An agent using the bridge today spends every call on a shell round-trip: read the endpoint file, sed the token out, hand-quote JSON. stage_findings is the worst of it, and hand-quoting is what produced the malformed_request seen in testing. The seven methods are already granular and chainable — do not add more, smaller ones, which would only mean more shell round-trips. Fix the invocation, not the granularity.
Do not rewrite the transport. Keep crates/app/src/agent_bridge.rs and the ai::agent contract as they are: they work, they are tested, and AGENTS.md documents them as the language-neutral route any runtime can use. Add a thin MCP adapter in front.
Researched 2026-08-15. The current spec is 2026-07-28, the largest revision since launch, and it lands in qrate's favour — several things that would have been work under the old spec no longer exist:
initialize/initialized handshake removed. Mcp-Session-Id and protocol-level sessions removed. Every request is self-describing. This matches the bridge's existing one-request → one-answer → closed-socket shape almost exactly, so there is no session machinery to build._meta carries io.modelcontextprotocol/clientInfo (name + version) on every request. This is a real replacement for the X-Agent header the Agent panel currently relies on — keep X-Agent for raw HTTP callers, prefer clientInfo when present.tools/list is what stops an agent guessing at parameter shapes. This is the single biggest win and the direct fix for the malformed requests.tools/list responses carry ttlMs and cacheScope.Mcp-Method and Mcp-Name on tools/list and tools/call.server/discover RPC for optional capability discovery.elicitation/create / sampling/createMessage over open streams are gone — Multi Round-Trip Requests (MRTR) replace them, and qrate needs none of it.A feature-lifecycle policy now guarantees ≥ 12 months between deprecation and removal, so pinning to 2026-07-28 is safe.
One tool per existing method, schemas generated from the ai::agent types. Stdio JSON-RPC is the transport an agent runtime registers; it forwards to the loopback HTTP already running. No new dependency needed — serde_json is in the tree and the repo already hand-rolls its HTTP; hand-roll the MCP subset the same way rather than pulling in an SDK for tools/list + tools/call.
An agent registers one MCP server, then reviews an open project and stages findings without invoking a shell, and every call still appears in the Agent panel with a real client name.
crates/app/src/agent_bridge.rs no longer exists on feature/qrate-cli (ASNT-118, PR #122): the loopback bridge, agent-bridge.json and the X-Agent-over-HTTP route were removed, and qrate agent <command> is now the public contract (JSON on stdin and stdout, exit codes 0–3). An MCP server should therefore be qrate mcp, a thin stdio adapter over the same handlers the CLI calls, not an adapter in front of a bridge. docs/dev/cli-plan.md Phase 4 and PLAN.md record that decision and that MCP stays deferred until a client cannot run a command.