SEP: Align text with WG decisions on out-of-process execution and config by olaservo · Pull Request #43 · modelcontextprotocol/experimental-ext-interceptors

olaservo · 2026-08-27T20:28:47Z

Text-only changes to docs/sep.md from the 7/23 and 8/18 WG meetings. No wire changes; SDKs are unaffected.

Interceptors always run out of process as MCP servers (7/23 Peder; 8/18 Sambhav, Peder, confirmed for Clare). Replaces the "first-party / in-process" wording in Key Advantage 3, the threat-model mitigation, and the sidecar YAML comments with local (stdio) and remote (Streamable HTTP) MCP servers.
Defines Interceptor Server and adds SHOULD NOT co-host tools, prompts, or resources (8/18, Peder's proposal, Sambhav and Clare agreed).
States that per-invocation config exists for statelessness, server defaults apply when omitted, and a server MAY expose no configurable settings (8/18, Sambhav answering Clare).
Gives ChainExecutionParams.context the same principal.claims, spanId, and sessionId fields as InterceptorInvocationParams.context (also raised by the Tersign comment on PR #2624).
Uses interceptors/list consistently in diagrams and prose. interceptor/invoke is left as is pending a WG decision on the plural form raised by a-akimov on PR #2624, since that one touches SDK constants.

Not in this PR: deployment architecture section, diagram replacement, stripping implementation detail (Sambhav and Clare, 8/18), and anything in the chain section pending #33.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NrQ4aQW4mRjgj5GJZbahEB

Text-only changes to docs/sep.md from the 2026-07-23 and 2026-08-18 WG meetings. No wire changes. - Interceptors always run out of process as MCP servers. Replace the "first-party / in-process" wording in Key Advantage 3, the threat-model mitigation, and the sidecar YAML comments with local (stdio) and remote (Streamable HTTP) MCP servers. - Define Interceptor Server and add SHOULD NOT co-host tools, prompts, or resources. - State that per-invocation config exists for statelessness, that server defaults apply when config is omitted, and that a server MAY expose no configurable settings. - Give ChainExecutionParams.context the same principal.claims, spanId, and sessionId fields as InterceptorInvocationParams.context. - Use interceptors/list (plural) consistently in diagrams and prose. interceptor/invoke is unchanged pending a WG decision on the plural form raised on PR #2624. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrQ4aQW4mRjgj5GJZbahEB

Copilot

Pull request overview

Aligns the interceptor SEP with working-group decisions on deployment, configuration, context fields, and method naming.

Changes:

Defines local and remote out-of-process Interceptor Servers.
Clarifies per-invocation configuration and context.
Standardizes interceptors/list references.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…ation wording Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrQ4aQW4mRjgj5GJZbahEB

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

docs/sep.md:1757

This mitigation says the interceptor receives only payload and context, but InterceptorInvocationParams also sends per-invocation config (line 699), along with other invocation metadata. That makes the threat model understate what a compromised interceptor can observe, especially when configuration carries sensitive policy values. Describe the address-space isolation without limiting the visible data to those two fields.

- Interceptors run out of process and receive only what is passed in `payload` and `context`; a local stdio interceptor still inherits the environment and filesystem access of the process that launches it, so it SHOULD be isolated accordingly

…ithout 'only' Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrQ4aQW4mRjgj5GJZbahEB

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

docs/sep.md:138

This new unconditional out-of-process requirement contradicts the PR's claim that SDKs are unaffected: the Go SDK's primary Extension.LocalChain path installs interceptors on the invoking mcp.Server and connects through mcp.NewInMemoryTransports() in the same process (go/sdk/interceptors/extension/server.go:116-124), and its conformance documentation explicitly labels this an in-process deployment. Either update/remove that SDK path and its documentation or qualify this requirement; otherwise the SEP immediately makes the repository's reference implementation nonconformant.

An **Interceptor** is an MCP primitive that provides governance for context operations through validation or mutation logic. Like tools, prompts, and resources, interceptors are discoverable, and hosted on MCP servers. Interceptors are always invoked over an MCP transport; they do not run inside the invoking client or server process.

docs/sep.md:1710

The two names do not both mirror the cited MCP pattern: tools/list and other primitive methods use a plural namespace, while the retained interceptor/invoke is singular and explicitly remains pending a WG decision. Reword this rationale so it does not present the provisional singular form as following that convention.

- **Method Names**: `interceptors/list` and `interceptor/invoke` mirror MCP patterns (`tools/list`, etc.)

…hod-name rationale Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrQ4aQW4mRjgj5GJZbahEB

olaservo · 2026-08-28T03:26:24Z

Addressed two suppressed Copilot notes in 57d6a1f:

The definition no longer says interceptors cannot run inside the invoking process. It now requires invocation over an MCP transport via interceptors/list / interceptor/invoke, names out-of-process (stdio or Streamable HTTP) as the expected deployment, and allows an SDK to use an in-memory transport for testing or embedding. This keeps the Go SDK's LocalChain conformant. Whether the SEP should go further and require a process boundary is a WG question; the 8/18 notes record execution as always out of process, and the Key Advantage bullets and sidecar example still describe only stdio and Streamable HTTP servers.
The Method Names rationale no longer presents singular interceptor/invoke as mirroring tools/list.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

…ot a requirement Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrQ4aQW4mRjgj5GJZbahEB

