+            for resource in result.resources {
+                discovered_resources.push(ManagedMcpResource {
+                    server_name: server_name.to_string(),
+                    resource,
+                });
+            }
+
+            match result.next_cursor {
+                Some(next_cursor) => cursor = Some(next_cursor),
+                None => break,
+            }
+        }
+
+        Ok(discovered_resources)
+    }
+
     async fn reset_server(&mut self, server_name: &str) -> Result<(), McpServerManagerError> {
         let mut process = {
             let server = self.server_mut(server_name)?;
@@ -1386,6 +1544,36 @@ mod tests {
             "                'isError': False",
             "            }",
             "        })",
+            "    elif method == 'resources/list':",
+            "        send_message({",
+            "            'jsonrpc': '2.0',",
+            "            'id': request['id'],",
+            "            'result': {",
+            "                'resources': [",
+            "                    {",
+            "                        'uri': f'resource://{LABEL}/guide.txt',",
+            "                        'name': f'{LABEL}-guide',",
+            "                        'description': f'Guide for {LABEL}',",
+            "                        'mimeType': 'text/plain'",
+            "                    }",
+            "                ]",
+            "            }",
+            "        })",
+            "    elif method == 'resources/read':",
+            "        uri = request['params']['uri']",
+            "        send_message({",
+            "            'jsonrpc': '2.0',",
+            "            'id': request['id'],",
+            "            'result': {",
+            "                'contents': [",
+            "                    {",
+            "                        'uri': uri,",
+            "                        'mimeType': 'text/plain',",
+            "                        'text': f'{LABEL} contents for {uri}'",
+            "                    }",
+            "                ]",
+            "            }",
+            "        })",
             "    else:",
             "        send_message({",
             "            'jsonrpc': '2.0',",
@@ -1936,6 +2124,60 @@ mod tests {
         });
     }
 
+    #[test]
+    fn manager_lists_and_reads_resources_from_stdio_servers() {
+        let runtime = Builder::new_current_thread()
+            .enable_all()
+            .build()
+            .expect("runtime");
+        runtime.block_on(async {
+            let script_path = write_manager_mcp_server_script();
+            let root = script_path.parent().expect("script parent");
+            let log_path = root.join("resources.log");
+            let servers = BTreeMap::from([(
+                "alpha".to_string(),
+                manager_server_config(&script_path, "alpha", &log_path),
+            )]);
+            let mut manager = McpServerManager::from_servers(&servers);
+
+            let resources = manager
+                .list_resources(Some("alpha"))
+                .await
+                .expect("list resources");
+
+            assert_eq!(resources.len(), 1);
+            assert_eq!(resources[0].server_name, "alpha");
+            assert_eq!(resources[0].resource.uri, "resource://alpha/guide.txt");
+            assert_eq!(resources[0].resource.name.as_deref(), Some("alpha-guide"));
+
+            let read = manager
+                .read_resource("alpha", "resource://alpha/guide.txt")
+                .await
+                .expect("read resource");
+
+            assert_eq!(
+                read.result.as_ref().map(|result| result.contents.len()),
+                Some(1)
+            );
+            assert_eq!(
+                read.result
+                    .as_ref()
+                    .and_then(|result| result.contents.first())
+                    .and_then(|content| content.text.as_deref()),
+                Some("alpha contents for resource://alpha/guide.txt")
+            );
+
+            let log = fs::read_to_string(&log_path).expect("read log");
+            assert_eq!(
+                log.lines().collect::<Vec<_>>(),
+                vec!["initialize", "resources/list", "resources/read"]
+            );
+
+            manager.shutdown().await.expect("shutdown");
+            cleanup_script(&script_path);
+        });
+    }
+
     #[test]
     fn manager_times_out_slow_tool_calls() {
         let runtime = Builder::new_current_thread()