Leverage latest MCP spec features from go-sdk v1.4.0

[dgageot]

Summary

Handle additional MCP content types and set richer tool annotations when exposing agents as MCP servers, leveraging features available in go-sdk v1.4.0.

Changes

New MCP content types in processMCPContent

• AudioContent: Re-encode raw bytes to base64 and collect in ToolCallResult.Audios, matching the existing ImageContent pattern.
• ResourceLink: Render as markdown links ([name](uri)) with proper escaping of ] in names and ) in URIs to prevent broken output.
• StructuredContent: Pass through CallToolResult.StructuredContent for tools that define an OutputSchema.

Richer ToolAnnotations on MCP server

• Replace the single ReadOnlyHint computation with agentToolAnnotations() that inspects all agent tools to derive DestructiveHint, IdempotentHint, OpenWorldHint, and Title.
• Follows MCP spec defaults: *bool fields left nil when they match the spec default (true), explicitly set to false otherwise.

Code quality

• Introduce MediaContent base type with ImageContent/AudioContent as type aliases (no breaking changes at call sites).
• Extract encodeMedia and optionalBool helpers to reduce duplication.
• Consolidate four separate processMCPContent test functions into one table-driven test.
• Add new server_test.go with table-driven tests for agentToolAnnotations.

[docker-agent]

Review: COMMENT

Assessment: 🟡 NEEDS ATTENTION

Summary

This PR successfully adds support for richer MCP content types (Audio, ResourceLink, StructuredContent) and improved tool annotations. The code is generally well-structured with comprehensive test coverage.

However, there is one notable issue in the new ResourceLink handling code that should be addressed:

MEDIUM severity: The markdown escaping for resource links is incomplete and could produce broken markdown or malformed URIs.

Findings

[MEDIUM] pkg/tools/mcp/mcp.go:505 — Incomplete markdown escaping for ResourceLink

The ResourceLink handling only escapes ] in names and ) in URIs:

name := strings.ReplaceAll(c.Name, "]", "\\]")
uri := strings.ReplaceAll(c.URI, ")", "%29")
text += fmt.Sprintf("[%s](%s)", name, uri)

This escaping is insufficient:

• URI: Only ) is escaped as %29. URIs with spaces, [, quotes, newlines, or other special characters will produce invalid markdown. Consider using proper URL encoding (e.g., url.PathEscape or url.QueryEscape).
• Name: Only ] is escaped. Names containing markdown metacharacters like *, _, backticks, or [ could be misinterpreted by markdown parsers.

Recommendation: Use url.PathEscape() or similar for the entire URI, and consider escaping all markdown special characters in the name, or use a markdown escaping library.

[docker-agent]

MEDIUM: Incomplete markdown escaping for ResourceLink

The escaping only handles ] in names and ) in URIs. This is insufficient for robust markdown link generation:

• URI escaping: Only ) → %29, but URIs with spaces, [, quotes, or newlines will break the markdown syntax. Consider using url.PathEscape() for proper URL encoding.
• Name escaping: Only ] is handled, but names with *, _, `, or [ could trigger unintended markdown formatting.

Recommendation: Apply proper URL encoding to the entire URI and escape all markdown metacharacters in the name.