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

jeongukjae · 2026-09-04T15:20:13Z

-An **Interceptor** is an MCP primitive that provides governance for context operations through validation or mutation logic. Like tools, prompts, and resources, interceptors are discoverable, and hosted on MCP servers.
+An **Interceptor** is an MCP primitive that provides governance for context operations through validation or mutation logic. Like tools, prompts, and resources, interceptors are discoverable, and hosted on MCP servers. Interceptors are always invoked over an MCP transport using `interceptors/list` and `interceptor/invoke`; this SEP defines no in-process interceptor API. The expected deployment is out of process, as a stdio or Streamable HTTP MCP server. An SDK MAY connect to an Interceptor Server over an in-memory transport, for example for testing or embedding, and the wire contract is unchanged.
+
+An MCP server that hosts interceptors is an **Interceptor Server**. An Interceptor Server SHOULD NOT also expose tools, prompts, or resources. It sits beside the client, server, or proxy that invokes it and is not in the request path between a client and the server whose traffic is being intercepted.


I agree that interceptor shouldn't sit in request path.

but regarding exposing interceptor with other resources in the same mcp server part, I think it should remain as recommendation rather than enforcement.

Agreed, it is a recommendation. SHOULD NOT was the wording Peder proposed on 8/18 and Sambhav and Clare agreed with, so I kept the keyword and added a sentence saying co-hosting is permitted, and my understanding of why the recommendation exists.

jeongukjae · 2026-09-04T15:26:24Z

 - **Severity Levels** (info/warn/error): Graduated response vs. binary pass/fail enables audit logging without blocking
 - **Replace vs. Patch**: Mutations replace entire payloads (vs. JSON Patch) for simplicity and atomicity
- **Method Names**: `interceptor/list` and `interceptor/invoke` mirror MCP patterns (`tools/list`, etc.)
+- **Method Names**: `interceptors/list` follows the plural namespace of `tools/list` and `resources/read`. `interceptor/invoke` is singular; aligning it to `interceptors/invoke` is under WG consideration


I'm +1 on using same and plural prefix - interceptors/list & interceptors/invoke

+1 from me too. Since the rename changes the wire method and the Go and C# constants, I would rather keep it out of this PR and do it as one follow-up right after this merges: SEP text plus go/sdk and csharp/sdk in the same PR, with the TypeScript and Python PRs picking it up on rebase. I will open a tracking issue for that so a-akimov's comment on modelcontextprotocol#2624 has something to point at. Leaving the "under WG consideration" line as is for now so this PR does not wait on it.

Ukjae's review on #43 read the SHOULD NOT as enforcement. Say that co-hosting is permitted and why the recommendation exists. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Copilot

Copilot review overview

🟢 Approval recommended

The documentation changes are internally consistent, and previously identified issues have been addressed.

Review effort: Balanced
Findings: None

Copilot AI balanced review requested due to automatic review settings August 27, 2026 20:28

Copilot started reviewing on behalf of olaservo August 27, 2026 20:29 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

Comment thread docs/sep.md Outdated

Comment thread docs/sep.md Outdated

Comment thread docs/sep.md Outdated

SEP: Address review comments on config schema, method name, and mitig…

11710b9

…ation wording Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrQ4aQW4mRjgj5GJZbahEB

Copilot AI review requested due to automatic review settings August 27, 2026 21:17

Copilot started reviewing on behalf of olaservo August 27, 2026 21:18 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

Comment thread docs/sep.md Outdated

Comment thread docs/sep.md Outdated

olaservo mentioned this pull request Aug 27, 2026

SEP: Remove the chain concept, keep the execution mechanics #44

Open

Merge branch 'main' into docs/sep-alignment

2941db7

Copilot AI review requested due to automatic review settings August 27, 2026 21:22

Copilot started reviewing on behalf of olaservo August 27, 2026 21:23 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

SEP: Attribute configSchema to the interceptor; describe disclosure w…

42ada88

…ithout 'only' Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrQ4aQW4mRjgj5GJZbahEB

Copilot AI review requested due to automatic review settings August 27, 2026 23:17

Copilot started reviewing on behalf of olaservo August 27, 2026 23:18 View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

SEP: Qualify out-of-process requirement to the wire contract; fix met…

57d6a1f

…hod-name rationale Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrQ4aQW4mRjgj5GJZbahEB

Copilot AI review requested due to automatic review settings August 28, 2026 03:26

Copilot started reviewing on behalf of olaservo August 28, 2026 03:26 View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

Comment thread docs/sep.md

SEP: Make out-of-process wording consistent as expected deployment, n…

b817ce3

…ot a requirement Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NrQ4aQW4mRjgj5GJZbahEB

Copilot AI review requested due to automatic review settings August 28, 2026 03:34

Copilot started reviewing on behalf of olaservo August 28, 2026 03:35 View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

jeongukjae reviewed Sep 4, 2026

View reviewed changes

SEP: State that the co-host rule is a recommendation

8cbf894

Ukjae's review on #43 read the SHOULD NOT as enforcement. Say that co-hosting is permitted and why the recommendation exists. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings September 29, 2026 15:41

Copilot started reviewing on behalf of olaservo September 29, 2026 15:42 View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

Conversation

olaservo commented Aug 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

olaservo commented Aug 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

jeongukjae Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

olaservo Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

jeongukjae Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

olaservo Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants