Independent AI systems researchOperated by NeuralArc
How to read this index

A citation is not a transferable result.

Reviewed identifies the part of the source used. Supports states the bounded proposition we draw from it. Retrieved records when time-sensitive material was checked.

Vendor documentation establishes vendor claims and product behavior as documented, not independent performance. Papers establish results only for their stated methods and tested scope. AccessAllGPT recommendations remain labeled analysis.

Read the full methodology →
Source ledger

Evidence by decision guide

Ordered by the latest publication or material update date. Follow a source to inspect the original material.

Models

GLM-5.3-Flash: Cheap, Open and Multimodal—Decide From the Artifact

AccessAllGPT desk review of the GLM-5.3-Flash Hugging Face model card, registry record, config.json, weight index and LICENSE at immutable revision 03eb5366286afd40d2221b1d9c63a6dd1ba4832e; the Z.ai release blog; the Z.ai GLM-5.3-Flash developer guide and pricing pages; and the GLM-5 technical-report abstract (arXiv:2602.15763v2), retrieved 2026-09-03. We wrote and ran scripts/audit-glm53-flash-artifact.mjs on Node v24.10.0, Darwin arm64. The script queried the Hugging Face API, paginated the pinned repository tree, reconciled 62 safetensor shards between tree and index, and reported file counts, byte totals, indexed tensor counts, parameter counts by dtype, architecture fields, layer-type counts, quantization exclusions and the license first line without downloading any shard. Vendor capability claims, registry facts, third-party-platform metrics and AccessAllGPT guidance are labeled separately below. This is not an original model run, benchmark reproduction, serving test, API trial, quantization evaluation, license review or hardware assessment.

9 sources · 9 retrieval dates · 9 scoped claim notes
  1. GLM-5.3-Flash model card at pinned revision 03eb5366

    Z.ai on Hugging Face · Retrieved

    Reviewed: Introduction; Serve GLM-5.3-Flash Locally framework list and linked cookbooks; reasoning_effort and clear_thinking notes; evaluation footnotes; citation block; Hugging Face-hosted evaluation results; model tree, downloads and likes

    Supports: The pinned card introduces GLM-5.3-Flash as the first natively multimodal GLM-5-series model, states 320B total and 18B active parameters, a newly trained base model, a hybrid sparse-plus-linear attention design, Manifold-Constrained Hyper-Connections and a 30T-token multimodal corpus, links SGLang, vLLM, TokenSpeed, Transformers, KTransformers and Unsloth deployment paths, documents reasoning_effort low/high/max with a max default and a clear_thinking chat-template default of false, and publishes per-benchmark run notes including harnesses, budgets, a GPT-5.6-luna judge and an empty Agent’s Last Exam entry. The page also lists Hugging Face-hosted Terminal-Bench 2.1 and ExtractBench rows and shows 517,902 downloads and 2,005 likes in the September 3 snapshot. These are vendor-authored claims and mutable platform metrics, not AccessAllGPT measurements.

  2. Hugging Face registry record for zai-org/GLM-5.3-Flash

    Hugging Face · Retrieved

    Reviewed: Repository identity, pinned main revision SHA, createdAt and lastModified timestamps, safetensors parameter totals by dtype, downloads, likes, gating and tags

    Supports: The registry records that the repository was created 2026-08-25T06:43:14Z, was last modified 2026-08-31T11:33:06Z, is not gated, and at pinned revision 03eb5366286afd40d2221b1d9c63a6dd1ba4832e declares 321,323,031,390 indexed parameters split across 314,396,639,232 F8_E4M3, 6,926,096,640 BF16 and 295,518 F32 values. These are registry facts about the artifact, not evidence of model quality or capability.

  3. config.json at pinned revision 03eb5366

    Z.ai on Hugging Face · Retrieved

    Reviewed: architectures and model_type; text_config layer_types, linear_attn_config, indexer fields, mHC fields, MoE routing, MLA-style dimensions, vocabulary and positions; vision_config; fp8 quantization_config and modules_to_not_convert

    Supports: The pinned configuration identifies Glm5NextForConditionalGeneration with glm5_next_text and glm5_next_vision components: 45 text layers typed as 34 linear_attention plus 11 deepseek_sparse_attention at layer indexes 3,7,11,15,19,23,27,31,35,39,43; mhc true with hc_mult 4; 288 routed experts plus 1 shared expert with 8 selected per token; 1,048,576 maximum position embeddings; a 24-layer, 448-pixel, patch-14 vision tower with spatial merge 2; and fp8 quantization excluding 1,509 named modules. These fields describe the shipped artifact only; they do not establish throughput, memory needs or quality.

  4. model.safetensors.index.json and repository tree at pinned revision 03eb5366

    Z.ai on Hugging Face · Retrieved

    Reviewed: Weight-map tensor names and shard assignments; metadata total_size; recursive repository tree file list and shard sizes

    Supports: AccessAllGPT paginated the pinned tree and reconciled it with the weight index: 72 files, 62 safetensor shards named model-00001-of-00062 through model-00062-of-00062, 76,108 indexed tensors, 328,326,771,576 indexed parameter bytes and 328,337,455,672 bytes of shard payloads. The shard count matches between tree and index. These byte counts size the download; they are not serving-memory requirements.

  5. LICENSE at pinned revision 03eb5366

    Z.ai on Hugging Face · Retrieved

    Reviewed: Full 21-line license text

    Supports: The pinned license file begins “MIT License” and carries “Copyright (c) 2026 Z.AI Co., Ltd” with the standard MIT permission, notice and warranty text. This establishes the license of the pinned weight artifact only; it does not cover related APIs, services, or other models, and it is not legal advice.

  6. GLM-5.3-Flash release blog

    Z.ai · Retrieved

    Reviewed: Announcement and quota statements; Artificial Analysis Pareto claim; six-benchmark comparison table summary; Z.ai Code Bench comparison; efficiency and IndexPool design; base-model evaluation statement; ox-alpha anonymous testing; Chinese-AI-chip serving stack and three-times improvement claim; conclusion

    Supports: Z.ai states GLM-5.3-Flash was tested anonymously as ox-alpha on OpenCode and OpenRouter and became the most popular model of the week; scores 57 on the Artificial Analysis Intelligence Index v4.1.1 at $0.045 per task at discounted pricing; outperforms GLM-5.2 across six coding and agentic benchmarks including 63.4 vs 46.2 on DeepSWE v1.1 and 48.8 vs 26.2 on AutomationBench; nearly matches Claude Opus 4.8 at max effort on Z.ai Code Bench v1.0 (29.0 vs 29.5); reduces attention compute 3.0× and KV cache 4.4× versus GLM-5.3 while retaining a larger cache than Kimi-K3 and DeepSeek-V4-Flash; and was served on Chinese AI chips with a claimed 3× end-to-end serving improvement. All of these are vendor claims; AccessAllGPT reproduced none of them.

  7. GLM-5.3-Flash model guide

    Z.ai Developer Documentation · Retrieved

    Reviewed: Model overview and hybrid-architecture statements; input and output modality, context and output limits; model code and parameter recommendations; thinking and reasoning_effort constraints; image input construction; Coding Plan quota and off-peak points; capabilities list; best-practice scenarios

    Supports: Z.ai documents model code glm-5.3-flash with Video/Image/Text/File input and Text output, a 1M context window and 128K maximum output tokens; recommends temperature 1, top_p 0.95 and reasoning_effort max; states thinking.type supports only enabled and recommends thinking.clear_thinking false with stream and tool_stream enabled; shows image_url content blocks for image input; and states GLM-5.3-Flash is fully available on the GLM Coding Plan with 3× GLM-5.3 quota, a points-based system and 50% point consumption off-peak including weekends. These are vendor documentation statements of the integration contract, not verified behavior.

  8. Z.ai pricing

    Z.ai Developer Documentation · Retrieved

    Reviewed: Latest-models price table, per-million-token units, discount framing and promotion end date, cached-input storage note

    Supports: The published table lists GLM-5.3-Flash at $0.075 input, $0.015 cached input and $0.25 output per million tokens, shown against struck-through list prices of $0.15, $0.03 and $0.50, with cached-input storage limited-time free; the 50% promotion ends 24:00 on September 9, 2026 UTC+8. GLM-5.3 and GLM-5.2 list $1.4 input, $0.26 cached input and $4.4 output. These are posted list prices on one platform; they are not total cost of ownership and are subject to change.

  9. GLM-5: from Vibe Coding to Agentic Engineering (arXiv:2602.15763v2)

    GLM-5 Team on arXiv · Retrieved

    Reviewed: Version history; abstract; subject classification; license badge

    Supports: The linked technical report (v1 February 17, 2026; v2 February 24, 2026; CC BY 4.0) describes the GLM-5 generation’s adoption of DSA to reduce training and inference cost while maintaining long-context fidelity, an asynchronous reinforcement-learning infrastructure, and asynchronous agent-RL algorithms. The report is the citation the GLM-5.3-Flash card supplies, but its abstract describes GLM-5; it does not isolate GLM-5.3-Flash’s results, and AccessAllGPT reviewed the abstract and metadata only.

Agents

A Zero MCP Task TTL Did Not Expire the AI Agent’s Result

AccessAllGPT reviewed the MCP 2025-11-25 task specification, its pinned schema, the SDK 1.30.0 release and registry record, the distributed task validator, the InMemoryTaskStore implementation, Node timer documentation and two independent contributor pull requests about adjacent TTL representation boundaries. I wrote and ran scripts/audit-mcp-task-ttl-retention.mjs twice on Node v24.10.0 and Darwin arm64. Each run created a clean temporary sandbox, installed @modelcontextprotocol/sdk 1.30.0 and Zod 3.25.76 with lifecycle scripts disabled, and called the public demonstration store with synthetic tools/call records. Nineteen assertions bound schema acceptance, returned TTLs, get/list visibility, timer outcomes, completion-time reset, package versions, source mechanics and hashes. The distributed store and types files were bound to SHA-256 807e5c727a0c6c8bfa5a6bc10e1bde1f3575cba5d3c011c0db7b2747ef191140 and 962836b0f8dad85bcd398ad3ddb5ba81a7c7530c706955aa846dd8dfc02dd6a9. No language model, production agent, network transport, credential, user data, payment or external side effect was used.

9 sources · 9 retrieval dates · 9 scoped claim notes
  1. Tasks (protocol version 2025-11-25)

    Model Context Protocol Specification · Retrieved

    Reviewed: Task creation, result retrieval, task retention, TTL semantics, listing, authorization and security considerations

    Supports: The task specification defines requested TTL as a duration from task creation, requires receivers to return the actual retention duration from creation, permits deletion after that lifetime, and recommends shorter TTLs where context binding is unavailable.

  2. MCP schema at the 2025-11-25 specification commit

    Model Context Protocol · Retrieved

    Reviewed: TaskCreationParams, Task interface, requested and actual TTL descriptions, timestamps, statuses and task request shapes

    Supports: The pinned TypeScript schema describes requested TTL as milliseconds to retain a task from creation and actual Task.ttl as the retention duration from creation, but supplies no positive or integer constraint in the interface.

  3. TypeScript SDK release 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Release identity, publication timestamp, v1.x target, included changes and full-changelog reference

    Supports: The official release record identifies SDK 1.30.0 as the v1.x package release published July 27, 2026 and anchors the tested implementation version.

  4. InMemoryTaskStore at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Task creation, actualTtl selection, cleanup timer conditions, result storage, status updates, task listing and manual cleanup

    Supports: The demonstration store schedules creation cleanup only when actualTtl is truthy, and restarts the full TTL when storing a result or entering a terminal status.

  5. Task schemas at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: TaskCreationParamsSchema, TaskMetadataSchema, TaskSchema, TTL field descriptions and generated request and result types

    Supports: The distributed request validator represents ttl as z.number().optional() without a positive, nonnegative or integer refinement, while the returned task permits a number or null.

  6. @modelcontextprotocol/sdk 1.30.0 registry record

    npm Registry · Retrieved

    Reviewed: Package version, repository, publication metadata, distribution integrity and runtime requirements

    Supports: The registry record binds both clean installations to the published SDK 1.30.0 artifact rather than a moving branch or local checkout.

  7. Allow null for Task.ttl in generated JSON schema

    Model Context Protocol pull request 2408 · Retrieved

    Reviewed: Contributor problem report, generator root cause, schema patch, merged status, scope and null-retention semantics

    Supports: An independent contributor found that generated JSON schema had rejected null even though the source defined null as unlimited retention; the March 25, 2026 merge repaired that representation mismatch, not the zero or timer behavior tested here.

  8. Disallow null (infinite) requested TTL

    Model Context Protocol TypeScript SDK pull request 1339 · Retrieved

    Reviewed: Request and response TTL distinction, motivation, tests, breaking-change disclosure, patch and merge metadata

    Supports: The SDK change distinguishes an omitted client request from a server-returned null lifetime and says clients should not request unlimited retention; it merged March 25, 2026 and provides independent history of TTL-shape ambiguity.

  9. Timers: scheduling timers

    Node.js Documentation · Retrieved

    Reviewed: Callback setTimeout delay coercion, out-of-range and negative delay behavior, scheduling guarantees and timer cancellation

    Supports: Node documents that negative, zero, non-finite and out-of-range callback delays are set to 1 ms and that exact callback timing is not guaranteed, which bounds interpretation of the negative-TTL observation.

Agents

An MCP Server Can Set Your AI Agent’s Polling Pace

AccessAllGPT reviewed the MCP 2025-11-25 task specification, pinned schema, SDK 1.30.0 release, registry artifact, task-stream implementation, task validator, Node timer documentation and two independent public issue records. I wrote and ran scripts/audit-mcp-task-poll-interval.mjs twice on Node v24.10.0 and Darwin arm64. Each run created a clean temporary sandbox, installed @modelcontextprotocol/sdk 1.30.0 and Zod 3.25.76 with lifecycle scripts disabled, and connected a real Client to a synthetic in-process transport. Three 125 ms synthetic inference scenarios returned pollInterval 0, pollInterval 5 or no interval with a 40 ms client default; a fourth returned 300 ms and fired AbortSignal at 40 ms. Twenty assertions bound completion, call-count ratios, median gaps, delayed abort, package versions, source mechanics and hashes. The distributed protocol and types files were bound to SHA-256 8de524602541771e084f7185e7d0fc418b8142a9cae1bd80a3ee7c70e9a9e132 and 962836b0f8dad85bcd398ad3ddb5ba81a7c7530c706955aa846dd8dfc02dd6a9. No language model, production agent, remote server, HTTP or stdio transport, external inference, credential, user data, payment or side effect was used.

9 sources · 9 retrieval dates · 9 scoped claim notes
  1. Tasks (protocol version 2025-11-25)

    Model Context Protocol Specification · Retrieved

    Reviewed: Task lifecycle, task retention, polling guidance, task fields, result retrieval, cancellation and security considerations

    Supports: The experimental task specification lets receivers include a millisecond pollInterval in tasks/get and says requestors should respect it; the published guidance states no minimum, maximum or abort-latency rule.

  2. MCP schema at the 2025-11-25 specification commit

    Model Context Protocol · Retrieved

    Reviewed: Task interface, status, timestamps, TTL, optional pollInterval and task request and result shapes

    Supports: The pinned protocol schema describes pollInterval only as an optional number of milliseconds and does not express a lower bound, upper bound or client policy field.

  3. TypeScript SDK release 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Release identity, publication date, v1.x target, package changes and full-changelog reference

    Supports: The official release record identifies SDK 1.30.0 as the v1.x package release published July 27, 2026 and anchors the tested implementation version.

  4. Protocol task stream at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: requestStream task creation, tasks/get loop, terminal handling, pollInterval selection, timer wait, signal check and request timeout path

    Supports: The pinned implementation chooses task.pollInterval before the configured client default, passes it directly to setTimeout, and checks AbortSignal only after that timer resolves.

  5. Task schemas at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Task creation parameters, task metadata, task object schema, pollInterval validator and generated protocol types

    Supports: The distributed SDK task validator represented pollInterval as an optional Zod number without integer, positive, minimum or maximum constraints in the artifact tested.

  6. @modelcontextprotocol/sdk 1.30.0 registry record

    npm Registry · Retrieved

    Reviewed: Package name, version, repository, publication metadata, distribution integrity and runtime requirement

    Supports: The registry record binds the installable SDK package used by both clean reproductions to version 1.30.0 and its published distribution artifact.

  7. Tasks SEP-1686 missing wait/await to prevent excessive polling

    Model Context Protocol issue tracker · Retrieved

    Reviewed: Independent implementation report, excessive-polling concern, token and context impact, proposed wait operation, discussion and closure metadata

    Supports: An independent implementer reported in December 2025 that agents could fixate on task polling and consume context, motivating a wait or join operation; it is experience evidence, not a reproduction of this SDK timer path.

  8. handleAutomaticTaskPolling ignores AbortSignal; cancelled requests poll indefinitely

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Independent server-side report, polling loop, cancellation handling, multi-tenant impact, comparison implementation and proposed fix

    Supports: A separate May 2026 report describes server-side automatic polling that did not stop on request cancellation, corroborating lifecycle pressure around polling while concerning a different code path from this client fixture.

  9. Timers: scheduling timers

    Node.js Documentation · Retrieved

    Reviewed: setTimeout delay coercion and range behavior, scheduling semantics, AbortSignal-capable timers promises and cancellation

    Supports: Node documents callback setTimeout scheduling and a separate timers-promises API that can accept AbortSignal, relevant to interpreting the SDK timer boundary without claiming exact scheduler performance.

Agents

Stopping an MCP Client Did Not Stop the AI Agent’s Task

AccessAllGPT reviewed the MCP 2025-11-25 task and cancellation specifications, pinned schema, SDK 1.30.0 release, registry artifact, protocol implementation and experimental client facade. I also reviewed independent TypeScript SDK issue 2018 and protocol issue 1956. I wrote and ran scripts/audit-mcp-abort-vs-task-cancel.mjs twice on Node v24.10.0 and Darwin arm64. Each run made a clean temporary sandbox, installed @modelcontextprotocol/sdk 1.30.0 and Zod 3.25.76 with lifecycle scripts disabled, connected a real Client to a synthetic in-process transport, started a durable embedding-index task with an 8 ms worker counter, aborted automatic polling after 95 ms, observed the worker for 75 ms, then called getTask and cancelTask explicitly. Twenty assertions bound event and method sequences, task states, counter movement, versions and distributed source boundaries. The distributed protocol and task-client files were bound to SHA-256 8de524602541771e084f7185e7d0fc418b8142a9cae1bd80a3ee7c70e9a9e132 and bfa97c01d4394fc53f9c659c7e156f96b1727b6d0052b0db52969251b9afe2cd. No model, production agent, external server, embedding operation, corpus, credential, network target, side effect or user data was used.

9 sources · 9 retrieval dates · 9 scoped claim notes
  1. Tasks (protocol version 2025-11-25)

    Model Context Protocol Specification · Retrieved

    Reviewed: Capabilities, cancelling tasks, task lifecycle, cancellation requirements, retention, errors and task-cancellation flow

    Supports: The experimental task specification defines tasks/cancel as the operation for explicit task cancellation, requires a valid request to transition the task to cancelled before responding, and says receivers should attempt to stop execution.

  2. Cancellation (protocol version 2025-11-25)

    Model Context Protocol Specification · Retrieved

    Reviewed: Cancellation notifications, request IDs, behavior requirements, race conditions and limitations

    Supports: The general cancellation utility lets either party signal that a previously issued request should be terminated; it is scoped to an in-flight request and does not define durable task-state cancellation.

  3. MCP schema at the 2025-11-25 specification commit

    Model Context Protocol · Retrieved

    Reviewed: Task capabilities, task status, task object, cancellation notification and tasks/cancel request and result schemas

    Supports: The pinned schema represents notifications/cancelled with a request ID while tasks/cancel carries a durable taskId and returns the resulting task, making the two protocol messages structurally distinct.

  4. TypeScript SDK release 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Release identity, publication date, v1.x line and changed-package record

    Supports: The official release record binds the tested package to SDK 1.30.0, published July 27, 2026 on the v1.x line.

  5. Protocol task stream and cancellation methods at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Automatic task polling, AbortSignal checks, request cancellation listener, getTask and cancelTask methods

    Supports: The pinned implementation checks the caller AbortSignal in requestStream and separately exposes cancelTask as a tasks/cancel request; the automatic task-stream path does not call cancelTask when its signal aborts.

  6. Experimental client tasks facade at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: callToolStream, getTask, getTaskResult, listTasks and cancelTask public experimental client methods

    Supports: The public experimental facade exposes local stream options and explicit cancelTask(taskId) as separate calls, supporting a host policy that preserves a task handle and cancels it deliberately.

  7. @modelcontextprotocol/sdk 1.30.0 registry record

    npm Registry · Retrieved

    Reviewed: Package identity, version, distribution integrity, repository, publication metadata and runtime requirement

    Supports: The registry identifies the installable official SDK artifact used by both clean temporary reproductions and records its package integrity and Node requirement.

  8. handleAutomaticTaskPolling ignores AbortSignal; cancelled requests poll indefinitely

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Independent May 2026 report, server-side polling path, resource-leak impact, comparison path and proposed fix

    Supports: An independent reporter describes a server-side automatic polling loop where request cancellation did not stop polling and could consume multi-tenant resources; it corroborates the practical need to distinguish request lifecycle from durable work, not this client-side fixture.

  9. Define result when pending tasks/result meets tasks/cancel

    Model Context Protocol issue tracker · Retrieved

    Reviewed: Independent December 2025 interoperability question, pending result scenario, proposed error behavior and closure metadata

    Supports: An independent implementer asked what tasks/result should return when tasks/cancel arrives concurrently, documenting an unresolved-at-filing lifecycle edge rather than validating the behavior measured here.

Agents

A Failed MCP Task Can Hide the Error an AI Agent Needs

AccessAllGPT reviewed the MCP 2025-11-25 task specification and pinned schema, SDK 1.30.0 release, registry artifact and pinned distributed task-stream implementation. I also reviewed independent TypeScript SDK issue 1922 and Apify MCP Server PR 680. I wrote and ran scripts/audit-mcp-failed-task-result.mjs twice on Node v24.10.0 and Darwin arm64. Each run created a clean temporary sandbox, installed @modelcontextprotocol/sdk 1.30.0 and Zod 3.25.76 with lifecycle scripts disabled, connected a real Client to a synthetic in-process transport, and returned one failed task with a stored isError result containing an upstream 429 and retry-after=30. Seventeen assertions bound request sequence, stream event sequence, generic error, omitted tasks/result call, manual recovery, versions and distributed source branches. The protocol file was bound to SHA-256 8de524602541771e084f7185e7d0fc418b8142a9cae1bd80a3ee7c70e9a9e132. No model, production agent, external server, credential, network target, payment or user data was used.

7 sources · 7 retrieval dates · 7 scoped claim notes
  1. Tasks (protocol version 2025-11-25)

    Model Context Protocol Specification · Retrieved

    Reviewed: Task creation, polling, terminal states, result retrieval requirements and task-related message association

    Supports: The experimental task specification says tasks/result for a terminal completed, failed or cancelled task must return exactly what the underlying request would have returned, whether a success or JSON-RPC error.

  2. MCP schema at the 2025-11-25 specification commit

    Model Context Protocol · Retrieved

    Reviewed: Task status, task object, task creation, tasks/get and tasks/result schemas

    Supports: The pinned schema distinguishes failed from completed task status and defines tasks/result as the route to the underlying request result.

  3. TypeScript SDK release 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Release identity, publication date, v1.x line and package changes

    Supports: The official release record binds the tested package to SDK 1.30.0, published July 27, 2026 on the v1.x line.

  4. Automatic task stream at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Task creation, status polling, completed, failed, cancelled and input-required branches

    Supports: The pinned implementation requests tasks/result after completed and input_required, but the failed branch instead synthesizes an InternalError containing only the task ID and returns.

  5. @modelcontextprotocol/sdk 1.30.0 registry record

    npm Registry · Retrieved

    Reviewed: Package identity, version, distribution integrity, repository and runtime requirements

    Supports: The registry identifies the installable official SDK artifact used by the clean temporary reproduction.

  6. Client sees “Task <id> failed” instead of the real error/result on failed tasks

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Independent bug report, Apify MCP Server context, reproducer, expected behavior, maintainer-bot confirmation and closure metadata

    Supports: An independent April 2026 report describes the same failed-task result loss in the then-main task manager and links it to production work on Apify MCP Server; the issue was closed April 20.

  7. Apify MCP Server PR 680: Set final statusMessage before storeTaskResult

    Apify MCP Server · Retrieved

    Reviewed: Problem statement, SDK workaround, outcome table, test plan and closure status

    Supports: The independent implementation report says its client could not receive stored failed-task details, describes impact on payment retry and diagnostics, and records a workaround that represented error results as completed so clients would fetch them. The PR was closed without merge.

Agents

MCP URL Elicitation Is Not a Safe-Link Filter for AI Agents

AccessAllGPT reviewed the MCP 2025-11-25 elicitation specification and pinned schema, SEP-1036 design history, SDK 1.30.0 release, pinned client validation and official URL example, then cross-checked URL parsing with the WHATWG standard and navigation policy with OWASP. I wrote and ran scripts/audit-mcp-url-elicitation-schemes.mjs on Node v24.10.0 and Darwin arm64. The script created a clean temporary sandbox, installed @modelcontextprotocol/sdk 1.30.0 and Zod 3.25.76 with lifecycle scripts disabled, connected three real Client instances to a synthetic in-process transport, and sent reverse elicitation/create requests through the SDK request path. Thirty-one assertions covered nine URL candidates, malformed syntax, URL-only and form-only capability boundaries, handler invocation, parsed scheme and host, and distributed source. The types, client and official example files were bound to SHA-256 962836b0f8dad85bcd398ad3ddb5ba81a7c7530c706955aa846dd8dfc02dd6a9, db6cc643f5cc095b2fd0b70bf691d1775f07a317e97555e3928559e815f5e32a and 3ced042125a83f5c8c47f1cfd89180600fa8af4cb75b181953c238a93b92a1f9. The fixture always declined and never fetched, rendered, opened or navigated to a candidate. I found no independent public reproduction of this exact SDK 1.30.0 scheme boundary in targeted SDK issue search; that absence is disclosed.

8 sources · 8 retrieval dates · 8 scoped claim notes
  1. Elicitation (protocol version 2025-11-25)

    Model Context Protocol Specification · Retrieved

    Reviewed: Capabilities, URL mode, completion flow, safe URL handling, identifying the user, form security and phishing

    Supports: The specification makes URL mode explicit, requires full-URL display and consent, prohibits automatic prefetch and opening without consent, recommends HTTPS outside development, and assigns identity binding to the server.

  2. MCP schema at the 2025-11-25 specification commit

    Model Context Protocol · Retrieved

    Reviewed: Form and URL elicitation parameter types, mode discriminator, message, elicitationId, URL and request union

    Supports: The pinned protocol schema represents the URL as a string and separates URL-mode requests from form-mode requestedSchema payloads; it does not define a scheme or destination allowlist in the type.

  3. SEP-1036: URL Mode Elicitation for secure out-of-band interactions

    Model Context Protocol proposal archive · Retrieved

    Reviewed: Proposal dates, motivation, sensitive-data boundary, URL-mode flow, identity-binding threat and accepted specification work

    Supports: The proposal opened July 22, 2025 and closed November 13, 2025; it explains that sensitive authorization should happen outside the MCP client and describes the phishing risk when the wrong user completes a flow.

  4. TypeScript SDK release 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Release identity, tag, publication date, v1.x branch and package changes

    Supports: The official release record binds the tested package to SDK 1.30.0, published July 27, 2026 on the v1.x line.

  5. Client elicitation validation at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Supported-mode helper, backwards-compatible form default and explicit URL-mode capability rule

    Supports: The pinned client computes form and URL support separately; URL mode is supported only when the client explicitly declares it.

  6. URL elicitation example at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: URL parsing, hostname display, warning, full URL display, consent, pending completion and navigation instruction

    Supports: The official example parses with the platform URL constructor, displays hostname and the full URL, asks for consent, and returns accept; the reviewed function does not impose a protocol or hostname allowlist.

  7. URL Standard

    WHATWG · Retrieved

    Reviewed: Goals, terminology, URL parser, URL representations, schemes and host parsing

    Supports: The web standard defines a general URL parser across special and non-special schemes. Successful parsing establishes URL syntax and components, not authorization or destination safety.

  8. Unvalidated Redirects and Forwards Cheat Sheet

    OWASP Cheat Sheet Series · Retrieved

    Reviewed: Dangerous URL redirects, safe alternatives, validation, allowlists and user-visible destination guidance

    Supports: Independent security guidance recommends avoiding untrusted destination input where possible or validating it against an allowlist; it is a cross-check for navigation policy, not an independent reproduction of this SDK path.

Agents

An MCP Task Timeout Is Not an AI Agent Deadline

AccessAllGPT reviewed the MCP 2025-11-25 tasks specification and pinned schema, the accepted SEP-1686 design history, SDK 1.30.0 release and registry records, and the pinned distributed polling and request implementation. I wrote and ran scripts/audit-mcp-task-overall-deadline.mjs twice on Node v24.10.0 and Darwin arm64. Each run created a clean temporary sandbox, installed @modelcontextprotocol/sdk 1.30.0 and Zod 3.25.76 with lifecycle scripts disabled, and connected a real Client to a synthetic in-process transport. The main fixture returned working immediately every 25 ms, advertised a 120 ms TTL and used timeout: 40 plus an AbortSignal at 360 ms. A control delayed one tasks/get response by 90 ms. Twenty assertions bound polling count, settlement time, status timing, error class, cancellation count, versions and distributed source. The protocol file was bound to SHA-256 8de524602541771e084f7185e7d0fc418b8142a9cae1bd80a3ee7c70e9a9e132. No model, production agent, external server, credential, network target, side effect or user data was used. I found no independent public reproduction of this exact overall-deadline and signal-listener behavior in a targeted search of the specification and TypeScript SDK issue trackers; that absence is disclosed rather than replaced with a corroboration claim.

6 sources · 6 retrieval dates · 6 scoped claim notes
  1. Tasks (protocol version 2025-11-25)

    Model Context Protocol Specification · Retrieved

    Reviewed: Definitions, requestor-driven model, task creation, polling, status lifecycle, TTL and resource management, result retrieval and cancellation

    Supports: The experimental task specification defines durable requestor-polled state, says requestors should poll until a terminal or input-required state, permits receivers to delete tasks after TTL, and treats pollInterval as a polling suggestion.

  2. MCP schema at the 2025-11-25 specification commit

    Model Context Protocol · Retrieved

    Reviewed: TaskStatus, TaskMetadata, Task, CreateTaskResult, tasks/get and tasks/result type definitions

    Supports: The pinned schema defines working, input_required, completed, failed and cancelled states; Task carries createdAt, lastUpdatedAt, ttl and optional pollInterval but no overall execution deadline field.

  3. TypeScript SDK release 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Release identity, tag, publication date, v1.x branch and changed-package record

    Supports: The official release record binds the tested package to SDK 1.30.0, released July 27, 2026 on the v1.x line.

  4. Protocol request and task polling implementation at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: requestStream polling loop, terminal-state handling, poll interval, AbortSignal check, request timeout setup, cancellation listener and tasks/get dispatch

    Supports: The pinned implementation applies request options to each tasks/get call, loops until status changes, sleeps by pollInterval, checks AbortSignal after sleep, and attaches the same signal cancellation listener to every request without removing it after a successful response.

  5. @modelcontextprotocol/sdk 1.30.0 registry record

    npm Registry · Retrieved

    Reviewed: Package identity, version, distribution integrity, publication metadata, repository and runtime requirements

    Supports: The npm registry identifies the installable official SDK 1.30.0 artifact used in the clean temporary reproduction.

  6. SEP-1686: Tasks

    Model Context Protocol proposal archive · Retrieved

    Reviewed: Accepted proposal abstract, motivation, agent-driven polling problem, long-running AI use cases, requestor orchestration and retention design

    Supports: The accepted proposal explains why host-driven polling replaced model-driven polling for long-running tools, including deep research, code migration and multi-agent use cases; it is design history, not independent validation of SDK behavior.

Agents

A Lost MCP SSE Response Can Hold an AI Agent Until Its Timeout

AccessAllGPT reviewed the MCP 2025-11-25 Streamable HTTP specification, @modelcontextprotocol/sdk 1.30.0 release and registry records, the pinned transport implementation, public issue 2739 and a separate contributor’s Node 22 reproduction. I wrote and ran scripts/audit-mcp-sse-response-lifecycle.mjs on Node v24.10.0 and Darwin arm64. A clean temporary sandbox installed SDK 1.30.0 and Zod 3.25.76 with lifecycle scripts disabled. A synthetic fetch fixture completed protocol initialization, then answered ping in five controlled modes: errored POST SSE at 300 ms and 900 ms deadlines, clean-EOF POST SSE at both deadlines, and application/json at 900 ms. Forty-two assertions bound settlement timing, error routing, cancellation messages, response mode, package version and distributed source. The transport file was bound to SHA-256 a181da6a31e8a34acd3e011ce5e574e8f1381b17f4541f64afcfb6b7209bafa3. No model, production agent, remote server, credential, network target, external action or user data was used.

6 sources · 6 retrieval dates · 6 scoped claim notes
  1. Transports (protocol version 2025-11-25)

    Model Context Protocol Specification · Retrieved

    Reviewed: Streamable HTTP architecture, POST request rules, JSON and SSE response modes, listening streams, disconnection and session management

    Supports: The specification permits a server to answer an MCP JSON-RPC request with either application/json or text/event-stream and requires an SSE response eventually to include the JSON-RPC response for that request.

  2. TypeScript SDK release 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Release identity, tag, publication date, v1.x branch and changed-package record

    Supports: The official release record binds the tested @modelcontextprotocol/sdk package to version 1.30.0, released July 27, 2026 on the v1.x line.

  3. StreamableHTTPClientTransport at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: SSE reader lifecycle, EOF and error branches, processStream invocation, POST send path, response media-type branch and JSON control path

    Supports: The pinned implementation starts its SSE reader without returning or awaiting the reader task; errors reach the transport onerror callback, while send returns after handing off an SSE body. The JSON branch awaits and parses its response directly.

  4. @modelcontextprotocol/sdk 1.30.0 registry record

    npm Registry · Retrieved

    Reviewed: Package identity, version, distribution integrity, publication metadata, repository and runtime requirements

    Supports: The npm registry identifies the installable official SDK 1.30.0 artifact used in the clean sandbox and binds it to distribution metadata.

  5. POST SSE responses remain pending after EOF or error (issue 2739)

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Original report, reproduction, expected behavior, implementation analysis, tested versions, related lifecycle issues and open state

    Supports: An independent contributor reported on August 30 that SDK 1.26.0 and 1.29.0 left request-scoped SSE responses pending until the protocol timeout after body EOF or error, and distinguished the case from explicit cancellation.

  6. Independent SDK 1.30.0 reproduction on issue 2739

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Independent environment, SDK versions, 300 millisecond measurements, SSE error path, clean EOF path, JSON control and linked reproduction

    Supports: A second contributor independently reported the same timeout-bound settlement on Node 22.18.0 with SDK 1.29.0 and 1.30.0, while an application/json control resolved promptly.

Agents

An Optional MCP Task Schema Can Strand an Agent’s Completed Result

AccessAllGPT reviewed the current MCP Tasks extension overview, the @modelcontextprotocol/sdk 1.30.0 release and registry records, the pinned experimental task wrapper, protocol request path and Zod compatibility implementation, plus public issue 2742 and its independent follow-up reproduction. I wrote and ran scripts/audit-mcp-task-result-schema.mjs on Node v24.10.0 and Darwin arm64. A clean temporary sandbox installed SDK 1.30.0 and Zod 3.25.76 with lifecycle scripts disabled, connected official Client and Server instances through linked in-memory transports, created one inert synthetic tool task, stored one text result, and compared getTaskResult with its schema omitted against the same call with CallToolResultSchema supplied. Fifteen assertions passed. The distributed experimental task client was bound to SHA-256 bfa97c01d4394fc53f9c659c7e156f96b1727b6d0052b0db52969251b9afe2cd. No model, production agent, remote server, credential, network target, external action or user data was used.

6 sources · 6 retrieval dates · 6 scoped claim notes
  1. Tasks: asynchronous task execution for long-running MCP operations

    Model Context Protocol · Retrieved

    Reviewed: Task purpose, non-blocking rationale, crash resilience, lifecycle, polling, result retrieval, client guidance and extension status

    Supports: The current Tasks extension describes a task ID as a durable handle and result retrieval as the step that returns a completed long-running operation after polling or reconnecting.

  2. TypeScript SDK release 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Release identity, tag, publication date, v1.x branch and changed-package record

    Supports: The official release record binds the tested @modelcontextprotocol/sdk package to version 1.30.0, released July 27, 2026 on the v1.x line.

  3. Experimental task client at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: ExperimentalClientTasks.getTaskResult signature, optional resultSchema parameter, cast and delegation to the underlying Protocol method

    Supports: The pinned public wrapper types resultSchema as optional and forwards its runtime value, including undefined, to the underlying getTaskResult method.

  4. Task-result request and Zod compatibility paths at SDK 1.30.0

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Protocol.getTaskResult required schema parameter, request dispatch, response safeParse path, zod-compat isZ4Schema and safeParse implementation

    Supports: The pinned protocol method requires a result schema and passes it into response parsing; zod-compat checks schema._zod before falling back to a Zod 3 safeParse call, so an undefined schema cannot be parsed.

  5. @modelcontextprotocol/sdk 1.30.0 registry record

    npm Registry · Retrieved

    Reviewed: Package identity, version, distribution integrity, publication metadata, repository and runtime requirements

    Supports: The npm registry identifies the installable official SDK 1.30.0 artifact used in the clean sandbox and binds it to distribution metadata.

  6. getTaskResult throws when the optional result schema is omitted (issue 2742)

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Independent report, reproduction, expected and actual behavior, stack, workaround, environment and independent branch-level follow-up reproduction

    Supports: An independent contributor reported the optional-schema TypeError on August 31, 2026; a second contributor reported reproducing it on the current v1.x branch. These reports prompted but did not validate the AccessAllGPT run.

Agents

MCP v2 Can Return a Partial Tool List as Complete

AccessAllGPT reviewed the MCP 2026-07-28 pagination and tools specifications, the npm package record and pinned distributed implementation for @modelcontextprotocol/client 2.0.0, Anthropic’s original MCP announcement and public issue 2735. I wrote and ran scripts/audit-mcp-v2-repeated-cursor.mjs on Node v24.10.0 and Darwin arm64. The clean temporary sandbox installed the exact client package with lifecycle scripts disabled, then connected it to a synthetic in-process transport. Fifteen assertions compared a three-page repeated empty-string cursor sequence with a unique-cursor control and a distinct nonconverging sequence capped at three pages. The client bundle was bound to SHA-256 af3ec9fcf3a70fb4681e9b3c11aa18a7ce9aca36fed9f138a6e704043695d414. No model, production client, remote server, credential, network target, user data or real tool was used.

6 sources · 6 retrieval dates · 6 scoped claim notes
  1. Pagination (version 2026-07-28)

    Model Context Protocol Specification · Retrieved

    Reviewed: Cursor model, request and response formats, opaque-value rule, supported list operations, implementation guidance and error handling

    Supports: The current protocol makes cursors opaque, says clients must not determine anything from a cursor value beyond whether a non-null value exists, treats an empty string as valid and defines absence of nextCursor as completion.

  2. Tools (version 2026-07-28)

    Model Context Protocol Specification · Retrieved

    Reviewed: Tool discovery, list request and result shapes, pagination link, tool definition and security considerations

    Supports: The current tools contract makes tools/list a paginated discovery operation through which an AI client learns the callable tool inventory exposed by a server.

  3. @modelcontextprotocol/client 2.0.0 distributed implementation

    Model Context Protocol TypeScript SDK · Retrieved

    Reviewed: Client.listTools, _listAllPages, repeated-cursor seen set, listMaxPages branch, aggregate finalization and response-cache write

    Supports: The pinned v2 client auto-aggregates a cursorless listTools call, stops its loop when a cursor has been seen, deletes nextCursor and returns or caches the resulting aggregate; the separate page cap throws when reached.

  4. @modelcontextprotocol/client 2.0.0 registry record

    npm Registry · Retrieved

    Reviewed: Package identity, version, publication artifact, repository, runtime requirement, integrity and distribution metadata

    Supports: The official npm registry record binds the tested split client package to version 2.0.0 on the TypeScript SDK repository and identifies the installable artifact plus its integrity metadata.

  5. Client.listTools() silently drops pages when a server repeats a cursor (issue 2735)

    Model Context Protocol TypeScript SDK issue tracker · Retrieved

    Reviewed: Independent issue report, empty-string reproduction, actual and expected output, source analysis, proposed fix, comments and open status

    Supports: An independent contributor reported that client 2.0.0 stops automatic aggregation on a repeated cursor and removes the remaining-cursor signal; this prompted but did not independently validate the AccessAllGPT reproduction.

  6. Introducing the Model Context Protocol

    Anthropic · Retrieved

    Reviewed: November 25, 2024 announcement, protocol purpose, architecture, SDKs and ecosystem description

    Supports: Anthropic introduced MCP as an open standard for connecting AI assistants to data sources and tools, establishing why tool discovery affects an agent host’s available action surface.